Function at 0x4b63d0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5c69cb
push eax
mov eax, 0x2028
mov dword fs:[0], esp
call fcn.00573c80
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x2040]
push ebp
mov eax, dword [ebx + 0x7e4c4]
push esi
test eax, eax
push edi
je 0x4b6444
test ecx, ecx
jle 0x4b643a
mov edi, dword [esp + 0x2048]
mov esi, 0x654200
sub edi, esi
mov ebp, ecx
mov ecx, dword [ebx + 0x7e4c4]
mov dx, word [edi + esi]
push edx
mov eax, dword [ecx]
call dword [eax + 8]
mov word [esi], ax
add esi, 2
dec ebp
jne 0x4b641a
mov ecx, dword [esp + 0x204c]
mov dword [esp + 0x14], 0x654200
jmp 0x4b644f
mov eax, dword [esp + 0x2048]
mov dword [esp + 0x14], eax
test ecx, ecx
mov dword [esp + 0x18], 0
jle 0x4b6cf2
mov eax, dword [ebx + 0x7e4c0]
test eax, eax
je 0x4b66de
mov eax, dword [ebx + 0xd4]
inc eax
cdq
idiv dword [ebx + 0xd8]
mov dword [ebx + 0xd4], edx
mov eax, dword [ebx + 0x4c]
shr eax, 0x10
cmp ax, 0x8000
ja 0x4b64ba
cmp ax, 0x4000
ja 0x4b64a4
mov ecx, eax
and ecx, 0xffff
mov esi, dword [ecx*4 + 0x6f9ecc]
jmp 0x4b64e7
mov edx, eax
mov ecx, 0x719ecc
and edx, 0xffff
shl edx, 2
sub ecx, edx
mov esi, dword [ecx]
jmp 0x4b64e7
cmp ax, 0xc000
ja 0x4b64d1
mov edx, eax
and edx, 0xffff
mov esi, dword [edx*4 + 0x6d9ecc]
jmp 0x4b64e5
mov ecx, eax
mov edx, 0x739ecc
and ecx, 0xffff
shl ecx, 2
sub edx, ecx
mov esi, dword [edx]
neg esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
movsx edx, word [edx + ecx*2]
mov ecx, edx
imul ecx, esi
cmp ax, 0x8000
ja 0x4b6527
cmp ax, 0x4000
ja 0x4b6517
and eax, 0xffff
mov esi, 0x709ecc
shl eax, 2
sub esi, eax
mov eax, dword [esi]
jmp 0x4b654e
and eax, 0xffff
mov eax, dword [eax*4 + 0x6e9ecc]
neg eax
jmp 0x4b654e
cmp ax, 0xc000
ja 0x4b6542
and eax, 0xffff
mov esi, 0x729ecc
shl eax, 2
sub esi, eax
mov eax, dword [esi]
neg eax
jmp 0x4b654e
and eax, 0xffff
mov eax, dword [eax*4 + 0x6c9ecc]
imul edx, eax
mov eax, dword [0x6643ec]
mov esi, eax
sar esi, 8
sar ecx, 9
sub ecx, esi
add eax, ecx
mov ecx, dword [0x6643f0]
mov esi, ecx
mov dword [0x6643ec], eax
sar esi, 8
sar edx, 9
sub edx, esi
add ecx, edx
mov edx, dword [0x6643f4]
mov esi, edx
mov dword [0x6643f0], ecx
sar esi, 8
sar eax, 8
sub eax, esi
add edx, eax
mov eax, dword [0x6643f8]
mov dword [0x6643f4], edx
mov edx, eax
sar edx, 8
sar ecx, 8
sub ecx, edx
add eax, ecx
mov dword [0x6643f8], eax
mov eax, dword [ebx + 0xd4]
test eax, eax
jne 0x4b66d0
fild dword [0x6643f8]
fild dword [0x6643f4]
fpatan
fmul qword [0x5e3be0]
call fcn.00573170
mov edi, dword [ebx + 0x58]
mov edx, dword [ebx + 0x5c]
mov esi, eax
sub eax, edi
inc edx
mov dword [esp + 0x10], eax
mov eax, edx
mov dword [ebx + 0x5c], edx
cmp eax, 0x118
jle 0x4b668e
fild dword [esp + 0x10]
mov ecx, 0x12c
fmul qword [0x5db088]
fld qword [ebx + 0x50]
fmul qword [0x5dce00]
faddp st(1)
fst qword [ebx + 0x50]
mov eax, dword [ebx + 0x5c]
cdq
fimul dword [ebx + 0x10c]
idiv ecx
fmul qword [0x5e3bd8]
test edx, edx
jne 0x4b66cb
mov edx, dword [0x639698]
mov dword [esp + 0x10], edx
fld st(0)
fmul qword [0x5dd038]
fild dword [ebx + 0x44]
sub esp, 8
lea eax, [esp + 0x18]
mov dword [esp + 0x2048], 0
fsub st(2)
fdivp st(1)
fstp qword [esp]
push str.TX_RX_rate__ppm_:__6f
push eax
fstp st(0)
call fcn.0058aded
mov ecx, dword [esp + 0x20]
add esp, 0x10
push ecx
mov ecx, dword [ebx + 0x7e4c0]
call fcn.00592c97
lea ecx, [esp + 0x10]
mov dword [esp + 0x2040], 0xffffffff
call fcn.005936db
jmp 0x4b66cd
cmp eax, 0x32
jle 0x4b66ad
fild dword [esp + 0x10]
fmul qword [0x5db048]
fld qword [ebx + 0x50]
fmul qword [0x5dbb58]
faddp st(1)
fstp qword [ebx + 0x50]
jmp 0x4b66cd
test eax, eax
jle 0x4b66cd
fild dword [esp + 0x10]
fmul qword [0x5db288]
fld qword [ebx + 0x50]
fmul qword [0x5e3bd0]
faddp st(1)
fstp qword [ebx + 0x50]
jmp 0x4b66cd
fstp st(0)
mov dword [ebx + 0x58], esi
mov edx, dword [ebx + 0xdc]
mov eax, dword [ebx + 0x4c]
add eax, edx
mov dword [ebx + 0x4c], eax
mov eax, dword [ebx + 0x74378]
test eax, eax
jl 0x4b6712
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movsx ecx, word [ecx + edx*2]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fstp dword [ebx + eax*4 + 0x64378]
mov eax, dword [ebx + 0x74378]
inc eax
mov dword [ebx + 0x74378], eax
jmp 0x4b6719
inc eax
mov dword [ebx + 0x74378], eax
cmp eax, 0x2000
jl 0x4b6cda
mov eax, dword [ebx + 0x7e4a8]
cmp eax, 8
ja case.0x4b6733.2
jmp dword [eax*4 + 0x4b7374]
lea ecx, [esp + 0x38]
lea eax, [ebx + 0x6a378]
mov edx, 0x800
fld dword [eax]
fmul qword [0x5e3bc8]
add eax, 4
add ecx, 4
dec edx
fstp dword [ecx - 4]
jne 0x4b6749
jmp 0x4b6ab4
xor ecx, ecx
lea edi, [esp + 0x38]
lea esi, [ebx + 0x6a378]
lea eax, [ecx - 0x400]
add esi, 4
cdq
xor eax, edx
add edi, 4
sub eax, edx
mov edx, 0x400
sub edx, eax
inc ecx
mov dword [esp + 0x10], edx
cmp ecx, 0x800
fild dword [esp + 0x10]
fmul dword [esi - 4]
fmul qword [0x5e3bc0]
fstp dword [edi - 4]
jl 0x4b676e
jmp 0x4b6ab4
xor ecx, ecx
lea esi, [esp + 0x38]
lea edx, [ebx + 0x6a378]
mov eax, ecx
shl eax, 5
cmp ax, 0x4000
ja 0x4b67cd
and eax, 0xffff
fld dword [eax*4 + 0x6e9ec8]
jmp 0x4b6817
cmp ax, 0x8000
ja 0x4b67ec
fld dword [0x5dc0b0]
and eax, 0xffff
mov edi, 0x709ec8
shl eax, 2
sub edi, eax
fsub dword [edi]
jmp 0x4b6817
cmp ax, 0xc000
ja 0x4b6806
fld dword [0x5dc0b0]
and eax, 0xffff
fsub dword [eax*4 + 0x6c9ec8]
jmp 0x4b6817
and eax, 0xffff
mov edi, 0x729ec8
shl eax, 2
sub edi, eax
fld dword [edi]
fmul qword [0x5e3bb8]
inc ecx
add edx, 4
add esi, 4
cmp ecx, 0x800
fadd qword [0x5e3bb0]
fmul dword [edx - 4]
fstp dword [esi - 4]
jl 0x4b67b4
jmp 0x4b6ab4
xor eax, eax
lea edx, [esp + 0x38]
lea ecx, [ebx + 0x6a378]
mov esi, eax
add ecx, 4
and esi, 0xffff
inc eax
add edx, 4
cmp eax, 0x800
fld dword [esi*4 + 0x6e7ec4]
fmul dword [ecx - 4]
fstp dword [edx - 4]
jl 0x4b684d
jmp 0x4b6ab4
mov eax, 0x1000
lea edx, [esp + 0x38]
lea ecx, [ebx + 0x68378]
mov esi, eax
add ecx, 4
and esi, 0xffff
add edx, 4
fld dword [esi*4 + 0x6e3ec0]
lea esi, [eax + 0x800]
fmul dword [ecx - 4]
and esi, 0xffff
inc eax
fld dword [esi*4 + 0x6e3ec0]
fmul dword [ecx + 0x1ffc]
lea esi, [eax - 0x1000]
cmp esi, 0x800
fadd st(1)
fmul qword [0x5daf38]
fstp dword [edx - 4]
fstp st(0)
jl 0x4b6884
jmp 0x4b6ab4
lea edx, [esp + 0x38]
mov eax, 0x1000
lea ecx, [ebx + 0x68378]
lea esi, [eax - 0x1000]
add ecx, 4
and esi, 0xffff
add edx, 4
fld dword [esi*4 + 0x6dbebc]
lea esi, [eax - 0x800]
fmul dword [ecx - 0x4004]
and esi, 0xffff
fld dword [esi*4 + 0x6dbebc]
fmul dword [ecx - 0x2004]
mov esi, eax
and esi, 0xffff
faddp st(1)
fld dword [esi*4 + 0x6dbebc]
fmul dword [ecx - 4]
lea esi, [eax + 0x800]
and esi, 0xffff
inc eax
faddp st(1)
fld dword [esi*4 + 0x6dbebc]
fmul dword [ecx + 0x1ffc]
lea esi, [eax - 0x1000]
cmp esi, 0x800
fadd st(1)
fmul qword [0x5daf30]
fstp dword [edx - 4]
fstp st(0)
jl 0x4b68e5
jmp 0x4b6ab4
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0x838]
rep stosd dword es:[edi], eax
mov eax, 0x200
lea ecx, [ebx + 0x6ab78]
lea esi, [eax + eax + 0xfc00]
add ecx, 4
and esi, 0xffff
inc eax
add edx, 4
cmp eax, 0x600
fld dword [esi*4 + 0x6e7ec4]
fmul dword [ecx - 4]
fadd st(0), st(0)
fstp dword [edx - 4]
jl 0x4b6990
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x1838]
rep stosd dword es:[edi], eax
jmp 0x4b6ab4
mov ecx, 0x300
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0xc38]
rep stosd dword es:[edi], eax
mov eax, 0x300
lea ecx, [ebx + 0x6af78]
lea esi, [eax*4 + 0xf800]
add ecx, 4
and esi, 0xffff
inc eax
add edx, 4
cmp eax, 0x500
fld dword [esi*4 + 0x6e7ec4]
fmul dword [ecx - 4]
fmul dword [0x5e3ba8]
fstp dword [edx - 4]
jl 0x4b69ee
mov ecx, 0x300
xor eax, eax
lea edi, [esp + 0x1438]
rep stosd dword es:[edi], eax
jmp 0x4b6ab4
xor ecx, ecx
lea esi, [esp + 0x38]
lea edx, [ebx + 0x6a378]
mov eax, ecx
shl eax, 5
cmp ax, 0x4000
ja 0x4b6a56
and eax, 0xffff
fld dword [eax*4 + 0x6e9ec8]
jmp 0x4b6aa0
cmp ax, 0x8000
ja 0x4b6a75
fld dword [0x5dc0b0]
and eax, 0xffff
mov edi, 0x709ec8
shl eax, 2
sub edi, eax
fsub dword [edi]
jmp 0x4b6aa0
cmp ax, 0xc000
ja 0x4b6a8f
fld dword [0x5dc0b0]
and eax, 0xffff
fsub dword [eax*4 + 0x6c9ec8]
jmp 0x4b6aa0
and eax, 0xffff
mov edi, 0x729ec8
shl eax, 2
sub edi, eax
fld dword [edi]
fmul dword [edx]
inc ecx
add edx, 4
add esi, 4
cmp ecx, 0x800
fstp dword [esi - 4]
jl 0x4b6a3d
lea esi, [ebx + 0x74384]
lea eax, [esp + 0x38]
push esi
push 1
push 0x3f000000
push 0x3ff
push 0
push eax
lea ecx, [ebx + 0x6435c]
call fcn.004cda80
mov eax, dword [ebx + 0x7e384]
lea ecx, [ebx + eax*4 + 0x76384]
add eax, 0x400
and eax, 0x80000fff
jns 0x4b6af9
dec eax
or eax, 0xfffff000
inc eax
mov dword [ebx + 0x7e384], eax
mov eax, esi
mov edx, 0x400
mov edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
dec edx
jne 0x4b6b06
lea edi, [ebx + 0x7e3e4]
mov ebp, 0x28
mov ecx, dword [edi]
test ecx, ecx
je 0x4b6b35
mov eax, dword [ebx + 0x74380]
mov edx, dword [ecx]
push 0
push eax
push esi
push 0x59
call dword [edx + 4]
add edi, 4
dec ebp
jne 0x4b6b1e
mov eax, dword [0x6643e4]
inc eax
cmp eax, 0xc8
mov dword [0x6643e4], eax
jle 0x4b6b68
mov eax, dword [ebx + 0x74380]
xor esi, esi
cmp eax, esi
jle 0x4b6b60
dec eax
mov dword [ebx + 0x74380], eax
mov dword [0x6643e4], esi
jmp 0x4b6b6a
xor esi, esi
mov ecx, dword [ebx + 0x74380]
cmp ecx, 0xa
ja case.default.0x4b6b79
jmp dword [ecx*4 + 0x4b7398]
mov dword [ebx + 0x74378], 0xfffff800
mov dword [ebx + 0x30e78], 0x400
jmp 0x4b6c80
mov dword [ebx + 0x74378], esi
mov dword [ebx + 0x30e78], 0x400
jmp 0x4b6c80
mov dword [ebx + 0x74378], 0x2ab
mov dword [ebx + 0x30e78], 0x400
jmp 0x4b6c80
mov eax, 0x400
mov dword [ebx + 0x74378], eax
mov dword [ebx + 0x30e78], eax
jmp 0x4b6c80
mov dword [ebx + 0x74378], 0x555
mov dword [ebx + 0x30e78], 0x2ab
jmp 0x4b6c80
mov dword [ebx + 0x74378], 0x600
mov dword [ebx + 0x30e78], 0x200
jmp 0x4b6c80
mov dword [ebx + 0x74378], 0x680
mov dword [ebx + 0x30e78], 0x180
jmp 0x4b6c80
mov dword [ebx + 0x74378], 0x700
mov dword [ebx + 0x30e78], 0x100
jmp 0x4b6c80
mov dword [ebx + 0x74378], 0x756
mov dword [ebx + 0x30e78], 0xaa
jmp 0x4b6c80
mov dword [ebx + 0x74378], 0x780
mov dword [ebx + 0x30e78], 0x80
jmp 0x4b6c80
mov dword [ebx + 0x74378], 0x7ab
mov dword [ebx + 0x30e78], 0x55
jmp 0x4b6c80
mov dword [ebx + 0x74378], esi
mov ebp, dword [ebx + 0x74378]
xor edx, edx
add ebp, 0x1800
cmp ecx, 4
setg dl
mov dword [ebx + 0x74378], ebp
mov dword [0x63fd78], edx
mov eax, dword [ebx + 0x74378]
cmp eax, esi
jle 0x4b6cda
mov ecx, 0x2000
sub ecx, eax
cmp ecx, 0x2000
jge 0x4b6cda
mov eax, 0x2000
lea edx, [ebx + 0x64378]
lea esi, [ebx + ecx*4 + 0x64378]
sub eax, ecx
mov ecx, dword [esi]
add esi, 4
mov dword [edx], ecx
add edx, 4
dec eax
jne 0x4b6ccd
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x204c]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x4b645f
mov eax, dword [ebx + 0x7e48c]
test eax, eax
je 0x4b6d23
mov edx, dword [0x66440c]
test edx, edx
je 0x4b6d15
mov dword [ebx + 0x7e48c], 0
jmp 0x4b7356
test eax, eax
je 0x4b6d23
mov edx, dword [ebx + 0xf8]
test edx, edx
jne 0x4b6d31
mov edx, dword [ebx + 0x30ea4]
test edx, edx
je 0x4b70b5
mov edx, dword [ebx + 0x30ea4]
test edx, edx
je 0x4b6d42
mov edi, 0x652200
jmp 0x4b6d54
mov edx, dword [ebx + 0x7e3e0]
mov esi, dword [ebx + 0x11c]
shl edx, 5
mov edi, dword [edx + esi]
cmp eax, 2
jne 0x4b6da0
test ecx, ecx
jle 0x4b6f40
mov ebp, dword [esp + 0x14]
mov esi, edi
sub ebp, edi
mov edi, dword [esp + 0x204c]
movsx eax, word [esi + ebp]
mov ecx, dword [ebx + 0x7e38c]
push 0
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.004c1a70
fmul qword [0x5dcee8]
call fcn.00573170
mov word [esi], ax
add esi, 2
dec edi
jne 0x4b6d70
jmp 0x4b6f40
cmp eax, 3
jne 0x4b6de7
test ecx, ecx
jle 0x4b6f40
mov ebp, dword [esp + 0x14]
mov esi, edi
sub ebp, edi
mov edi, dword [esp + 0x204c]
mov ax, word [esi + ebp]
mov ecx, dword [ebx + 0x7e38c]
push 1
push eax
call fcn.004c1a70
fmul qword [0x5dcfb8]
call fcn.00573170
mov word [esi], ax
add esi, 2
dec edi
jne 0x4b6dbc
jmp 0x4b6f40
cmp eax, 4
jne 0x4b6f0c
fld qword [0x631e58]
call fcn.00573170
mov edx, dword [ebx + 0x7e3cc]
mov ecx, eax
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jle 0x4b6e1d
mov dword [ebx + 0x7e3cc], ecx
push ecx
mov ecx, ebx
call fcn.004b90d0
mov eax, dword [esp + 0x204c]
test eax, eax
jle 0x4b6f40
mov ebp, dword [esp + 0x14]
lea esi, [ebx + 0x7e390]
sub ebp, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebp
movsx eax, word [edi + ebp]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [ebx + 0x7e3d4]
test ecx, ecx
je 0x4b6edf
mov dx, word [ebx + 0x7e3c8]
cmp dx, 0x8000
ja 0x4b6e95
cmp dx, 0x4000
mov ecx, edx
ja 0x4b6e80
and ecx, 0xffff
mov ecx, dword [ecx*4 + 0x6f9ecc]
jmp 0x4b6ec2
and ecx, 0xffff
mov ebp, 0x719ecc
shl ecx, 2
sub ebp, ecx
mov ecx, dword [ebp]
jmp 0x4b6ec2
cmp dx, 0xc000
mov ecx, edx
ja 0x4b6ead
and ecx, 0xffff
mov ecx, dword [ecx*4 + 0x6d9ecc]
jmp 0x4b6ec0
and ecx, 0xffff
mov ebp, 0x739ecc
shl ecx, 2
sub ebp, ecx
mov ecx, dword [ebp]
neg ecx
imul ecx, eax
mov ebp, dword [esp + 0x18]
sar ecx, 0xe
mov eax, ecx
mov cx, word [ebx + 0x7e3ca]
add cx, dx
mov word [ebx + 0x7e3c8], cx
mov edx, dword [ebx + 0x7e3ac]
lea ecx, [ebx + 0x7e3ac]
shl eax, 2
push eax
call dword [edx + 0xc]
shl eax, 2
mov word [edi], ax
mov eax, dword [esp + 0x10]
add edi, 2
dec eax
mov dword [esp + 0x10], eax
jne 0x4b6e40
jmp 0x4b6f40
cmp eax, 5
je 0x4b6f40
cmp eax, 6
je 0x4b6f40
cmp eax, 7
je 0x4b6f40
cmp eax, 8
je 0x4b6f40
cmp eax, 9
je 0x4b6f40
mov ecx, dword [esp + 0x204c]
mov esi, dword [esp + 0x14]
add ecx, ecx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x30e8c]
test eax, eax
jge 0x4b6f97
mov eax, dword [ebx + 0x7e3e0]
mov ebp, dword [ebx + 0x11c]
mov ecx, dword [ebx + 0x114]
push 0x20
shl eax, 5
add eax, ebp
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveOutWrite]
mov edx, dword [ebx + 0x7e3e0]
mov ecx, dword [ebx + 0xe4]
inc edx
mov eax, edx
mov dword [ebx + 0x7e3e0], edx
cmp eax, ecx
jl 0x4b70b5
mov dword [ebx + 0x7e3e0], 0
jmp 0x4b70b5
mov eax, dword [ebx + 0x61c28]
xor ecx, ecx
cmp eax, 8
jle 0x4b6fa9
mov ecx, 1
mov eax, dword [esp + 0x204c]
cmp ecx, eax
jge 0x4b6fdd
mov edx, dword [0x6643e8]
sub eax, ecx
lea esi, [ecx*2 + 0x652200]
mov ecx, eax
lea edi, [edx*2 + 0x650200]
shr ecx, 1
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
add edx, eax
rep movsw word es:[edi], word [esi]
mov dword [0x6643e8], edx
mov eax, dword [ebx + 0x30e94]
mov ecx, dword [0x6643e8]
cmp ecx, eax
jl 0x4b70b5
mov ebp, dword [sym.imp.WINMM.dll_waveOutWrite]
mov edx, dword [ebx + 0x7e3e0]
lea ecx, [eax + eax]
mov eax, dword [ebx + 0x30ec8]
mov esi, 0x650200
shl edx, 5
push 0x20
mov edi, dword [edx + eax]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x6643e8]
mov ecx, dword [ebx + 0x30e94]
sub eax, ecx
mov edi, 0x650200
mov dword [0x6643e8], eax
lea ecx, [eax + eax]
mov eax, dword [ebx + 0x30e94]
mov edx, ecx
lea esi, [eax*2 + 0x650200]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x7e3e0]
mov edx, dword [ebx + 0x30ec8]
mov ecx, dword [ebx + 0x30ec0]
shl eax, 5
add eax, edx
push eax
push ecx
call ebp
mov esi, dword [ebx + 0x61c28]
mov edx, dword [ebx + 0x7e3e0]
mov ecx, dword [ebx + 0x30e90]
inc esi
inc edx
mov dword [ebx + 0x61c28], esi
mov eax, edx
mov dword [ebx + 0x7e3e0], edx
cmp eax, ecx
jl 0x4b70a1
mov dword [ebx + 0x7e3e0], 0
mov eax, dword [ebx + 0x30e94]
mov ecx, dword [0x6643e8]
cmp ecx, eax
jge 0x4b6ff7
lea ebp, [ebx + 0x7e3e4]
mov dword [esp + 0x18], 0x28
mov dword [esp + 0x10], ebp
mov ecx, dword [ebp]
test ecx, ecx
je 0x4b7304
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x4b7304
mov edx, dword [ecx]
push 0
push 0
push 0
push 0x56
call dword [edx + 4]
test eax, eax
je 0x4b72bc
mov esi, dword [ebp]
mov eax, dword [ebx + 0x7e494]
add esi, 0x44
test eax, eax
je 0x4b728f
cmp dword [esi], 0
jl 0x4b728f
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0x201
push 0x201
lea eax, [esp + 0x28]
push 0
push eax
call edi
test eax, eax
jne 0x4b7152
push eax
push 0x202
push 0x202
lea ecx, [esp + 0x28]
push eax
push ecx
call edi
test eax, eax
jne 0x4b7152
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x4b7158
mov dword [esi], 0xffffffff
cmp dword [esi], 0xffffffff
je 0x4b728f
mov ecx, dword [ebx + 0x7e494]
mov edi, 0x2000
mov edx, dword [ecx]
mov eax, edx
sub eax, dword [esi]
test eax, eax
jg 0x4b7179
add eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
cmp eax, ecx
jle 0x4b7195
mov eax, ecx
sub edx, eax
mov dword [esi], edx
jns 0x4b7195
mov ecx, dword [ebx + 0x7e494]
