Function at 0x4990e0
Capabilities:
Capture webcam image
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536ddd
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x58e5a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], ecx
sub eax, 0
je 0x499803
sub eax, 1
je 0x499413
sub eax, 2
jne 0x499321
mov eax, dword [ebp + 0xc]
cmp eax, 0x200
jne 0x49929b
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
test byte [edi + 0x84], 1
movsx edx, ax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x4c], 0
je 0x499272
mov eax, dword [edi + 4]
push edx
push ecx
mov dword [ebp - 0x50], eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov ecx, dword [ebp - 0x50]
cmp eax, ecx
jne 0x49927f
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x18]
push eax
push 0
push 0x445
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
cmp ecx, dword [0x58e47c]
jne 0x4991c2
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [0x58e480]
je 0x49927f
test eax, eax
js 0x49927f
push dword [edi + 0x44]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov ecx, dword [ebp - 0x50]
cmp ecx, eax
jge 0x49927f
mov eax, dword [edi + 0x88]
cmp ecx, eax
je 0x49927f
cmp eax, 0xffffffff
je 0x49927f
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], 0
push eax
push ecx
push 0x417
push dword [edi + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.USER32.dll_SendMessageW]
test byte [ebp - 0x2c], 4
je 0x49927f
mov eax, dword [ebp - 0x50]
or eax, 0xffff0000
mov dword [edi + 0x8c], eax
mov ecx, dword [edi + 0xc]
sub ecx, 1
jns 0x499236
xor edi, edi
jmp 0x49923c
mov eax, dword [edi + 8]
mov edi, dword [eax + ecx*4]
movzx ecx, word [ebp - 0x14]
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 0x202
push edi
call esi
push 0
push 0x1b
push 0x100
push edi
call esi
mov esi, dword [ebp - 0x54]
mov dword [ebp - 0x4c], 1
jmp 0x49927f
lea eax, [ebp - 0x18]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [0x58e47c], eax
mov dword [0x58e480], ecx
mov dword [esi], 0
jmp 0x499cfb
cmp eax, 0x104
jne 0x49936b
mov eax, dword [ebp + 0x10]
cmp eax, 0x12
jne 0x4992d5
cmp byte [edi + 0x84], 0
jge 0x4992da
mov cl, byte [edi + 0x85]
mov al, cl
and al, 6
cmp al, 2
jne 0x4992da
test cl, 8
je 0x4992da
push 1
mov ecx, edi
call fcn.0049f460
jmp 0x4992da
cmp eax, 0x20
je 0x499340
test byte [edi + 0x84], 1
jne 0x499360
mov eax, dword [edi + 4]
mov dword [ebp - 0x54], eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [ebp - 0x54]
cmp eax, ecx
jne 0x499360
and byte [edi + 0x85], 0xf7
push 0
push 0xffffffffffffffff
push 0x448
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, edi
call fcn.0048f520
or byte [edi + 0x84], 0x40
mov dword [esi], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d2a60
mov esp, ebp
pop ebp
ret 0x18
mov cl, byte [edi + 0x85]
mov al, cl
and al, 6
cmp al, 6
jne 0x499360
or cl, 8
mov byte [edi + 0x85], cl
mov ecx, edi
push 0
call fcn.0049f460
mov eax, dword [ebp + 0x10]
mov dword [edi + 0xa8], eax
jmp 0x49931b
cmp eax, 0x105
jne 0x499386
mov al, byte [edi + 0x85]
test al, 8
jne 0x49931b
or al, 8
mov byte [edi + 0x85], al
jmp 0x49931b
cmp eax, 0x106
jne 0x4993bc
test byte [edi + 0x84], 1
jne 0x49931b
mov eax, dword [edi + 0x20]
cmp eax, dword [edi + 4]
je 0x49931b
cmp dword [ebp + 0x10], 0x20
je 0x49931b
mov dword [esi], 0
mov eax, 1
jmp 0x499323
cmp eax, 0x100
jne 0x4993e3
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 1
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push 0x100
call fcn.00495670
jmp 0x499cf9
cmp eax, 0x213
je 0x4997c7
cmp eax, 0x102
jne 0x499321
cmp dword [ebp + 0x10], 0x1b
mov dword [esi], 0
jne 0x499321
mov eax, 1
jmp 0x499323
mov eax, dword [ebp + 0xc]
cmp eax, 0x4e
jne 0x499551
cmp dword [ecx + 8], 0xfffffd37
jne 0x4994d4
mov eax, dword [ecx]
cmp eax, dword [edi + 4]
jne 0x4994ce
test byte [edi + 0x58], 8
mov byte [ebp - 0x55], 0
jne 0x49945f
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x54]
setne byte [ebp - 0x55]
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x499472
cmp byte [ebp - 0x55], 0
je 0x49948b
mov ecx, dword [ebp - 0x50]
test byte [ecx + 0x14], 1
je 0x49948e
mov dword [esi], 1
mov eax, 1
jmp 0x499323
mov ecx, dword [ebp - 0x50]
mov eax, dword [ecx + 0x14]
test al, 0x85
jne 0x4994ce
test al, 0x10
je 0x4994b2
push dword [edi + 0x44]
push 0
push 0x11f
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ecx + 0x14]
test al, 0x20
je 0x4994ce
push 0
push 0xffff0000
push 0x11f
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x50]
mov dword [esi], 0
cmp dword [ecx + 8], 0xfffffd3a
jne 0x49957f
mov eax, dword [ecx]
cmp eax, dword [edi + 4]
je 0x4994f3
mov dword [esi], 1
jmp 0x49957f
mov eax, dword [edi + 4]
mov dword [ebp - 0x54], eax
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, dword [ebp - 0x54]
cmp eax, edx
je 0x49952e
test byte [edi + 0x58], 4
je 0x499524
cmp dword [edi + 0xac], 0
jne 0x499524
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, dword [edi + 4]
mov dword [edi + 0xac], eax
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [edi + 4]
mov ecx, dword [ebp - 0x50]
push 0
push dword [ecx + 0xc]
push 0x419
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
and byte [edi + 0x84], 0xcf
push 1
push eax
jmp 0x499959
cmp eax, 0x117
jne 0x49957f
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 1
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push 0x117
call fcn.00495960
cmp dword [ebp - 0x4c], 0
mov dword [esi], eax
jne 0x499966
call fcn.0048e7e0
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
jne 0x4995cb
cmp dword [ebp + 0x10], 0
je 0x49959c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4995bd
xor ecx, ecx
lea eax, [edi + 4]
test edi, edi
cmove eax, ecx
mov dword [esi], eax
lea eax, [ecx + 1]
jmp 0x499323
xor eax, eax
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp ecx, 0x112
jne 0x499689
mov eax, dword [edi + 0xa8]
cmp eax, 0x12
je 0x4995fc
cmp eax, 0x79
jne 0x4995f3
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4995fc
cmp dword [edi + 0xa8], 0x20
jne 0x499629
cmp dword [ebp + 0x10], 0xf100
jne 0x499629
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [edi + 4]
jne 0x49963b
mov ecx, edi
call fcn.0048f520
push 0
push 0xffffffffffffffff
push 0x448
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
and byte [edi + 0x84], 0xbf
xor eax, eax
mov dword [esi], eax
test eax, eax
jmp 0x499cff
cmp dword [edi + 0xa8], 0x20
je 0x499629
test byte [edi + 0x84], 0x40
jne 0x499670
mov cl, byte [edi + 0x85]
mov al, cl
and al, 6
cmp al, 2
jne 0x499669
test cl, 8
je 0x499669
push 1
mov ecx, edi
call fcn.0049f460
mov ecx, edi
call fcn.0049fb10
and byte [edi + 0x84], 0xbf
mov eax, 1
mov dword [esi], 0
test eax, eax
jmp 0x499cff
cmp ecx, 0x52e
jne 0x4996a0
mov eax, dword [edi + 0x44]
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp ecx, 0x120
jne 0x4996cb
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp - 0x4c], 1
push 0x120
call fcn.004960a0
jmp 0x499cf9
cmp ecx, 0x52f
jne 0x499709
mov ecx, dword [ebp - 0x50]
test ecx, ecx
je 0x4995bd
cmp dword [ecx], 0x18
jne 0x4995bd
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
mov ecx, edi
call fcn.0049fb40
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp ecx, 0x52d
jne 0x499720
mov eax, dword [edi + 4]
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp ecx, 0x1a
jne 0x499751
mov eax, dword [ebp + 0x10]
cmp eax, 0x2a
je 0x49973f
cmp eax, 0x100b
je 0x49973f
cmp eax, 0x1023
jne 0x4997c7
mov ecx, edi
call fcn.0048ee00
mov dword [esi], 1
jmp 0x499321
cmp ecx, 0x2b
jne 0x499776
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp - 0x4c], 1
push 0x2b
call fcn.00494290
jmp 0x499cf9
cmp ecx, 0x2c
je 0x499cde
cmp ecx, 6
jne 0x4997d2
mov ecx, dword [ebp + 0x10]
mov al, byte [edi + 0x84]
neg cx
sbb cl, cl
and al, 0x7f
and cl, 0x80
or cl, al
mov byte [edi + 0x84], cl
jl 0x4997b1
mov al, byte [edi + 0x85]
and al, 6
cmp al, 6
je 0x4999e0
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [esi], 1
jmp 0x499321
cmp ecx, 0x4e
jne 0x499321
mov ecx, dword [ebp - 0x50]
cmp dword [ecx + 8], 0xfffffff4
jne 0x499321
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 1
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
call fcn.00497250
jmp 0x499cf9
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x499828
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push 1
call fcn.00492770
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp eax, 2
jne 0x49984a
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push 2
call fcn.00493ca0
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp eax, 0x14
jne 0x4998b1
test byte [edi + 0x84], 2
jne 0x4998a6
test byte [edi + 0x58], 1
jne 0x4998a6
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x50], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push dword [edi + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
push 5
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x54]
mov dword [eax], 1
mov eax, 1
jmp 0x499323
mov dword [esi], 0
jmp 0x49994a
cmp eax, 0x116
jne 0x4998ec
push 0
push 0
push 0x447
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [edi + 0x44]
movzx eax, ax
or eax, 0x900000
push eax
push 0x11f
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi], 1
jmp 0x49994a
cmp eax, 0x117
jne 0x499920
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 1
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push 0x117
call fcn.00495960
cmp dword [ebp - 0x4c], 0
mov dword [esi], eax
je 0x49994a
mov eax, 1
jmp 0x499323
cmp eax, 0x11f
jne 0x49994a
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 1
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push 0x11f
call fcn.00496510
cmp dword [ebp - 0x4c], 0
mov dword [esi], eax
jne 0x499966
call fcn.0048e720
cmp dword [ebp + 0xc], eax
jne 0x499970
push 0
push dword [ebp + 0x10]
mov ecx, edi
call fcn.0048aec0
mov dword [esi], 0
mov eax, 1
jmp 0x499323
call fcn.0048e7e0
mov edx, dword [ebp + 0xc]
cmp edx, eax
jne 0x49999b
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push edx
call fcn.00495ff0
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp edx, 0x1a
jne 0x4999bf
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push edx
call fcn.00497820
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp edx, 0x120
je 0x4996a8
cmp edx, 8
jne 0x4999f4
mov al, byte [edi + 0x85]
and al, 6
cmp al, 6
jne 0x4997c7
push 0
mov ecx, edi
call fcn.0049f460
mov dword [esi], 1
jmp 0x499321
cmp edx, 0x100
jne 0x499ad5
mov dl, byte [edi + 0x84]
xor ecx, ecx
test dl, 2
jne 0x4997c7
mov eax, dword [ebp + 0x10]
cmp eax, 0x20
jne 0x499a42
mov ecx, dword [ebp - 0x50]
or ecx, 0x20000000
push ecx
push eax
push 0x104
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esi], 0
mov eax, 1
jmp 0x499323
cmp eax, 0x25
je 0x499a4c
cmp eax, 0x27
jne 0x499ac8
movzx eax, byte [edi + 0x85]
shr eax, 5
not eax
and eax, 2
or eax, 0x25
mov dword [ebp - 0x54], eax
test dl, 1
jne 0x499ac8
push 0
push 0
push 0x447
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x54]
cmp dword [ebp + 0x10], ecx
mov ecx, edi
push eax
jne 0x499a8a
call fcn.0048ea50
jmp 0x499a8f
call fcn.0048eb80
cmp eax, 0xfffffffe
jne 0x499ac6
push 0
push 0xffffffffffffffff
push 0x448
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.0048a720
xor ecx, ecx
mov dword [esi], 0
test al, al
mov eax, 1
cmovne ecx, eax
test ecx, ecx
jmp 0x499cff
xor ecx, ecx
mov dword [esi], 0
test ecx, ecx
jmp 0x499cff
cmp edx, 0x101
jne 0x499b04
test byte [edi + 0x84], 2
jne 0x4997c7
cmp dword [ebp + 0x10], 0x20
mov dword [esi], 0
jne 0x499321
mov eax, 1
jmp 0x499323
cmp edx, 0x102
jne 0x499c3f
test byte [edi + 0x84], 2
jne 0x4997c7
cmp dword [ebp + 0x10], 0x20
je 0x499960
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x49931b
mov eax, dword [edi + 4]
mov dword [ebp - 0x54], eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [ebp - 0x54]
cmp eax, ecx
jne 0x49931b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], 0
cmp eax, 0xd
je 0x499b8d
lea edx, [ebp - 0x50]
movzx eax, ax
push edx
push eax
push 0x45a
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x499b8d
cmp word [ebp + 0x10], 0x2f
je 0x49931b
push eax
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x49931b
lea eax, [ebp - 0x30]
xorps xmm0, xmm0
push eax
push dword [edi + 4]
movups xmmword [ebp - 0x30], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x50]
movups xmmword [ebp - 0x20], xmm0
push 0x41d
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x38], 0
push eax
push dword [ebp - 0x50]
xorps xmm0, xmm0
push 0x417
push dword [edi + 4]
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, byte [ebp - 0x40]
test al, 4
je 0x499c27
test al, 8
jne 0x499c27
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x28]
jg 0x499c27
push 0
push 0x28
push 0x100
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp + 0x10], 0xd
je 0x49931b
push 0
push dword [ebp - 0x50]
push 0x448
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x49931b
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [esi], 0
mov eax, 1
jmp 0x499323
cmp edx, 0x104
je 0x49931b
cmp edx, 0x105
je 0x49931b
cmp edx, 0x106
je 0x49931b
cmp edx, 0x52e
jne 0x499c7a
mov eax, dword [edi + 0x44]
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp edx, 0x52f
jne 0x499ca1
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push edx
call fcn.004918a0
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp edx, 0x52d
jne 0x499cb8
mov eax, dword [edi + 4]
mov dword [esi], eax
mov eax, 1
jmp 0x499323
cmp edx, 0x2b
jne 0x499cd9
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp - 0x4c], 1
push edx
call fcn.00494290
jmp 0x499cf9
cmp edx, 0x2c
jne 0x499d0f
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push ecx
push dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp - 0x4c], 1
push 0x2c
call fcn.00496020
mov dword [esi], eax
cmp dword [ebp - 0x4c], 0
je 0x499321
mov eax, 1
jmp 0x499323
cmp edx, 0x37f
jne 0x499321
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + 4]
lea eax, [edx - 0x200]
cmp eax, 0xe
ja 0x499d35
and byte [edi + 0x85], 0xef
jmp 0x499d47
lea eax, [edx - 0x100]
cmp eax, 9
ja 0x499d47
or byte [edi + 0x85], 0x10
mov eax, dword [edi]
lea edx, [ebp - 0x54]
push 3
push edx
push dword [ecx + 0xc]
mov dword [ebp - 0x54], 0
push dword [ecx + 8]
push dword [ecx + 4]
push dword [ecx]
mov ecx, edi
call dword [eax]
mov eax, dword [ebp - 0x54]
mov dword [esi], eax
mov eax, 1
jmp 0x499323