Function at 0x40e240
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], ecx
mov al, dl
mov byte [ebp - 5], al
cmp word [edi], 0
je 0x40f304
mov ebx, dword [0x4ce8c8]
mov dword [ebp - 0x28], ebx
test al, al
jne 0x40e290
push 7
push str.Blind
push edi
call fcn.00491336
add esp, 0xc
test eax, eax
jne 0x40e290
add edi, 0xe
mov byte [0x4d4c53], 1
mov dword [ebp - 0xc], edi
jmp 0x40e297
mov byte [0x4d4c53], 0
mov eax, dword [ebx + 0x5c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x68], eax
cmp ecx, 1
je 0x40e2b4
cmp ecx, 3
jne 0x40e37a
cmp dword [0x4d4b80], 0
je 0x40e348
mov eax, dword [0x4d4b94]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40e2d3
push eax
call esi
push str._sp4dl23sus
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4d4b94], 0
mov ebx, eax
je 0x40e2fd
mov dword [0x4d4b94], edi
jmp 0x40e300
push edi
call esi
cmp ebx, 0xb7
je 0x40e33f
cmp byte [ebp - 5], 0
jne 0x40e333
call fcn.0040a3f0
mov edi, dword [ebp - 0xc]
test al, al
je 0x40e336
mov edx, str.Click
mov ecx, edi
call fcn.004730c0
test eax, eax
jne 0x40e342
mov dword [ebp + 8], 1
jmp 0x40e37a
mov edi, dword [ebp - 0xc]
mov dword [ebp + 8], 1
jmp 0x40e37a
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
cmp ecx, 3
jne 0x40e356
mov dword [ebp + 8], 2
jmp 0x40e37a
cmp dword [ebx + 0x5c], 0
mov dword [ebp + 8], 0
jge 0x40e36e
cmp dword [ebx + 0x64], 0
jge 0x40e36e
or eax, 0xffffffff
jmp 0x40e370
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x5c], 0xffffffff
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov byte [ebp - 0x11], 0
test esi, esi
je 0x40e3d2
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x40e4cc
cmp eax, dword [0x4d3e6c]
je 0x40e4cc
mov ecx, esi
call fcn.00477810
test al, al
jne 0x40e4cc
mov ebx, dword [ebp - 0x40]
push 1
push ebx
push dword [0x4d3e6c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [ebp - 0x11]
jmp 0x40e4cc
test byte [0x4d4992], 0xc0
je 0x40e4b1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4d4988]
cmp eax, 0x32
jae 0x40e4b1
cmp dword [ebp + 8], 2
je 0x40e4b1
cmp byte [0x4d4c53], bl
jne 0x40e4b1
cmp byte [0x4d4b73], bl
je 0x40e4b1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4d3e6c]
jne 0x40e4b1
mov edx, 0x4bff14
mov ecx, edi
call fcn.0040ab90
cmp byte [ebp - 5], bl
jne 0x40e469
test eax, eax
je 0x40e4b1
nop dword [eax]
lea ecx, [eax + 2]
mov edx, 0x4bff1c
call fcn.0040ab90
test eax, eax
je 0x40e46d
cmp word [eax], 0x7b
je 0x40e46d
mov edx, 0x4bff14
mov ecx, eax
call fcn.0040ab90
test eax, eax
jne 0x40e440
jmp 0x40e4b1
test eax, eax
je 0x40e4b1
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x8000
push 0x5b
call esi
test di, ax
jne 0x40e48a
push 0x5c
call esi
test di, ax
je 0x40e4ab
mov edx, 1
mov dword [0x4ce8c0], ebx
mov ecx, 0x8000012f
call fcn.00401e60
mov dword [0x4ce8c0], 1
jmp 0x40e478
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40e4c6
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov dword [0x4d4be4], eax
mov ecx, eax
call fcn.004122c0
mov cl, 1
mov dword [0x4d4c38], eax
call fcn.00411ce0
cmp dword [0x4d16a0], 0
mov bl, al
je 0x40e510
mov al, byte [0x4d2017]
mov cl, byte [0x4d2015]
mov bh, al
not al
and bh, cl
and al, cl
mov byte [ebp - 7], al
jmp 0x40e536
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4d4988]
cmp eax, dword [0x4cfad0]
jae 0x40e52e
mov cl, byte [0x4d4992]
and cl, bl
jmp 0x40e530
xor cl, cl
mov bh, cl
mov byte [ebp - 7], 0
not bh
mov byte [ebp - 4], cl
and bh, byte [0x4d4bde]
and bh, bl
cmp byte [0x4d4c53], 0
mov byte [ebp - 2], bh
mov byte [0x4d4bde], bh
je 0x40e562
not bh
and bh, bl
mov al, bh
mov bh, bl
mov byte [ebp - 2], bh
jmp 0x40e564
xor al, al
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x16], bh
cmp byte [eax + 0xf3], 0
je 0x40e590
cmp byte [0x4d4c53], 0
jne 0x40e590
mov edx, 2
mov cl, 0x14
call fcn.00411540
mov dword [ebp - 0x3c], eax
jmp 0x40e597
mov dword [ebp - 0x3c], 0
mov ecx, dword [ebp + 8]
mov eax, 0x1f4
mov dword [0x4d4c54], ecx
mov edx, 0x5dc
test ecx, ecx
je 0x40e610
cmp ecx, 1
cmovne eax, edx
mov edx, 0x2ee0
mov dword [0x4d4c40], eax
mov eax, 0x36b0
cmovne eax, edx
call fcn.004a4700
mov eax, dword [0x4cffb8]
mov ecx, esp
mov byte [0x4d4bdf], bl
mov byte [0x4d4c50], 0
mov dword [0x4d4c3c], 0
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [0x4d4c48], 0x80000000
mov dword [0x4d4c4c], 0x80000000
mov byte [0x4d4c51], 0
mov byte [0x4d4c52], 1
mov al, byte [0x4d169b]
mov byte [ebp - 0x1e], al
mov eax, dword [0x4ce8d4]
cmp eax, 8
je 0x40e627
cmp eax, 0xa
jne 0x40e63c
test ecx, ecx
jne 0x40e63c
test esi, esi
jne 0x40e63c
mov cl, 1
mov byte [ebp - 0x12], 1
call fcn.0042cd00
jmp 0x40e640
mov byte [ebp - 0x12], 0
xor eax, eax
xor bl, bl
mov word [ebp - 0x32], ax
mov byte [ebp - 0x10], bl
cmp word [edi], ax
je 0x40f0a6
nop dword [eax]
nop dword [eax + eax]
cmp dword [0x4d4c54], 0
mov byte [ebp - 1], 0
jne 0x40e6ca
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x4ce8c8]
sub eax, dword [0x4d49c4]
cmp eax, dword [ecx + 0xd8]
jbe 0x40e6ca
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40e6c3
mov edx, 1
mov dword [0x4ce8c0], 0
or ecx, 0xffffffff
call fcn.00401e60
mov dword [0x4ce8c0], 1
call esi
mov dword [0x4d49c4], eax
cmp byte [ebp - 5], 0
jne 0x40efa7
movzx eax, word [edi]
push eax
push str._
call fcn.0048c759
add esp, 8
test eax, eax
je 0x40efa7
movzx eax, word [edi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x40e703.34
movzx eax, byte [eax + 0x40f330]
jmp dword [eax*4 + 0x40f314]
test bh, 3
jne case.0x40e703.34
or bl, 1
jmp 0x40f08a
test bh, 0x30
jne case.0x40e703.34
or bl, 0x10
jmp 0x40f08a
test bh, 0xc
jne case.0x40e703.34
or bl, 4
jmp 0x40f08a
test bh, 0xc0
jne case.0x40e703.34
or bl, 0x40
jmp 0x40f08a
lea esi, [edi + 2]
push 0x7d
push esi
call fcn.0048c759
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je case.0x40e703.34
mov edi, esi
nop dword [eax]
movzx ecx, word [edi]
cmp ecx, 0x20
je 0x40e77d
cmp ecx, 9
jne 0x40e782
add edi, 2
jmp 0x40e770
mov esi, dword [ebp - 0xc]
mov ebx, esi
sub ebx, edi
sar ebx, 1
mov dword [ebp - 0x48], ebx
jne 0x40e818
movzx eax, word [esi + 2]
add esi, 2
cmp eax, 0x7d
jne 0x40e7a8
mov dword [ebp - 0xc], esi
lea ebx, [eax - 0x7c]
jmp 0x40e815
cmp eax, 0x20
je 0x40e7b6
cmp eax, 9
jne 0x40e897
cmp ax, 0x20
je 0x40e7c2
cmp ax, 9
jne 0x40e7cb
movzx eax, word [esi + 2]
add esi, 2
jmp 0x40e7b6
push 4
push str.Down
push esi
call fcn.00491336
add esp, 0xc
test eax, eax
je 0x40e7f7
push 2
push 0x4bee74
push esi
call fcn.00491336
add esp, 0xc
test eax, eax
jne 0x40e897
push 0x7d
push esi
call fcn.0048c759
mov esi, eax
add esp, 8
mov dword [ebp - 0xc], esi
test esi, esi
je 0x40ef9c
mov ebx, esi
sub ebx, edi
sar ebx, 1
mov dword [ebp - 0x48], ebx
push 5
push 0x4bd398
push edi
call fcn.00491336
add esp, 0xc
test eax, eax
jne 0x40e8d3
mov word [esi], ax
lea ecx, [edi + 0xa]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x40e843
cmp eax, 9
jne 0x40e848
add ecx, 2
jmp 0x40e836
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
call fcn.0040ff60
add esp, 0x14
mov eax, 0x7d
mov word [esi], ax
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x54]
cmp eax, 1
jge 0x40e8a4
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x50]
movzx eax, byte [eax + 0xef]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00410be0
add esp, 0xc
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0xc]
xor bl, bl
jmp 0x40f08d
push dword [ebp - 0x4c]
mov cl, byte [ebp - 3]
xor edx, edx
push dword [ebp - 0x50]
push dword [ebp + 0xc]
push 0
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x16]
push dword [ebp - 0x10]
call fcn.0040f390
mov bh, byte [ebp - 1]
add esp, 0x24
mov edi, dword [ebp - 0xc]
xor bl, bl
jmp 0x40f08d
push 3
push 0x4bff34
push edi
call fcn.00491336
add esp, 0xc
test eax, eax
jne 0x40e8f8
mov bh, byte [ebp - 1]
xor bl, bl
mov edi, dword [ebp - 0xc]
mov byte [ebp - 5], 1
jmp 0x40f08d
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov esi, 1
mov dword [ebp - 0x1c], 2
mov edx, 0x4bfc0c
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x44], esi
mov word [eax], cx
mov ecx, edi
mov dword [ebp - 0x2c], ebx
call fcn.0040ab90
mov dword [ebp - 0x58], eax
test eax, eax
je 0x40e9b8
movzx ecx, word [eax]
lea esi, [eax + 2]
mov ebx, eax
mov dword [ebp - 0x5c], ecx
xor ecx, ecx
sub ebx, edi
sar ebx, 1
mov word [eax], cx
mov dword [ebp - 0x2c], ebx
movzx eax, word [esi]
cmp eax, 0x20
je 0x40e950
cmp eax, 9
jne 0x40e955
add esi, 2
jmp 0x40e943
mov eax, dword [ebp - 0xc]
sub eax, esi
sar eax, 1
je 0x40e9b8
push 4
push str.Down
push esi
call fcn.00491336
add esp, 0xc
test eax, eax
jne 0x40e990
push 4
mov dword [ebp - 0x1c], eax
lea eax, [esi + 8]
push str.Temp
push eax
call fcn.00491336
add esp, 0xc
test eax, eax
setne byte [ebp - 0x1d]
jmp 0x40e9b8
push 0x4bee74
push esi
call fcn.0048f253
add esp, 8
test eax, eax
jne 0x40e9ab
mov dword [ebp - 0x1c], 1
jmp 0x40e9b8
mov ecx, esi
call fcn.0040df30
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
movzx ecx, word [edi]
test cx, cx
jne 0x40ea4b
xor bl, bl
xor bh, bh
mov byte [ebp - 3], bh
mov ecx, edi
call fcn.004125c0
movzx eax, ax
mov dword [ebp - 0x24], eax
test bl, bl
jne 0x40eac2
test ax, ax
jne 0x40eac2
mov cx, word [edi]
call fcn.0040ab40
cmp ax, 0x56
jne 0x40eac2
mov cx, word [edi + 2]
call fcn.0040ab40
cmp ax, 0x4b
jne 0x40eac2
lea ebx, [edi + 4]
mov edx, 0x4bff48
mov ecx, ebx
call fcn.0040ab90
mov esi, eax
test esi, esi
je 0x40eaa9
mov cx, word [esi + 2]
call fcn.0040ab40
cmp ax, 0x43
jne 0x40eaa9
push 0x10
lea eax, [esi + 4]
push 0
push eax
call fcn.00492e76
add esp, 0xc
movzx esi, ax
jmp 0x40eaac
cmp word [edi + 2], 0
jne 0x40ea67
push dword [0x4d4be4]
lea edx, [ebp - 0x10]
call fcn.00412730
add esp, 4
mov bl, al
jmp 0x40ea95
xor esi, esi
nop dword [eax]
push edi
push dword [esi*8 + 0x4ce940]
call fcn.0048f253
add esp, 8
test eax, eax
je 0x40ea8e
inc esi
cmp esi, 0x6d
jl 0x40ea70
xor bl, bl
jmp 0x40ea95
mov bl, byte [esi*8 + 0x4ce944]
mov bh, bl
mov byte [ebp - 3], bh
test bl, bl
je 0x40e9cb
xor eax, eax
jmp 0x40e9d5
mov esi, dword [ebp - 0x24]
push 0x10
push 0
push ebx
call fcn.00492e76
mov bh, al
add esp, 0xc
mov byte [ebp - 3], bh
mov bl, bh
jmp 0x40eac5
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x40ead2
mov ecx, dword [ebp - 0x5c]
mov word [eax], cx
mov eax, dword [ebp - 0xc]
mov ecx, 0x7d
mov word [eax], cx
mov eax, dword [ebp - 0x38]
cmp eax, 1
jl 0x40e897
test bl, bl
jne 0x40ee6c
test si, si
jne 0x40ee6c
cmp dword [ebp - 0x2c], 1
jne 0x40eb42
cmp dword [ebp - 0x1c], 1
je 0x40e897
mov edx, dword [ebp + 0xc]
movzx ecx, word [edi]
test edx, edx
je 0x40eb2e
push 0
push ecx
push 0x102
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0xc]
jmp 0x40f08d
mov edx, eax
call fcn.0040f530
mov bh, byte [ebp - 1]
xor bl, bl
mov edi, dword [ebp - 0xc]
jmp 0x40f08d
cmp dword [ebp + 0xc], 0
mov ecx, edi
mov esi, dword [ebp - 0x48]
mov edx, esi
sete al
movzx eax, al
push eax
lea eax, [ebp - 0x16]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004127b0
mov bl, al
add esp, 0xc
mov byte [ebp - 3], bl
test bl, bl
je 0x40ecd3
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x1c]
test edi, edi
jne 0x40ebf6
test esi, esi
jne 0x40eb83
mov bh, bl
jmp 0x40ebf9
cmp dword [0x4d4be0], 0
jne 0x40ebf6
cmp byte [0x4d4bc7], bl
je 0x40ebf6
cmp byte [0x4d4c53], 0
jne 0x40ebf6
mov al, byte [0x4d4bc6]
cmp bl, 0x5b
je 0x40ebac
cmp bl, 0x5c
jne 0x40ebbd
cmp al, 0x5b
je 0x40ebb4
cmp al, 0x5c
jne 0x40ebbd
cmp dword [0x4d4c54], 2
jne 0x40ebd8
cmp bl, 0xa4
je 0x40ebd0
cmp bl, 0xa5
jne 0x40ebf6
cmp dword [0x4d4c38], 3
je 0x40ebf6
cmp al, 0xa4
je 0x40ebd8
cmp al, 0xa5
jne 0x40ebf6
mov dl, byte [0x4cfaa3]
mov ecx, 2
push 0xffc3d44d
push 0
push 0
push 0
call fcn.0040f910
add esp, 0x10
mov bh, byte [ebp - 1]
cmp dword [0x4d4c54], 0
je 0x40ec09
mov al, byte [0x4d4bdf]
jmp 0x40ec10
xor cl, cl
call fcn.00411ce0
mov ah, byte [ebp - 0x16]
mov dl, al
push 0xffc3d44d
push 0
push 0
push edi
mov cl, ah
mov byte [ebp - 2], ah
call fcn.00411650
mov edi, dword [ebp - 0x38]
add esp, 0x10
test edi, edi
jle 0x40e89a
nop word [eax + eax]
push 0xffc3d44d
push 1
push dword [ebp + 0xc]
mov dl, bl
mov ecx, esi
push 0
call fcn.0040f910
add esp, 0x10
cmp dword [0x4d4c54], 0
jne 0x40ecc0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4ce8c8]
sub eax, dword [0x4d49c4]
cmp eax, dword [ecx + 0xd8]
jbe 0x40ecc0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40ecb5
mov edx, 1
mov dword [0x4ce8c0], 0
or ecx, 0xffffffff
call fcn.00401e60
mov dword [0x4ce8c0], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4d49c4], eax
sub edi, 1
jne 0x40ec40
mov edi, dword [ebp - 0xc]
xor bl, bl
jmp 0x40f08d
cmp esi, 4
jbe 0x40ed51
push 4
push str.ASC
push edi
call fcn.00491336
mov ebx, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
jne 0x40ed54
test ebx, ebx
jne 0x40ed54
lea ecx, [edi + 6]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x40ed03
cmp eax, 9
jne 0x40ed08
add ecx, 2
jmp 0x40ecf6
call fcn.0040f630
cmp dword [0x4d4c54], 2
mov eax, dword [0x4ce8c8]
jne 0x40ed36
mov ecx, dword [eax + 0x60]
call fcn.00411350
mov ah, byte [ebp - 0x16]
xor bl, bl
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0xc]
mov byte [ebp - 2], ah
jmp 0x40f08d
mov ecx, dword [eax + 0x5c]
call fcn.00411350
mov ah, byte [ebp - 0x16]
xor bl, bl
mov bh, byte [ebp - 1]
mov edi, dword [ebp - 0xc]
mov byte [ebp - 2], ah
jmp 0x40f08d
mov ebx, dword [ebp + 0xc]
cmp esi, 2
jbe 0x40ed3e
push 2
push 0x4bff5c
push edi
call fcn.00491336
add esp, 0xc
test eax, eax
jne 0x40ed3e
push 0x10
push eax
lea eax, [edi + 4]
push eax
call fcn.00492e76
mov edx, eax
add esp, 0xc
cmp edx, 0x10000
jb 0x40edb1
sub edx, 0x10000
mov ecx, edx
mov eax, edx
shr ecx, 0xa
and eax, 0x3ff
and ecx, 0x3ff
sub ecx, 0x2800
sub eax, 0x2400
movzx ecx, cx
movzx esi, ax
jmp 0x40edb6
movzx ecx, dx
xor esi, esi
mov ah, byte [ebp - 0x16]
mov byte [ebp - 2], ah
test ebx, ebx
je 0x40ede9
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
movzx eax, cx
push eax
push 0x102
push ebx
call edi
test si, si
je 0x40ee34
push 0
movzx eax, si
push eax
push 0x102
push ebx
call edi
jmp 0x40ee34
cmp dword [0x4d4c54], 2
je 0x40ee14
mov al, byte [ebp - 0x10]
movzx edi, al
movzx eax, ah
or edi, eax
mov edx, edi
call fcn.0040e120
test si, si
je 0x40ee34
mov edx, edi
mov ecx, esi
call fcn.0040e120
jmp 0x40ee34
mov eax, 0x30
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push 0xa
push eax
push edx
call fcn.0048f17a
add esp, 0xc
lea ecx, [ebp - 0x7c]
call fcn.0040f630
cmp dword [0x4d4c54], 2
mov eax, dword [0x4ce8c8]
jne 0x40ee57
mov ecx, dword [eax + 0x60]
call fcn.00411350
mov bh, byte [ebp - 1]
xor bl, bl
mov edi, dword [ebp - 0xc]
jmp 0x40f08d
mov ecx, dword [eax + 0x5c]
call fcn.00411350
mov bh, byte [ebp - 1]
xor bl, bl
mov edi, dword [ebp - 0xc]
jmp 0x40f08d
push 0
mov edx, esi
mov cl, bh
call fcn.00411ed0
mov bh, al
add esp, 4
mov byte [ebp - 0x60], bh
test bh, bh
je 0x40ef64
cmp dword [ebp + 0xc], 0
jne 0x40ef64
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40eeb5
cmp byte [ebp - 0x1d], al
je 0x40eea3
or byte [0x4d4bde], bh
mov ah, byte [ebp - 2]
or ah, bh
mov bh, bl
mov byte [ebp - 2], ah
mov byte [ebp - 0x16], ah
jmp 0x40ef67
cmp eax, 1
jne 0x40ef64
cmp dword [0x4d4be0], 0
jne 0x40ef31
cmp byte [0x4d4bc7], bl
je 0x40ef31
cmp byte [0x4d4c53], 0
jne 0x40ef31
mov al, byte [0x4d4bc6]
cmp bl, 0x5b
je 0x40eee7
cmp bl, 0x5c
jne 0x40eef8
cmp al, 0x5b
je 0x40eeef
cmp al, 0x5c
jne 0x40eef8
cmp dword [0x4d4c54], 2
jne 0x40ef13
cmp bl, 0xa4
je 0x40ef0b
cmp bl, 0xa5
jne 0x40ef31
cmp dword [0x4d4c38], 3
je 0x40ef31
cmp al, 0xa4
je 0x40ef13
cmp al, 0xa5
jne 0x40ef31
mov dl, byte [0x4cfaa3]
mov ecx, 2
push 0xffc3d44d
push 0
push 0
push 0
call fcn.0040f910
add esp, 0x10
mov al, byte [ebp - 6]
not bh
mov ah, bh
and al, bh
and ah, byte [0x4d4bde]
mov byte [0x4d4bde], ah
mov byte [ebp - 6], al
cmp bl, 0xa5
jne 0x40ef5c
cmp dword [0x4d4c38], 3
jne 0x40ef5c
and al, 0xfe
mov byte [ebp - 6], al
or ah, al
mov byte [ebp - 2], ah
mov byte [ebp - 0x16], ah
mov bh, byte [ebp - 1]
mov cl, byte [ebp - 3]
mov edx, esi
push 0
push SysReAllocString
push SysReAllocString
push dword [ebp + 0xc]
push dword [ebp - 0x60]
push dword [ebp - 0x1c]
push dword [ebp - 0x38]
push dword [ebp - 0x16]
push dword [ebp - 0x10]
call fcn.0040f390
mov edi, dword [ebp - 0xc]
add esp, 0x24
xor bl, bl
jmp 0x40f08d
mov bl, byte [ebp - 0x10]
mov bh, byte [ebp - 1]
jmp 0x40f090
movzx eax, word [edi]
mov word [ebp - 0x34], ax
test ax, ax
jne 0x40efd8
mov byte [ebp - 3], al
mov edx, dword [ebp + 0xc]
movzx ecx, word [edi]
test edx, edx
je 0x40f07e
push 0
push ecx
push 0x102
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40f088
cmp word [ebp - 0x32], 0
mov ecx, dword [ebp - 0x34]
jne 0x40eff5
push dword [0x4d4be4]
lea edx, [ebp - 0x10]
call fcn.00412730
add esp, 4
jmp 0x40f04a
call fcn.0040ab40
cmp ax, 0x56
jne 0x40f020
mov ecx, dword [ebp - 0x32]
call fcn.0040ab40
cmp ax, 0x4b
jne 0x40f020
push 0x10
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.00492e76
add esp, 0xc
jmp 0x40f04a
xor esi, esi
lea eax, [ebp - 0x34]
push eax
push dword [esi*8 + 0x4ce940]
call fcn.0048f253
add esp, 8
test eax, eax
je 0x40f043
inc esi
cmp esi, 0x6d
jl 0x40f022
xor al, al
jmp 0x40f04a
mov al, byte [esi*8 + 0x4ce944]
mov byte [ebp - 3], al
test al, al
je 0x40efb6
push 0
push SysReAllocString
push SysReAllocString
push dword [ebp + 0xc]
xor edx, edx
mov cl, al
push 0
push 2
push 1
push dword [ebp - 0x16]
push dword [ebp - 0x10]
call fcn.0040f390
add esp, 0x24
jmp 0x40f088
mov edx, 1
call fcn.0040f530
xor bl, bl
mov bh, byte [ebp - 1]
mov byte [ebp - 0x10], bl
add edi, 2
mov byte [0x4d4bc7], bh
mov bh, byte [ebp - 2]
cmp word [edi], 0
jne 0x40e660
cmp dword [0x4d4c54], 0
je 0x40f14a
or esi, 0xffffffff
cmp byte [0x4d4c51], 0
mov dword [ebp - 0x2c], esi
jne 0x40f10a
cmp dword [0x4d4c3c], 0
jbe 0x40f10a
cmp byte [0x4d4c53], 0
je 0x40f0d8
xor bl, bl
jmp 0x40f0e0
mov bl, byte [ebp - 7]
not bl
and bl, byte [ebp - 4]
mov dl, byte [0x4d4bdf]
or bl, bh
push 0xffc3d44d
push 1
push 1
push 0
mov cl, bl
call fcn.00411650
add esp, 0x10
lea ecx, [ebp - 0x2c]
mov dl, bl
call fcn.00411200
mov esi, dword [ebp - 0x2c]
cmp dword [0x4d4c54], 1
mov eax, 0x5dc
mov ecx, 0x1f4
cmove eax, ecx
cmp dword [0x4d4c40], eax
jbe 0x40f134
push dword [0x4d3100]
call fcn.004914e4
add esp, 4
mov ecx, esi
mov dword [0x4d4c54], 0
call fcn.00411350
jmp 0x40f1ca
cmp dword [0x4d16a0], 0
je 0x40f15e
mov cl, byte [0x4d2015]
mov dl, byte [ebp - 4]
jmp 0x40f187
cmp dword [0x4cfad0], 0
jl 0x40f182
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4d4988]
cmp eax, dword [0x4cfad0]
jb 0x40f182
mov dl, byte [ebp - 4]
xor cl, cl
jmp 0x40f187
mov dl, byte [ebp - 4]
mov cl, dl
cmp byte [0x4d4c53], 0
je 0x40f1a2
mov al, cl
xor al, dl
mov bl, al
and al, cl
and bl, dl
not bl
and bl, bh
or bl, al
jmp 0x40f1ab
mov bl, byte [ebp - 7]
not bl
and bl, cl
or bl, bh
push 0xffc3d44d
push 1
push 1
push dword [ebp + 0xc]
xor cl, cl
call fcn.00411ce0
mov dl, al
mov cl, bl
call fcn.00411650
add esp, 0x10
cmp dword [0x4d16a0], 0
je 0x40f1ed
mov cl, byte [0x4d2016]
mov al, cl
xor al, byte [0x4d2017]
and al, cl
not al
and cl, al
mov byte [0x4d2016], cl
cmp dword [ebp - 0x3c], 1
jne 0x40f289
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test al, 1
jne 0x40f289
push 0x14
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f231
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 1
call fcn.0040f910
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 2
call fcn.0040f910
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
add esp, 0x10
push 0
call esi
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call ebx
cmp eax, dword [0x4d3e6c]
jne 0x40f295
mov edx, 1
mov dword [0x4ce8c0], 0
or ecx, 0xffffffff
call fcn.00401e60
mov dword [0x4ce8c0], 1
jmp 0x40f295
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp byte [ebp - 0x11], 0
je 0x40f2ac
push 0
push dword [ebp - 0x40]
push dword [0x4d3e6c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp - 0x12], 0
je 0x40f2bf
cmp byte [ebp - 0x1e], 0
jne 0x40f2bf
xor cl, cl
call fcn.0042cd00
cmp dword [ebp + 8], 1
jne 0x40f2f5
push 0
call esi
push eax
call ebx
cmp eax, dword [0x4d3e6c]
jne 0x40f2f5
mov edx, 1
mov dword [0x4ce8c0], 0
or ecx, 0xffffffff
call fcn.00401e60
mov dword [0x4ce8c0], 1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x64]
mov dword [eax + 0x5c], ecx
mov ecx, dword [ebp - 0x68]
mov dword [eax + 0x64], ecx
lea esp, [ebp - 0xa8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret