Function at 0x43f4f9
Capabilities:
Get keyboard layout
Log keystrokes via polling
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push edi
mov esi, eax
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x43f541
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.004495a0
add esp, 0xc
jmp 0x43f5b5
cmp dword [ebp + 8], 0x12
jne 0x43f55a
mov eax, esi
shr eax, 0x10
test ah, 1
je 0x43f55a
mov al, byte [ebp - 0x10a]
mov byte [ebp - 0x77], al
mov eax, dword [0x4769e4]
cmp eax, 3
je 0x43f57e
cmp eax, 1
jg 0x43f5a8
mov eax, dword [0x474ecc]
cmp dword [eax + 0x144], edi
je 0x43f5a8
cmp dword [0x4769ec], edi
jne 0x43f5a8
cmp dword [ebp + 8], 0x90
jne 0x43f5a8
test byte [ebp - 0x10c], 0x80
jne 0x43f5a8
mov eax, esi
shr eax, 0x10
test ah, 0xc0
mov dword [ebp + 8], 0x2b
jne 0x43f5a8
xor byte [ebp - 0x8c], 1
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edi, dword [0x474ecc]
xor edx, edx
cmp dword [edi + 0x14c], edx
je 0x43f5d8
mov eax, esi
shr eax, 0x10
and ax, 0xc000
cmp ax, 0x4000
je 0x440280
shr esi, 0x10
test si, 0x2000
mov dword [ebp - 8], esi
je 0x43f5f2
test byte [ebp - 0x77], 0x80
jne 0x43f5f2
mov dword [ebp - 4], 1
movzx eax, si
mov ecx, eax
shr ecx, 0xf
not ecx
and ecx, 1
cmp dword [ebp - 4], edx
mov dword [ebp - 0x1c], ecx
je 0x43f628
test byte [ebp - 0x10b], 0x80
je 0x43f628
cmp dword [0x476a4c], edx
je 0x43f621
mov byte [ebp - 0x10a], 0
jmp 0x43f628
mov byte [ebp - 0x77], 0x80
mov dword [ebp - 4], edx
movzx ecx, byte [ebp - 0x10c]
and eax, 0x81ff
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp - 0x10b]
shr eax, 7
shr ecx, 7
lea edx, [ecx + eax*2]
mov eax, dword [0x473aec]
test eax, eax
mov ecx, dword [0x4769e4]
jne 0x43f68f
cmp dword [0x476a48], 0
mov dword [0x473b44], 0x100
je 0x43f67f
cmp dword [ebp + 8], 0x12
jne 0x43f67f
test byte [ebp - 7], 1
je 0x43f6e0
mov dword [0x473b44], 0x12
cmp dword [ebp + 8], 0x5d
jne 0x43f68f
mov dword [0x473b44], 0x5d
mov esi, dword [0x473b44]
cmp dword [ebp + 8], esi
jne 0x43f6bc
test eax, eax
jne 0x43f6a7
test byte [ebp - 7], 0xc0
jne 0x43f6d9
inc eax
jmp 0x43f6db
cmp eax, 1
jne 0x43f6d9
test byte [ebp - 7], 0x80
je 0x43f6d9
push 2
pop eax
mov dword [0x473aec], eax
jmp 0x43f6d3
cmp eax, 1
jne 0x43f6d1
cmp dword [ebp + 8], 0x11
je 0x43f6e0
xor eax, eax
mov dword [0x473aec], eax
cmp eax, 1
jle 0x43f6e0
cmp dword [ebp - 4], 0
je 0x43f6e6
xor eax, eax
mov dword [0x473aec], eax
cmp dword [ebp - 4], 0
jne 0x43f710
xor esi, esi
cmp dword [edi + 0x144], esi
je 0x43f6fd
cmp dword [0x4769ec], esi
jne 0x43f6fd
cmp ecx, 2
jne 0x43f712
cmp ecx, 3
je 0x43f712
cmp dword [0x476a14], esi
jne 0x43f712
cmp eax, esi
je 0x43f782
jmp 0x43f712
xor esi, esi
test byte [ebp - 7], 1
jne 0x43f782
mov ecx, dword [ebp + 8]
cmp ecx, 0x25
ja 0x43f74d
je 0x43f749
sub ecx, 0xc
je 0x43f745
sub ecx, 0x15
je 0x43f741
dec ecx
je 0x43f73d
dec ecx
je 0x43f739
dec ecx
jne 0x43f782
push 0x67
jmp 0x43f772
push 0x61
jmp 0x43f772
push 0x63
jmp 0x43f772
push 0x69
jmp 0x43f772
push 0x65
jmp 0x43f772
push 0x64
jmp 0x43f772
sub ecx, 0x26
je 0x43f770
dec ecx
je 0x43f76c
dec ecx
je 0x43f768
sub ecx, 5
je 0x43f764
dec ecx
jne 0x43f782
push 0x6e
jmp 0x43f772
push 0x60
jmp 0x43f772
push 0x62
jmp 0x43f772
push 0x66
jmp 0x43f772
push 0x68
test byte [ebp - 0x8c], 1
pop ecx
je 0x43f77f
or edx, 1
mov dword [ebp + 8], ecx
cmp dword [ebp - 0x1c], esi
je 0x43ff87
xor esi, esi
test byte [ebp - 0x77], 0x80
jne 0x43ff87
cmp eax, esi
jne 0x43ff87
cmp dword [ebp - 4], esi
je 0x43f7ab
mov ebx, dword [ebp + 0xc]
mov byte [ebx], 0x1b
inc ebx
cmp dword [ebp + 8], 0x21
jne 0x43f7dc
cmp edx, 1
jne 0x43f7cf
push esi
push 2
push 0x115
push dword [0x477a58]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x440280
push 2
pop edi
cmp edx, edi
jne 0x43f7f9
push 0
push 0
jmp 0x43f7b9
cmp dword [ebp + 8], 0x22
jne 0x43f81c
cmp edx, 1
jne 0x43f7ec
push esi
push 3
jmp 0x43f7b9
push 2
pop edi
cmp edx, edi
jne 0x43f7f9
push 0
push 1
jmp 0x43f7b9
push 3
pop esi
cmp edx, esi
jne 0x43f822
xor eax, eax
cmp dword [ebp + 8], 0x21
setne al
push eax
push dword [0x474ecc]
call fcn.00430e96
pop ecx
pop ecx
jmp 0x440280
push 3
pop esi
push 2
pop edi
mov eax, dword [ebp + 8]
cmp eax, 0x2d
jne 0x43f838
cmp edx, 1
jne 0x43f838
push 0
call fcn.0043e270
jmp 0x43f816
cmp dword [ebp - 4], 0
je 0x43f8a7
cmp eax, 0x73
jne 0x43f854
cmp dword [0x476a20], 0
je 0x43f8c1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp eax, 0x20
jne 0x43f87c
cmp dword [0x476a24], 0
je 0x43f8c1
push 0
push 0xf100
push 0x112
push dword [0x477a58]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x43f84c
cmp eax, 0xd
jne 0x43f8a7
cmp dword [0x476a38], 0
je 0x43f8c1
cmp dword [0x476c8c], 1
je 0x43f8c1
mov eax, dword [ebp - 8]
and ax, 0xc000
cmp ax, 0x4000
je 0x43f84c
call fcn.0043f1d4
jmp 0x43f84c
cmp eax, 0x13
jne 0x43f8c1
cmp edx, edi
jne 0x43f8c1
mov eax, dword [0x474ecc]
xor dword [eax + 0x144], 1
jmp 0x440280
xor eax, eax
cmp dword [0x476a14], eax
je 0x43f943
cmp dword [ebp - 4], eax
jne 0x43fac5
mov eax, dword [ebp + 8]
add eax, 0xffffff9f
cmp eax, 8
ja case.default.0x43f8df
jmp dword [eax*4 + 0x440287]
and edx, esi
mov al, byte [edx + 0x4699f0]
mov byte [ebx], al
jmp 0x43fbd6
and edx, esi
mov al, byte [edx + str.jJ_n_n]
jmp 0x43f8ee
and edx, esi
mov al, byte [edx + 0x4699e0]
jmp 0x43f8ee
and edx, esi
mov al, byte [edx + str.hH_b_b]
jmp 0x43f8ee
mov byte [ebx], 0x2e
jmp 0x43fbd6
and edx, esi
mov al, byte [edx + str.lL_f_f]
jmp 0x43f8ee
and edx, esi
mov al, byte [edx + 0x4699c8]
jmp 0x43f8ee
and edx, esi
mov al, byte [edx + str.kK_v_v]
jmp 0x43f8ee
and edx, esi
mov al, byte [edx + 0x4699b8]
jmp 0x43f8ee
cmp dword [ebp - 4], eax
jne 0x43fac5
mov eax, dword [0x4769e4]
xor ecx, ecx
cmp eax, esi
je 0x43f971
cmp eax, 1
jg 0x43f995
mov eax, dword [0x474ecc]
cmp dword [eax + 0x144], ecx
je 0x43f995
cmp dword [0x4769ec], ecx
jne 0x43f995
mov eax, dword [ebp + 8]
sub eax, 0x2b
je 0x43f992
sub eax, 0x3f
je 0x43f98e
sub eax, esi
je 0x43f98a
sub eax, edi
jne 0x43f995
push 0x51
jmp 0x43f994
push 0x53
jmp 0x43f994
push 0x52
jmp 0x43f994
push 0x50
pop ecx
mov eax, dword [0x474ecc]
cmp dword [eax + 0x144], 0
je 0x43fa8d
cmp dword [0x4769ec], 0
jne 0x43fa8d
mov eax, dword [ebp + 8]
cmp eax, 0x67
ja 0x43fa24
je 0x43fa20
cmp eax, 0x63
ja 0x43fa06
je 0x43f9ff
sub eax, 0xd
je 0x43f9ee
sub eax, 0x53
je 0x43f9e7
dec eax
je 0x43f9e0
dec eax
jne 0x43fa8d
push 0x72
jmp 0x43fa87
push 0x71
jmp 0x43fa87
push 0x70
jmp 0x43fa87
test byte [ebp - 7], 1
je 0x43fa8d
push 0x4d
jmp 0x43fa8c
push 0x73
jmp 0x43fa87
mov eax, dword [ebp + 8]
sub eax, 0x64
je 0x43fa1c
dec eax
je 0x43fa18
dec eax
jne 0x43fa8d
push 0x76
jmp 0x43fa87
push 0x75
jmp 0x43fa87
push 0x74
jmp 0x43fa87
push 0x77
jmp 0x43fa87
mov eax, dword [ebp + 8]
sub eax, 0x68
je 0x43fa8a
dec eax
je 0x43fa85
dec eax
je 0x43fa79
dec eax
je 0x43fa5b
sub eax, edi
je 0x43fa4f
dec eax
je 0x43fa4b
dec eax
jne 0x43fa8d
cmp dword [0x4769e4], edi
jne 0x43fa8d
push 0x6f
jmp 0x43fa8c
push 0x6e
jmp 0x43fa87
cmp dword [0x4769e4], edi
jne 0x43fa8d
push 0x6d
jmp 0x43fa8c
xor ecx, ecx
cmp dword [0x4769e4], edi
jne 0x43fa6f
test edx, edx
setne cl
add ecx, 0x6b
jmp 0x43fa91
test edx, edx
setne cl
add ecx, 0x6c
jmp 0x43fa91
cmp dword [0x4769e4], edi
jne 0x43fa8d
push 0x6a
jmp 0x43fa8c
push 0x79
pop ecx
jmp 0x43fa91
push 0x78
pop ecx
test ecx, ecx
je 0x43fac5
mov eax, dword [0x474ecc]
cmp dword [eax + 0x148], 0
je 0x43fabf
cmp ecx, 0x50
jl 0x43fab4
cmp ecx, 0x53
jg 0x43fab4
push ecx
push 0x467448
jmp 0x43feb5
push ecx
push str.e__c
jmp 0x43feb5
push ecx
jmp 0x43feb0
mov eax, dword [ebp + 8]
cmp eax, 8
jne 0x43fafe
test edx, edx
jne 0x43fae7
cmp dword [0x4769dc], edx
sete al
dec al
and al, 0x77
add al, 8
mov byte [ebx], al
jmp 0x43ff51
cmp edx, 1
jne 0x43fb67
cmp dword [0x4769dc], 0
sete al
dec al
and al, 0x89
add al, 0x7f
jmp 0x43fae0
cmp eax, 9
jne 0x43fb18
cmp edx, 1
jne 0x43fb67
mov byte [ebx], 0x1b
inc ebx
mov byte [ebx], 0x5b
inc ebx
mov byte [ebx], 0x5a
jmp 0x43fbd6
cmp eax, 0x20
jne 0x43fb35
cmp edx, edi
jne 0x43fb29
mov byte [ebx], 0
jmp 0x43fbd6
cmp edx, esi
jne 0x43fb67
mov byte [ebx], 0xa0
jmp 0x43fbd6
cmp eax, esi
jne 0x43fb5a
cmp edx, edi
jne 0x43fba9
mov eax, dword [0x472aec]
test eax, eax
je 0x440280
push 1
push dword [0x4727c0]
call dword [eax + 0x18]
jmp 0x43f815
cmp eax, 0x13
jne 0x43fb67
mov byte [ebx], 0x1a
jmp 0x43ff51
cmp edx, edi
jne 0x43fba9
cmp eax, 0x32
jb 0x43fb83
cmp eax, 0x38
ja 0x43fb83
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x46997e]
jmp 0x43f8ee
cmp eax, 0xbd
je 0x43fb91
cmp eax, 0xbf
jne 0x43fb96
mov byte [ebx], 0x1f
jmp 0x43fbd6
cmp eax, 0xdf
je 0x43fba4
cmp eax, 0xdc
jne 0x43fbe1
mov byte [ebx], 0x1c
jmp 0x43fbd6
cmp edx, esi
jne 0x43fbb9
cmp eax, 0xde
jne 0x43fbe1
mov byte [ebx], 0x1e
jmp 0x43fbd6
test edx, edx
jne 0x43fbe1
cmp eax, 0xd
jne 0x43fbe1
mov eax, dword [0x474ecc]
cmp dword [eax + 0x150], edx
je 0x43fbe1
mov byte [ebx], 0xd
inc ebx
mov byte [ebx], 0xa
mov eax, ebx
sub eax, dword [ebp + 0xc]
inc eax
jmp 0x43f84f
mov ecx, dword [ebp + 8]
add ecx, 0xffffff90
xor eax, eax
cmp ecx, 0x13
mov dword [ebp - 0x18], ecx
ja case.default.0x43fbf5
jmp dword [ecx*4 + 0x4402ab]
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0xb
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0xc
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0xd
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0xe
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0xf
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0x11
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0x12
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0x13
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0x14
jmp case.default.0x43fbf5
mov al, byte [ebp - 0x10c]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0x15
jmp case.default.0x43fbf5
push 0x17
jmp 0x43fcf9
push 0x18
jmp 0x43fcf9
push 0x19
jmp 0x43fcf9
push 0x1a
jmp 0x43fcf9
push 0x1c
jmp 0x43fcf9
push 0x1d
jmp 0x43fcf9
push 0x1f
jmp 0x43fcf9
push 0x20
jmp 0x43fcf9
push 0x21
jmp 0x43fcf9
push 0x22
pop eax
test dl, 2
push 6
pop edi
jne 0x43fd33
mov ecx, dword [ebp + 8]
sub ecx, 0x21
je 0x43fd30
dec ecx
je 0x43fd2c
dec ecx
je 0x43fd28
dec ecx
je 0x43fd23
sub ecx, 9
je 0x43fd1f
dec ecx
jne 0x43fd33
push 3
jmp 0x43fd32
push 2
jmp 0x43fd32
xor eax, eax
inc eax
jmp 0x43fd33
push 4
jmp 0x43fd32
mov eax, edi
jmp 0x43fd33
push 5
pop eax
cmp dword [0x4769e4], 3
jne 0x43fd47
cmp eax, edi
jg 0x43fd47
movsx eax, byte [eax + 0x4699a8]
mov ecx, dword [0x474ecc]
mov esi, dword [ecx + 0x148]
test esi, esi
je 0x43fd7a
test eax, eax
jle 0x43fd7a
cmp eax, edi
jg 0x43fd7a
movsx eax, byte [eax + str._HLMEIG]
push eax
push 0x467448
push ebx
call fcn.00449da8
add esp, 0xc
jmp 0x43ff40
cmp dword [0x4769e4], 5
jne 0x43fe42
cmp eax, 0xb
jl 0x43fe12
cmp eax, 0x22
jg 0x43fe12
push 0xc
pop ecx
mov esi, str.MNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_____
lea edi, [ebp - 0x150]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x18]
xor eax, eax
cmp ecx, 0xb
movsb byte es:[edi], byte [esi]
ja case.default.0x43fdb0
jmp dword [ecx*4 + 0x4402fb]
xor eax, eax
jmp case.default.0x43fdb0
xor eax, eax
inc eax
jmp case.default.0x43fdb0
push 2
jmp 0x43fde6
push 3
jmp 0x43fde6
push 4
jmp 0x43fde6
push 5
jmp 0x43fde6
push 6
jmp 0x43fde6
push 7
jmp 0x43fde6
push 8
jmp 0x43fde6
push 9
jmp 0x43fde6
push 0xa
jmp 0x43fde6
push 0xb
pop eax
test byte [ebp - 0x10c], 0x80
je 0x43fdf3
add eax, 0xc
test byte [ebp - 0x10b], 0x80
je 0x43fdff
add eax, 0x18
movsx eax, byte [ebp + eax - 0x150]
push eax
push 0x467438
jmp 0x43fd6c
cmp eax, 1
jl 0x43fe42
cmp eax, edi
jg 0x43fe42
cmp eax, 3
mov esi, str.HL.FIG
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jne 0x43fe35
mov byte [ebx], 0x7f
inc ebx
jmp 0x43fec0
movsx eax, byte [ebp + eax - 0x19]
push eax
push 0x467438
jmp 0x43feb5
xor edi, edi
cmp esi, edi
jne 0x43fe51
cmp dword [0x4769e4], 4
jne 0x43fe72
cmp eax, 0xb
jl 0x43fe72
cmp eax, 0x18
jg 0x43fe72
xor ecx, ecx
cmp eax, 0xf
jle 0x43fe63
inc ecx
cmp eax, 0x15
jle 0x43fe69
inc ecx
sub eax, ecx
add eax, 0x45
test esi, esi
jmp 0x43fea9
mov ecx, dword [0x4769e4]
cmp ecx, 1
jne 0x43fe95
cmp eax, 0xb
jl 0x43feca
cmp eax, 0xf
jg 0x43feca
add eax, 0x36
push eax
push str.e___c
jmp 0x43fd6c
cmp ecx, 2
jne 0x43feca
cmp eax, 0xb
jl 0x43feca
cmp eax, 0xe
jg 0x43feca
add eax, 0x45
cmp esi, edi
push eax
jne 0x43faaa
push str.eO_c
push ebx
call fcn.00449da8
add esp, 0xc
add ebx, eax
mov eax, ebx
sub eax, dword [ebp + 0xc]
jmp 0x43f84f
cmp dword [0x4769e0], edi
je 0x43fef3
cmp eax, 1
je 0x43feec
cmp eax, 4
jne 0x43fef3
mov eax, 0x467474
push eax
push ebx
call fcn.00449da8
pop ecx
pop ecx
jmp 0x43ff40
mov eax, 0x467470
jmp 0x43fee1
cmp eax, edi
je 0x43ff02
push eax
push 0x467468
jmp 0x43fd6c
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, 0xc
je 0x43ff2a
sub eax, 0x19
je 0x43ff26
dec eax
je 0x43ff22
dec eax
je 0x43ff1e
dec eax
jne 0x43ff4a
mov al, 0x42
jmp 0x43ff2c
mov al, 0x43
jmp 0x43ff2c
mov al, 0x41
jmp 0x43ff2c
mov al, 0x44
jmp 0x43ff2c
mov al, 0x47
push edx
movsx eax, al
push eax
push dword [0x474ecc]
push ebx
call fcn.00430a2b
add esp, 0x10
sub ebx, dword [ebp + 0xc]
add eax, ebx
jmp 0x43f84f
cmp ecx, 0xd
jne 0x43ff5d
mov byte [ebx], cl
push 0xfffffffffffffffe
mov byte [ebx + 1], 0
pop eax
jmp 0x43f84f
cmp dword [ebp - 4], edi
je 0x43ff7f
cmp ecx, 0x60
jb 0x43ff7f
cmp ecx, 0x69
ja 0x43ff7f
mov eax, dword [0x473b3c]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2 - 0x60]
mov dword [0x473b3c], eax
jmp 0x43ff85
mov dword [0x473b3c], edi
xor esi, esi
cmp dword [0x477298], esi
mov dword [ebp - 0x18], esi
je 0x43ffad
cmp byte [ebp - 0x108], 0
je 0x43ffad
xor eax, eax
cmp dword [ebp - 4], esi
mov byte [ebp - 0x108], 0
sete al
mov dword [ebp - 0x18], eax
cmp dword [0x474e30], 2
push dword [ebp - 0xc]
push esi
jne 0x43ffeb
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov ebx, eax
xor eax, eax
movzx cx, byte [ebp + eax + 0xc]
mov word [eax*2 + 0x473638], cx
inc eax
cmp eax, 3
jl 0x43ffd5
jmp 0x440005
push 0x473638
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov ebx, eax
cmp ebx, esi
jle 0x440226
push dword [0x474ecc]
call fcn.00430a90
xor esi, esi
test ebx, ebx
pop ecx
jle 0x440212
xor edi, edi
inc edi
mov ecx, dword [0x473aec]
cmp ecx, 2
mov al, byte [esi*2 + 0x473638]
mov byte [ebp + 0xf], al
jne 0x44005a
test al, al
js 0x4400b8
cmp al, 0x20
jbe 0x4400b8
movzx eax, al
mov dword [0x473b40], eax
mov dword [0x473aec], 3
jmp 0x440209
cmp ecx, 3
jne 0x4400b8
test al, al
js 0x4400b8
cmp al, 0x20
jbe 0x4400b8
and dword [0x473aec], 0
movzx eax, al
push eax
push dword [0x473b40]
call fcn.0044791b
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x44021c
push dword [0x474ecc]
mov dword [ebp - 0xc], eax
call fcn.004315cb
mov eax, dword [0x472b00]
test eax, eax
pop ecx
je 0x440209
push edi
push edi
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.0040803c
add esp, 0x10
jmp 0x440209
xor edx, edx
cmp dword [ebp - 0x1c], edx
mov dword [0x473aec], edx
jne 0x44016a
mov ecx, dword [0x473b3c]
cmp ecx, edx
je 0x440147
mov eax, dword [0x474ecc]
cmp dword [eax + 0xdc], edx
jne 0x440119
mov edx, dword [eax + 0x108c]
cmp dword [edx + 0xc], 0xfde9
je 0x440119
cmp dword [0x472b0c], 0
jne 0x440119
push eax
mov byte [ebp + 0xf], cl
call fcn.004315cb
mov eax, dword [0x472b00]
test eax, eax
pop ecx
je 0x44013b
push edi
push edi
lea ecx, [ebp + 0xf]
push ecx
push eax
call fcn.00407948
jmp 0x440138
push eax
mov dword [ebp - 0xc], ecx
call fcn.004315cb
mov eax, dword [0x472b00]
test eax, eax
pop ecx
je 0x44013b
push edi
push edi
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.0040803c
add esp, 0x10
and dword [0x473b3c], 0
jmp 0x440202
push dword [0x474ecc]
call fcn.004315cb
mov eax, dword [0x472b00]
test eax, eax
pop ecx
je 0x440202
push edi
push edi
lea ecx, [ebp + 0xf]
jmp 0x4401f2
cmp dword [ebp - 0x18], edx
je 0x4401bf
cmp al, 0x80
jae 0x4401bf
movzx eax, al
push eax
mov word [ebp - 0x10], 0x1b
call fcn.00447879
push dword [0x474ecc]
mov word [ebp - 0xe], ax
call fcn.004315cb
mov eax, dword [0x472b00]
test eax, eax
pop ecx
pop ecx
je 0x440202
xor ecx, ecx
cmp dword [ebp - 4], ecx
push edi
setne cl
inc ecx
push ecx
xor ecx, ecx
cmp dword [ebp - 4], ecx
sete cl
lea ecx, [ebp + ecx*2 - 0x10]
push ecx
push eax
call fcn.0040803c
add esp, 0x10
jmp 0x440202
push dword [0x474ecc]
mov byte [ebp - 6], 0x1b
mov byte [ebp - 5], al
call fcn.004315cb
mov eax, dword [0x472b00]
test eax, eax
pop ecx
je 0x440202
xor ecx, ecx
cmp dword [ebp - 4], ecx
push edi
setne cl
inc ecx
push ecx
xor ecx, ecx
cmp dword [ebp - 4], ecx
sete cl
lea ecx, [ebp + ecx - 6]
push ecx
push dword [0x4726e0]
push eax
call fcn.004081ca
add esp, 0x14
xor eax, eax
call fcn.0043c9f1
inc esi
cmp esi, ebx
jl 0x440026
and word [0x473638], 0
jmp 0x440280
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x440280
cmp dword [ebp - 4], esi
jne 0x440234
mov word [0x473638], si
jmp 0x44026a
cmp word [0x473638], si
je 0x44026a
mov eax, dword [0x474ecc]
cmp dword [eax + 0xdc], esi
jne 0x440261
mov eax, dword [eax + 0x108c]
cmp dword [eax + 0xc], 0xfde9
je 0x440261
cmp dword [0x472b0c], esi
je 0x44026a
mov word [0x473638], 0xa
cmp dword [ebp + 8], 0x12
jne 0x43f84c
cmp dword [0x476a28], esi
jne 0x43f84c
xor eax, eax
jmp 0x43f84f