Function at 0x40c6d0
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi], 0
je 0x40d927
mov bl, byte [ebp + 0xc]
mov esi, dword [0x49d3c8]
mov dword [ebp - 0x40], esi
test bl, bl
jne 0x40c76d
push 7
push 0x491a84
push edi
call fcn.00477695
add esp, 0xc
test eax, eax
jne 0x40c76d
add edi, 7
mov byte [0x49f956], 1
mov dword [ebp + 8], edi
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x64]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], ecx
cmp eax, 1
je 0x40c732
cmp eax, 3
jne 0x40c7a3
cmp dword [0x4a3304], 0
je 0x40c779
call fcn.00408480
test al, al
jne 0x40c776
test bl, bl
jne 0x40c764
call fcn.004084e0
test al, al
je 0x40c764
push reloc.USER32.dll_DestroyWindow
mov eax, edi
call fcn.00464370
add esp, 4
test eax, eax
jne 0x40c776
mov dword [ebp + 0x10], 1
jmp 0x40c7a3
mov byte [0x49f956], 0
jmp 0x40c719
mov eax, dword [ebp + 0x10]
cmp eax, 3
jne 0x40c787
mov dword [ebp + 0x10], 2
jmp 0x40c7a3
xor eax, eax
mov dword [ebp + 0x10], eax
cmp dword [esi + 0x5c], eax
jge 0x40c799
cmp dword [esi + 0x64], eax
jge 0x40c799
or eax, reloc.USER32.dll_AdjustWindowRectEx
mov dword [esi + 0x64], eax
mov dword [esi + 0x5c], reloc.USER32.dll_AdjustWindowRectEx
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov byte [ebp - 0x11], 0
test esi, esi
je 0x40c7fb
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
mov dword [ebp - 0x5c], edi
test edi, edi
je 0x40c8f7
cmp edi, dword [0x4a2bbc]
je 0x40c8f7
call fcn.00468640
test al, al
jne 0x40c8f7
mov edx, dword [0x4a2bbc]
push 1
push edi
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [ebp - 0x11]
mov ebx, edi
jmp 0x40c8f7
test byte [0x4a30c9], 0xc0
je 0x40c8e2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4a30c0]
cmp eax, 0x32
jae 0x40c8e2
xor esi, esi
cmp dword [ebp + 0x10], esi
jne 0x40c8e2
cmp byte [0x49f956], bl
jne 0x40c8e2
cmp byte [0x4a32ee], bl
je 0x40c8e2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4a2bbc]
jne 0x40c8e2
mov eax, dword [ebp + 8]
mov edi, 0x491a94
call fcn.00408bf0
cmp byte [ebp + 0xc], bl
je 0x40c8b3
test eax, eax
setne al
test al, al
je 0x40c8e2
lea ecx, [ecx]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
jne 0x40c892
push 0x5c
call edi
mov edx, 0x8000
test dx, ax
je 0x40c8e2
push 1
push 0x8000012f
mov dword [0x49d328], esi
call fcn.00401340
add esp, 8
mov dword [0x49d328], 1
jmp 0x40c870
cmp eax, esi
je 0x40c8e2
jmp 0x40c8c0
inc eax
mov edi, 0x491a98
call fcn.00408bf0
cmp eax, esi
je 0x40c870
cmp byte [eax], 0x7b
je 0x40c870
mov edi, 0x491a94
call fcn.00408bf0
cmp eax, esi
jne 0x40c8c0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40c8f7
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x49f97c], eax
push eax
xor eax, eax
call fcn.00410d50
add esp, 4
push 1
mov dword [0x49f978], eax
call fcn.00410850
add esp, 4
cmp dword [0x4a0b68], 0
mov bl, al
mov byte [ebp - 4], bl
je 0x40c947
mov cl, byte [0x4a0a35]
mov dl, byte [0x4a0a37]
mov al, cl
not cl
and al, dl
and cl, dl
mov byte [ebp - 3], dl
mov byte [ebp - 9], cl
jmp 0x40c972
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4a30c0]
cmp eax, dword [0x49d320]
jae 0x40c967
mov al, byte [0x4a30c9]
and al, bl
mov byte [ebp - 3], al
jmp 0x40c96e
mov byte [ebp - 3], 0
mov al, byte [ebp - 3]
mov byte [ebp - 9], 0
mov cl, byte [0x4a14ef]
not al
and al, bl
and cl, al
mov al, byte [0x49f956]
mov byte [0x4a14ef], cl
test al, al
je 0x40c999
not cl
and cl, bl
mov byte [ebp - 2], cl
mov byte [ebp - 8], bl
jmp 0x40c9a0
mov byte [ebp - 2], 0
mov byte [ebp - 8], cl
mov ecx, dword [ebp - 0x40]
cmp byte [ecx + 0xca], 0
je 0x40ca79
test al, al
jne 0x40ca79
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push DestroyWindow
call esi
and al, 1
movsx edi, al
neg edi
sbb edi, edi
add edi, 2
cmp edi, 2
jne 0x40c9db
mov dword [ebp - 0x44], edi
jmp 0x40ca80
push 0xffc3d44d
push 0
push 0
push 0
push DestroyWindow
push 2
call fcn.0040e2a0
add esp, 0x18
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
sete bl
test bl, bl
je 0x40ca2e
push 1
push 0xffffffffffffffff
mov dword [0x49d328], 0
call fcn.00401340
add esp, 8
mov dword [0x49d328], 1
push DestroyWindow
call esi
test al, 1
je 0x40ca71
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 2
call fcn.0040e2a0
add esp, 0x18
test bl, bl
je 0x40ca71
push 1
push 0xffffffffffffffff
mov dword [0x49d328], 0
call fcn.00401340
add esp, 8
mov dword [0x49d328], 1
mov bl, byte [ebp - 4]
mov dword [ebp - 0x44], edi
jmp 0x40ca80
mov dword [ebp - 0x44], 0
mov esi, dword [ebp + 0x10]
mov dword [0x4a2500], esi
test esi, esi
je 0x40caf2
cmp esi, 1
jne 0x40caa3
mov eax, 0x36b0
mov dword [0x49f96c], 0x1f4
jmp 0x40cab2
mov eax, 0x2ee0
mov dword [0x49f96c], 0x5dc
call fcn.004854f0
mov eax, esp
mov dword [0x49f974], eax
mov eax, 0x80000000
mov byte [0x49f95e], bl
mov dword [0x49f960], eax
mov dword [0x49f964], eax
mov byte [0x49f95d], 0
mov dword [0x49f970], 0
mov byte [0x49f95c], 0
mov byte [0x49f957], 1
mov eax, dword [0x49d3d8]
mov dl, byte [0x4a14b2]
mov byte [ebp - 0x29], dl
cmp eax, 8
je 0x40cb0a
cmp eax, 0xa
jne 0x40cb45
test esi, esi
jne 0x40cb45
cmp dword [ebp + 0x14], esi
jne 0x40cb45
test byte [0x4a3b94], 1
mov byte [ebp - 4], 1
jne 0x40cb4b
or dword [0x4a3b94], 1
push 0x49081c
push 0x491a7c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4a3b90], eax
jmp 0x40cb50
mov byte [ebp - 4], 0
jmp 0x40cb5f
mov eax, dword [0x4a3b90]
test eax, eax
je 0x40cb58
push 1
call eax
mov byte [0x4a14b2], 1
mov eax, dword [ebp + 8]
mov byte [ebp - 0xf], 0
cmp byte [eax], 0
mov byte [ebp - 1], 0
je 0x40d4a7
mov bl, byte [ebp - 8]
cmp dword [0x4a2500], 0
mov byte [ebp - 0xa], 0
jne 0x40cbdf
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4a3104]
mov ecx, dword [0x49d3c8]
cmp eax, dword [ecx + 0xb0]
jbe 0x40cbdf
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40cbd8
push 1
push 0xffffffffffffffff
mov dword [0x49d328], 0
call fcn.00401340
add esp, 8
mov dword [0x49d328], 1
call esi
mov dword [0x4a3104], eax
cmp byte [ebp + 0xc], 0
jne 0x40d4e9
mov esi, dword [ebp + 8]
movsx eax, byte [esi]
push eax
push 0x491a9c
call fcn.00477c01
add esp, 8
test eax, eax
je 0x40d4e9
movsx eax, byte [esi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x40cc1b.34
movzx eax, byte [eax + 0x40d950]
jmp dword [eax*4 + 0x40d934]
test bl, 3
jne case.0x40cc1b.34
or byte [ebp - 1], 1
jmp case.0x40cc1b.34
test bl, 0x30
jne case.0x40cc1b.34
or byte [ebp - 1], 0x10
jmp case.0x40cc1b.34
test bl, 0xc
jne case.0x40cc1b.34
or byte [ebp - 1], 4
jmp case.0x40cc1b.34
cmp byte [0x4a30e7], 0
jne case.0x40cc1b.34
test bl, 0xc0
jne case.0x40cc1b.34
or byte [ebp - 1], 0x40
jmp case.0x40cc1b.34
mov esi, dword [ebp + 8]
inc esi
push 0x7d
push esi
call fcn.00477c01
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
test edi, edi
je case.0x40cc1b.34
mov ebx, esi
mov al, byte [ebx]
cmp al, 0x20
je 0x40cc9f
cmp al, 9
jne 0x40cca2
inc ebx
jmp 0x40cc95
mov esi, edi
sub esi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x34], esi
jne 0x40cd3d
mov al, byte [edi + 1]
lea esi, [edi + 1]
cmp al, 0x7d
jne 0x40cccb
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], 1
jmp 0x40cd37
cmp al, 0x20
je 0x40cce0
cmp al, 9
jne 0x40d481
mov ebx, dword [ebp - 0x20]
lea ebx, [ebx]
mov al, byte [esi]
cmp al, 0x20
je 0x40ccea
cmp al, 9
jne 0x40cced
inc esi
jmp 0x40cce0
push 4
push str.Form1
push esi
call fcn.00477695
add esp, 0xc
test eax, eax
je 0x40cd1c
push 2
push str.Module1
push esi
call fcn.00477695
add esp, 0xc
test eax, eax
jne 0x40d481
mov ebx, dword [ebp - 0x20]
push 0x7d
push esi
call fcn.00477c01
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x40d48b
sub eax, ebx
mov dword [ebp - 0x34], eax
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x1c]
push 5
push 0x491100
push ebx
call fcn.00477695
add esp, 0xc
test eax, eax
jne 0x40cde2
mov byte [edi], al
lea eax, [ebx + 5]
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, 0x20
je 0x40cd6c
cmp cl, 9
jne 0x40cd6f
inc eax
jmp 0x40cd60
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.0040e9f0
mov ecx, dword [ebp - 0x30]
add esp, 0x18
mov byte [edi], 0x7d
cmp ecx, 1
jge 0x40cdc1
mov ecx, dword [ebp - 0x40]
movzx edx, byte [ecx + 0xc7]
mov eax, dword [ebp - 0x50]
push eax
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x6c]
call fcn.0040f6d0
add esp, 0x10
jmp 0x40d481
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
push edx
mov edx, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp + 0x14]
push edx
mov edx, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push 0
push edx
push eax
push 0
jmp 0x40d472
push 3
push 0x491aa4
push ebx
call fcn.00477695
add esp, 0xc
test eax, eax
jne 0x40cdff
mov byte [ebp + 0xc], 1
jmp 0x40d481
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
mov edi, 0x4918e4
mov eax, ebx
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], esi
call fcn.00408bf0
mov dword [ebp - 0x60], eax
test eax, eax
je 0x40cea9
mov cl, byte [eax]
mov byte [ebp - 0x2b], cl
mov ecx, eax
sub ecx, ebx
mov byte [eax], 0
mov dword [ebp - 0x24], ecx
lea esi, [eax + 1]
nop
mov al, byte [esi]
cmp al, 0x20
je 0x40ce4a
cmp al, 9
jne 0x40ce4d
inc esi
jmp 0x40ce40
mov edx, dword [ebp - 0x1c]
sub edx, esi
je 0x40cea9
push 4
push str.Form1
push esi
call fcn.00477695
add esp, 0xc
test eax, eax
jne 0x40ce86
push 4
push 0x491aa8
add esi, 4
push esi
mov dword [ebp - 0x18], eax
call fcn.00477695
add esp, 0xc
test eax, eax
setne byte [ebp - 0x2a]
jmp 0x40cea9
push str.Module1
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
jne 0x40cea1
mov dword [ebp - 0x18], 1
jmp 0x40cea9
call fcn.0040c2c0
mov dword [ebp - 0x30], eax
mov al, byte [ebx]
test al, al
je 0x40cee2
cmp byte [ebx + 1], 0
jne 0x40cec5
mov ecx, dword [0x49f97c]
lea esi, [ebp - 1]
call fcn.00410ff0
jmp 0x40cee4
xor esi, esi
mov eax, dword [esi*8 + reloc.USER32.dll_AdjustWindowRectEx]
push ebx
push eax
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x40cef9
inc esi
cmp esi, 0x6d
jl 0x40cec7
xor al, al
mov esi, dword [ebp - 0x20]
mov bl, al
mov byte [ebp - 0x28], bl
test al, al
je 0x40cf02
mov dword [ebp + 8], 0
jmp 0x40cf74
mov al, byte [esi*8 + 0x49e10c]
jmp 0x40cee4
mov eax, esi
call fcn.00410e90
movzx edi, ax
mov dword [ebp + 8], edi
test di, di
jne 0x40cf77
mov al, byte [esi]
call fcn.00408bc0
cmp al, 0x56
jne 0x40cf77
mov al, byte [esi + 1]
call fcn.00408bc0
cmp al, 0x4b
jne 0x40cf77
lea ebx, [esi + 2]
mov edi, reloc.USER32.dll_DestroyWindow
mov eax, ebx
call fcn.00408bf0
mov edi, eax
test edi, edi
je 0x40cf62
mov al, byte [edi + 1]
call fcn.00408bc0
cmp al, 0x43
jne 0x40cf62
push 0x10
push 0
add edi, 2
push edi
call fcn.00478594
movzx eax, ax
add esp, 0xc
mov dword [ebp + 8], eax
push 0x10
push 0
push ebx
call fcn.00478594
mov bl, al
add esp, 0xc
mov byte [ebp - 0x28], bl
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x40cf83
mov cl, byte [ebp - 0x2b]
mov byte [eax], cl
mov edx, dword [ebp - 0x1c]
mov eax, 1
mov byte [edx], 0x7d
cmp dword [ebp - 0x30], eax
jl 0x40d481
test bl, bl
jne 0x40d3e0
test di, di
jne 0x40d3e0
cmp dword [ebp - 0x24], eax
jne 0x40cfe3
cmp dword [ebp - 0x18], eax
je 0x40d481
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40cfd4
movsx ecx, byte [esi]
push 0
push ecx
push 0x102
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40d481
mov eax, dword [ebp - 0x30]
mov cl, byte [esi]
call fcn.0040dde0
jmp 0x40d481
cmp dword [ebp + 0x14], 0
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x20]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x18]
sete bl
push eax
call fcn.00411060
add esp, 8
mov byte [ebp - 0x28], al
test al, al
je 0x40d1db
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x40d021
cmp dword [ebp - 0x18], edi
jne 0x40d01c
mov byte [ebp - 0xa], al
jmp 0x40d021
call fcn.0040c490
cmp dword [0x4a2500], 0
je 0x40d035
mov bl, byte [0x49f95e]
jmp 0x40d127
cmp dword [0x4a0b68], 0
je 0x40d049
mov bl, byte [0x4a0a35]
jmp 0x40d127
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
xor bl, bl
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d064
mov bl, 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x40d078
or bl, 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d08c
or bl, 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x40d0a0
or bl, 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d0b4
or bl, 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x40d0c8
or bl, 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d0d9
or bl, 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x40d0ea
or bl, 0x80
cmp dword [0x4a0b68], 0
je 0x40d127
mov al, bl
not al
and al, byte [0x4a0a35]
je 0x40d127
mov cl, byte [0x4a0a37]
not al
and byte [0x4a0a35], al
and byte [0x4a0a36], al
and cl, al
mov al, cl
mov byte [0x4a0a37], cl
mov ecx, 0x4a0a58
call fcn.00410950
mov eax, dword [ebp - 8]
push 0
push 0
push edi
push ebx
push eax
mov eax, 0xffc3d44d
call fcn.004101a0
mov eax, dword [ebp - 0x30]
add esp, 0x14
test eax, eax
jle 0x40d481
mov ebx, dword [ebp - 0x28]
mov edi, eax
mov edi, edi
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
push 0xffc3d44d
push 1
push ecx
push 0
push ebx
push edx
call fcn.0040e2a0
add esp, 0x18
cmp dword [0x4a2500], 0
jne 0x40d1cf
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4a3104]
mov ecx, dword [0x49d3c8]
cmp eax, dword [ecx + 0xb0]
jbe 0x40d1cf
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40d1c8
push 1
push 0xffffffffffffffff
mov dword [0x49d328], 0
call fcn.00401340
add esp, 8
mov dword [0x49d328], 1
call esi
mov dword [0x4a3104], eax
dec edi
jne 0x40d150
jmp 0x40d481
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x20]
cmp edi, 4
jbe 0x40d215
push 4
push 0x491ab4
push esi
call fcn.00477695
add esp, 0xc
test eax, eax
jne 0x40d215
cmp dword [ebp + 0x14], eax
jne 0x40d215
lea eax, [esi + 3]
mov cl, byte [eax]
cmp cl, 0x20
je 0x40d212
cmp cl, 9
jne 0x40d3ad
inc eax
jmp 0x40d202
cmp edi, 2
jbe 0x40d481
push 2
push 0x491abc
push esi
call fcn.00477695
add esp, 0xc
test eax, eax
jne 0x40d481
push 0x10
push eax
add esi, 2
push esi
call fcn.00478594
movzx esi, ax
mov eax, dword [ebp + 0x14]
add esp, 0xc
test eax, eax
je 0x40d263
push 0
push esi
push 0x102
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40d3b2
mov eax, dword [0x4a2500]
cmp eax, 2
je 0x40d397
test eax, eax
je 0x40d280
mov bl, byte [0x49f95e]
jmp 0x40d372
cmp dword [0x4a0b68], 0
je 0x40d294
mov bl, byte [0x4a0a35]
jmp 0x40d372
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
xor bl, bl
call edi
mov ecx, 0x8000
test cx, ax
je 0x40d2af
mov bl, 0x10
push 0xa1
call edi
mov edx, 0x8000
test dx, ax
je 0x40d2c3
or bl, 0x20
push 0xa2
call edi
mov ecx, 0x8000
test cx, ax
je 0x40d2d7
or bl, 1
push 0xa3
call edi
mov edx, 0x8000
test dx, ax
je 0x40d2eb
or bl, 2
push 0xa4
call edi
mov ecx, 0x8000
test cx, ax
je 0x40d2ff
or bl, 4
push 0xa5
call edi
mov edx, 0x8000
test dx, ax
je 0x40d313
or bl, 8
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
je 0x40d324
or bl, 0x40
push 0x5c
call edi
mov edx, 0x8000
test dx, ax
je 0x40d335
or bl, 0x80
cmp dword [0x4a0b68], 0
je 0x40d372
mov al, bl
not al
and al, byte [0x4a0a35]
je 0x40d372
mov cl, byte [0x4a0a37]
not al
and byte [0x4a0a35], al
and byte [0x4a0a36], al
and cl, al
mov al, cl
mov byte [0x4a0a37], cl
mov ecx, 0x4a0a58
call fcn.00410950
mov al, byte [ebp - 1]
or al, byte [ebp - 8]
push 1
push 0
movzx eax, al
push 0
push ebx
push eax
mov eax, 0xffc3d44f
call fcn.004101a0
add esp, 0x14
call fcn.0040c510
jmp 0x40d3b2
push 0xa
lea ecx, [ebp - 0x67]
push ecx
push esi
mov byte [ebp - 0x68], 0x30
call fcn.00476952
add esp, 0xc
lea eax, [ebp - 0x68]
call fcn.0040dec0
cmp dword [0x4a2500], 2
jne 0x40d3cd
mov eax, dword [0x49d3c8]
mov esi, dword [eax + 0x60]
call fcn.0040fdf0
jmp 0x40d481
mov ecx, dword [0x49d3c8]
mov esi, dword [ecx + 0x5c]
call fcn.0040fdf0
jmp 0x40d481
xor ecx, ecx
mov edx, edi
mov al, bl
call fcn.00410a20
mov byte [ebp - 0x3c], al
test al, al
je 0x40d452
cmp dword [ebp + 0x14], 0
jne 0x40d452
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x40d418
mov byte [ebp - 0xa], bl
cmp byte [ebp - 0x2a], al
je 0x40d410
mov dl, byte [ebp - 0x3c]
or byte [0x4a14ef], dl
mov al, byte [ebp - 0x3c]
or byte [ebp - 8], al
jmp 0x40d452
cmp eax, 1
jne 0x40d452
mov al, bl
call fcn.0040c490
mov al, byte [ebp - 0x3c]
mov cl, byte [0x4a14ef]
not al
and byte [ebp - 2], al
and cl, al
mov byte [0x4a14ef], cl
cmp bl, 0xa5
jne 0x40d44c
cmp dword [0x49f978], 3
jne 0x40d44c
and byte [ebp - 2], 0xfe
or cl, byte [ebp - 2]
mov byte [ebp - 8], cl
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
push 0
push 0x80000000
push 0x80000000
push ecx
mov ecx, dword [ebp - 8]
push edx
push eax
push ecx
mov ecx, dword [ebp - 0x30]
push edi
mov edx, dword [ebp - 0x28]
mov al, byte [ebp - 1]
push edx
call fcn.0040d9b0
add esp, 0x24
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
mov byte [ebp - 1], 0
mov bl, byte [ebp - 8]
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0xa]
inc eax
cmp byte [eax], 0
mov dword [ebp + 8], eax
mov byte [0x4a14ee], cl
jne 0x40cb76
xor edi, edi
cmp dword [0x4a2500], edi
je 0x40d69a
cmp byte [0x49f95c], 0
mov dword [ebp - 0x24], reloc.USER32.dll_AdjustWindowRectEx
jne 0x40d656
cmp dword [0x49f970], edi
jbe 0x40d656
cmp byte [0x49f956], 0
je 0x40d614
xor eax, eax
jmp 0x40d620
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
mov byte [ebp - 0x10], al
test al, al
je 0x40d58e
cmp byte [ebp - 0xf], 0
jne 0x40d512
mov ecx, dword [0x49f97c]
lea esi, [ebp - 1]
call fcn.00410ff0
jmp 0x40d590
movzx esi, al
test esi, 0xffffff80
jne 0x40d52f
push 2
push esi
call fcn.0047814e
add esp, 8
test eax, eax
je 0x40d52f
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x56
jne 0x40d56b
movzx esi, byte [ebp - 0xf]
test esi, 0xffffff80
jne 0x40d553
push 2
push esi
call fcn.0047814e
add esp, 8
test eax, eax
je 0x40d553
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x4b
jne 0x40d56b
push 0x10
lea edx, [ebp - 0xe]
push 0
push edx
call fcn.00478594
add esp, 0xc
jmp 0x40d590
xor esi, esi
lea ecx, [ecx]
mov eax, dword [esi*8 + reloc.USER32.dll_AdjustWindowRectEx]
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x40d5d1
inc esi
cmp esi, 0x6d
jl 0x40d570
xor al, al
mov byte [ebp - 0x38], al
mov byte [ebp - 0x28], al
test al, al
je 0x40d5da
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x38]
push 0
push 0x80000000
push 0x80000000
push edx
push 0
push 2
push eax
mov al, byte [ebp - 1]
push 0
push ecx
mov ecx, 1
call fcn.0040d9b0
add esp, 0x24
mov byte [ebp - 1], 0
jmp case.0x40cc1b.34
mov al, byte [esi*8 + 0x49e10c]
jmp 0x40d590
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
test eax, eax
je 0x40d5ff
movsx ecx, byte [edx]
push 0
push ecx
push 0x102
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 1], 0
jmp case.0x40cc1b.34
mov cl, byte [edx]
mov eax, 1
call fcn.0040dde0
mov byte [ebp - 1], 0
jmp case.0x40cc1b.34
movzx eax, byte [ebp - 9]
movzx edx, byte [ebp - 3]
not eax
and eax, edx
or al, byte [ebp - 8]
mov ebx, 1
push ebx
mov byte [ebp + 8], al
movzx eax, byte [0x49f95e]
mov esi, dword [ebp + 8]
push ebx
push edi
push eax
push esi
mov eax, 0xffc3d44d
call fcn.004101a0
add esp, 0x14
lea ecx, [ebp - 0x24]
push esi
push ecx
call fcn.0040fca0
add esp, 8
jmp 0x40d65b
mov ebx, 1
mov eax, dword [0x4a2500]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x3e8
add eax, 0x1f4
cmp dword [0x49f96c], eax
jbe 0x40d687
mov edx, dword [0x49f974]
push edx
call fcn.004785bf
add esp, 4
mov esi, dword [ebp - 0x24]
mov dword [0x4a2500], edi
call fcn.0040fdf0
jmp 0x40d811
cmp dword [0x4a0b68], edi
je 0x40d6aa
mov cl, byte [0x4a0a37]
jmp 0x40d6cd
cmp dword [0x49d320], edi
jl 0x40d6ca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4a30c0]
cmp eax, dword [0x49d320]
jb 0x40d6ca
xor cl, cl
jmp 0x40d6cd
mov cl, byte [ebp - 3]
cmp byte [0x49f956], 0
je 0x40d6ef
mov dl, byte [ebp - 3]
mov al, cl
xor al, dl
mov bl, al
and bl, dl
not bl
and bl, byte [ebp - 8]
and al, cl
or bl, al
mov byte [ebp + 8], bl
jmp 0x40d6fc
mov al, byte [ebp - 9]
not al
and al, cl
or al, byte [ebp - 8]
mov byte [ebp + 8], al
cmp dword [0x4a0b68], edi
je 0x40d711
mov al, byte [0x4a0a35]
mov byte [ebp - 0x24], al
jmp 0x40d7f1
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
xor bl, bl
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d72c
mov bl, 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x40d740
or bl, 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d754
or bl, 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x40d768
or bl, 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d77c
or bl, 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x40d790
or bl, 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x40d7a1
or bl, 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x40d7b2
or bl, 0x80
cmp dword [0x4a0b68], edi
je 0x40d7ee
mov al, bl
not al
and al, byte [0x4a0a35]
je 0x40d7ee
mov cl, byte [0x4a0a37]
not al
and byte [0x4a0a35], al
and byte [0x4a0a36], al
and cl, al
mov al, cl
mov byte [0x4a0a37], cl
mov ecx, 0x4a0a58
call fcn.00410950
mov byte [ebp - 0x24], bl
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
mov ebx, 1
push ebx
push ebx
push eax
push ecx
push edx
mov eax, 0xffc3d44d
call fcn.004101a0
add esp, 0x14
cmp dword [0x4a0b68], edi
je 0x40d831
mov al, byte [0x4a0a36]
mov cl, al
xor cl, byte [0x4a0a35]
and cl, al
not cl
and al, cl
mov byte [0x4a0a36], al
cmp dword [ebp - 0x44], ebx
jne 0x40d883
push DestroyWindow
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
jne 0x40d883
push 0xffc3d44d
push edi
push edi
push edi
push DestroyWindow
push 2
call fcn.0040e2a0
add esp, 0x18
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
jne 0x40d883
push ebx
push 0xffffffffffffffff
mov dword [0x49d328], edi
call fcn.00401340
add esp, 8
mov dword [0x49d328], ebx
cmp byte [ebp - 0x11], 0
je 0x40d89a
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x4a2bbc]
push edi
push edx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp - 4], 0
je 0x40d8e6
cmp byte [ebp - 0x29], 0
jne 0x40d8e6
test byte [0x4a3b94], 1
jne 0x40d8d3
or dword [0x4a3b94], ebx
push 0x49081c
push 0x491a7c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4a3b90], eax
jmp 0x40d8d8
mov eax, dword [0x4a3b90]
cmp eax, edi
je 0x40d8df
push edi
call eax
mov byte [0x4a14b2], 0
cmp dword [ebp + 0x10], ebx
jne 0x40d918
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
jne 0x40d918
push ebx
push 0xffffffffffffffff
mov dword [0x49d328], edi
call fcn.00401340
add esp, 8
mov dword [0x49d328], ebx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x64], edx
lea esp, [ebp - 0x98]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret