Function at 0x46fa00
Capabilities:
Check os version
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1f4
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x7d
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0x1a4], 0
call fcn.00475590
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x1a8], ecx
push 0xff
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x1a8]
call dword [sym.imp.USER32.dll_GetClassNameA]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov byte [ebp + eax - 0x108], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [0x55d674], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov dword [0x55d678], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov dword [0x55d67c], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
mov dword [0x55d680], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
mov dword [0x55d684], edx
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov dword [0x55d688], ebx
mov dword [0x55d68c], edx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
je 0x46fadf
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x104
je 0x46fadf
mov al, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x1b8], ecx
cmp dword [ebp - 0x1b8], 0xff
jne 0x46fb00
mov al, 0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
call fcn.004aceb0
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x10c], 0
cmp dword [ebp - 0x1bc], 0
jne 0x46fb55
cmp dword [ebp - 0x1b8], 0xa6
jl 0x46fb55
cmp dword [ebp - 0x1b8], 0xb7
jg 0x46fb55
mov bl, 0
cmp dword [ebp - 0x10c], 0
je 0x46fb4c
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
test dword [ebp - 0x1bc], 0x1000
je 0x46fbfa
mov dword [ebp - 0x130], 0
push 0x55d790
call fcn.0040e8d0
pop ecx
push eax
push 0x55d790
lea ecx, [ebp - 0x130]
call fcn.0040cb20
cmp dword [ebp - 0x130], 0
je 0x46fba3
mov ebx, dword [ebp - 0x130]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x134], 0
je 0x46fbe6
mov ecx, dword [ebp - 0x134]
call fcn.0040c8f0
cmp dword [ebp - 0x130], 0
je 0x46fbfa
mov ecx, dword [ebp - 0x130]
call fcn.0040c8f0
test dword [ebp - 0x1bc], 0x200
je 0x46fc9f
mov dword [ebp - 0x138], 0
push 0x55d796
call fcn.0040e8d0
pop ecx
push eax
push 0x55d796
lea ecx, [ebp - 0x138]
call fcn.0040cb20
cmp dword [ebp - 0x138], 0
je 0x46fc48
mov ebx, dword [ebp - 0x138]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x13c], 0
je 0x46fc8b
mov ecx, dword [ebp - 0x13c]
call fcn.0040c8f0
cmp dword [ebp - 0x138], 0
je 0x46fc9f
mov ecx, dword [ebp - 0x138]
call fcn.0040c8f0
test dword [ebp - 0x1bc], 0x800
je 0x46fd66
mov dword [ebp - 0x140], 0
push 0x55d789
call fcn.0040e8d0
pop ecx
push eax
push 0x55d789
lea ecx, [ebp - 0x140]
call fcn.0040cb20
cmp dword [ebp - 0x140], 0
je 0x46fced
mov ebx, dword [ebp - 0x140]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x144], 0
je 0x46fd30
mov ecx, dword [ebp - 0x144]
call fcn.0040c8f0
cmp dword [ebp - 0x140], 0
je 0x46fd44
mov ecx, dword [ebp - 0x140]
call fcn.0040c8f0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 5
jb 0x46fd66
push 0
push 0x20002
push 0x127
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ax, word [ebp - 0x1bc]
mov word [0x5661f4], ax
cmp dword [ebp - 0x1b8], 0x70
jl 0x46fe77
cmp dword [ebp - 0x1b8], 0x87
jg 0x46fe77
mov dword [ebp - 0x148], 0
push 0x55d79d
call fcn.0040e8d0
pop ecx
push eax
push 0x55d79d
lea ecx, [ebp - 0x148]
call fcn.0040cb20
cmp dword [ebp - 0x148], 0
je 0x46fdce
mov ebx, dword [ebp - 0x148]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x14c], 0
je 0x46fe11
mov ecx, dword [ebp - 0x14c]
call fcn.0040c8f0
cmp dword [ebp - 0x148], 0
je 0x46fe25
mov ecx, dword [ebp - 0x148]
call fcn.0040c8f0
mov edx, dword [ebp - 0x1b8]
add edx, 0xffffffc1
movsx eax, dl
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.0040df10
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x150], 0
je 0x4702f9
mov ecx, dword [ebp - 0x150]
call fcn.0040c8f0
jmp 0x4702f9
cmp dword [ebp - 0x1b8], 0x1b
jne 0x46ff22
mov dword [ebp - 0x154], 0
push 0x55d79f
call fcn.0040e8d0
pop ecx
push eax
push 0x55d79f
lea ecx, [ebp - 0x154]
call fcn.0040cb20
cmp dword [ebp - 0x154], 0
je 0x46fec2
mov ebx, dword [ebp - 0x154]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x158], 0
je 0x46ff05
mov ecx, dword [ebp - 0x158]
call fcn.0040c8f0
cmp dword [ebp - 0x154], 0
je 0x4702f9
mov ecx, dword [ebp - 0x154]
call fcn.0040c8f0
jmp 0x4702f9
cmp dword [ebp - 0x1b8], 8
jne 0x46ffcd
mov dword [ebp - 0x15c], 0
push 0x55d7a3
call fcn.0040e8d0
pop ecx
push eax
push 0x55d7a3
lea ecx, [ebp - 0x15c]
call fcn.0040cb20
cmp dword [ebp - 0x15c], 0
je 0x46ff6d
mov ebx, dword [ebp - 0x15c]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x160], 0
je 0x46ffb0
mov ecx, dword [ebp - 0x160]
call fcn.0040c8f0
cmp dword [ebp - 0x15c], 0
je 0x4702f9
mov ecx, dword [ebp - 0x15c]
call fcn.0040c8f0
jmp 0x4702f9
cmp dword [ebp - 0x1b8], 9
jne 0x470078
mov dword [ebp - 0x164], 0
push 0x55d7a7
call fcn.0040e8d0
pop ecx
push eax
push 0x55d7a7
lea ecx, [ebp - 0x164]
call fcn.0040cb20
cmp dword [ebp - 0x164], 0
je 0x470018
mov ebx, dword [ebp - 0x164]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x168], 0
je 0x47005b
mov ecx, dword [ebp - 0x168]
call fcn.0040c8f0
cmp dword [ebp - 0x164], 0
je 0x4702f9
mov ecx, dword [ebp - 0x164]
call fcn.0040c8f0
jmp 0x4702f9
cmp dword [ebp - 0x1b8], 0xc
jne 0x470123
mov dword [ebp - 0x16c], 0
push 0x55d7ab
call fcn.0040e8d0
pop ecx
push eax
push 0x55d7ab
lea ecx, [ebp - 0x16c]
call fcn.0040cb20
cmp dword [ebp - 0x16c], 0
je 0x4700c3
mov ebx, dword [ebp - 0x16c]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x170], 0
je 0x470106
mov ecx, dword [ebp - 0x170]
call fcn.0040c8f0
cmp dword [ebp - 0x16c], 0
je 0x4702f9
mov ecx, dword [ebp - 0x16c]
call fcn.0040c8f0
jmp 0x4702f9
cmp dword [ebp - 0x1b8], 0xd
jne 0x4701ce
mov dword [ebp - 0x174], 0
push 0x55d7af
call fcn.0040e8d0
pop ecx
push eax
push 0x55d7af
lea ecx, [ebp - 0x174]
call fcn.0040cb20
cmp dword [ebp - 0x174], 0
je 0x47016e
mov ebx, dword [ebp - 0x174]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x178], 0
je 0x4701b1
mov ecx, dword [ebp - 0x178]
call fcn.0040c8f0
cmp dword [ebp - 0x174], 0
je 0x4702f9
mov ecx, dword [ebp - 0x174]
call fcn.0040c8f0
jmp 0x4702f9
cmp dword [ebp - 0x1b8], 0x20
jl 0x47028c
cmp dword [ebp - 0x1b8], 0x2f
jg 0x47028c
mov edx, dword [ebp - 0x1b8]
add edx, 0xffffffe0
mov ebx, dword [edx*4 + 0x55d690]
mov dword [ebp - 0x17c], 0
cmp ebx, 0
je 0x470233
push ebx
call fcn.0040e8d0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x17c]
call fcn.0040cb20
cmp dword [ebp - 0x17c], 0
je 0x470233
mov ebx, dword [ebp - 0x17c]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.0040dcb0
add esp, 0xc
lea eax, [ebp - 0x180]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x180], 0
je 0x470276
mov ecx, dword [ebp - 0x180]
call fcn.0040c8f0
cmp dword [ebp - 0x17c], 0
je 0x4702f9
mov ecx, dword [ebp - 0x17c]
call fcn.0040c8f0
jmp 0x4702f9
test dword [ebp - 0x1bc], 0x200
je 0x47029c
mov dl, 1
jmp 0x47029e
mov dl, 0
movzx eax, dl
push eax
push dword [ebp - 0x1b8]
call fcn.004a7950
pop ecx
pop ecx
mov byte [ebp - 0x1be], al
movsx eax, byte [ebp - 0x1be]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.0040df10
add esp, 0xc
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x184], 0
je 0x4702f9
mov ecx, dword [ebp - 0x184]
call fcn.0040c8f0
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0046d850
pop ecx
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 0x1bf], 0
cmp dword [ebp - 0x1a4], 0
je 0x470337
mov edx, dword [ebp - 0x1a4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x1b8]
cmp al, 0
setne dl
mov byte [ebp - 0x1bf], dl
mov eax, dword [0x55d6d0]
mov dword [ebp - 0x1b0], eax
jmp 0x4707f3
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 0x1b0]
mov ebx, dword [eax]
mov dword [edx], ebx
mov eax, dword [ebp - 0x1b0]
mov ebx, dword [eax + 4]
mov dword [edx + 4], ebx
mov eax, dword [ebp - 0x1b0]
mov ebx, dword [eax + 8]
mov dword [edx + 8], ebx
mov eax, dword [ebp - 0x1b0]
mov ebx, dword [eax + 0xc]
mov dword [edx + 0xc], ebx
cmp dword [edx + 0xc], 0
je 0x470386
mov edx, dword [edx + 0xc]
inc dword [edx]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x11c]
add ecx, 0xc
call fcn.0040e1a0
cmp eax, 0
jne 0x4707d1
cmp dword [ebp - 0x114], 0
jne 0x470454
push 0
movzx eax, byte [ebp - 0x1bf]
push eax
call fcn.00473ad0
pop ecx
pop ecx
push 0
mov edx, dword [ebp - 0x118]
and edx, 0xffff
movzx edx, dx
push edx
mov edx, dword [ebp - 0x118]
shr edx, 0x10
movzx edx, dx
push edx
call dword [sym.imp.USER32.dll_GetMenuState]
mov dword [ebp - 0x1c4], eax
test dword [ebp - 0x1c4], 1
jne 0x47044f
mov edx, dword [ebp - 0x118]
and edx, 0xffff
movzx edx, dx
push edx
movzx eax, byte [ebp - 0x1bf]
push eax
call fcn.004732f0
pop ecx
pop ecx
cmp al, 0
je 0x47044f
mov bl, 1
cmp dword [ebp - 0x110], 0
je 0x470432
mov ecx, dword [ebp - 0x110]
call fcn.0040c8f0
cmp dword [ebp - 0x10c], 0
je 0x470446
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
jmp 0x4707d1
cmp dword [ebp - 0x114], 1
jne 0x470530
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
je 0x47052b
push 0x55d708
push dword [ebp - 0x1cc]
call dword [sym.imp.USER32.dll_GetPropA]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
je 0x47052b
push dword [ebp - 0x1c8]
call fcn.004993d0
pop ecx
push eax
call fcn.0046d8a0
pop ecx
cmp al, 0
je 0x47052b
mov eax, dword [ebp - 0x1c8]
cmp byte [eax + 0x3e], 0
je 0x47052b
mov eax, dword [ebp - 0x1c8]
cmp byte [eax + 0x3c], 0
je 0x47052b
mov eax, dword [ebp - 0x1c8]
cmp byte [eax + 0x3d], 0
je 0x47052b
mov ecx, dword [ebp - 0x1c8]
call fcn.0049b510
push 0
mov edx, dword [ebp - 0x1c8]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x1b0]
mov bl, 1
cmp dword [ebp - 0x110], 0
je 0x47050e
mov ecx, dword [ebp - 0x110]
call fcn.0040c8f0
cmp dword [ebp - 0x10c], 0
je 0x470522
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
jmp 0x4707d1
cmp dword [ebp - 0x114], 3
jne 0x4705f2
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
je 0x4705ed
mov eax, dword [ebp - 0x1d0]
push dword [eax + 0x20]
call fcn.004993d0
pop ecx
push eax
call fcn.0046d8a0
pop ecx
cmp al, 0
je 0x4705ed
mov eax, dword [ebp - 0x1d0]
mov edx, dword [eax + 0x20]
cmp byte [edx + 0x3e], 0
je 0x4705ed
mov eax, dword [ebp - 0x1d0]
mov edx, dword [eax + 0x20]
cmp byte [edx + 0x3c], 0
je 0x4705ed
mov eax, dword [ebp - 0x1d0]
mov edx, dword [eax + 0x20]
cmp byte [edx + 0x3d], 0
je 0x4705ed
push 0
push 0
push 0
mov eax, dword [ebp - 0x1d0]
mov edx, dword [eax + 0x20]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x24]
call fcn.00475600
mov bl, 1
cmp dword [ebp - 0x110], 0
je 0x4705d0
mov ecx, dword [ebp - 0x110]
call fcn.0040c8f0
cmp dword [ebp - 0x10c], 0
je 0x4705e4
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
jmp 0x4707d1
mov eax, dword [ebp - 0x114]
and eax, 0xffffffff
cmp ax, 2
jne 0x470742
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
je 0x47073d
push 0x55d708
push dword [ebp - 0x1d4]
call dword [sym.imp.USER32.dll_GetPropA]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
je 0x47073d
push dword [ebp - 0x1d8]
call fcn.004993d0
pop ecx
push eax
call fcn.0046d8a0
pop ecx
cmp al, 0
je 0x47073d
mov eax, dword [ebp - 0x1d8]
cmp byte [eax + 0x3e], 0
je 0x47073d
mov eax, dword [ebp - 0x1d8]
cmp byte [eax + 0x3c], 0
je 0x47073d
mov eax, dword [ebp - 0x1d8]
cmp byte [eax + 0x3d], 0
je 0x47073d
push 0
push 0
push 0x130b
push dword [ebp - 0x1d4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x114]
shr edx, 0x10
movzx edx, dx
cmp edx, eax
je 0x47073d
mov ecx, dword [ebp - 0x1d8]
call fcn.0049b510
push 0
mov edx, dword [ebp - 0x114]
shr edx, 0x10
movzx edx, dx
push edx
push 0x130c
push dword [ebp - 0x1d4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x1d8]
cmp dword [eax + 0x1ec], 0
je 0x47070a
push dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x1d8]
mov edx, dword [eax + 0x1ec]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi]
mov bl, 1
cmp dword [ebp - 0x110], 0
je 0x470720
mov ecx, dword [ebp - 0x110]
call fcn.0040c8f0
cmp dword [ebp - 0x10c], 0
je 0x470734
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
jmp 0x4707d1
cmp dword [ebp - 0x114], 4
jne 0x4707d1
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
je 0x4707d1
push dword [ebp - 0x1dc]
call fcn.004993d0
pop ecx
push eax
call fcn.0046d8a0
pop ecx
cmp al, 0
je 0x4707d1
mov eax, dword [ebp - 0x1dc]
cmp byte [eax + 0x3c], 0
je 0x4707d1
mov eax, dword [ebp - 0x1dc]
cmp byte [eax + 0x3d], 0
je 0x4707d1
mov ecx, dword [ebp - 0x1dc]
call fcn.004b9e50
mov bl, 1
cmp dword [ebp - 0x110], 0
je 0x4707b4
mov ecx, dword [ebp - 0x110]
call fcn.0040c8f0
cmp dword [ebp - 0x10c], 0
je 0x4707c8
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x110], 0
je 0x4707e5
mov ecx, dword [ebp - 0x110]
call fcn.0040c8f0
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax]
mov dword [ebp - 0x1b0], ecx
cmp dword [ebp - 0x1b0], 0
jne 0x470347
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0046d850
pop ecx
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jne 0x470839
mov bl, 0
cmp dword [ebp - 0x10c], 0
je 0x470830
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x124]
call fcn.00493db0
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x12c]
call fcn.00493db0
mov eax, dword [ebp - 0x1b8]
sub eax, 0x10
cmp eax, 4
jbe 0x47087b
sub eax, 0x4b
cmp eax, 2
jbe 0x47087b
sub eax, 0x35
cmp eax, 1
jbe 0x47087b
jmp 0x4708df
mov dword [ebp - 0x188], 0
push 0x55d76a
call fcn.0040e8d0
pop ecx
push eax
push 0x55d76a
lea ecx, [ebp - 0x188]
call fcn.0040cb20
cmp dword [ebp - 0x188], 0
je 0x4708b9
mov ebx, dword [ebp - 0x188]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0040d2e0
cmp dword [ebp - 0x188], 0
je 0x4708df
mov ecx, dword [ebp - 0x188]
call fcn.0040c8f0
mov byte [ebp - 0x1bd], 1
cmp dword [ebp - 0x1b8], 0xd
jne 0x470905
mov eax, dword [ebp + 8]
test dword [eax + 0xc], 0x1000000
je 0x470905
mov dword [ebp - 0x1b8], 0x97
cmp dword [ebp - 0x128], 0
je 0x470ab4
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x120]
cmp ecx, edx
je 0x470ab4
mov dword [ebp - 0x18c], 0
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
call fcn.0040e8d0
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x18c]
call fcn.0040cb20
cmp dword [ebp - 0x18c], 0
je 0x47096e
mov ebx, dword [ebp - 0x18c]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
push str.RICHEDIT
lea ecx, [ebp - 0x18c]
call fcn.0040d250
push eax
call fcn.0040e980
pop ecx
pop ecx
cmp eax, 0
jne 0x47098f
mov bl, 1
jmp 0x470991
mov bl, 0
cmp dword [ebp - 0x18c], 0
je 0x4709a5
mov ecx, dword [ebp - 0x18c]
call fcn.0040c8f0
cmp bl, 0
jne 0x470a32
mov dword [ebp - 0x190], 0
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
call fcn.0040e8d0
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x190]
call fcn.0040cb20
cmp dword [ebp - 0x190], 0
je 0x4709f6
mov ebx, dword [ebp - 0x190]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
push str.RICHEDIT20W
lea ecx, [ebp - 0x190]
call fcn.0040d250
push eax
call fcn.0040e980
pop ecx
pop ecx
cmp eax, 0
jne 0x470a17
mov bl, 1
jmp 0x470a19
mov bl, 0
cmp dword [ebp - 0x190], 0
je 0x470a2d
mov ecx, dword [ebp - 0x190]
call fcn.0040c8f0
cmp bl, 0
je 0x470a39
mov byte [ebp - 0x1bd], 0
cmp dword [ebp - 0x10c], 0
je 0x470a4d
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx + 0xc]
jmp 0x470a52
mov eax, 0
cmp eax, 0
je 0x470ab4
movsx eax, word [ebp - 0x1bc]
push eax
push 0
movzx eax, byte [ebp - 0x1b8]
push eax
mov edx, dword [ebp - 0x128]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0xc0]
cmp al, 0
je 0x470ab4
mov bl, 1
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x470aab
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x1bd], 0
je 0x470b45
cmp dword [ebp - 0x10c], 0
je 0x470ad5
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx + 0xc]
jmp 0x470ada
mov eax, 0
cmp eax, 0
je 0x470b45
cmp dword [ebp - 0x120], 0
je 0x470b45
movsx eax, word [ebp - 0x1bc]
push eax
push 0
movzx eax, byte [ebp - 0x1b8]
push eax
mov edx, dword [ebp - 0x120]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0xc0]
cmp al, 0
je 0x470b45
mov bl, 1
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x470b3c
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0046d850
pop ecx
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jne 0x470b94
mov bl, 0
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x470b8b
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x1b8], 0x28
je 0x470bbc
cmp dword [ebp - 0x1b8], 0x26
je 0x470bbc
cmp dword [ebp - 0x1b8], 0x25
je 0x470bbc
cmp dword [ebp - 0x1b8], 0x27
jne 0x470c98
cmp dword [ebp - 0x1ac], 0
je 0x4711cf
mov edx, dword [ebp - 0x1ac]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x84]
cmp al, 0
je 0x4711cf
mov dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1b8], 0x25
je 0x470bff
cmp dword [ebp - 0x1b8], 0x26
jne 0x470c1f
push dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x1a4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x200]
mov dword [ebp - 0x1e0], eax
jmp 0x470c3d
push dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x1a4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x204]
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
je 0x470c63
mov edx, dword [ebp - 0x1e0]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0xcc]
mov ecx, dword [ebp - 0x1e0]
call fcn.0049b510
mov bl, 1
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x470c8f
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x1b8], 9
jne 0x470f2d
mov dword [ebp - 0x1e4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, 0x8000
je 0x470cf6
mov bl, 0
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x470ced
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, 0x8000
je 0x470d2b
push dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x1a4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x200]
mov dword [ebp - 0x1e4], eax
jmp 0x470ed2
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
call fcn.0040e8d0
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x194]
call fcn.0040cb20
cmp dword [ebp - 0x194], 0
je 0x470d73
mov ebx, dword [ebp - 0x194]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
push str.RICHEDIT
lea ecx, [ebp - 0x194]
call fcn.0040d250
push eax
call fcn.0040e980
pop ecx
pop ecx
cmp eax, 0
jne 0x470d94
mov bl, 1
jmp 0x470d96
mov bl, 0
cmp dword [ebp - 0x194], 0
je 0x470daa
mov ecx, dword [ebp - 0x194]
call fcn.0040c8f0
cmp bl, 0
jne 0x470e37
mov dword [ebp - 0x198], 0
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
call fcn.0040e8d0
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x198]
call fcn.0040cb20
cmp dword [ebp - 0x198], 0
je 0x470dfb
mov ebx, dword [ebp - 0x198]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
push str.RICHEDIT20W
lea ecx, [ebp - 0x198]
call fcn.0040d250
push eax
call fcn.0040e980
pop ecx
pop ecx
cmp eax, 0
jne 0x470e1c
mov bl, 1
jmp 0x470e1e
mov bl, 0
cmp dword [ebp - 0x198], 0
je 0x470e32
mov ecx, dword [ebp - 0x198]
call fcn.0040c8f0
cmp bl, 0
je 0x470eb4
call fcn.00475590
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
je 0x470eb4
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x1e8]
mov edx, dword [eax + 0x58]
cmp ebx, edx
jne 0x470eb4
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1ec], eax
mov edx, dword [ebp - 0x1ec]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x3c0]
cmp al, 0
je 0x470eb4
mov bl, 0
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x470eab
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
push dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x1a4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x204]
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
je 0x470ef8
mov edx, dword [ebp - 0x1e4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0xcc]
mov ecx, dword [ebp - 0x1e4]
call fcn.0049b510
mov bl, 1
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x470f24
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x1b8], 0xd
je 0x470f46
cmp dword [ebp - 0x1b8], 0x97
jne 0x47115e
call fcn.00475590
mov dword [ebp - 0x1f0], eax
mov edx, dword [ebp - 0x1a4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x11c]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
je 0x470f9d
cmp dword [ebp - 0x1f0], 0
je 0x470f9d
mov edx, dword [ebp - 0x1f0]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0xac]
cmp al, 0
je 0x470f9d
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x19c], 0
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
call fcn.0040e8d0
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040cb20
cmp dword [ebp - 0x19c], 0
je 0x470fe5
mov ebx, dword [ebp - 0x19c]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
push str.RICHEDIT
lea ecx, [ebp - 0x19c]
call fcn.0040d250
push eax
call fcn.0040e980
pop ecx
pop ecx
cmp eax, 0
jne 0x471006
mov bl, 1
jmp 0x471008
mov bl, 0
cmp dword [ebp - 0x19c], 0
je 0x47101c
mov ecx, dword [ebp - 0x19c]
call fcn.0040c8f0
cmp bl, 0
jne 0x4710ad
mov dword [ebp - 0x1a0], 0
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
call fcn.0040e8d0
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040cb20
cmp dword [ebp - 0x1a0], 0
je 0x47106d
mov ebx, dword [ebp - 0x1a0]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
push str.RICHEDIT20W
lea ecx, [ebp - 0x1a0]
call fcn.0040d250
push eax
call fcn.0040e980
pop ecx
pop ecx
cmp eax, 0
jne 0x47108e
mov bl, 1
jmp 0x471090
mov bl, 0
cmp dword [ebp - 0x1a0], 0
je 0x4710a4
mov ecx, dword [ebp - 0x1a0]
call fcn.0040c8f0
cmp bl, 0
je 0x471141
cmp dword [ebp - 0x1f0], 0
je 0x471141
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x1f0]
mov edx, dword [eax + 0x58]
cmp ebx, edx
jne 0x471141
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f8], eax
mov edx, dword [ebp - 0x1f8]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x270]
cmp al, 0
je 0x471141
cmp dword [ebp - 0x1f4], 0
je 0x47110c
cmp dword [ebp - 0x1f4], 0
je 0x471141
cmp dword [ebp - 0x1b8], 0x97
je 0x471141
mov bl, 0
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x471138
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x1f4], 0
je 0x47115c
mov edx, dword [ebp - 0x1f4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x124]
jmp 0x4711cf
cmp dword [ebp - 0x1b8], 0x1b
jne 0x4711cf
mov edx, dword [ebp - 0x1a4]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x120]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
je 0x4711cf
mov edx, dword [ebp - 0x1fc]
mov ecx, edx
mov esi, dword [ecx]
mov ecx, edx
call dword [esi + 0x124]
mov bl, 1
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x4711c6
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov bl, 0
lea ecx, [ebp - 0x12c]
call fcn.00493df0
lea ecx, [ebp - 0x124]
call fcn.00493df0
cmp dword [ebp - 0x10c], 0
je 0x4711fb
mov ecx, dword [ebp - 0x10c]
call fcn.0040c8f0
mov al, bl
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret