Function at 0x433650
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x178
mov eax, dword [0x4fc00c]
xor eax, esp
mov dword [esp + 0x174], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push str.tx_levelup_uia
push str.tx_levelup_ui
mov dword [esp + 0x20], edi
call fcn.0043add0
mov ecx, eax
call fcn.0043b1a0
mov word [edi + 2], ax
test ax, ax
jne 0x4336bf
push str.ui_guide_load_failed
push 0x200
push esi
call fcn.00483128
add esp, 0xc
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x174]
xor ecx, esp
call fcn.0047d312
mov esp, ebp
pop ebp
ret 4
call fcn.004288e0
mov ecx, eax
call fcn.00428c20
movzx eax, ax
mov dword [esp + 0x10], eax
call fcn.004288e0
mov dword [esp + 0x2c], eax
call fcn.0043add0
push 0
push 0x1c
push ecx
push 1
push 0x800
push 0x800
push 0
mov ecx, eax
call fcn.0043b090
movzx eax, ax
mov dword [esp + 0x24], eax
test ax, ax
jne 0x433736
push str.create_texture_failed
push 0x200
push esi
call fcn.00483128
xor eax, eax
add esp, 0xc
mov word [edi], ax
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x174]
xor ecx, esp
call fcn.0047d312
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x2c]
push esi
push dword [esp + 0x14]
push eax
call fcn.00428aa0
test al, al
jne 0x433766
xor eax, eax
mov word [edi], ax
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x174]
xor ecx, esp
call fcn.0047d312
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x24]
mov ecx, edi
mov word [edi], ax
call fcn.00432b90
movss xmm0, dword [0x4f4134]
mov eax, 0xff
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x144], ax
lea eax, [esp + 0x160]
movss dword [esp + 0x28], xmm0
xorps xmm0, xmm0
push eax
sub esp, 8
mov byte [esp + 0x23], 0
movups xmmword [esp + 0x154], xmm0
mov dword [esp + 0x28], 0xff
movups xmmword [esp + 0x164], xmm0
movsd xmm0, qword [0x4f3d98]
movsd qword [esp], xmm0
call fcn.004c0b10
add esp, 0xc
xorps xmm0, xmm0
xor eax, eax
movsd qword [esp + 0x150], xmm0
fstp qword [esp + 0x158]
mov word [esp + 0x144], ax
call fcn.0041c1a0
cmp byte [eax + 0xe], 0
je 0x433808
mov byte [eax + 0xe], 0
mov dword [eax + 0x14], 0x3caaaaab
call fcn.0041c1a0
mov dword [eax + 8], 1
call fcn.00420dc0
cmp byte [eax + 0x62], 0
mov eax, dword fs:[0x2c]
mov dword [esp + 0x24], eax
jne 0x43419b
movsd xmm0, qword [0x4f3d58]
mov eax, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esp + 0x30], eax
movsd qword [esp + 0x98], xmm0
call fcn.00420dc0
mov esi, eax
mov al, byte [esi + 0x61]
test al, 0xf0
je 0x433885
movzx ecx, al
and ecx, 0xf
push ecx
mov ecx, 0x4fe450
call fcn.00440a60
movzx eax, word [0x4fe456]
push ecx
push eax
movzx eax, word [0x4fe454]
mov ecx, 0x4fe450
push eax
call fcn.004407c0
mov byte [esi + 0x61], 0
cmp byte [esi + 0x60], 0
jne 0x43389d
call fcn.00423ed0
lea ecx, [eax + 8]
call fcn.00445df0
jmp 0x434188
call fcn.0041c1a0
mov ecx, eax
call fcn.0041c290
call fcn.0042dc50
mov esi, eax
xor edx, edx
cmp byte [esi + 0x474], dl
jbe 0x4338e3
xor ecx, ecx
nop dword [eax]
mov eax, dword [esi + 0x470]
lea ecx, [ecx + 0x260]
xor edi, edi
inc edx
mov word [eax + ecx - 0xc], di
movzx eax, byte [esi + 0x474]
cmp edx, eax
jl 0x4338c0
mov edi, dword [esp + 0x18]
call dword [esp + 0x30]
movsd xmm0, qword [esp + 0x158]
addsd xmm0, qword [esp + 0x150]
movsd xmm1, qword [esp + 0x98]
mov dword [esp + 0x140], eax
xor eax, eax
comisd xmm0, xmm1
movsd qword [esp + 0x150], xmm0
jb 0x43392c
subsd xmm0, xmm1
mov eax, 1
movsd qword [esp + 0x150], xmm0
movd xmm0, eax
mov eax, dword [edi + 0xcd0]
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [esp + 0x160]
movsd qword [esp + 0x148], xmm0
test eax, eax
jne 0x4339f1
call fcn.0041c1a0
cmp byte [eax + 0x20], 0
jne 0x433a81
mov ecx, dword [esp + 0x20]
test cx, cx
jns 0x4339db
add ecx, 6
xor edx, edx
test cx, cx
movzx eax, cx
cmovle edx, eax
movzx ecx, dx
mov dword [esp + 0x20], ecx
test cx, cx
jg 0x433a81
mov cl, byte [edi + 0x2b4]
movsx eax, cl
imul eax, eax, 0x4c
mov dword [esp + 0x34], 0x43480000
mov dword [esp + 0x38], 0x43820000
cmp byte [eax + edi + 0x40], 0
jne 0x4339b5
mov dword [esp + 0x38], 0x43480000
lea edx, [esp + 0x34]
add eax, 0xc
push edx
add eax, edi
push eax
push ecx
lea ecx, [edi + 0x264]
call fcn.0041f680
mov dword [edi + 0xcd0], 1
jmp 0x433a81
jle 0x43398a
sub ecx, 6
mov dword [esp + 0x20], ecx
test cx, cx
jns 0x433984
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x43398a
cmp eax, 1
jne 0x433a5f
lea eax, [esp + 0x3c]
push eax
call fcn.0041e7c0
mov ecx, eax
call fcn.0041def0
mov ecx, edi
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xb8], eax
lea eax, [esp + 0xa0]
push eax
movq qword [esp + 0xb4], xmm0
call fcn.00433010
test al, al
jne 0x433a81
call fcn.0041c1a0
cmp byte [eax + 0xe], 1
je 0x433a53
mov byte [eax + 0xe], 1
mov dword [eax + 0x14], 0x3cd79436
mov dword [edi + 0xcd0], 2
jmp 0x433a81
cmp eax, 2
jne 0x433a81
call fcn.0041c1a0
cmp byte [eax + 0x20], 0
jne 0x433a81
mov al, byte [esp + 0x17]
inc al
mov byte [esp + 0x17], al
cmp al, 0x14
ja 0x434197
call fcn.0041c1a0
cmp byte [eax + 0x20], 0
jne 0x433ac2
mov eax, dword [esp + 0x1c]
cmp ax, 0x40
jge 0x433aad
add eax, 3
mov dword [esp + 0x1c], eax
cmp ax, 0x40
jle 0x433ac2
mov dword [esp + 0x1c], 0x40
jmp 0x433ac2
jle 0x433ac2
sub eax, 3
mov ecx, 0x40
cmp ax, 0x40
cmovl eax, ecx
mov dword [esp + 0x1c], eax
cmp dword [edi + 0xcd0], 0
je 0x433b68
movss xmm1, dword [esp + 0x28]
movss xmm2, dword [0x4f3e50]
comiss xmm2, xmm1
jbe 0x433af6
movaps xmm0, xmm1
movaps xmm1, xmm2
addss xmm0, dword [0x4f3d88]
minss xmm1, xmm0
jmp 0x433b0d
comiss xmm1, xmm2
jbe 0x433b13
movaps xmm0, xmm1
movaps xmm1, xmm2
subss xmm0, dword [0x4f3d88]
maxss xmm1, xmm0
movss dword [esp + 0x28], xmm1
mov dword [esp + 0x2c], 0
xor esi, esi
mov dword [esp + 0x10], 8
lea ecx, [esi + 4]
add ecx, edi
call fcn.0041eb70
movsx eax, byte [edi + 0x2b4]
lea esi, [esi + 0x4c]
mov edx, dword [esp + 0x2c]
mov ecx, 0xff
cmp eax, edx
mov eax, 0xa0
cmovne ecx, eax
inc edx
sub dword [esp + 0x10], 1
mov word [edi + esi - 0x18], cx
mov dword [esp + 0x2c], edx
jne 0x433b25
lea ecx, [edi + 0x264]
call fcn.0041f7c0
cmp byte [edi + 0x2b8], 0
lea esi, [edi + 0x2b8]
movzx eax, word [esi + 2]
je 0x433bd4
mov ecx, 0xff
cmp ax, cx
jge 0x433b93
add eax, 8
mov word [esi + 2], ax
cmp ax, cx
jle 0x433ba5
jmp 0x433ba1
jle 0x433ba5
add eax, 0xfffffff8
mov word [esi + 2], ax
cmp ax, cx
jge 0x433ba5
mov word [esi + 2], cx
movzx eax, word [esi + 4]
cmp ax, cx
jge 0x433bc0
add eax, 8
mov word [esi + 4], ax
cmp ax, cx
jle 0x433c26
mov word [esi + 4], cx
jmp 0x433c26
jle 0x433c26
add eax, 0xfffffff8
mov word [esi + 4], ax
cmp ax, cx
jge 0x433c26
mov word [esi + 4], cx
jmp 0x433c26
test ax, ax
jns 0x433be7
add eax, 6
mov word [esi + 2], ax
test ax, ax
jle 0x433bfb
jmp 0x433bf5
jle 0x433bfb
add eax, 0xfffffffa
mov word [esi + 2], ax
test ax, ax
jns 0x433bfb
xor eax, eax
mov word [esi + 2], ax
movzx eax, word [esi + 4]
test ax, ax
jns 0x433c12
add eax, 6
mov word [esi + 4], ax
test ax, ax
jle 0x433c26
jmp 0x433c20
jle 0x433c26
add eax, 0xfffffffa
mov word [esi + 4], ax
test ax, ax
jns 0x433c26
xor eax, eax
mov word [esi + 4], ax
call fcn.00420dc0
cmp byte [eax + 0xc], 0
je 0x433c83
mov ax, word [esp + 0x144]
test ax, ax
je 0x433c83
mov esi, dword [esp + 0x30]
mov ecx, 0xffff
add ax, cx
mov word [esp + 0x144], ax
call esi
sub eax, dword [esp + 0x140]
movsd xmm0, qword [esp + 0x148]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x4f44f0]
comisd xmm0, xmm1
ja 0x433c52
jmp 0x434188
mov eax, dword [0x4fe4d8]
movaps xmm0, xmmword [0x4f44a0]
push 0x4fe554
movups xmmword [esp + 0x170], xmm0
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x54]
mov eax, dword [0x4fe4d8]
push 0x4fe56c
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [0x4fe490]
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov eax, dword [eax*4 + 0x4fe498]
mov dword [esp + 0x48], eax
mov eax, dword [0x4fe4d8]
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 4
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x68]
mov eax, dword [0x4fe4d8]
push 0
push 0
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 3
push dword [0x4fe4c8]
push eax
call dword [ecx + 0xbc]
mov ecx, dword [0x4fe4d8]
lea eax, [esp + 0x16c]
push 0
push 0
push eax
mov eax, dword [0x4fe490]
mov edx, dword [ecx]
push dword [eax*4 + 0x4fe4ac]
push ecx
call dword [edx + 0xc0]
mov eax, dword [0x4fe490]
lea edx, [esp + 0x168]
push 0x4fe4c8
push 1
push edx
mov eax, dword [eax*4 + 0x4fe4ac]
mov dword [esp + 0x174], eax
mov eax, dword [0x4fe4d8]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb8]
mov eax, dword [esp + 0x1c]
movsx ecx, ax
mov eax, ecx
mov dword [esp + 0x10], ecx
or eax, 0xffffff00
shl eax, 8
or eax, ecx
shl eax, 8
or eax, ecx
push eax
sub esp, 0x18
mov dword [esp + 0x14], 0x3eb40000
mov dword [esp + 0x10], 0x3f070000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44340000
mov dword [esp], 0x44870000
push 3
call fcn.0042dc50
movss xmm2, dword [0x4f3f7c]
xorps xmm3, xmm3
mov ecx, eax
call fcn.0042ed20
push 0xffffffffffffffff
sub esp, 0x18
mov dword [esp + 0x14], 0x3d800000
mov dword [esp + 0x10], 0x3e980000
mov dword [esp + 0xc], 0x3d400000
mov dword [esp + 8], 0x3f020000
mov dword [esp + 4], 0x42800000
mov dword [esp], 0x43980000
push 2
call fcn.0042dc50
movss xmm3, dword [esp + 0x48]
mov ecx, eax
movss xmm2, dword [0x4f400c]
call fcn.0042ed20
lea esi, [edi + 4]
mov edi, 8
nop dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax]
add esi, 0x4c
sub edi, 1
jne 0x433e40
mov edi, dword [esp + 0x18]
push 2
lea ecx, [edi + 0x264]
call fcn.0041f980
sub esp, 8
lea ecx, [edi + 0x2b8]
call fcn.004326d0
movzx esi, word [edi]
mov edi, dword [0x4fe4d8]
call fcn.0042dc50
mov edx, eax
lea ecx, [esp + 0x58]
lea eax, [esp + 0x100]
push eax
call fcn.0044d350
push ecx
push esi
mov eax, ecx
mov dword [esp + 0x9c], 0x3f800000
push eax
push 3
push 7
push edi
mov ecx, edx
mov dword [esp + 0x98], 0x3f800000
mov dword [esp + 0x84], 0x3f800000
mov dword [esp + 0x70], 0x3f800000
call fcn.0042f110
mov eax, dword [esp + 0x18]
mov edi, dword [0x4fe4d8]
movzx esi, word [eax + 2]
call fcn.0042dc50
mov edx, eax
lea ecx, [esp + 0x58]
lea eax, [esp + 0xc0]
push eax
call fcn.0044d350
push ecx
push esi
mov eax, ecx
mov dword [esp + 0x9c], 0x3f800000
push eax
push 2
push 7
push edi
mov ecx, edx
mov dword [esp + 0x98], 0x3f800000
mov dword [esp + 0x84], 0x3f800000
mov dword [esp + 0x70], 0x3f800000
call fcn.0042f110
mov esi, dword [0x4fe4d8]
call fcn.00420dc0
movzx eax, byte [eax + 4]
cmp dword [eax*4 + 0x4eec58], 0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov eax, dword [0x502d74]
je 0x433fb5
cmp eax, dword [ecx + 4]
jle 0x433faa
push 0x502d74
call fcn.0047d453
add esp, 4
cmp dword [0x502d74], 0xffffffff
jne 0x433faa
movaps xmm0, xmmword [0x4f44c0]
xor eax, eax
push 0x4c83f0
mov dword [0x502d54], eax
mov dword [0x502d60], eax
mov dword [0x502d58], eax
mov dword [0x502d5c], eax
movups xmmword [0x502d64], xmm0
call fcn.0047d765
add esp, 4
push 0x502d74
call fcn.0047d409
add esp, 4
movzx eax, word [0x502d54]
push 0
jmp 0x43401c
cmp eax, dword [ecx + 4]
jle 0x434011
push 0x502d74
call fcn.0047d453
add esp, 4
cmp dword [0x502d74], 0xffffffff
jne 0x434011
movaps xmm0, xmmword [0x4f44c0]
xor eax, eax
push 0x4c83f0
mov dword [0x502d54], eax
mov dword [0x502d60], eax
mov dword [0x502d58], eax
mov dword [0x502d5c], eax
movups xmmword [0x502d64], xmm0
call fcn.0047d765
add esp, 4
push 0x502d74
call fcn.0047d409
add esp, 4
push 0
call fcn.00443770
movzx eax, word [eax + 0x2e]
push eax
push 4
push esi
call fcn.0042dc50
mov ecx, eax
call fcn.0042f2b0
mov esi, dword [esp + 0x20]
test si, si
je 0x4340fa
mov ecx, dword [esp + 0x10]
movsx eax, si
shl eax, 8
or eax, ecx
shl eax, 8
or eax, ecx
shl eax, 8
or eax, ecx
push eax
sub esp, 0x18
mov dword [esp + 0x14], 0x3eb40000
mov dword [esp + 0x10], 0x3f070000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44340000
mov dword [esp], 0x44870000
push 5
call fcn.0042dc50
movss xmm2, dword [0x4f3f7c]
xorps xmm3, xmm3
mov ecx, eax
call fcn.0042ed20
mov eax, dword [esp + 0x18]
mov edi, dword [0x4fe4d8]
movzx esi, word [eax]
call fcn.0042dc50
mov edx, eax
lea ecx, [esp + 0x58]
lea eax, [esp + 0xc0]
push eax
call fcn.0044d350
push ecx
push esi
mov eax, ecx
mov dword [esp + 0x9c], 0x3f800000
push eax
push 5
push 7
push edi
mov ecx, edx
mov dword [esp + 0x98], 0x3f800000
mov dword [esp + 0x84], 0x3f800000
mov dword [esp + 0x70], 0x3f800000
call fcn.0042f110
push dword [0x4fe4d8]
call fcn.0041c1a0
mov ecx, eax
call fcn.0041c3a0
push 0
mov ecx, 0x4fe450
call fcn.004404e0
mov esi, dword [esp + 0x30]
call esi
sub eax, dword [esp + 0x140]
movsd xmm1, qword [esp + 0x148]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f44f0]
comisd xmm1, xmm0
ja 0x434158
divsd xmm0, xmm1
cvttsd2si eax, xmm0
mov word [esp + 0x144], ax
call esi
sub eax, dword [esp + 0x140]
movsd xmm0, qword [esp + 0x148]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x4f44f0]
comisd xmm0, xmm1
ja 0x434158
mov edi, dword [esp + 0x18]
call fcn.00420dc0
cmp byte [eax + 0x62], 0
je 0x433847
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov eax, dword [0x502e88]
cmp eax, dword [ecx + 4]
jle 0x4341f5
push 0x502e88
call fcn.0047d453
add esp, 4
cmp dword [0x502e88], 0xffffffff
jne 0x4341f5
push 0x6028
push 0
push 0x502e90
call fcn.0047ebc0
add esp, 0xc
mov byte [0x502e9c], 0
push 0x4c8500
call fcn.0047d765
add esp, 4
push 0x502e88
call fcn.0047d409
add esp, 4
mov ecx, 0x502e90
call fcn.00420060
call fcn.00442700
mov esi, eax
mov dword [esp + 0x10], 0
cmp byte [esi + 0x2f8], 0
jbe 0x43424e
xor edi, edi
nop dword [eax]
mov ecx, dword [esi + 0x2f4]
push 1
push esi
add ecx, edi
call fcn.004466b0
mov ecx, dword [esp + 0x10]
add edi, 0x260
movzx eax, byte [esi + 0x2f8]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x434220
mov edi, dword [esp + 0x18]
call fcn.0042dc50
mov esi, eax
mov dword [esp + 0x10], 0
cmp byte [esi + 0x474], 0
jbe 0x43429e
xor edi, edi
nop dword [eax + eax]
mov ecx, dword [esi + 0x470]
push 1
push esi
add ecx, edi
call fcn.004466b0
mov ecx, dword [esp + 0x10]
add edi, 0x260
movzx eax, byte [esi + 0x474]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x434270
mov edi, dword [esp + 0x18]
movzx eax, word [edi]
push eax
call fcn.0043add0
mov ecx, eax
call fcn.0043af50
movzx eax, word [edi + 2]
push eax
call fcn.0043add0
mov ecx, eax
call fcn.0043af50
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor eax, eax
mov dword [edi], eax
nop dword [eax]
push 0x1b
call esi
cwde
test eax, 0x10000
jne 0x4342d0
mov ecx, dword [esp + 0x17c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0047d312
mov esp, ebp
pop ebp
ret 4