Function at 0x525de4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x525dec
push ebx
push esi
push edi
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x527550
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [0x57b3ec]
call fcn.0046e7c0
mov eax, dword [0x57438c]
mov eax, dword [eax]
cmp byte [eax + 0x79a], 0
jne 0x525e37
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov edx, dword [eax]
call dword [edx + 0xf0]
mov eax, dword [0x57438c]
mov eax, dword [eax]
mov byte [eax + 0x79a], 0
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov eax, dword [eax + 0x280]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push 0
mov eax, dword [ebp - 4]
add eax, 0x3b8
mov ecx, 1
mov edx, dword [0x4df324]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 4]
mov byte [eax + 0x7b4], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x7b5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x37f], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x7d0], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x7d1], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x37e], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa72], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa73], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x8e0], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x8e1], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x8e2], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa94], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x8e3], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x8e4], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x8e5], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x8e8], edx
mov eax, dword [ebp - 4]
add eax, 0x8ec
call fcn.004054b0
mov eax, dword [ebp - 4]
add eax, 0x8f0
call fcn.004054b0
mov eax, dword [ebp - 4]
add eax, 0x8f4
call fcn.004054b0
mov eax, dword [ebp - 4]
add eax, 0x8f8
call fcn.004054b0
mov eax, dword [ebp - 4]
mov byte [eax + 0x7d2], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x7d3], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x7d4], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x7d5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa90], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa91], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa92], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x380], 0
mov eax, dword [ebp - 4]
add eax, 0x384
call fcn.004054b0
mov eax, dword [ebp - 4]
add eax, 0x388
call fcn.004054b0
mov eax, dword [ebp - 4]
add eax, 0x38c
call fcn.004054b0
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 1
jbe 0x525fe8
call fcn.00403c14
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x390]
call fcn.004054b0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jne 0x525fdb
mov dword [ebp - 0x30], 2
mov eax, dword [ebp - 0x30]
add eax, 0xfffffffe
cmp eax, 5
jbe 0x526017
call fcn.00403c14
add eax, 2
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*4 + 0x390], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 8
jne 0x526007
mov eax, dword [ebp - 4]
mov byte [eax + 0xa74], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa78], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x654], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x658], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0xa70], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x908], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x65c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x660], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x664], edx
mov eax, dword [ebp - 4]
add eax, 0x668
call fcn.00404c88
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x66c], edx
mov eax, dword [0x57438c]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x79c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x694]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x698]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x678]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x67c]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x680]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
mov eax, dword [ebp - 4]
add eax, 0x68c
mov ecx, 1
mov edx, dword [0x4df37c]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7bc]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 4]
add eax, 0x9a0
call fcn.00406c8c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x9a4], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x9ac], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x9d4], edx
push 0
mov eax, dword [ebp - 4]
add eax, 0xa64
mov ecx, 1
mov edx, dword [0x4df4b4]
call fcn.0040659c
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0xa68
mov ecx, 1
mov edx, dword [0x4df4d4]
call fcn.0040659c
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x6a0
mov ecx, 1
mov edx, dword [0x4df39c]
call fcn.0040659c
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0xa60
mov ecx, 1
mov edx, dword [0x4df494]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6a4]
call fcn.004063e0
sub eax, 1
jno 0x526235
call fcn.00403c1c
test eax, eax
jl 0x52627e
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0
push 0
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x6a4]
test edx, edx
je 0x52625b
cmp eax, dword [edx - 4]
jb 0x526260
call fcn.00403c14
lea eax, [edx + eax*4]
mov ecx, 1
mov edx, dword [0x4df3bc]
call fcn.0040659c
add esp, 4
inc dword [ebp - 0x30]
dec dword [ebp - 0x4c]
jne 0x526244
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6a8]
call fcn.004063e0
sub eax, 1
jno 0x526296
call fcn.00403c1c
test eax, eax
jl 0x5262df
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0
push 0
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x6a8]
test edx, edx
je 0x5262bc
cmp eax, dword [edx - 4]
jb 0x5262c1
call fcn.00403c14
lea eax, [edx + eax*4]
mov ecx, 1
mov edx, dword [0x4df3fc]
call fcn.0040659c
add esp, 4
inc dword [ebp - 0x30]
dec dword [ebp - 0x4c]
jne 0x5262a5
push 0
mov eax, dword [ebp - 4]
add eax, 0x6a4
mov ecx, 1
mov edx, dword [0x4df3dc]
call fcn.0040659c
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x6a8
mov ecx, 1
mov edx, dword [0x4df41c]
call fcn.0040659c
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x1f
jbe 0x52632b
call fcn.00403c14
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x7e0]
call fcn.004054b0
mov eax, dword [ebp - 0x30]
cmp eax, 0x1f
jbe 0x526347
call fcn.00403c14
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*4 + 0x860], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x20
jne 0x52631e
mov eax, dword [ebp - 4]
add eax, 0x6b0
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
xor edx, edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x64]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x68]
call fcn.004063e0
sub eax, 1
jno 0x52639a
call fcn.00403c1c
test eax, eax
jl 0x5263d0
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx + 0x68]
test edx, edx
je 0x5263bb
cmp eax, dword [edx - 4]
jb 0x5263c0
call fcn.00403c14
mov eax, dword [edx + eax*4]
call fcn.00403d4c
inc dword [ebp - 0x30]
dec dword [ebp - 0x4c]
jne 0x5263a9
push 0
mov eax, dword [ebp - 0x50]
add eax, 0x68
mov ecx, 1
mov edx, dword [0x4def90]
call fcn.0040659c
add esp, 4
push 0
push 0
mov eax, dword [ebp - 0x50]
add eax, 0x70
mov ecx, 2
mov edx, dword [0x4defd0]
call fcn.0040659c
add esp, 8
push 0
push 0
mov eax, dword [ebp - 0x50]
add eax, 0x74
mov ecx, 2
mov edx, dword [0x4df010]
call fcn.0040659c
add esp, 8
push 0
mov eax, dword [ebp - 0x50]
add eax, 0x78
mov ecx, 1
mov edx, dword [0x4df030]
call fcn.0040659c
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0xf
jbe 0x526452
call fcn.00403c14
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*4 + 0x9dc], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x10
jne 0x526445
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_GetAsyncKeyState
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x100
jne 0x52646c
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 2
jbe 0x526493
call fcn.00403c14
mov edx, dword [ebp - 4]
mov byte [edx + eax + 0xa9c], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jne 0x526486
push 0
mov eax, dword [ebp - 4]
add eax, 0x7c0
mov ecx, 1
mov edx, dword [0x4df43c]
call fcn.0040659c
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x7c4
mov ecx, 1
mov edx, dword [0x4df45c]
call fcn.0040659c
add esp, 4
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_GetSystemTime
mov eax, dword [ebp - 4]
add eax, 0x7c8
push eax
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
lea eax, [ebp - 0x6c]
call fcn.0056dda8
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
add eax, 0x374
call fcn.004054ec
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x9d8], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov ecx, dword [eax]
call dword [ecx + 0x28]
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 0x37d], al
call fcn.0040330c
movzx eax, ax
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0xa98]
je 0x526594
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa98]
cmp eax, 0xffff
jbe 0x52658f
call fcn.00403c14
call fcn.004032fc
xor eax, eax
push ebp
push 0x527398
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004054b0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 1
xor eax, eax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x29], 1
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 1
jno 0x5265e2
call fcn.00403c1c
test eax, eax
jl 0x526b4e
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x48]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [ebp - 9], 0
jne 0x526751
mov edx, dword [ebp - 0x48]
mov eax, 0x527568
call fcn.004059bc
test eax, eax
jle 0x526687
push 1
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x527574
mov edx, 0x527588
mov eax, dword [ebp - 0x48]
call fcn.004af81c
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x48]
call fcn.00405514
push 1
lea eax, [ebp - 0x74]
push eax
mov ecx, 0x527598
mov edx, 0x5275ac
mov eax, dword [ebp - 0x48]
call fcn.004af81c
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x48]
call fcn.00405514
push 1
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x5275c0
mov edx, 0x5275d4
mov eax, dword [ebp - 0x48]
call fcn.004af81c
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x48]
call fcn.00405514
push 0
push 1
xor ecx, ecx
mov edx, dword [ebp - 0x48]
mov eax, 0x5275e8
call fcn.004af570
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x526751
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov dx, 0x28
mov eax, dword [ebp - 4]
call fcn.004e3f30
mov ebx, eax
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov dx, 0x29
mov eax, dword [ebp - 4]
call fcn.004e3f30
cmp ebx, eax
je 0x5266e2
lea eax, [ebp - 0x48]
mov edx, 0x5275f4
call fcn.00405514
jmp 0x526751
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x48]
dec eax
test edx, edx
je 0x5266f2
cmp eax, dword [edx - 4]
jb 0x5266f7
call fcn.00403c14
inc eax
mov word [edx + eax*2 - 2], 0x5d
mov edx, dword [ebp - 0x34]
sub edx, 1
jno 0x52670c
call fcn.00403c1c
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0052331c
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jge 0x52672f
lea eax, [ebp - 0x48]
mov edx, 0x5275f4
call fcn.00405514
jmp 0x526751
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x48]
dec eax
test edx, edx
je 0x52673f
cmp eax, dword [edx - 4]
jb 0x526744
call fcn.00403c14
inc eax
mov word [edx + eax*2 - 2], 0x5b
jmp 0x526687
add dword [ebp - 0x38], 1
jno 0x52675c
call fcn.00403c1c
mov eax, dword [ebp - 0x48]
mov edx, 0x5275f4
call fcn.004057c0
jne 0x5267fd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, 0x527620
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
jno 0x526795
call fcn.00403c1c
call fcn.0040a504
lea eax, [ebp - 0x84]
mov edx, 0x52766c
call fcn.00404f70
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
call fcn.0040567c
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x88]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88]
pop eax
call fcn.004056a8
mov edx, dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
call fcn.004e3600
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x526b42
mov byte [ebp - 0x2a], 0
cmp byte [ebp - 9], 0
jne 0x526874
lea eax, [ebp - 0x8c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x48]
call fcn.00405844
mov eax, dword [ebp - 0x8c]
mov edx, 0x527674
call fcn.004057c0
je 0x526874
lea eax, [ebp - 0x90]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 0x48]
call fcn.00405844
mov eax, dword [ebp - 0x90]
mov edx, 0x527680
call fcn.004057c0
je 0x526874
push 0
push 1
xor ecx, ecx
mov edx, dword [ebp - 0x48]
mov eax, 0x527698
call fcn.004af570
test eax, eax
jne 0x526878
mov byte [ebp - 0x2a], 1
cmp byte [ebp - 9], 0
je 0x5268e9
mov edx, dword [ebp - 0x48]
mov eax, 0x527698
call fcn.004059bc
test eax, eax
jle 0x5268e9
lea eax, [ebp - 0x94]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 0x48]
call fcn.00405844
mov eax, dword [ebp - 0x94]
mov edx, 0x5276a0
call fcn.004057c0
je 0x5268e5
lea eax, [ebp - 0x98]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 0x48]
call fcn.00405844
mov eax, dword [ebp - 0x98]
mov edx, 0x5276c0
call fcn.004057c0
jne 0x5268e9
mov byte [ebp - 0x2a], 0
cmp byte [ebp - 0x2a], 0
je 0x526a45
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x48]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebp
call fcn.005236cc
pop ecx
mov byte [ebp - 0x2b], 0
lea eax, [ebp - 0x9c]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 0x48]
call fcn.00405844
mov eax, dword [ebp - 0x9c]
mov edx, 0x5276e0
call fcn.004057c0
jne 0x526991
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [ebp - 0x48]
call fcn.0040569c
mov edx, eax
sub edx, 5
jno 0x526955
call fcn.00403c1c
mov ecx, 0x7fffffff
mov eax, dword [ebp - 0x48]
call fcn.00405844
mov eax, dword [ebp - 0xa0]
mov edx, 0x5276fc
call fcn.004057c0
jne 0x526991
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x3c], 1
add dword [ebp - 0x40], 1
jno 0x52698d
call fcn.00403c1c
mov byte [ebp - 0x29], 1
cmp byte [ebp - 0x29], 0
je 0x5269b5
mov eax, dword [ebp - 0x48]
mov edx, 0x527710
call fcn.004057c0
jne 0x5269b5
mov dword [ebp - 0x3c], 2
mov byte [ebp - 0x29], 0
mov byte [ebp - 0x2b], 1
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
jno 0x5269c8
call fcn.00403c1c
call fcn.0040a504
lea eax, [ebp - 0xac]
mov edx, 0x52766c
call fcn.00404f70
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
call fcn.0040567c
lea eax, [ebp - 0xa8]
mov edx, dword [ebp - 0x48]
call fcn.004056a8
mov edx, dword [ebp - 0xa8]
lea ecx, [ebp - 0xa4]
mov eax, dword [ebp - 4]
call fcn.004e3600
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [ebp - 0x2b], 0
je 0x526b42
cmp dword [ebp - 0x40], 0xffffffff
jne 0x526b42
lea eax, [ebp - 0x44]
call fcn.004054b0
jmp 0x526b42
push 1
push 1
push 1
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x48]
mov cl, 1
mov edx, 0x527698
call fcn.004af0b8
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0x44]
call fcn.0040a18c
mov eax, dword [ebp - 0x44]
xor edx, edx
call fcn.004057c0
je 0x526b42
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebp
call fcn.005236cc
pop ecx
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
jno 0x526aaa
call fcn.00403c1c
call fcn.0040a504
lea eax, [ebp - 0xbc]
mov edx, 0x52766c
call fcn.00404f70
mov edx, dword [ebp - 0xbc]
lea eax, [ebp - 0xb8]
call fcn.0040567c
lea eax, [ebp - 0xb8]
mov edx, dword [ebp - 0x44]
call fcn.004056a8
mov edx, dword [ebp - 0xb8]
lea ecx, [ebp - 0xb4]
mov eax, dword [ebp - 4]
call fcn.004e3600
mov edx, dword [ebp - 0xb4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [ebp - 9], 0
je 0x526a45
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
sub edx, 1
jno 0x526b2a
call fcn.00403c1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov ecx, 0x527720
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x526a45
inc dword [ebp - 0x30]
dec dword [ebp - 0x4c]
jne 0x5265f5
mov eax, dword [ebp - 4]
add eax, 0x8fc
call fcn.004054b0
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004057c0
je 0x526be6
mov eax, dword [0x5743fc]
cmp byte [eax], 0
je 0x526bab
push 0
push 0
push 0x527768
push dword [ebp - 8]
push 0x52778c
lea eax, [ebp - 0xc0]
mov edx, 3
call fcn.00405778
mov edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6b0]
mov eax, dword [ebp - 4]
call fcn.004e3b44
jmp 0x526bd9
push 0
push 0
lea eax, [ebp - 0xc4]
mov ecx, dword [ebp - 8]
mov edx, 0x5277cc
call fcn.00405708
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6b0]
mov eax, dword [ebp - 4]
call fcn.004e3b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52747e
cmp byte [ebp - 9], 0
je 0x526c39
mov eax, dword [0x5743fc]
cmp byte [eax], 0
je 0x526c12
push 0
push 0
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6b0]
mov edx, 0x527834
mov eax, dword [ebp - 4]
call fcn.004e3b44
jmp 0x526c2c
push 0
push 0
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6b0]
mov edx, 0x527860
mov eax, dword [ebp - 4]
call fcn.004e3b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52747e
mov dl, 1
mov eax, dword [0x41bb08]
call fcn.00403d1c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 1
jno 0x526c60
call fcn.00403c1c
test eax, eax
jl 0x5271ce
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x44]
mov cx, 0x20
mov eax, dword [ebp - 4]
call fcn.004e1310
mov eax, dword [ebp - 0x48]
mov edx, 0x52789c
call fcn.004057c0
jne 0x526cd8
lea ecx, [ebp - 0xc8]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00527cd8
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x5278a8
call fcn.004057c0
je 0x526cf6
mov eax, dword [ebp - 0x48]
mov edx, 0x5278b4
call fcn.004057c0
jne 0x526d23
lea ecx, [ebp - 0xcc]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00527f48
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x5278c8
call fcn.004057c0
jne 0x526d5f
lea ecx, [ebp - 0xd0]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00528b94
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x5278d4
call fcn.004057c0
jne 0x526d9b
lea ecx, [ebp - 0xd4]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.005293a8
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x5278e4
call fcn.004057c0
jne 0x526dd7
lea ecx, [ebp - 0xd8]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.005296f4
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x5278f8
call fcn.004057c0
jne 0x526e13
lea ecx, [ebp - 0xdc]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.005285a8
mov ecx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x52790c
call fcn.004057c0
jne 0x526e53
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00529b68
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527918
call fcn.004057c0
je 0x526e84
mov eax, dword [ebp - 0x48]
mov edx, 0x52792c
call fcn.004057c0
je 0x526e84
mov eax, dword [ebp - 0x48]
mov edx, 0x527940
call fcn.004057c0
jne 0x526fdd
mov eax, dword [ebp - 0x48]
mov edx, 0x527918
call fcn.004057c0
jne 0x526f07
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527954
call fcn.00405708
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0052a738
test al, al
je 0x526f07
mov eax, dword [0x5743fc]
cmp byte [eax], 0
je 0x526ef1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov ecx, 0x527960
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x526f07
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov ecx, 0x5279d8
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0x48]
mov edx, 0x52792c
call fcn.004057c0
jne 0x526f40
lea eax, [ebp - 0xe8]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527a88
call fcn.00405708
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0x48]
mov edx, 0x527940
call fcn.004057c0
jne 0x526f79
lea eax, [ebp - 0xec]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527a94
call fcn.00405708
mov ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 0x30]
call fcn.0040a504
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x28]
call fcn.004b1694
test eax, eax
jge 0x5271c2
mov eax, dword [0x5743fc]
cmp byte [eax], 0
je 0x526fc2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov ecx, 0x527aa0
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov ecx, 0x527ae4
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527b38
call fcn.004057c0
jne 0x52701b
lea eax, [ebp - 0xf4]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527b48
call fcn.00405708
mov ecx, dword [ebp - 0xf4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527b54
call fcn.004057c0
jne 0x527059
lea eax, [ebp - 0xf8]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527b64
call fcn.00405708
mov ecx, dword [ebp - 0xf8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527b70
call fcn.004057c0
jne 0x527097
lea eax, [ebp - 0xfc]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527b80
call fcn.00405708
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527b8c
call fcn.004057c0
jne 0x5270d5
lea eax, [ebp - 0x100]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527b9c
call fcn.00405708
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527ba8
call fcn.004057c0
jne 0x527113
lea eax, [ebp - 0x104]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527bb8
call fcn.00405708
mov ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527bc4
call fcn.004057c0
jne 0x52714e
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527bd8
call fcn.00405708
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527be4
call fcn.004057c0
jne 0x527189
lea eax, [ebp - 0x10c]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527bf4
call fcn.00405708
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x5271c2
mov eax, dword [ebp - 0x48]
mov edx, 0x527c00
call fcn.004057c0
jne 0x5271c2
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x44]
mov edx, 0x527c14
call fcn.00405708
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x20]
inc dword [ebp - 0x30]
dec dword [ebp - 0x4c]
jne 0x526c73
mov eax, dword [ebp - 0x28]
call fcn.00403d4c
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x114]
mov eax, 0x5275f4
call fcn.004059bc
test eax, eax
jne 0x52738e
mov eax, dword [ebp - 4]
add eax, 0x8fc
call fcn.004054b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 1
jno 0x527227
call fcn.00403c1c
test eax, eax
jl 0x52738e
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x118]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov edx, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x48]
call fcn.0040567c
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 4]
add eax, 0x6b0
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x48]
push 0x527c20
push dword [ebp - 0x48]
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.00405778
mov edx, dword [ebp - 0x11c]
mov ecx, 3
mov eax, dword [ebp - 4]
call fcn.004e6bbc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x527382
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x120]
push eax
lea edx, [ebp - 0x48]
mov cx, 0x28
mov eax, dword [ebp - 4]
call fcn.004e1310
push 0
lea eax, [ebp - 0x124]
push eax
lea edx, [ebp - 0x48]
mov cx, 0x29
mov eax, dword [ebp - 4]
call fcn.004e1310
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x48]
call fcn.00405514
mov eax, dword [ebp - 0x48]
xor edx, edx
call fcn.004057c0
je 0x527382
lea ecx, [ebp - 0x128]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 4]
add eax, 0x8fc
call fcn.004054ec
mov eax, dword [0x5743fc]
cmp byte [eax], 0
je 0x52735b
push 0
push 0
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6b0]
mov edx, 0x527c28
mov eax, dword [ebp - 4]
call fcn.004e3b44
jmp 0x527375
push 0
push 0
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6b0]
mov edx, 0x527c58
mov eax, dword [ebp - 4]
call fcn.004e3b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52747e
inc dword [ebp - 0x30]
dec dword [ebp - 0x4c]
jne 0x52723a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5273f3
mov eax, dword [ebp - 4]
add eax, 0x8fc
call fcn.004054b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, 0x6a0
mov ecx, 1
mov edx, dword [0x4df39c]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, 0x6a4
mov ecx, 1
mov edx, dword [0x4df3dc]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, 0x6a8
mov ecx, 1
mov edx, dword [0x4df41c]
call fcn.0040659c
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52755a
lea eax, [ebp - 0x130]
call fcn.00404c88
lea eax, [ebp - 0x12c]
mov edx, 5
call fcn.004054c8
lea eax, [ebp - 0x118]
call fcn.00404c88
lea eax, [ebp - 0x114]
mov edx, 9
call fcn.004054c8
lea eax, [ebp - 0xf0]
call fcn.00404c88
lea eax, [ebp - 0xec]
mov edx, 0xc
call fcn.004054c8
lea eax, [ebp - 0xbc]
call fcn.00404c88
lea eax, [ebp - 0xb8]
mov edx, 3
call fcn.004054c8
lea eax, [ebp - 0xac]
call fcn.00404c88
lea eax, [ebp - 0xa8]
mov edx, 9
call fcn.004054c8
lea eax, [ebp - 0x84]
call fcn.00404c88
lea eax, [ebp - 0x80]
mov edx, 7
call fcn.004054c8
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004054c8
lea eax, [ebp - 0x1c]
call fcn.004054b0
lea eax, [ebp - 0x10]
call fcn.004054b0
lea eax, [ebp - 8]
call fcn.004054b0
ret