Function at 0x418440
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0x1c], ebx
cmp word [edi], 0
je 0x41948a
mov eax, dword [0x4e30f4]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4e8688]
mov dword [ebp - 0x68], eax
mov eax, dword fs:[0x24]
mov dword [ebp - 0x48], eax
test ebx, ebx
jne 0x41849d
push 7
push str.Blind
push edi
call esi
add esp, 0xc
test eax, eax
jne 0x41849d
mov byte [0x4e8924], 1
add edi, 0xe
jmp 0x4184a8
mov byte [0x4e8924], 0
test ebx, ebx
jne 0x4184c3
push 6
push str.Text
push edi
call esi
add esp, 0xc
test eax, eax
jne 0x4184c3
mov dword [ebp - 0x1c], 2
add edi, 0xc
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
mov dword [ebp - 0x6c], eax
mov eax, dword [edx + 0x64]
mov dword [ebp - 0x54], eax
cmp ecx, 1
je 0x4184e3
cmp ecx, 3
jne 0x41858f
mov eax, dword [0x4e8884]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4184f5
push eax
call ebx
push str.AHK_Keybd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4e8884], 0
mov dword [ebp - 0x30], eax
je 0x418520
mov dword [0x4e8884], esi
jmp 0x41852a
test esi, esi
je 0x41852a
push esi
call ebx
mov eax, dword [ebp - 0x30]
cmp eax, 0xb7
je 0x418559
cmp dword [ebp - 0x1c], 0
jne 0x418550
call fcn.00412970
test al, al
je 0x418550
mov edx, str.Click
mov ecx, edi
call fcn.0049ca40
test eax, eax
jne 0x418559
mov dword [ebp + 8], 1
jmp 0x41858f
cmp dword [ebp + 8], 3
jne 0x418568
mov dword [ebp + 8], 2
jmp 0x41858f
mov edx, dword [ebp - 0x28]
mov dword [ebp + 8], 0
cmp dword [edx + 0x5c], 0
jge 0x418583
cmp dword [edx + 0x64], 0
jge 0x418583
or eax, 0xffffffff
jmp 0x418585
xor eax, eax
mov dword [edx + 0x64], eax
mov dword [edx + 0x5c], 0xffffffff
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov byte [ebp - 0xb], 0
test ebx, ebx
je 0x4185e9
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x41868c
cmp eax, dword [0x4e72e4]
je 0x41868c
mov ecx, ebx
call fcn.004a28c0
test al, al
jne 0x41868c
mov ebx, dword [ebp - 0x38]
push 1
push ebx
push dword [0x4e72e4]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov esi, ebx
setne byte [ebp - 0xb]
jmp 0x41868c
test byte [0x4e864e], 0xc0
je 0x418677
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e8644]
cmp eax, 0x32
jae 0x418677
cmp dword [ebp + 8], 2
je 0x418677
cmp byte [0x4e8924], 0
jne 0x418677
mov ebx, dword [ebp - 0x1c]
cmp ebx, 2
je 0x418677
cmp byte [0x4e8853], 0
je 0x418677
mov eax, dword [ebp - 0x48]
cmp eax, dword [0x4e72e4]
jne 0x418677
mov edx, 0x4d0c54
mov ecx, edi
call fcn.00406570
test ebx, ebx
jne 0x4186d3
test eax, eax
je 0x418677
nop word [eax + eax]
lea ecx, [eax + 2]
mov edx, 0x4d0c5c
call fcn.00406570
test eax, eax
je 0x4186d7
cmp word [eax], 0x7b
je 0x4186d7
mov edx, 0x4d0c54
mov ecx, eax
call fcn.00406570
test eax, eax
jne 0x418650
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
call fcn.0041c670
mov esi, eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x38], eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov dword [0x4e8900], eax
mov ecx, eax
call fcn.0041c710
mov cl, 1
mov dword [0x4e8904], eax
call fcn.0041c0a0
mov bl, al
and byte [0x4e88af], bl
cmp dword [0x4e5a08], 0
je 0x418719
mov al, byte [0x4e64d2]
mov cl, byte [0x4e64d0]
mov bh, al
not al
and bh, cl
and al, cl
jmp 0x41873d
test eax, eax
je 0x418677
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, 0x8000
push 0x5b
call esi
test bx, ax
jne 0x4186f4
push 0x5c
call esi
test bx, ax
je 0x418677
mov edx, 1
mov dword [0x4e30ec], 0
mov ecx, 0x8000012f
call fcn.004019f0
mov dword [0x4e30ec], 1
jmp 0x4186e2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e8644]
cmp eax, dword [0x4e4360]
jae 0x418737
mov cl, byte [0x4e864e]
and cl, bl
jmp 0x418739
xor cl, cl
mov bh, cl
xor al, al
not bh
mov byte [ebp - 3], cl
and bh, byte [0x4e88ae]
and bh, bl
mov byte [ebp - 6], al
cmp byte [0x4e8924], 0
mov byte [ebp - 1], bh
mov byte [0x4e88ae], bh
je 0x41876c
not bh
and bh, bl
mov al, bh
mov bh, bl
mov byte [ebp - 1], bh
jmp 0x41876e
xor al, al
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x10], bh
cmp byte [eax + 0xf3], 0
je 0x4187a0
cmp byte [0x4e8924], 0
jne 0x4187a0
cmp dword [ebp - 0x1c], 2
je 0x4187a0
mov edx, 2
mov cl, 0x14
call fcn.0041b920
mov dword [ebp - 0x30], eax
jmp 0x4187a7
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp + 8]
mov eax, 0x1f4
mov dword [0x4e8920], ecx
mov edx, 0x5dc
test ecx, ecx
je 0x418820
cmp ecx, 1
cmovne eax, edx
mov edx, 0x2ee0
mov dword [0x4e890c], eax
mov eax, 0x36b0
cmovne eax, edx
call fcn.004b79d0
mov eax, dword [0x4e4b54]
mov ecx, esp
mov byte [0x4e8914], bl
mov byte [0x4e8915], 0
mov dword [0x4e8908], 0
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [0x4e8918], 0x80000000
mov dword [0x4e891c], 0x80000000
mov byte [0x4e8916], 0
mov byte [0x4e8917], 1
mov al, byte [0x4e5a62]
mov byte [ebp - 0x1d], al
mov eax, dword [0x4e3104]
cmp eax, 8
je 0x418837
cmp eax, 0xa
jne 0x418857
mov esi, dword [ebp + 0xc]
test ecx, ecx
jne 0x41885a
test esi, esi
jne 0x41885a
push 1
mov byte [ebp - 0xc], 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e5a62], 1
jmp 0x41885e
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0xc], 0
xor bl, bl
cmp word [edi], 0
mov byte [ebp - 0xa], bl
je 0x4191e8
jmp 0x418873
mov esi, dword [ebp + 0xc]
cmp dword [0x4e8920], 0
mov byte [ebp - 5], 0
jne 0x4188df
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e30f4]
sub eax, dword [0x4e868c]
cmp eax, dword [ecx + 0xd8]
jbe 0x4188df
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4188d4
mov edx, 1
mov dword [0x4e30ec], 0
or ecx, 0xffffffff
call fcn.004019f0
mov dword [0x4e30ec], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4e868c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x41910f
movzx eax, word [edi]
push eax
push str._
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
test eax, eax
je 0x41914c
movzx eax, word [edi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x41891a.34
movzx eax, byte [eax + 0x4194b4]
jmp dword [eax*4 + 0x419498]
test bh, 3
jne case.0x41891a.34
or bl, 1
jmp 0x4191d0
test bh, 0x30
jne case.0x41891a.34
or bl, 0x10
jmp 0x4191d0
test bh, 0xc
jne case.0x41891a.34
or bl, 4
jmp 0x4191d0
test bh, 0xc0
jne case.0x41891a.34
or bl, 0x40
jmp 0x4191d0
lea esi, [edi + 2]
push 0x7d
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je case.0x41891a.34
mov edi, esi
movzx ecx, word [edi]
cmp ecx, 0x20
je 0x41898e
cmp ecx, 9
jne 0x418993
add edi, 2
jmp 0x418981
mov esi, eax
sub esi, edi
sar esi, 1
mov dword [ebp - 0x34], esi
jne 0x418a26
lea esi, [eax + 2]
movzx eax, word [esi]
cmp eax, 0x7d
jne 0x4189b5
mov dword [ebp - 0x18], esi
lea esi, [eax - 0x7c]
jmp 0x418a23
cmp eax, 0x20
je 0x4189c3
cmp eax, 9
jne 0x419107
cmp ax, 0x20
je 0x4189cf
cmp ax, 9
jne 0x4189d8
movzx eax, word [esi + 2]
add esi, 2
jmp 0x4189c3
push 4
push str.Down
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x418a06
push 2
push 0x4cf774
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x419107
push 0x7d
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je case.0x41891a.34
mov esi, eax
sub esi, edi
sar esi, 1
mov dword [ebp - 0x34], esi
push 5
push 0x4cdc20
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x418ae6
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov word [eax], cx
lea ecx, [edi + 0xa]
nop word [eax + eax]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x418a5d
cmp eax, 9
jne 0x418a62
add ecx, 2
jmp 0x418a50
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x44]
call fcn.0041a130
mov eax, dword [ebp - 0x18]
add esp, 0x14
mov ecx, 0x7d
push dword [ebp - 0x4c]
mov word [eax], cx
mov eax, dword [ebp - 0x3c]
cmp eax, 1
jge 0x418abc
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x44]
movzx eax, byte [eax + 0xef]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0041adc0
mov edi, dword [ebp - 0x18]
add esp, 0xc
jmp 0x4191ce
push dword [ebp - 0x50]
mov cl, byte [ebp - 2]
xor edx, edx
push dword [ebp - 0x44]
push dword [ebp + 0xc]
push 0
push dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xa]
call fcn.00419530
mov edi, dword [ebp - 0x18]
add esp, 0x24
jmp 0x4191ce
push 3
push 0x4d0c74
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x418b0a
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 1
jmp 0x4191ce
push 4
push 0x4d0bc4
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x418b4c
lea ecx, [edi + 8]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x418b2f
cmp eax, 9
jne 0x418b34
add ecx, 2
jmp 0x418b22
cmp ecx, dword [ebp - 0x18]
jne 0x419107
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 2
jmp 0x4191ce
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov ebx, 1
mov dword [ebp - 0x14], 2
mov edx, 0x4d05d4
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], ebx
mov word [eax], cx
mov ecx, edi
mov dword [ebp - 0x40], esi
call fcn.00406570
mov dword [ebp - 0x58], eax
test eax, eax
je 0x418c33
movzx ecx, word [eax]
lea esi, [eax + 2]
mov dword [ebp - 0x5c], ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, eax
sub ecx, edi
sar ecx, 1
mov dword [ebp - 0x40], ecx
movzx eax, word [esi]
cmp eax, 0x20
je 0x418ba4
cmp eax, 9
jne 0x418ba9
add esi, 2
jmp 0x418b97
mov eax, dword [ebp - 0x18]
sub eax, esi
sar eax, 1
je 0x418c33
push 4
push str.Down
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x418c0c
push 4
add esi, 8
mov dword [ebp - 0x14], eax
push str.Temp
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x418beb
mov dword [ebp - 0x2c], eax
jmp 0x418c33
xor eax, eax
cmp word [esi], 0x52
sete al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
add esp, 4
mov esi, eax
neg esi
sbb esi, esi
neg esi
inc esi
mov dword [ebp - 0x2c], esi
jmp 0x418c33
push 0x4cf774
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x418c24
mov dword [ebp - 0x14], ebx
jmp 0x418c33
mov ecx, esi
call fcn.004180f0
mov ebx, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], ebx
push dword [0x4e8900]
lea eax, [ebp - 0xa]
mov ecx, edi
push eax
lea eax, [ebp - 0x60]
push eax
lea edx, [ebp - 2]
call fcn.0041cd20
mov eax, dword [ebp - 0x58]
add esp, 0xc
test eax, eax
je 0x418c5b
mov ecx, dword [ebp - 0x5c]
mov word [eax], cx
mov eax, dword [ebp - 0x18]
mov ecx, 0x7d
mov word [eax], cx
cmp ebx, 1
jl 0x419104
mov bh, byte [ebp - 2]
mov esi, dword [ebp - 0x60]
test bh, bh
jne 0x419045
test si, si
jne 0x419045
movzx eax, byte [edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x40]
je 0x418d3e
cmp eax, 1
jbe 0x418d41
cmp dword [0x4e8920], 0
je 0x418cd3
mov ecx, edi
call fcn.004180f0
push eax
push 0
push 0
xor dl, dl
xor cl, cl
call fcn.0041b0f0
mov bh, byte [ebp - 1]
add esp, 0xc
mov edi, dword [ebp - 0x18]
jmp 0x4191ce
mov eax, dword [ebp - 0x48]
mov dword [0x4e30ec], 0
cmp dword [0x4e72e4], eax
je 0x418d16
mov ecx, edi
call fcn.004180f0
test eax, eax
js 0x418d16
mov ecx, edi
call fcn.004180f0
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0x18]
mov dword [0x4e30ec], 1
jmp 0x4191ce
mov ecx, edi
call fcn.004180f0
mov edx, 1
mov ecx, eax
call fcn.004019f0
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0x18]
mov dword [0x4e30ec], 1
jmp 0x4191ce
cmp eax, 1
jne 0x418da7
cmp dword [ebp - 0x14], 1
je 0x419104
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x418d85
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jle 0x419104
nop
movzx eax, word [edi]
push 0
push eax
push 0x102
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp + 0xc]
sub ebx, 1
jne 0x418d60
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0x18]
jmp 0x4191ce
mov al, byte [ebp - 0xa]
mov bh, byte [ebp - 1]
mov edx, dword [ebp - 0x24]
or al, bh
mov cx, word [edi]
movzx eax, al
push eax
call fcn.004196e0
mov edi, dword [ebp - 0x18]
add esp, 4
jmp 0x4191ce
mov ebx, dword [ebp + 0xc]
mov ecx, edi
mov esi, dword [ebp - 0x34]
test ebx, ebx
mov edx, esi
sete al
movzx eax, al
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041cdf0
add esp, 0xc
mov byte [ebp - 2], al
test al, al
je 0x418ec3
mov esi, dword [ebp - 0x14]
mov edi, ebx
test edi, edi
jne 0x418dee
test esi, esi
jne 0x418de7
mov byte [ebp - 5], al
jmp 0x418dee
mov cl, al
call fcn.004182c0
cmp dword [0x4e8920], 0
je 0x418dfe
mov al, byte [0x4e8914]
jmp 0x418e05
xor cl, cl
call fcn.0041c0a0
push 0xffc3d44d
push 0
mov dl, al
mov al, byte [ebp - 0x10]
push 0
push edi
mov cl, al
mov byte [ebp - 1], al
call fcn.0041ba30
mov ebx, dword [ebp - 0x24]
add esp, 0x10
test ebx, ebx
jle 0x419104
nop dword [eax]
mov dl, byte [ebp - 2]
mov ecx, esi
push 0xffc3d44d
push 1
push edi
push 0
call fcn.00419ad0
add esp, 0x10
cmp dword [0x4e8920], 0
jne 0x418eaf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e30f4]
sub eax, dword [0x4e868c]
cmp eax, dword [ecx + 0xd8]
jbe 0x418eaf
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x418ea4
mov edx, 1
mov dword [0x4e30ec], 0
or ecx, 0xffffffff
call fcn.004019f0
mov dword [0x4e30ec], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4e868c], eax
sub ebx, 1
jne 0x418e30
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0x18]
jmp 0x4191ce
cmp esi, 4
jbe 0x418f35
push 4
push str.ASC
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x418f35
test ebx, ebx
jne 0x418f35
lea ecx, [edi + 6]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x418ef1
cmp eax, 9
jne 0x418ef6
add ecx, 2
jmp 0x418ee4
call fcn.004197f0
cmp dword [0x4e8920], 2
mov eax, dword [0x4e30f4]
jne 0x418f1f
mov ecx, dword [eax + 0x60]
call fcn.0041b6f0
mov bh, byte [ebp - 0x10]
mov edi, dword [ebp - 0x18]
mov byte [ebp - 1], bh
jmp 0x4191ce
mov ecx, dword [eax + 0x5c]
call fcn.0041b6f0
mov bh, byte [ebp - 0x10]
mov edi, dword [ebp - 0x18]
mov byte [ebp - 1], bh
jmp 0x4191ce
cmp esi, 2
jbe 0x418f27
push 2
push 0x4d0c94
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x418f27
push 0x10
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
mov edx, eax
add esp, 0xc
cmp edx, 0x10000
jb 0x418f94
sub edx, 0x10000
mov ecx, edx
mov eax, edx
shr ecx, 0xa
and eax, 0x3ff
and ecx, 0x3ff
sub ecx, 0x2800
sub eax, 0x2400
movzx ecx, cx
movzx esi, ax
jmp 0x418f99
movzx ecx, dx
xor esi, esi
test ebx, ebx
mov bh, byte [ebp - 0x10]
mov byte [ebp - 1], bh
je 0x418fd1
mov edi, dword [ebp + 0xc]
push 0
movzx eax, cx
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
test si, si
je 0x419017
push 0
movzx eax, si
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x419017
cmp dword [0x4e8920], 2
je 0x418ff6
mov bl, byte [ebp - 0xa]
or bl, bh
mov dl, bl
call fcn.00418340
test si, si
je 0x419017
mov dl, bl
mov ecx, esi
call fcn.00418340
jmp 0x419017
mov eax, 0x30
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push 0xa
push eax
push edx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.004197f0
cmp dword [0x4e8920], 2
mov eax, dword [0x4e30f4]
jne 0x419035
mov ecx, dword [eax + 0x60]
call fcn.0041b6f0
mov edi, dword [ebp - 0x18]
jmp 0x4191ce
mov ecx, dword [eax + 0x5c]
call fcn.0041b6f0
mov edi, dword [ebp - 0x18]
jmp 0x4191ce
push 0
mov edx, esi
mov cl, bh
call fcn.0041c2b0
mov edi, dword [ebp - 0x14]
mov bl, al
add esp, 4
mov byte [ebp - 0x64], bl
test bl, bl
je 0x4190dc
cmp dword [ebp + 0xc], 0
jne 0x4190dc
test edi, edi
jne 0x419097
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 5], bh
cmp eax, 1
jne 0x419085
mov al, byte [ebp - 1]
or byte [0x4e88ae], bl
or al, bl
jmp 0x4190d6
cmp eax, 2
jne 0x419090
or byte [0x4e88af], bl
mov al, byte [ebp - 1]
or al, bl
jmp 0x4190d6
cmp edi, 1
jne 0x4190dc
mov cl, bh
call fcn.004182c0
mov cl, byte [ebp - 4]
not bl
and byte [0x4e88af], bl
mov al, bl
and al, byte [0x4e88ae]
and cl, bl
mov byte [0x4e88ae], al
mov byte [ebp - 4], cl
cmp bh, 0xa5
jne 0x4190d4
cmp dword [0x4e8904], 3
jne 0x4190d4
and cl, 0xfe
mov byte [ebp - 4], cl
or al, cl
mov byte [ebp - 0x10], al
mov byte [ebp - 1], al
push 0
push connect
push connect
push dword [ebp + 0xc]
mov edx, esi
mov cl, bh
push dword [ebp - 0x64]
push edi
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push dword [ebp - 0xa]
call fcn.00419530
add esp, 0x24
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0x18]
jmp 0x4191ce
cmp eax, 2
jne 0x41914f
movzx eax, word [edi]
add eax, 0xfffffff8
cmp eax, 5
ja case.0x41911f.11
jmp dword [eax*4 + 0x419514]
cmp word [edi + 2], 0xa
lea eax, [edi + 2]
cmove edi, eax
mov al, 0xd
mov byte [ebp - 2], al
jmp 0x419179
mov al, 8
mov byte [ebp - 2], al
jmp 0x419179
mov al, 9
mov byte [ebp - 2], al
jmp 0x419179
mov byte [ebp - 2], 0
jmp 0x4191a3
mov eax, dword [ebp - 0x1c]
or bl, bh
je 0x41915b
test eax, eax
jne 0x41915b
mov al, 1
jmp 0x41915d
xor al, al
mov cx, word [edi]
lea edx, [ebp - 0xa]
push eax
push dword [0x4e8900]
call fcn.0041cc60
add esp, 8
mov byte [ebp - 2], al
test al, al
je 0x4191a0
push 0
push connect
push connect
push esi
push 0
push 2
push 1
push dword [ebp - 0x10]
xor edx, edx
mov cl, al
push dword [ebp - 0xa]
call fcn.00419530
add esp, 0x24
jmp 0x4191ce
mov bl, byte [ebp - 0xa]
movzx ecx, word [edi]
test esi, esi
je 0x4191bb
push 0
push ecx
push 0x102
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4191ce
or bl, bh
mov edx, 1
movzx eax, bl
push eax
call fcn.004196e0
add esp, 4
xor bl, bl
mov byte [ebp - 0xa], bl
mov al, byte [ebp - 5]
add edi, 2
mov byte [0x4e88ad], al
cmp word [edi], 0
jne 0x418870
cmp dword [0x4e8920], 0
je 0x419293
or esi, 0xffffffff
cmp byte [0x4e8916], 0
mov dword [ebp - 0x2c], esi
jne 0x419252
cmp dword [0x4e8908], 0
jbe 0x419252
cmp byte [0x4e8924], 0
je 0x41921a
xor bl, bl
jmp 0x419222
mov bl, byte [ebp - 6]
not bl
and bl, byte [ebp - 3]
or bl, byte [0x4e88af]
mov dl, byte [0x4e8914]
or bl, bh
push 0xffc3d44d
push 1
push 1
push 0
mov cl, bl
call fcn.0041ba30
add esp, 0x10
lea ecx, [ebp - 0x2c]
mov dl, bl
call fcn.0041b4e0
mov esi, dword [ebp - 0x2c]
cmp dword [0x4e8920], 1
mov eax, 0x5dc
mov ecx, 0x1f4
cmove eax, ecx
cmp dword [0x4e890c], eax
jbe 0x41927d
push dword [0x4e655c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, esi
mov dword [0x4e8920], 0
call fcn.0041b6f0
jmp 0x41931f
cmp dword [0x4e5a08], 0
je 0x4192a7
mov cl, byte [0x4e64d0]
mov dl, byte [ebp - 3]
jmp 0x4192d0
cmp dword [0x4e4360], 0
jl 0x4192cb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e8644]
cmp eax, dword [0x4e4360]
jb 0x4192cb
mov dl, byte [ebp - 3]
xor cl, cl
jmp 0x4192d0
mov dl, byte [ebp - 3]
mov cl, dl
or cl, byte [0x4e88af]
cmp byte [0x4e8924], 0
je 0x4192f1
mov al, cl
xor al, dl
mov bl, al
and al, cl
and bl, dl
not bl
and bl, bh
or bl, al
jmp 0x4192fa
mov bl, byte [ebp - 6]
not bl
and bl, cl
or bl, bh
push 0xffc3d44d
push 1
push 1
push dword [ebp + 0xc]
xor cl, cl
call fcn.0041c0a0
or al, byte [0x4e5a97]
mov cl, bl
mov dl, al
call fcn.0041ba30
add esp, 0x10
cmp dword [0x4e5a08], 0
je 0x419342
mov cl, byte [0x4e64d1]
mov al, cl
xor al, byte [0x4e64d2]
and al, cl
not al
and cl, al
mov byte [0x4e64d1], cl
cmp dword [ebp - 0x30], 1
jne 0x4193de
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test al, 1
jne 0x4193de
push 0x14
call esi
mov ecx, 0x8000
test cx, ax
je 0x419386
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 1
call fcn.00419ad0
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 2
call fcn.00419ad0
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
add esp, 0x10
push 0
call ebx
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call esi
cmp eax, dword [0x4e72e4]
jne 0x4193ea
mov edx, 1
mov dword [0x4e30ec], 0
or ecx, 0xffffffff
call fcn.004019f0
mov dword [0x4e30ec], 1
jmp 0x4193ea
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp byte [ebp - 0xb], 0
je 0x419401
push 0
push dword [ebp - 0x38]
push dword [0x4e72e4]
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp - 0xc], 0
je 0x41941c
cmp byte [ebp - 0x1d], 0
jne 0x41941c
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e5a62], 0
mov eax, dword [ebp + 8]
test eax, eax
jne 0x419446
mov eax, dword [ebp - 0x68]
cmp dword [0x4e8688], eax
je 0x41947b
call fcn.00404930
test eax, eax
je 0x41947b
mov edx, 1
or ecx, 0xffffffff
call fcn.004019f0
jmp 0x41947b
cmp eax, 1
jne 0x41947b
push 0
call ebx
push eax
call esi
cmp eax, dword [0x4e72e4]
jne 0x41947b
mov edx, 1
mov dword [0x4e30ec], 0
or ecx, 0xffffffff
call fcn.004019f0
mov dword [0x4e30ec], 1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x6c]
mov dword [eax + 0x5c], ecx
mov ecx, dword [ebp - 0x54]
mov dword [eax + 0x64], ecx
lea esp, [ebp - 0xa8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret