Function at 0x4460d7
Capabilities:
Get keyboard layout
Log keystrokes via polling
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x3f
push dword [0x47f55c]
mov esi, eax
mov dword [ebp - 8], edi
call fcn.00402257
push 0x41
push dword [0x47f55c]
mov dword [ebp - 0x14], eax
call fcn.00402257
push 0x59
push dword [0x47f55c]
mov dword [ebp - 0x18], eax
call fcn.00402257
push 0x4b
push dword [0x47f55c]
mov ebx, eax
call fcn.00402257
add esp, 0x20
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x446164
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.00452e50
add esp, 0xc
jmp 0x4461d7
cmp dword [ebp + 8], 0x12
jne 0x446180
mov eax, esi
shr eax, 0x10
test ah, 1
je 0x446180
mov al, byte [ebp - 0x11a]
mov byte [ebp - 0x87], al
cmp dword [ebp - 0x14], 3
je 0x4461a0
cmp dword [ebp - 0x14], 1
jg 0x4461ca
mov eax, dword [0x47f570]
cmp dword [eax + 0x144], 0
je 0x4461ca
cmp dword [ebp - 0x18], 0
jne 0x4461ca
cmp dword [ebp + 8], 0x90
jne 0x4461ca
test byte [ebp - 0x11c], 0x80
jne 0x4461ca
mov eax, esi
shr eax, 0x10
test ah, 0xc0
mov dword [ebp + 8], 0x2b
jne 0x4461ca
xor byte [ebp - 0x9c], 1
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov eax, dword [0x47f570]
xor edx, edx
cmp dword [eax + 0x14c], edx
je 0x4461f9
mov eax, esi
shr eax, 0x10
and ax, 0xc000
cmp ax, 0x4000
je 0x446f50
shr esi, 0x10
test si, 0x2000
mov dword [ebp - 0x1c], esi
je 0x446216
test byte [ebp - 0x87], 0x80
jne 0x446216
mov dword [ebp - 4], 1
movzx eax, si
mov ecx, eax
shr ecx, 0xf
not ecx
and ecx, 1
cmp dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
je 0x44624b
test byte [ebp - 0x11b], 0x80
je 0x44624b
cmp ebx, edx
je 0x446241
mov byte [ebp - 0x11a], 0
jmp 0x44624b
mov byte [ebp - 0x87], 0x80
mov dword [ebp - 4], edx
movzx ecx, byte [ebp - 0x11c]
and eax, 0x81ff
mov dword [ebp - 0x24], eax
movzx eax, byte [ebp - 0x11b]
shr eax, 7
shr ecx, 7
cmp dword [0x47e13c], edx
lea esi, [ecx + eax*2]
mov dword [ebp - 0xc], esi
jne 0x4462b2
push 0x58
push dword [0x47f55c]
mov dword [0x47e194], 0x100
call fcn.00402257
test eax, eax
pop ecx
pop ecx
je 0x4462a5
push 0x12
pop eax
cmp dword [ebp + 8], eax
jne 0x4462a5
test byte [ebp - 0x1b], 1
je 0x4462b2
mov dword [0x47e194], eax
push 0x5d
pop eax
cmp dword [ebp + 8], eax
jne 0x4462b2
mov dword [0x47e194], eax
mov eax, dword [ebp + 8]
push 2
xor ebx, ebx
cmp eax, dword [0x47e194]
pop edx
jne 0x4462f1
mov ecx, dword [0x47e13c]
cmp ecx, ebx
jne 0x4462de
test byte [ebp - 0x1b], 0xc0
jne 0x44630f
mov dword [0x47e13c], 1
jmp 0x446315
cmp ecx, 1
jne 0x44630f
test byte [ebp - 0x1b], 0x80
je 0x44630f
mov dword [0x47e13c], edx
jmp 0x44630a
cmp dword [0x47e13c], 1
jne 0x446308
cmp eax, 0x11
je 0x446315
mov dword [0x47e13c], ebx
cmp ebx, 1
jle 0x446315
cmp dword [ebp - 4], ebx
je 0x44631a
mov dword [0x47e13c], ebx
cmp dword [ebp - 4], ebx
jne 0x446345
mov ecx, dword [0x47f570]
cmp dword [ecx + 0x144], ebx
je 0x446332
cmp dword [ebp - 0x18], ebx
jne 0x446332
cmp dword [ebp - 0x14], edx
jne 0x446345
cmp dword [ebp - 0x14], 3
je 0x446345
cmp dword [ebp - 0x10], ebx
jne 0x446345
cmp dword [0x47e13c], ebx
je 0x4463b5
test byte [ebp - 0x1b], 1
jne 0x4463b5
cmp eax, 0x25
ja 0x44637d
je 0x446379
sub eax, 0xc
je 0x446375
sub eax, 0x15
je 0x446371
dec eax
je 0x44636d
dec eax
je 0x446369
dec eax
jne 0x4463b5
push 0x67
jmp 0x4463a2
push 0x61
jmp 0x4463a2
push 0x63
jmp 0x4463a2
push 0x69
jmp 0x4463a2
push 0x65
jmp 0x4463a2
push 0x64
jmp 0x4463a2
sub eax, 0x26
je 0x4463a0
dec eax
je 0x44639c
dec eax
je 0x446398
sub eax, 5
je 0x446394
dec eax
jne 0x4463b5
push 0x6e
jmp 0x4463a2
push 0x60
jmp 0x4463a2
push 0x62
jmp 0x4463a2
push 0x66
jmp 0x4463a2
push 0x68
test byte [ebp - 0x9c], 1
pop eax
je 0x4463b2
or esi, 1
mov dword [ebp - 0xc], esi
mov dword [ebp + 8], eax
cmp dword [ebp - 0x2c], ebx
je 0x446c10
test byte [ebp - 0x87], 0x80
jne 0x446c10
cmp dword [0x47e13c], 0
jne 0x446c10
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4463e9
mov edi, dword [ebp + 0xc]
mov byte [edi], 0x1b
inc edi
mov dword [ebp - 8], edi
mov eax, dword [ebp + 8]
cmp eax, 0x21
jne 0x44641b
cmp esi, 1
jne 0x446410
push 0
push 2
push 0x115
push dword [0x47f57c]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x446f50
cmp esi, 2
jne 0x446436
push 0
push 0
jmp 0x4463fa
cmp eax, 0x22
jne 0x446457
cmp esi, 1
jne 0x44642b
push 0
push 3
jmp 0x4463fa
cmp esi, 2
jne 0x446436
push 0
push 1
jmp 0x4463fa
cmp esi, 3
jne 0x446457
xor eax, eax
cmp dword [ebp + 8], 0x21
setne al
push eax
push dword [0x47f570]
call fcn.004371a0
pop ecx
pop ecx
jmp 0x446f50
cmp eax, 0x2d
jne 0x44646a
cmp esi, 1
jne 0x44646a
push 0
call fcn.00444bfa
jmp 0x446451
test ebx, ebx
je 0x446508
cmp eax, 0x73
jne 0x446496
push 0x4e
push dword [0x47f55c]
call fcn.00402257
test eax, eax
pop ecx
pop ecx
je 0x446523
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp eax, 0x20
jne 0x4464c8
push 0x4f
push dword [0x47f55c]
call fcn.00402257
test eax, eax
pop ecx
pop ecx
je 0x446523
push 0
push 0xf100
push 0x112
push dword [0x47f57c]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x44648e
cmp eax, 0xd
jne 0x446508
push 0x54
push dword [0x47f55c]
call fcn.00402257
test eax, eax
pop ecx
pop ecx
je 0x446523
push 0x6a
push dword [0x47f55c]
call fcn.00402257
cmp eax, 1
pop ecx
pop ecx
je 0x446523
mov eax, dword [ebp - 0x1c]
and ax, 0xc000
cmp ax, 0x4000
je 0x44648e
call fcn.00445d47
jmp 0x44648e
cmp eax, 0x13
jne 0x446523
cmp esi, 2
jne 0x446523
mov eax, dword [0x47f570]
xor dword [eax + 0x144], 1
jmp 0x446f50
cmp dword [ebp - 0x10], 0
je 0x4465a8
test ebx, ebx
jne 0x446710
mov eax, dword [ebp + 8]
add eax, 0xffffff9f
cmp eax, 8
ja case.default.0x44653c
jmp dword [eax*4 + 0x446f57]
and esi, 3
mov al, byte [esi + 0x4733e0]
mov byte [edi], al
jmp 0x446835
and esi, 3
mov al, byte [esi + str.jJ_n_n]
jmp 0x44654c
and esi, 3
mov al, byte [esi + 0x4733d0]
jmp 0x44654c
and esi, 3
mov al, byte [esi + str.hH_b_b]
jmp 0x44654c
mov byte [edi], 0x2e
jmp 0x446835
and esi, 3
mov al, byte [esi + str.lL_f_f]
jmp 0x44654c
and esi, 3
mov al, byte [esi + 0x4733b8]
jmp 0x44654c
and esi, 3
mov al, byte [esi + str.kK_v_v]
jmp 0x44654c
and esi, 3
mov al, byte [esi + 0x4733a8]
jmp 0x44654c
test ebx, ebx
jne 0x446710
mov edx, dword [ebp - 0x14]
xor ebx, ebx
xor ecx, ecx
cmp edx, 3
je 0x4465d3
cmp edx, 1
jg 0x4465f8
mov eax, dword [0x47f570]
cmp dword [eax + 0x144], ebx
je 0x4465f8
cmp dword [ebp - 0x18], ebx
jne 0x4465f8
mov eax, dword [ebp + 8]
sub eax, 0x2b
je 0x4465f5
sub eax, 0x3f
je 0x4465f1
sub eax, 3
je 0x4465ed
dec eax
dec eax
jne 0x4465f8
push 0x51
jmp 0x4465f7
push 0x53
jmp 0x4465f7
push 0x52
jmp 0x4465f7
push 0x50
pop ecx
mov eax, dword [0x47f570]
cmp dword [eax + 0x144], ebx
je 0x4466d9
cmp dword [ebp - 0x18], ebx
jne 0x4466d9
mov eax, dword [ebp + 8]
cmp eax, 0x67
ja 0x44667c
je 0x446678
cmp eax, 0x63
ja 0x44665e
je 0x44665a
sub eax, 0xd
je 0x44664c
sub eax, 0x53
je 0x446645
dec eax
je 0x44663e
dec eax
jne 0x4466d9
push 0x72
jmp 0x4466d3
push 0x71
jmp 0x4466d3
push 0x70
jmp 0x4466d3
test byte [ebp - 0x1b], 1
je 0x4466d9
push 0x4d
jmp 0x4466d8
push 0x73
jmp 0x4466d3
mov eax, dword [ebp + 8]
sub eax, 0x64
je 0x446674
dec eax
je 0x446670
dec eax
jne 0x4466d9
push 0x76
jmp 0x4466d3
push 0x75
jmp 0x4466d3
push 0x74
jmp 0x4466d3
push 0x77
jmp 0x4466d3
mov eax, dword [ebp + 8]
sub eax, 0x68
je 0x4466d6
dec eax
je 0x4466d1
dec eax
je 0x4466c8
dec eax
je 0x4466ad
dec eax
dec eax
je 0x4466a4
dec eax
je 0x4466a0
dec eax
jne 0x4466d9
cmp edx, 2
jne 0x4466d9
push 0x6f
jmp 0x4466d8
push 0x6e
jmp 0x4466d3
cmp edx, 2
jne 0x4466d9
push 0x6d
jmp 0x4466d8
xor ecx, ecx
cmp edx, 2
jne 0x4466be
cmp esi, ebx
setne cl
add ecx, 0x6b
jmp 0x4466dd
cmp esi, ebx
setne cl
add ecx, 0x6c
jmp 0x4466dd
cmp edx, 2
jne 0x4466d9
push 0x6a
jmp 0x4466d8
push 0x79
pop ecx
jmp 0x4466dd
push 0x78
pop ecx
cmp ecx, ebx
je 0x446710
mov eax, dword [0x47f570]
cmp dword [eax + 0x148], ebx
je 0x44670a
cmp ecx, 0x50
jl 0x4466ff
cmp ecx, 0x53
jg 0x4466ff
push ecx
push 0x470750
jmp 0x446b2e
push ecx
push str.e__c
jmp 0x446b2e
push ecx
jmp 0x446b29
mov eax, dword [ebp + 8]
cmp eax, 8
jne 0x44675a
test esi, esi
jne 0x44673a
push 0x3d
push dword [0x47f55c]
call fcn.00402257
neg eax
sbb al, al
and al, 0x77
add al, 8
pop ecx
pop ecx
mov byte [edi], al
jmp 0x446bda
cmp esi, 1
jne 0x4467c7
push 0x3d
push dword [0x47f55c]
call fcn.00402257
neg eax
sbb al, al
and al, 0x89
add al, 0x7f
jmp 0x446731
cmp eax, 9
jne 0x446774
cmp esi, 1
jne 0x4467c7
mov byte [edi], 0x1b
inc edi
mov byte [edi], 0x5b
inc edi
mov byte [edi], 0x5a
jmp 0x446835
cmp eax, 0x20
jne 0x446793
cmp esi, 2
jne 0x446786
mov byte [edi], 0
jmp 0x446835
cmp esi, 3
jne 0x4467c7
mov byte [edi], 0xa0
jmp 0x446835
cmp eax, 3
jne 0x4467ba
cmp esi, 2
jne 0x446807
mov eax, dword [0x47d144]
test eax, eax
je 0x446f50
push 1
push dword [0x47ce10]
call dword [eax + 0x18]
jmp 0x446450
cmp eax, 0x13
jne 0x4467c7
mov byte [edi], 0x1a
jmp 0x446bda
cmp esi, 2
jne 0x446807
cmp eax, 0x32
jb 0x4467e1
cmp eax, 0x38
ja 0x4467e1
mov al, byte [eax + 0x473366]
jmp 0x44654c
cmp eax, 0xbd
je 0x4467ef
cmp eax, 0xbf
jne 0x4467f4
mov byte [edi], 0x1f
jmp 0x446835
cmp eax, 0xdf
je 0x446802
cmp eax, 0xdc
jne 0x446840
mov byte [edi], 0x1c
jmp 0x446835
cmp esi, 3
jne 0x446818
cmp eax, 0xde
jne 0x446840
mov byte [edi], 0x1e
jmp 0x446835
test esi, esi
jne 0x446840
cmp eax, 0xd
jne 0x446840
mov eax, dword [0x47f570]
cmp dword [eax + 0x150], esi
je 0x446840
mov byte [edi], 0xd
inc edi
mov byte [edi], 0xa
mov eax, edi
sub eax, dword [ebp + 0xc]
inc eax
jmp 0x446491
mov ecx, dword [ebp + 8]
lea eax, [ecx - 0x70]
xor ebx, ebx
cmp eax, 0x13
push 0xb
mov dword [ebp - 0x10], eax
pop esi
ja case.default.0x446857
jmp dword [eax*4 + 0x446f7b]
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xc
add ebx, esi
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xc
add ebx, 0xc
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xc
add ebx, 0xd
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xc
add ebx, 0xe
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xd
add ebx, 0xf
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xc
add ebx, 0x11
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xd
add ebx, 0x12
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xd
add ebx, 0x13
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xd
add ebx, 0x14
jmp case.default.0x446857
mov bl, byte [ebp - 0x11c]
and bl, 0x80
neg bl
sbb ebx, ebx
and ebx, 0xd
add ebx, 0x15
jmp case.default.0x446857
push 0x17
jmp 0x446964
push 0x18
jmp 0x446964
push 0x19
jmp 0x446964
push 0x1a
jmp 0x446964
push 0x1c
jmp 0x446964
push 0x1d
jmp 0x446964
push 0x1f
jmp 0x446964
push 0x20
jmp 0x446964
push 0x21
jmp 0x446964
push 0x22
pop ebx
test byte [ebp - 0xc], 2
push 6
pop edx
jne 0x44699e
mov eax, ecx
sub eax, 0x21
je 0x44699b
dec eax
je 0x446997
dec eax
je 0x446993
dec eax
je 0x44698e
sub eax, 9
je 0x44698a
dec eax
jne 0x44699e
push 3
jmp 0x44699d
push 2
jmp 0x44699d
xor ebx, ebx
inc ebx
jmp 0x44699e
push 4
jmp 0x44699d
mov ebx, edx
jmp 0x44699e
push 5
pop ebx
cmp dword [ebp - 0x14], 3
jne 0x4469af
cmp ebx, edx
jg 0x4469af
movsx ebx, byte [ebx + 0x473390]
mov eax, dword [0x47f570]
mov ecx, dword [eax + 0x148]
test ecx, ecx
je 0x4469e1
test ebx, ebx
jle 0x4469e1
cmp ebx, edx
jg 0x4469e1
movsx eax, byte [ebx + str._HLMEIG]
push eax
push 0x470750
push edi
call fcn.00452d28
add esp, 0xc
jmp 0x446bc9
mov eax, dword [ebp - 0x14]
cmp eax, 5
jne 0x446acf
cmp ebx, esi
jl 0x446a8c
cmp ebx, 0x22
jg 0x446a8c
push 0xc
pop ecx
mov esi, str.MNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_____
lea edi, [ebp - 0x160]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp ecx, 0xb
movsb byte es:[edi], byte [esi]
ja case.default.0x446a19
jmp dword [ecx*4 + 0x446fcb]
xor eax, eax
jmp case.default.0x446a19
xor eax, eax
inc eax
jmp case.default.0x446a19
push 2
jmp 0x446a4f
push 3
jmp 0x446a4f
push 4
jmp 0x446a4f
push 5
jmp 0x446a4f
mov eax, edx
jmp case.default.0x446a19
push 7
jmp 0x446a4f
push 8
jmp 0x446a4f
push 9
jmp 0x446a4f
push 0xa
jmp 0x446a4f
push 0xb
pop eax
test byte [ebp - 0x11c], 0x80
je 0x446a5c
add eax, 0xc
test byte [ebp - 0x11b], 0x80
je 0x446a68
add eax, 0x18
movsx eax, byte [ebp + eax - 0x160]
mov esi, dword [ebp - 8]
push eax
push 0x470740
push esi
call fcn.00452d28
sub esi, dword [ebp + 0xc]
add esp, 0xc
add eax, esi
jmp 0x446491
cmp ebx, 1
jl 0x446acf
cmp ebx, edx
jg 0x446acf
cmp ebx, 3
mov esi, str.HL.FIG
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jne 0x446ab1
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [eax], 0x7f
jmp 0x446aca
movsx eax, byte [ebp + ebx - 0x2d]
push eax
push 0x470740
push dword [ebp - 8]
call fcn.00452d28
add esp, 0xc
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x446b3b
test ecx, ecx
jne 0x446ad8
cmp eax, 4
jne 0x446af3
cmp ebx, esi
jl 0x446af3
cmp ebx, 0x18
jg 0x446af3
xor eax, eax
cmp ebx, 0xf
jle 0x446ae9
inc eax
cmp ebx, 0x15
jle 0x446aef
inc eax
sub ebx, eax
jmp 0x446b1d
cmp eax, 1
jne 0x446b0f
cmp ebx, esi
jl 0x446b43
cmp ebx, 0xf
jg 0x446b43
add ebx, 0x36
push ebx
push str.e___c
jmp 0x4469d3
cmp eax, 2
jne 0x446b43
cmp ebx, esi
jl 0x446b43
cmp ebx, 0xe
jg 0x446b43
add ebx, 0x45
test ecx, ecx
push ebx
jne 0x4466f5
push str.eO_c
push edi
call fcn.00452d28
add esp, 0xc
add edi, eax
mov eax, edi
sub eax, dword [ebp + 0xc]
jmp 0x446491
cmp ebx, 1
je 0x446b4d
cmp ebx, 4
jne 0x446b7a
push 0x3e
push dword [0x47f55c]
call fcn.00402257
test eax, eax
pop ecx
pop ecx
je 0x446b7a
cmp ebx, 1
mov eax, 0x473340
je 0x446b6f
mov eax, 0x47333c
push eax
push edi
call fcn.00452d28
pop ecx
pop ecx
jmp 0x446bc9
test ebx, ebx
je 0x446b89
push ebx
push str.e__d
jmp 0x4469d3
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, 0xc
je 0x446bb1
sub eax, 0x19
je 0x446bad
dec eax
je 0x446ba9
dec eax
je 0x446ba5
dec eax
jne 0x446bd3
mov al, 0x42
jmp 0x446bb3
mov al, 0x43
jmp 0x446bb3
mov al, 0x41
jmp 0x446bb3
mov al, 0x44
jmp 0x446bb3
mov al, 0x47
push dword [ebp - 0xc]
movsx eax, al
push eax
push dword [0x47f570]
push edi
call fcn.00436cdc
add esp, 0x10
sub edi, dword [ebp + 0xc]
add eax, edi
jmp 0x446491
cmp ecx, 0xd
jne 0x446be6
mov byte [edi], cl
push 0xfffffffffffffffe
mov byte [edi + 1], 0
pop eax
jmp 0x446491
cmp dword [ebp - 4], 0
je 0x446c09
cmp ecx, 0x60
jb 0x446c09
cmp ecx, 0x69
ja 0x446c09
mov eax, dword [0x47e18c]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2 - 0x60]
mov dword [0x47e18c], eax
jmp 0x446c10
and dword [0x47e18c], 0
and dword [ebp - 0x10], 0
cmp byte [ebp - 0x118], 0
je 0x446c45
push 0x8f
push dword [0x47f55c]
call fcn.00402257
test eax, eax
pop ecx
pop ecx
je 0x446c45
xor eax, eax
cmp dword [ebp - 4], eax
mov byte [ebp - 0x118], 0
sete al
mov dword [ebp - 0x10], eax
cmp dword [0x47f4d0], 2
jne 0x446c77
mov eax, dword [0x47e0f0]
test eax, eax
je 0x446c77
push dword [ebp - 0x20]
xor edi, edi
push edi
push 3
push 0x47dcc4
lea ecx, [ebp - 0x12c]
push ecx
push dword [ebp - 0x24]
push dword [ebp + 8]
call eax
mov esi, eax
jmp 0x446ccf
push dword [ebp - 0x20]
lea eax, [ebp - 0x12c]
push 0
push 0x47ccf0
push eax
push dword [ebp - 0x24]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov esi, eax
test esi, esi
jle 0x446ee9
xor eax, eax
test esi, esi
jle 0x446cb6
mov cl, byte [eax*2 + 0x47ccf0]
mov byte [eax + 0x47cce0], cl
inc eax
cmp eax, esi
jl 0x446ca4
push 3
push 0x47dcc4
push esi
push 0x47cce0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
cmp esi, edi
jle 0x446ee9
xor ebx, ebx
cmp esi, edi
jle 0x446ed6
mov ecx, dword [0x47e13c]
xor eax, eax
cmp ecx, 2
mov ax, word [ebx*2 + 0x47dcc4]
mov dword [ebp - 0x18], eax
jne 0x446d20
cmp ax, 0x20
jb 0x446d83
cmp ax, 0x80
jae 0x446d83
movzx eax, ax
mov dword [0x47e190], eax
mov dword [0x47e13c], 3
jmp 0x446ecd
cmp ecx, 3
jne 0x446d83
cmp ax, 0x20
jb 0x446d83
cmp ax, 0x80
jae 0x446d83
movzx eax, ax
push eax
push dword [0x47e190]
mov dword [0x47e13c], edi
call fcn.004501bb
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x446edf
push dword [0x47f570]
mov dword [ebp - 0xc], eax
call fcn.00437384
mov eax, dword [0x47d158]
cmp eax, edi
pop ecx
je 0x446ecd
push 1
push 1
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.004091dd
add esp, 0x10
jmp 0x446ecd
cmp dword [ebp - 0x2c], edi
mov dword [0x47e13c], edi
jne 0x446e37
mov ecx, dword [0x47e18c]
cmp ecx, edi
je 0x446e12
mov eax, dword [0x47f570]
cmp dword [eax + 0xdc], edi
jne 0x446de3
mov edx, dword [eax + 0x1090]
cmp dword [edx + 0xc], 0xfde9
je 0x446de3
cmp dword [0x47d164], edi
jne 0x446de3
push eax
mov byte [ebp + 0xf], cl
call fcn.00437384
mov eax, dword [0x47d158]
cmp eax, edi
pop ecx
je 0x446e07
push 1
push 1
lea ecx, [ebp + 0xf]
push ecx
push eax
call fcn.00408ad7
jmp 0x446e04
push eax
mov dword [ebp - 0xc], ecx
call fcn.00437384
mov eax, dword [0x47d158]
cmp eax, edi
pop ecx
je 0x446e07
push 1
push 1
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.004091dd
add esp, 0x10
mov dword [0x47e18c], edi
jmp 0x446ec6
push dword [0x47f570]
call fcn.00437384
mov eax, dword [0x47d158]
cmp eax, edi
pop ecx
je 0x446ec6
push 1
push 1
lea ecx, [ebp - 0x18]
jmp 0x446ebc
cmp dword [ebp - 0x10], edi
je 0x446e85
cmp ax, 0x80
jae 0x446e85
movzx eax, ax
push eax
mov word [ebp - 0x24], 0x1b
call fcn.00450119
push dword [0x47f570]
mov word [ebp - 0x22], ax
call fcn.00437384
mov eax, dword [0x47d158]
cmp eax, edi
pop ecx
pop ecx
je 0x446ec6
xor ecx, ecx
cmp dword [ebp - 4], edi
push 1
setne cl
inc ecx
push ecx
xor ecx, ecx
cmp dword [ebp - 4], edi
sete cl
lea ecx, [ebp + ecx*2 - 0x24]
jmp 0x446ebc
push dword [0x47f570]
mov word [ebp - 0x20], 0x1b
mov word [ebp - 0x1e], ax
call fcn.00437384
mov eax, dword [0x47d158]
cmp eax, edi
pop ecx
je 0x446ec6
xor ecx, ecx
cmp dword [ebp - 4], edi
push 1
setne cl
inc ecx
push ecx
xor ecx, ecx
cmp dword [ebp - 4], edi
sete cl
lea ecx, [ebp + ecx*2 - 0x20]
push ecx
push eax
call fcn.004091dd
add esp, 0x10
xor eax, eax
call fcn.00443009
inc ebx
cmp ebx, esi
jl 0x446ce1
mov word [0x47dcc4], di
jmp 0x446f50
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x446f50
xor ecx, ecx
cmp dword [ebp - 4], ecx
jne 0x446ef9
mov word [0x47dcc4], cx
jmp 0x446f2f
cmp word [0x47dcc4], cx
je 0x446f2f
mov eax, dword [0x47f570]
cmp dword [eax + 0xdc], ecx
jne 0x446f26
mov eax, dword [eax + 0x1090]
cmp dword [eax + 0xc], 0xfde9
je 0x446f26
cmp dword [0x47d164], ecx
je 0x446f2f
mov word [0x47dcc4], 0xa
cmp dword [ebp + 8], 0x12
jne 0x44648e
push 0x50
push dword [0x47f55c]
call fcn.00402257
test eax, eax
pop ecx
pop ecx
jne 0x44648e
xor eax, eax
jmp 0x446491