mov ecx, dword [ecx + 8]
add ecx, edx
mov dword [esi], ecx
mov edx, dword [ebx + 0x7e494]
mov ecx, dword [edx + 8]
sub ecx, dword [esi]
cmp eax, 0x2000
jge 0x4b71a9
mov edi, eax
cmp ecx, edi
jge 0x4b71af
mov edi, ecx
mov ecx, dword [ebp]
mov ebp, dword [esi]
mov edx, dword [edx + 4]
mov eax, dword [ebx + 0xf8]
test eax, eax
mov eax, dword [ecx]
lea edx, [edx + ebp*2]
push edi
push edx
jne 0x4b71cd
call dword [eax + 0x24]
jmp 0x4b71d0
call dword [eax + 0x28]
mov edx, dword [esi]
mov ebp, dword [esp + 0x10]
add edx, edi
mov eax, edx
mov dword [esi], edx
mov ecx, dword [ebx + 0x7e494]
cdq
idiv dword [ecx + 8]
mov dword [esi], edx
mov eax, dword [ebx + 0x7e494]
cmp edx, dword [eax]
je 0x4b7289
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0xf
push 0xf
lea ecx, [esp + 0x28]
push 0
push ecx
call edi
test eax, eax
je 0x4b7239
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push 0xf
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xf
push 0xf
lea edx, [esp + 0x28]
push 0
push edx
call edi
test eax, eax
jne 0x4b720f
push 0
push 0x3c0
push 0x3c0
lea eax, [esp + 0x28]
push 0
push eax
call edi
test eax, eax
jne 0x4b728f
mov eax, dword [0x66440c]
test eax, eax
je 0x4b710f
mov ecx, dword [ebx + 0x30e70]
mov eax, 0x186a0
sub eax, ecx
mov edx, dword [ebx + 0x30e6c]
add eax, edx
mov ecx, 0x186a0
cdq
idiv ecx
cmp edx, 0x1f4
jg 0x4b728f
jmp 0x4b710f
mov dword [esi], 0xffffffff
mov ecx, dword [ebp]
mov eax, dword [ecx + 0x44]
test eax, eax
jge 0x4b7304
mov eax, dword [ebx + 0xf8]
mov edx, dword [ecx]
test eax, eax
mov eax, dword [esp + 0x204c]
push eax
mov eax, dword [esp + 0x18]
push eax
jne 0x4b72b7
call dword [edx + 0x24]
jmp 0x4b7304
call dword [edx + 0x28]
jmp 0x4b7304
mov eax, dword [ebx + 0xf8]
test eax, eax
je 0x4b72e7
mov eax, dword [ebx + 0x7e48c]
test eax, eax
jg 0x4b72e7
mov eax, dword [esp + 0x204c]
mov ecx, dword [ebp]
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
call dword [edx + 0x28]
jmp 0x4b72fc
mov eax, dword [esp + 0x204c]
mov ecx, dword [ebp]
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
call dword [edx + 0x24]
mov ecx, dword [ebp]
mov edx, dword [ecx]
call dword [edx + 0x20]
mov eax, dword [esp + 0x18]
add ebp, 4
dec eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], eax
jne 0x4b70c7
mov ecx, dword [ebx + 0x7e494]
test ecx, ecx
je 0x4b7336
mov eax, dword [esp + 0x204c]
mov edx, dword [esp + 0x14]
push eax
push edx
call fcn.00501d10
mov ebx, dword [ebx + 0x7e49c]
test ebx, ebx
je 0x4b7356
mov ecx, dword [esp + 0x204c]
mov edx, dword [esp + 0x14]
mov eax, dword [ebx]
push 0
push ecx
push edx
mov ecx, ebx
call dword [eax + 4]
mov ecx, dword [esp + 0x2038]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2034
ret 8