Function at 0x10018cf0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100ef018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.1006e7e0
test al, al
jne 0x1001a8f4
call fcn.1006ed10
test al, al
jne 0x1001a8f4
push 0x2b
mov edi, 0x861110
call edi
mov esi, 0x85ec20
mov ecx, eax
call esi
test al, al
jne 0x1001a8f4
push 0x2d
call edi
mov ecx, eax
call esi
test al, al
jne 0x1001a8f4
mov eax, dword [0xe61e18]
cmp eax, 0x1e
je 0x1001a8f4
cmp eax, 0x22
je 0x1001a8f4
cmp eax, 0x41
jl 0x10018d7a
cmp eax, 0x44
jle 0x1001a8f4
cmp eax, 0x45
jl 0x10018d88
cmp eax, 0x48
jle 0x1001a8f4
cmp eax, 0x2d
jl 0x10018d88
cmp eax, 0x32
jle 0x1001a8f4
mov ecx, dword [0x102bc1bc]
lea eax, [ecx - 1]
cmp eax, 2
ja 0x10018dac
push 0x21
call edi
mov ecx, eax
call esi
test al, al
jne 0x1001a8f4
mov ecx, dword [0x102bc1bc]
test ecx, ecx
je 0x10018db8
lea eax, [ecx - 5]
cmp eax, 1
ja 0x10018dcd
call edi
mov edx, 0x861200
mov ecx, eax
call edx
cmp byte [eax + 0x40], 0
jne 0x1001a8f4
cmp dword [0x107dcee0], 0
je 0x1001a8f4
cmp dword [0x107dcee4], 0
je 0x1001a8f4
cmp dword [0x100febd8], 0
mov edi, 0x790b10
mov ebx, dword [sym.imp.OPENGL32.dll_glColor3f]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10019ae9
sub esp, 0xc
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call ebx
push 0xf
push 0x3c
push dword [0x100febe4]
push dword [0x100febe0]
call edi
add esp, 0x10
cmp al, 1
jne 0x10019f35
xor ecx, ecx
cmp dword [0x100feb04], ecx
setne cl
add ecx, 7
cmp dword [0x100feb08], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feb0c], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb1c], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feb24], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb28], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feb2c], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb30], 0
lea edx, [ecx + 1]
cmove edx, ecx
inc edx
cmp dword [0x100feb34], 0
lea eax, [edx + 3]
cmove eax, edx
cmp dword [0x100feb38], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb3c], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feb40], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb44], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feb48], 0
mov ecx, 1
lea esi, [eax + 1]
cmove esi, eax
mov eax, dword [0x102bc1bc]
add eax, 0xfffffffb
lea edx, [esi + 2]
lea edx, [edx + edx*4]
add edx, edx
cmp ecx, eax
sbb ebx, ebx
and ebx, 0x28
add ebx, 0x14
cmp word [0x100feb50], 0
jl 0x10018f23
add edx, 0xb
inc esi
movzx eax, word [0x100feb52]
lea ecx, [edx + 0xb]
test ax, ax
movzx eax, word [0x100feb54]
push 1
cmovs ecx, edx
lea edx, [esi + 1]
cmovs edx, esi
test ax, ax
movzx eax, word [0x100feb56]
lea esi, [ecx + 0xb]
cmovs esi, ecx
lea edi, [edx + 1]
cmovs edi, edx
test ax, ax
movzx eax, word [0x100feb58]
lea edx, [esi + 0xb]
cmovs edx, esi
lea ecx, [edi + 1]
cmovs ecx, edi
test ax, ax
mov eax, 0x635fd0
lea edi, [edx + 0xb]
lea esi, [ecx + 1]
cmovs edi, edx
cmovs esi, ecx
mov dword [ebp - 0x20], edi
call eax
mov eax, dword [sym.imp.OPENGL32.dll_glColor4f]
mov dword [esp], 0x3f4ccccd
sub esp, 0xc
mov dword [esp + 8], 0x3f000000
mov dword [esp + 4], 0x3f000000
mov dword [esp], 0x3f000000
call eax
mov eax, dword [0x100febe4]
sub eax, edi
movd xmm1, ebx
sub eax, 3
push 0
sub esp, 0x14
cvtdq2ps xmm1, xmm1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x3f800000
movd xmm0, eax
mov eax, 0x6378a0
cvtdq2ps xmm0, xmm0
mov dword [esp + 8], 0x42e80000
movss dword [esp + 4], xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
subss xmm0, xmm1
subss xmm0, dword [0x100e6db4]
movss dword [esp], xmm0
call eax
mov eax, dword [0x100febe4]
add esp, 0x18
imul esi, esi, 0xb
sub eax, edi
movd xmm1, ebx
cvtdq2ps xmm1, xmm1
push 0
sub esp, 0x14
sub eax, 3
movd xmm0, esi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x10], 0
movss dword [ebp - 0x18], xmm0
addss xmm0, dword [0x100e70f8]
movss dword [esp + 0xc], xmm0
movss dword [ebp - 0x1c], xmm0
movd xmm0, eax
mov eax, 0x6378a0
cvtdq2ps xmm0, xmm0
mov dword [esp + 8], 0x3f800000
movss dword [esp + 4], xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
subss xmm0, xmm1
subss xmm0, dword [0x100e6db4]
movss dword [esp], xmm0
call eax
movss xmm0, dword [ebp - 0x1c]
add esp, 0x18
movd xmm1, dword [0x100febe4]
mov eax, 0x6378a0
cvtdq2ps xmm1, xmm1
push 0
sub esp, 0x14
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mov dword [esp + 8], 0x3f800000
subss xmm1, xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
subss xmm1, dword [0x100e70f8]
movss dword [esp + 4], xmm1
movd xmm1, ebx
cvtdq2ps xmm1, xmm1
subss xmm0, xmm1
subss xmm0, dword [0x100e6db4]
addss xmm0, dword [0x100e7560]
addss xmm0, dword [0x100e6db4]
movss dword [esp], xmm0
call eax
add esp, 0x18
movd xmm1, ebx
sub esi, edi
mov eax, 0x6378a0
add esi, dword [0x100febe4]
cvtdq2ps xmm1, xmm1
push 0
sub esp, 0x14
movd xmm0, esi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x42ea0000
movss dword [esp + 4], xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
subss xmm0, xmm1
subss xmm0, dword [0x100e6db4]
movss dword [esp], xmm0
call eax
mov esi, dword [sym.imp.OPENGL32.dll_glColor4f]
add esp, 8
mov dword [esp + 0xc], 0x3f666666
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
movss xmm0, dword [ebp - 0x18]
addss xmm0, dword [0x100e6fc8]
mov eax, dword [0x100febe4]
sub eax, edi
push 0
sub esp, 0x14
sub eax, 2
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movd xmm0, eax
mov eax, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
sub eax, ebx
mov dword [esp + 8], 0x42e60000
movss dword [esp + 4], xmm0
movd xmm0, eax
mov eax, 0x6378a0
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
call eax
mov eax, 0x636070
call eax
add esp, 8
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call esi
push 0
mov eax, 0x635fd0
call eax
mov dword [esp], 0x3f800000
sub esp, 0xc
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call esi
cmp dword [0x100feb20], 0
mov ecx, 0x101a8848
je 0x10019257
push 0x121
jmp 0x1001925c
push pe_nt_image_headers32
call fcn.1003fea0
push 0x11d
mov ecx, 0x101a8848
mov esi, eax
call fcn.1003fea0
mov ecx, dword [0x100febe0]
mov edx, eax
mov eax, dword [0x100febe4]
sub ecx, ebx
push esi
push edx
push str._s___s_
push 3
sub eax, edi
push 0x73
add eax, 2
push eax
push ecx
push 0xff19bdff
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov ecx, 0x101a8848
push dword [0x100feb18]
push dword [0x100feb10]
push 0x125
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, 0x14
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov esi, 0x1f
xor edi, edi
movsx eax, word [edi*2 + 0x100feb50]
mov dword [ebp - 0x18], eax
test eax, eax
js 0x100193cf
movsx eax, byte [edi + 0x100feb5a]
push eax
lea eax, [ebp - 0x10]
push 0x100e3d24
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov al, byte [edi + 0x100feb5a]
add esp, 0xc
mov byte [ebp - 0x11], al
movzx eax, al
push 0
push eax
push dword [ebp - 0x18]
call fcn.10085bf0
lea ecx, [esi + 0xb]
mov dword [ebp - 0x1c], ecx
test eax, eax
jne 0x10019392
cmp byte [ebp - 0x11], 0
lea eax, [ebp - 0x10]
mov ecx, 0x100e2be3
cmovle eax, ecx
push eax
imul eax, dword [ebp - 0x18], 0x54
add eax, dword [0x8128ac0]
push eax
movzx eax, byte [edi + 0x100feb5f]
push eax
mov eax, dword [0x100febe4]
sub eax, dword [ebp - 0x20]
push str._dx__s_s
push 3
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x28
jmp 0x100193cc
add eax, 2
push eax
movzx eax, byte [edi + 0x100feb5f]
push eax
mov eax, dword [0x100febe4]
sub eax, dword [ebp - 0x20]
push str._dx__s
push 3
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 5
jl 0x100192f1
cmp dword [0x100feb34], 0
jle 0x10019477
push 0x11d
mov ecx, 0x101a8848
add esi, 9
call fcn.1003fea0
push eax
push 0x129
mov ecx, 0x101a8848
call fcn.1003fea0
mov edi, dword [ebp - 0x20]
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff8be100
push 0x10297260
call fcn.1006a050
add esp, 0x20
mov ecx, 0x101a8848
add esi, 0xb
push dword [0x100feb34]
push 0x12a
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x20
add esi, 0xb
jmp 0x1001947a
mov edi, dword [ebp - 0x20]
push 0x122
mov ecx, 0x101a8848
add esi, 9
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff8be100
push 0x10297260
call fcn.1006a050
mov eax, dword [0x100feb48]
add esp, 0x1c
add eax, dword [0x107dce34]
mov ecx, 0x101a8848
add esi, 0xc
push dword [0x100feb1c]
push eax
push 0x11d
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push str._s___d__d_
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
mov eax, dword [0x100feb38]
add esp, 0x28
add esi, 0xb
test eax, eax
jle 0x1001954b
push eax
push 0x5d
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 0x100e3b34
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
add esi, 0xb
mov eax, dword [0x100feb3c]
test eax, eax
jle 0x10019595
push eax
push 0xf5
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 0x100e3d48
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff00ffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
add esi, 0xb
mov eax, dword [0x100feb40]
test eax, eax
jle 0x100195df
push eax
push 0xf6
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 0x100e3d48
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff00ffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
add esi, 0xb
mov eax, dword [0x100feb44]
test eax, eax
jle 0x10019629
push eax
push 0xf7
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 0x100e3d48
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff00ffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
add esi, 0xb
cmp dword [0x100feb08], 0
jle 0x1001966d
push 0x127
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x1c
add esi, 0xc
cmp dword [0x100feb0c], 0
jle 0x100196b1
push 0x128
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x1c
add esi, 0xc
push 0xbd
mov ecx, 0x101a8848
add esi, 9
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xff8be100
push 0x10297260
call fcn.1006a050
add esp, 0x1c
mov ecx, 0x101a8848
add esi, 0xc
push dword [0x100feb14]
push 0xef
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x20
mov ecx, 0x8128adc
mov eax, 0x402320
add esi, 0xb
push 0xa6
call eax
cmp dword [0x100feb20], 0
je 0x100198bf
push 0xa6
mov ecx, 0x8128adc
mov eax, 0x402320
call eax
push dword [0x100feb20]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov ecx, 0x8128adc
mov eax, 0x402320
add esi, 0xb
push 0xa7
call eax
push dword [0x100feb24]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov ecx, 0x8128adc
mov eax, 0x402320
add esi, 0xb
push 0xa9
call eax
push dword [0x100feb28]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov ecx, 0x8128adc
mov eax, 0x402320
add esi, 0xb
push 0xa8
call eax
push dword [0x100feb2c]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
mov eax, dword [0x107dcee0]
add esp, 0x24
movzx eax, byte [eax + 0xb]
push eax
mov eax, 0x405230
call eax
add esp, 4
cmp al, 4
jne 0x100198f7
push 0x6ca
mov ecx, 0x8128adc
mov eax, 0x402320
call eax
push dword [0x100feb30]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
sub eax, edi
push 3
add eax, 0xb
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
jmp 0x100198f7
push pe_nt_image_headers32
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, edi
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
sub eax, ebx
push eax
push 0xffcc6699
push 0x10297260
call fcn.1006a050
add esp, 0x1c
mov ebx, dword [sym.imp.OPENGL32.dll_glColor3f]
sub esp, 0xc
mov dword [esp + 8], 0x3f333333
mov dword [esp + 4], 0x3f4ccccd
mov dword [esp], 0x3f666666
call ebx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x10019a0d
push 9
mov edi, 0x861110
call edi
mov ecx, eax
mov esi, 0x85ec20
call esi
test al, al
jne 0x10019a0d
push 8
call edi
mov ecx, eax
call esi
test al, al
jne 0x10019a0d
push 0xc
call edi
mov ecx, eax
call esi
test al, al
jne 0x10019a0d
push 7
call edi
mov ecx, eax
call esi
test al, al
jne 0x10019a0d
push 0xe
call edi
mov ecx, eax
call esi
test al, al
jne 0x10019a0d
push 0xf
call edi
mov ecx, eax
call esi
test al, al
jne 0x10019a0d
push 0x3c
call edi
mov ecx, eax
call esi
test al, al
jne 0x10019a0d
push 0x3d
call edi
mov ecx, eax
call esi
test al, al
jne 0x10019a0d
mov ecx, 0x10297260
call fcn.1006f3c0
sub esp, 0xc
mov byte [0x1029a22d], 1
mov dword [0xe8cb3c], 1
mov dword [0x100febc4], 1
mov dword [0x100febd4], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [0x1029a2d8], 0xbf800000
mov dword [0x1029a278], 0xbf800000
mov dword [esp], 0x3f800000
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, 0x790b10
movd xmm0, dword [0x100febe4]
mov eax, 0x637c60
push 0
push 1
push 1
sub esp, 0x20
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x1c], 0x3f800000
mov dword [esp + 0x18], 0x3f5eb852
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x41600000
mov dword [esp + 8], 0x42a00000
movss dword [esp + 4], xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push 0xf08e
call eax
mov eax, dword [sym.imp.OPENGL32.dll_glColor4f]
add esp, 0x20
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call eax
push 0x11d
mov ecx, 0x101a8848
call fcn.1003fea0
movd xmm0, dword [0x100febe4]
cvtdq2pd xmm0, xmm0
push eax
push 3
push 0x50
addsd xmm0, qword [0x100e6ff0]
cvttsd2si eax, xmm0
push eax
push dword [0x100febe0]
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x1c
cmp dword [0x100febdc], 0
je 0x1001a8f4
sub esp, 0xc
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call ebx
push 0xf
push 0x3c
push dword [0x100febec]
push dword [0x100febe8]
call edi
add esp, 0x10
cmp al, 1
jne 0x1001a7ad
xor ecx, ecx
cmp dword [0x100feb64], ecx
push 1
setne cl
add ecx, 7
cmp dword [0x100feb68], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feb6c], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb7c], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feb84], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb88], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feb8c], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb90], 0
lea edx, [ecx + 1]
cmove edx, ecx
inc edx
cmp dword [0x100feb94], 0
lea eax, [edx + 3]
cmove eax, edx
cmp dword [0x100feb98], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feb9c], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feba0], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100feba4], 0
lea eax, [ecx + 1]
cmove eax, ecx
cmp dword [0x100feba8], 0
lea ecx, [eax + 1]
cmove ecx, eax
cmp dword [0x100febac], 0
lea edi, [ecx + 1]
cmove edi, ecx
movzx ecx, word [0x100febb0]
lea eax, [edi + 2]
lea eax, [eax + eax*4]
add eax, eax
lea esi, [edi + 1]
test cx, cx
cmovs esi, edi
lea edx, [eax + 0xb]
cmovs edx, eax
movzx eax, word [0x100febb2]
test ax, ax
movzx eax, word [0x100febb4]
lea ecx, [edx + 0xb]
cmovs ecx, edx
lea edx, [esi + 1]
cmovs edx, esi
test ax, ax
movzx eax, word [0x100febb6]
lea esi, [ecx + 0xb]
cmovs esi, ecx
lea edi, [edx + 1]
cmovs edi, edx
test ax, ax
movzx eax, word [0x100febb8]
lea edx, [esi + 0xb]
cmovs edx, esi
lea ecx, [edi + 1]
cmovs ecx, edi
test ax, ax
lea ebx, [edx + 0xb]
lea esi, [ecx + 1]
cmovs ebx, edx
cmovs esi, ecx
mov eax, 0x635fd0
call eax
mov edi, dword [sym.imp.OPENGL32.dll_glColor4f]
mov dword [esp], 0x3f4ccccd
sub esp, 0xc
mov dword [esp + 8], 0x3f000000
mov dword [esp + 4], 0x3f000000
mov dword [esp], 0x3f000000
call edi
mov eax, dword [0x100febe4]
sub eax, ebx
sub eax, 3
push 0
sub esp, 0x14
movd xmm0, eax
mov eax, 0x6378a0
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x42e80000
movss dword [esp + 4], xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
subss xmm0, dword [0x100e74a4]
subss xmm0, dword [0x100e6db4]
movss dword [esp], xmm0
call eax
mov eax, dword [0x100febe4]
add esp, 0x18
imul esi, esi, 0xb
sub eax, ebx
sub eax, 3
push 0
sub esp, 0x14
movd xmm0, esi
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x10], 0
movss dword [ebp - 0x18], xmm0
addss xmm0, dword [0x100e70f8]
movss dword [esp + 0xc], xmm0
movss dword [ebp - 0x1c], xmm0
movd xmm0, eax
mov eax, 0x6378a0
cvtdq2ps xmm0, xmm0
mov dword [esp + 8], 0x3f800000
movss dword [esp + 4], xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
subss xmm0, dword [0x100e74a4]
subss xmm0, dword [0x100e6db4]
movss dword [esp], xmm0
call eax
movss xmm0, dword [ebp - 0x1c]
add esp, 0x18
movd xmm1, dword [0x100febe4]
mov eax, 0x6378a0
cvtdq2ps xmm1, xmm1
push 0
sub esp, 0x14
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
mov dword [esp + 8], 0x3f800000
subss xmm1, xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
subss xmm1, dword [0x100e70f8]
subss xmm0, dword [0x100e74a4]
movss dword [esp + 4], xmm1
subss xmm0, dword [0x100e6db4]
addss xmm0, dword [0x100e7560]
addss xmm0, dword [0x100e6db4]
movss dword [esp], xmm0
call eax
add esp, 0x18
push 0
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x42ea0000
sub esi, ebx
add esi, dword [0x100febe4]
movd xmm0, esi
mov esi, 0x6378a0
cvtdq2ps xmm0, xmm0
movss dword [esp + 4], xmm0
movd xmm0, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
subss xmm0, dword [0x100e74a4]
subss xmm0, dword [0x100e6db4]
movss dword [esp], xmm0
call esi
add esp, 8
mov dword [esp + 0xc], 0x3f666666
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
movss xmm0, dword [ebp - 0x18]
addss xmm0, dword [0x100e6fc8]
mov eax, dword [0x100febe4]
sub eax, ebx
push 0
sub esp, 0x14
sub eax, 2
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movd xmm0, eax
mov eax, dword [0x100febe0]
cvtdq2ps xmm0, xmm0
add eax, 0xffffffc4
mov dword [esp + 8], 0x42e60000
movss dword [esp + 4], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
call esi
mov eax, 0x636070
call eax
add esp, 8
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call edi
push 0
mov eax, 0x635fd0
call eax
mov dword [esp], 0x3f800000
sub esp, 0xc
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call edi
cmp dword [0x100feb80], 0
mov ecx, 0x101a8848
je 0x10019fb0
push 0x121
jmp 0x10019fb5
mov edx, dword [0x107dcee0]
movsx eax, word [0x87935d8]
movzx ecx, word [edx + 0xe]
add ecx, eax
cmp ecx, dword [0x100feb10]
jl 0x10019a18
mov eax, dword [edx + 0x1744]
cmp eax, dword [0x100feb18]
jl 0x10019a18
call esi
sub eax, dword [0x100febf0]
cmp eax, 0x1f4
jbe 0x10019a18
call esi
sub eax, dword [0x100febf0]
cmp eax, 0x3e8
jbe 0x10019f8f
call esi
mov dword [0x100febf0], eax
sub esp, 0xc
mov dword [esp + 8], 0x3f333333
mov dword [esp + 4], 0x3f4ccccd
mov dword [esp], 0x3f666666
call ebx
jmp 0x10019a18
push pe_nt_image_headers32
call fcn.1003fea0
push 0x11e
mov ecx, 0x101a8848
mov esi, eax
call fcn.1003fea0
mov ecx, dword [0x100febe0]
mov edx, eax
mov eax, dword [0x100febe4]
add ecx, 0xffffffc4
push esi
push edx
push str._s___s_
push 3
sub eax, ebx
push 0x73
add eax, 2
push eax
push ecx
push 0xff19bdff
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov ecx, 0x101a8848
push dword [0x100feb78]
push dword [0x100feb70]
push 0x125
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, 0x14
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov esi, 0x1f
xor edi, edi
nop dword [eax]
movsx eax, word [edi*2 + 0x100febb0]
mov dword [ebp - 0x1c], eax
test eax, eax
js 0x1001a12e
movsx eax, byte [edi + 0x100febba]
push eax
lea eax, [ebp - 0x10]
push 0x100e3d24
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov al, byte [edi + 0x100febba]
add esp, 0xc
mov byte [ebp - 0x11], al
movzx eax, al
push 0
push eax
push dword [ebp - 0x1c]
call fcn.10085bf0
lea ecx, [esi + 0xb]
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x1001a0f1
cmp byte [ebp - 0x11], 0
lea eax, [ebp - 0x10]
mov ecx, 0x100e2be3
cmovle eax, ecx
push eax
imul eax, dword [ebp - 0x1c], 0x54
add eax, dword [0x8128ac0]
push eax
movzx eax, byte [edi + 0x100febbf]
push eax
mov eax, dword [0x100febe4]
push str._dx__s_s
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x28
jmp 0x1001a12b
add eax, 2
push eax
movzx eax, byte [edi + 0x100febbf]
push eax
mov eax, dword [0x100febe4]
push str._dx__s
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 5
jl 0x1001a050
mov eax, dword [0x100febac]
test eax, eax
jle 0x1001a17e
push eax
push 0x82
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x20
add esi, 0xb
cmp dword [0x100feb94], 0
jle 0x1001a219
push 0x11e
mov ecx, 0x101a8848
add esi, 9
call fcn.1003fea0
push eax
push 0x129
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff8be100
push 0x10297260
call fcn.1006a050
add esp, 0x20
mov ecx, 0x101a8848
add esi, 0xb
push dword [0x100feb94]
push 0x12a
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x20
add esi, 0xb
push 0x122
mov ecx, 0x101a8848
add esi, 9
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff8be100
push 0x10297260
call fcn.1006a050
mov eax, dword [0x100feba8]
add esp, 0x1c
add eax, dword [0x107dce30]
mov ecx, 0x101a8848
add esi, 0xc
push dword [0x100feb7c]
push eax
push 0x11e
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push str._s___d__d_
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
mov eax, dword [0x100feb98]
add esp, 0x28
add esi, 0xb
test eax, eax
jle 0x1001a2ed
push eax
push 0x5d
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 0x100e3b34
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
add esi, 0xb
mov eax, dword [0x100feb9c]
test eax, eax
jle 0x1001a338
push eax
push 0xf5
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 0x100e3d48
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff00ffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
add esi, 0xb
mov eax, dword [0x100feba0]
test eax, eax
jle 0x1001a383
push eax
push 0xf6
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 0x100e3d48
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff00ffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
add esi, 0xb
mov eax, dword [0x100feba4]
test eax, eax
jle 0x1001a3ce
push eax
push 0xf7
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 0x100e3d48
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff00ffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
add esi, 0xb
cmp dword [0x100feb68], 0
jle 0x1001a413
push 0x127
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x1c
add esi, 0xc
cmp dword [0x100feb6c], 0
jle 0x1001a458
push 0x128
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff0000e1
push 0x10297260
call fcn.1006a050
add esp, 0x1c
add esi, 0xc
push 0xbd
mov ecx, 0x101a8848
add esi, 9
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xff8be100
push 0x10297260
call fcn.1006a050
add esp, 0x1c
mov ecx, 0x101a8848
add esi, 0xc
push dword [0x100feb74]
push 0xef
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x20
mov ecx, 0x8128adc
mov edi, 0x402320
add esi, 0xb
push 0xa6
call edi
cmp dword [0x100feb80], 0
je 0x1001a654
push 0xa6
mov ecx, 0x8128adc
call edi
push dword [0x100feb80]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov ecx, 0x8128adc
add esi, 0xb
push 0xa7
call edi
push dword [0x100feb84]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov ecx, 0x8128adc
add esi, 0xb
push 0xa9
call edi
push dword [0x100feb88]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
mov ecx, 0x8128adc
add esi, 0xb
push 0xa8
call edi
push dword [0x100feb8c]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
mov eax, dword [0x107dcee0]
add esp, 0x24
movzx eax, byte [eax + 0xb]
push eax
mov eax, 0x405230
call eax
add esp, 4
cmp al, 4
jne 0x1001a68d
push 0x6ca
mov ecx, 0x8128adc
call edi
push dword [0x100feb90]
push eax
mov eax, dword [0x100febe4]
push str._s:__d
sub eax, ebx
push 3
add eax, 0xb
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x24
jmp 0x1001a68d
push pe_nt_image_headers32
mov ecx, 0x101a8848
call fcn.1003fea0
push eax
mov eax, dword [0x100febe4]
push 3
sub eax, ebx
push 0x73
add eax, esi
push eax
mov eax, dword [0x100febe0]
add eax, 0xffffffc4
push eax
push 0xffcc6699
push 0x10297260
call fcn.1006a050
add esp, 0x1c
mov esi, dword [sym.imp.OPENGL32.dll_glColor3f]
sub esp, 0xc
mov dword [esp + 8], 0x3f333333
mov dword [esp + 4], 0x3f4ccccd
mov dword [esp], 0x3f666666
call esi
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1001a824
push 9
mov edi, 0x861110
call edi
mov ecx, eax
mov ebx, 0x85ec20
call ebx
test al, al
jne 0x1001a824
push 8
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1001a824
push 0xc
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1001a824
push 7
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1001a824
push 0xe
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1001a824
push 0xf
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1001a824
push 0x3c
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1001a824
push 0x3d
call edi
mov ecx, eax
call ebx
test al, al
jne 0x1001a824
mov ecx, 0x10297260
call fcn.1006f3c0
sub esp, 0xc
mov byte [0x1029a22d], 1
mov dword [0xe8cb3c], 1
mov dword [0x100febc4], 2
mov dword [0x100febd4], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [0x1029a2d8], 0xbf800000
mov dword [0x1029a278], 0xbf800000
mov dword [esp], 0x3f800000
call esi
jmp 0x1001a824
mov eax, dword [0x107dce34]
cmp eax, dword [0x100febac]
jl 0x1001a824
mov edx, dword [0x107dcee0]
movsx eax, word [0x87935d8]
movzx ecx, word [edx + 0xe]
add ecx, eax
cmp ecx, dword [0x100feb70]
jl 0x1001a824
mov eax, dword [edx + 0x1744]
cmp eax, dword [0x100feb78]
jl 0x1001a824
call esi
sub eax, dword [0x100febf0]
cmp eax, 0x1f4
jbe 0x1001a824
call esi
sub eax, dword [0x100febf0]
cmp eax, 0x3e8
jbe 0x1001a808
call esi
mov dword [0x100febf0], eax
sub esp, 0xc
mov dword [esp + 8], 0x3f333333
mov dword [esp + 4], 0x3f4ccccd
mov dword [esp], 0x3f666666
call ebx
movd xmm0, dword [0x100febec]
mov eax, 0x637c60
push 0
push 1
push 1
sub esp, 0x20
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x1c], 0x3f800000
mov dword [esp + 0x18], 0x3f5eb852
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x41600000
mov dword [esp + 8], 0x42a00000
movss dword [esp + 4], xmm0
movd xmm0, dword [0x100febe8]
cvtdq2ps xmm0, xmm0
movss dword [esp], xmm0
push 0xf08e
call eax
add esp, 0x20
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0x3f800000
mov dword [esp], 0x3f800000
call dword [sym.imp.OPENGL32.dll_glColor4f]
push 0x11e
mov ecx, 0x101a8848
call fcn.1003fea0
movd xmm0, dword [0x100febec]
cvtdq2pd xmm0, xmm0
push eax
push 3
push 0x50
addsd xmm0, qword [0x100e6ff0]
cvttsd2si eax, xmm0
push eax
push dword [0x100febe8]
push 0xffffffffffffffff
push 0x10297260
call fcn.1006a050
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b7755
mov esp, ebp
pop ebp
ret