Function at 0x404470
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [ebp + 0x24]
mov dl, byte [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
mov dword [esp + 0x20], 0x3fff
cmp eax, 0xffc3d44f
je 0x4044aa
cmp eax, 0xffc3d44e
je 0x4044aa
mov byte [esp + 0xd], 0
cmp eax, 0xffc3d44d
jne 0x4044af
mov byte [esp + 0xd], 1
mov ecx, dword [0x4a14b4]
test ecx, ecx
jne 0x4044c6
lea edi, [esp + 0x40]
mov dword [esp + 0x1c], edi
jmp 0x40456d
mov eax, dword [0x4a14b8]
mov edi, eax
imul edi, edi, 0x70
inc eax
add edi, ecx
mov dword [esp + 0x1c], edi
mov dword [0x4a14b8], eax
cmp eax, dword [0x49d32c]
jl 0x4044ee
mov dword [0x4a14b8], 0
mov al, byte [ebp + 0x18]
mov cl, byte [ebp + 0x20]
mov byte [edi], al
mov byte [edi + 5], cl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [0x4a32fc]
mov dword [0x4a14bc], eax
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
jns 0x40451c
fadd dword [0x497be0]
fdiv qword [0x497bd8]
mov dword [0x4a32fc], eax
fstp dword [edi + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x40455d
cmp esi, dword [0x4a14c0]
je 0x404557
mov ecx, dword [0x4a0a38]
push esi
lea eax, [edi + 0xc]
push eax
push 0x418
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x404564
mov byte [edi + 0xc], 0
jmp 0x404564
mov dword [edi + 0xc], 0x412f4e
mov dl, byte [ebp + 0x18]
mov dword [0x4a14c0], esi
cmp dl, 0xe7
jne 0x40458a
mov edx, dword [ebp + 0x14]
mov ax, word [edx + 4]
mov word [edi + 2], ax
mov byte [edi + 4], 0x55
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edx + 0x64]
mov word [edi + 2], bx
cmp cl, 3
ja 0x40459b
xor ebx, ebx
mov dword [ebp + 0x1c], ebx
mov eax, dword [ebp + 8]
cmp eax, dword [0x4a0b6c]
jne 0x4045cf
mov al, byte [ebp + 0x28]
and al, 1
mov byte [esp + 0xf], al
jne 0x4046ff
cmp byte [ebp + 0x20], 0
movzx edx, dl
setne cl
dec cl
and cl, 0x80
mov byte [edx + 0x4a0a58], cl
jmp 0x4046ff
mov eax, dword [ebp + 0x28]
shr eax, 4
and al, 1
mov byte [esp + 0xf], al
test ebx, 0x100
jne case.0x404611.13
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je case.0x404611.13
movzx eax, byte [ebp + 0x18]
add eax, 0xfffffff4
cmp eax, 0x62
ja case.0x404611.13
movzx ecx, byte [eax + 0x405f94]
jmp dword [ecx*4 + 0x405f64]
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x49f92c], dl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x49f92d], al
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x49f92e], cl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x49f92f], dl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x49f930], al
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x49f931], cl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x49f932], dl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x49f933], al
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x49f934], cl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x49f935], dl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x49f936], al
movzx esi, byte [ebp + 0x18]
mov edx, dword [0x4a14d8]
lea ecx, [esi + esi*8]
shl ecx, 5
cmp byte [ecx + edx + 4], 0
jne 0x4046ff
test byte [ebp + 0x28], 0x10
jne 0x4046ff
mov eax, dword [ebp + 0x20]
push eax
mov al, byte [ebp + 0x18]
call fcn.004073a0
add esp, 4
test al, al
je 0x4046ff
cmp byte [ebp + 0x20], 0
setne cl
dec cl
and cl, 0x80
mov byte [esi + 0x4a0a58], cl
cmp byte [esp + 0xd], 0
je 0x40470a
mov al, 0x69
jmp 0x404716
mov al, byte [esp + 0xf]
neg al
sbb al, al
and al, 0x41
add al, 0x20
cmp byte [0x4a0b58], 0
mov byte [edi + 4], al
je 0x40475c
mov al, byte [ebp + 0x18]
cmp al, 0x5b
je 0x40472d
cmp al, 0x5c
jne 0x40475c
cmp byte [ebp + 0x20], 0
jne 0x40475c
mov edx, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
push edx
xor bl, bl
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
call fcn.00406090
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x49f951], 0
je 0x404800
cmp byte [ebp + 0x18], 0x1b
jne 0x404800
cmp byte [ebp + 0x20], 0
jne 0x404800
push 0
push str.32771
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x404800
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
jne 0x404800
push 0xffc3d44d
push 0
push 0
push 0
push 0x1b
push 0
call fcn.0040e2a0
mov al, byte [0x4a0a35]
push 0xffc3d44d
shr al, 3
push 0
and al, 1
or al, 0xa4
push 0
movzx ecx, al
push 0
push ecx
push 1
call fcn.0040e2a0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
push 0x1b
xor bl, bl
call fcn.00406090
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, bx
lea edx, [eax + eax*8]
mov dword [esp + 0x30], eax
mov eax, dword [0x4a14dc]
shl edx, 5
mov cl, byte [eax + edx + 0x12]
add eax, edx
mov edx, dword [0x4a0b68]
mov byte [esp + 0x27], cl
cmp dword [ebp + 8], edx
jne 0x404832
test cl, cl
je 0x404832
mov cl, byte [ebp + 0x18]
mov esi, eax
jmp 0x404844
mov cl, byte [ebp + 0x18]
movzx eax, cl
lea esi, [eax + eax*8]
shl esi, 5
add esi, dword [0x4a14d8]
cmp byte [esp + 0xd], 0
mov dword [esp + 0x18], esi
je 0x404889
cmp dword [ebp + 0x24], 0xffc3d44e
jne 0x404878
cmp byte [ebp + 0x20], 0
je 0x404878
cmp dword [0x49f94c], esi
jne 0x404878
mov byte [esi + 0xc], 0
mov byte [esi + 0xf], 0
mov dword [0x49f94c], 0
mov ecx, dword [ebp + 0x20]
push 0
push 0x3fff
push edi
push ecx
jmp 0x405f3f
cmp byte [ebp + 0x20], 0
jne 0x40489c
mov eax, 0x3fff
mov byte [esi + 0x10], 0
mov word [esi + 6], ax
cmp dword [ebp + 8], edx
jne 0x404956
cmp byte [ebp + 0x20], 0
je 0x4049c5
cmp byte [0x49f955], 0
je 0x4048bd
cmp cl, 0x5b
je 0x4048ef
cmp byte [0x49f954], 0
je 0x4048cb
cmp cl, 0x5c
je 0x4048ef
cmp byte [0x49f953], 0
je 0x4048d9
cmp cl, 0xa4
je 0x4048ef
cmp byte [0x49f952], 0
je 0x4049c5
cmp cl, 0xa5
jne 0x4049c5
movzx eax, cl
add eax, 0xffffffa5
cmp eax, 0x4a
ja case.0x404901.93
movzx ecx, byte [eax + 0x40600c]
jmp dword [ecx*4 + 0x405ff8]
mov byte [0x49f955], 0
jmp case.0x404901.93
mov byte [0x49f954], 0
jmp case.0x404901.93
mov byte [0x49f953], 0
jmp case.0x404901.93
mov byte [0x49f952], 0
test byte [0x4a0a35], 3
jne 0x4049c5
movzx edx, byte [0x49d2f9]
push 0xffc3d44d
push 0
push 0
push 0
push edx
push 2
call fcn.0040e2a0
add esp, 0x18
jmp 0x4049c5
test cl, cl
jne 0x404988
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push 0x3fff
push edi
push eax
mov eax, dword [ebp + 8]
push 0
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
mov eax, ebx
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp cl, 1
je 0x404992
cmp cl, 2
jne 0x4049c5
cmp dword [0x4a0bb0], 0
jne 0x405f27
push 0
push str.32768
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4049c5
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
je 0x405f27
mov ecx, dword [0x49f94c]
test ecx, ecx
je 0x4049fd
cmp ecx, esi
je 0x4049fd
mov dl, byte [ebp + 0x20]
test dl, dl
jne 0x404a00
mov eax, dword [ebp + 8]
cmp eax, dword [0x4a0b68]
jne 0x4049ef
xor eax, eax
cmp byte [esi + 4], al
sete al
jmp 0x4049f3
movzx eax, byte [ecx + 4]
test eax, eax
je 0x404a00
mov byte [ecx + 0x11], 1
jmp 0x404a00
mov dl, byte [ebp + 0x20]
cmp byte [esi + 8], 0
jne 0x404a10
cmp byte [esi + 9], 0
je 0x404878
mov byte [esp + 0x2b], 0
mov dword [esp + 0x10], 0x3fff
mov dword [esp + 0x3c], 0
test dl, dl
je 0x404a58
mov al, byte [esi + 0xc]
mov cl, byte [esi + 0xf]
mov byte [esp + 0x17], al
movzx eax, word [esi + 6]
mov byte [esp + 0x15], cl
mov ecx, 0x3fff
mov byte [esi + 0xf], 0
cmp ax, cx
je 0x404a56
mov dword [esp + 0x10], eax
mov byte [esp + 0x2b], 1
mov word [esi + 6], cx
test dl, dl
sete al
mov byte [esi + 0xc], al
mov eax, dword [0x4a0b68]
mov byte [esp + 0xd], 0
cmp dword [ebp + 8], eax
jne 0x404ae8
cmp byte [esi + 4], 0
je 0x404b08
mov ecx, dword [0x4a14d8]
cmp byte [ecx + 0xb64c], 0
jne 0x404a93
cmp byte [ecx + 0xb76c], 0
jne 0x404a93
xor eax, eax
jmp 0x404a98
mov eax, 1
cmp byte [ecx + 0xb88c], 0
mov byte [ecx + 0x132c], al
jne 0x404ab4
cmp byte [ecx + 0xb9ac], 0
jne 0x404ab4
xor eax, eax
jmp 0x404ab9
mov eax, 1
cmp byte [ecx + 0xb40c], 0
mov byte [ecx + 0x144c], al
jne 0x404adb
cmp byte [ecx + 0xb52c], 0
jne 0x404adb
xor eax, eax
mov byte [ecx + 0x120c], al
jmp 0x404b0e
mov eax, 1
mov byte [ecx + 0x120c], al
jmp 0x404b0e
test eax, eax
jne 0x404b08
push 1
call fcn.00410850
mov dl, byte [ebp + 0x20]
add esp, 4
mov byte [0x4a0a36], al
mov byte [0x4a0a35], al
mov byte [esp + 0xd], 1
mov ecx, dword [0x4a14d8]
mov eax, dword [esi]
test eax, eax
je 0x404b1e
cmp dword [eax], 7
mov byte [esp + 0xf], 1
je 0x404b23
mov byte [esp + 0xf], 0
mov al, byte [esi + 8]
test al, al
je 0x404cc1
test dl, dl
jne 0x404cc1
mov edx, dword [0x49f94c]
test edx, edx
je 0x404b4e
cmp byte [esi + 9], 0
je 0x404b4e
cmp esi, edx
jne 0x404cc1
cmp al, 1
jne 0x404b7a
cmp byte [esp + 0x27], 0
mov eax, dword [esp + 0x30]
jne 0x404b61
movzx eax, byte [ebp + 0x18]
mov ecx, dword [esp + 0x27]
push ecx
push eax
call fcn.00409590
add esp, 8
test al, al
je 0x404b7a
mov byte [esp + 0xe], 1
jmp 0x404b91
mov byte [esp + 0xe], 0
cmp esi, dword [0x49f94c]
je 0x404b91
mov dword [0x49f94c], esi
mov byte [esi + 0x11], 0
cmp byte [esi + 9], 0
je 0x404c41
cmp byte [esp + 0xd], 0
jne 0x404bb1
push 1
mov byte [esp + 0x11], 1
call fcn.00410850
add esp, 4
mov al, byte [esi + 4]
mov cl, byte [0x4a0a36]
test al, al
je 0x404bc2
not al
and cl, al
test cl, cl
jne 0x404bcc
cmp byte [esp + 0xe], cl
je 0x404c41
mov edx, dword [ebp + 8]
cmp edx, dword [0x4a0b68]
jne 0x404bf4
cmp byte [esp + 0x27], 0
je 0x404bf4
movzx eax, cl
mov ecx, dword [0x4a14d0]
shl eax, 8
add eax, dword [esp + 0x30]
movzx ecx, word [ecx + eax*2]
jmp 0x404c0a
movzx eax, byte [ebp + 0x18]
movzx edx, cl
mov ecx, dword [0x4a14cc]
shl edx, 8
add edx, eax
movzx ecx, word [ecx + edx*2]
mov dword [esp + 0x10], ecx
test ecx, 0x4000
je 0x404c1c
mov word [esi + 6], cx
jmp 0x404c4f
mov edx, dword [0x49e4e0]
mov eax, ecx
and eax, 0x3fff
cmp ax, word [edx]
jae 0x404c45
mov edx, dword [0x4a14d4]
movzx eax, ax
mov ax, word [edx + eax*2]
mov word [esi + 6], ax
jmp 0x404c45
mov ecx, dword [esp + 0x10]
mov edx, 0x3fff
cmp cx, dx
jne 0x404cbb
mov al, byte [esp + 0xe]
test al, al
je 0x404c5f
or byte [esi + 0xb], 8
mov byte [edi + 4], 0x23
cmp byte [esi + 4], 0
jne 0x404c8d
test byte [esi + 0xb], 1
jne 0x404c8d
cmp byte [esp + 0xf], 0
jne 0x404c8d
test al, al
jne 0x404c8d
mov eax, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
push eax
jmp 0x404745
push 0
push 0x3fff
push edi
push 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, ebx
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4a14d8]
cmp byte [esi + 9], 0
mov byte [esp + 0x16], 0
je 0x404d35
cmp byte [ebp + 0x20], 0
je 0x404d35
cmp dword [0x49f94c], esi
jne 0x404ceb
cmp byte [esp + 0x15], 0
je 0x404d35
mov dword [0x49f94c], 0
cmp byte [esi + 0xa], 0
jne 0x404d30
mov al, byte [esi + 0xb]
test al, 8
je 0x404d01
xor cl, cl
and al, 0xf7
mov byte [esi + 0xb], al
jmp 0x404d03
mov cl, 1
cmp byte [esp + 0x15], 0
je 0x404e38
test cl, cl
je 0x404e38
mov edx, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
mov bl, byte [ebp + 0x20]
push edx
jmp 0x404747
mov byte [esp + 0x16], 1
cmp byte [esi + 8], 0
je 0x404f24
cmp byte [ebp + 0x20], 0
je 0x404f24
cmp dword [0x49f94c], esi
jne 0x404d5b
mov dword [0x49f94c], 0
cmp byte [esi + 0xd], 0
je 0x404d82
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
mov byte [esi + 0xd], 0
call fcn.0040e2a0
mov ecx, dword [0x4a14d8]
add esp, 0x18
cmp byte [esi + 0xe], 0
je 0x404da9
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
mov byte [esi + 0xe], 0
call fcn.0040e2a0
mov ecx, dword [0x4a14d8]
add esp, 0x18
mov edx, dword [esp + 0x10]
mov eax, 0x3fff
cmp dx, ax
jne 0x404dd4
mov al, byte [esi + 0xb]
test al, 8
je 0x404dd4
mov ecx, dword [ebp + 0x20]
push 0
push 0x3fff
and al, 0xf7
push edi
mov byte [esi + 0xb], al
push ecx
jmp 0x405f3f
cmp byte [esp + 0xf], 0
mov al, byte [esi + 0x11]
je 0x404e49
cmp al, 2
jne 0x404e30
mov esi, dword [ebp + 0x18]
push 0xffc3d44e
push 0
push 0
push ebx
push esi
push 1
call fcn.0040e2a0
push 0xffc3d44d
push 0
push 0
push ebx
push esi
push 2
call fcn.0040e2a0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
mov bl, byte [ebp + 0x20]
push esi
call fcn.00406090
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 1
jne 0x404ec7
push 0
mov eax, dword [ebp + 0x20]
push 0x3fff
push edi
push eax
jmp 0x404c97
test al, al
je 0x404ec7
mov ecx, 0x3fff
cmp dx, cx
jne 0x404ec1
cmp byte [esi + 4], 0
je 0x404e91
cmp al, 2
jne 0x404878
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
push 1
push ecx
mov ecx, dword [ebp + 0x10]
push edi
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
mov eax, ebx
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [esi + 0xb], 1
push 0
jne 0x404e3a
push SysReAllocString
push 0x3fff
push edi
push ebx
mov edx, dword [ebp + 0x18]
push edx
mov bl, byte [ebp + 0x20]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
call fcn.00406090
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4a14d8]
cmp byte [esi + 9], 0
jne 0x404f06
cmp byte [esi + 4], 0
jne 0x404878
test byte [esi + 0xb], 1
jne 0x404878
cmp byte [esp + 0xf], 0
jne 0x404878
mov eax, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
mov bl, byte [ebp + 0x20]
push eax
jmp 0x404747
cmp byte [esp + 0x17], 0
jne 0x404f28
cmp byte [esi + 0xa], 0
jne 0x404f28
mov eax, dword [ebp + 0x20]
push 0
push 0x3fff
push edi
push eax
jmp 0x404c97
mov edx, dword [esp + 0x10]
cmp byte [esp + 0xd], 0
jne 0x404f4d
mov eax, 0x3fff
cmp dx, ax
jne 0x404f4d
push 1
call fcn.00410850
mov edx, dword [esp + 0x14]
mov ecx, dword [0x4a14d8]
add esp, 4
cmp dword [0x49f94c], 0
mov byte [esp + 0xe], 0
je 0x405608
cmp byte [ebp + 0x20], 0
je 0x404f73
mov eax, dword [esp + 0x18]
cmp byte [eax + 0xa], 0
je 0x405608
mov eax, 0x3fff
cmp dx, ax
jne 0x40585c
mov edi, dword [esp + 0x18]
cmp byte [edi + 0x13], 0
mov dword [esp + 0x2c], 0
jbe 0x40501e
mov ebx, dword [0x4a14d8]
lea esi, [edi + 0x16]
mov cl, byte [esi]
movzx eax, cl
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x404fec
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x404fda
cmp byte [ebp + 0x20], 0
jne 0x405002
mov ecx, 0x3fff
mov word [edi + 6], ax
cmp dx, cx
je 0x404fec
mov dword [esp + 0x10], edx
jmp 0x4050c0
cmp byte [ebp + 0x20], 0
mov ebx, dword [0x4a14d8]
jne 0x404fec
mov edx, eax
mov byte [esp + 0xd], cl
mov eax, dword [esp + 0x2c]
movzx ecx, byte [edi + 0x13]
inc eax
add esi, 4
mov dword [esp + 0x2c], eax
cmp eax, ecx
jl 0x404fa0
jmp 0x40500c
mov al, byte [esi]
movzx edx, word [esi + 2]
mov byte [esp + 0xd], al
mov ecx, 0x3fff
mov dword [esp + 0x10], edx
cmp dx, cx
jne 0x4050ba
cmp byte [edi + 0x14], 0
mov dword [esp + 0x2c], 0
jbe 0x4050a1
lea esi, [edi + 0xde]
movzx ecx, word [esi]
mov ebx, dword [0x4a14dc]
mov eax, ecx
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x405141
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x405133
cmp byte [ebp + 0x20], 0
jne 0x40515b
mov ecx, 0x3fff
mov word [edi + 6], ax
cmp dx, cx
je 0x405141
mov dword [esp + 0x10], edx
movzx eax, word [esp + 0x38]
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4a14dc]
mov dword [0x49f94c], eax
mov eax, 0x3fff
cmp dx, ax
jne case.default.0x4050b3
movzx eax, byte [ebp + 0x18]
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x4050b3
jmp dword [eax*4 + 0x406058]
mov ebx, dword [0x4a14d8]
movzx ecx, byte [esp + 0xd]
mov eax, ecx
sub eax, 0x10
je 0x405117
dec eax
je 0x4050fb
dec eax
je 0x4050e2
lea ecx, [ecx + ecx*8]
shl ecx, 5
add ecx, ebx
mov dword [0x49f94c], ecx
jmp 0x405093
xor eax, eax
cmp byte [ebx + 0xb9ac], al
setne al
lea eax, [eax + eax*8 + 0x5c4]
shl eax, 5
add eax, ebx
jmp 0x40508e
xor eax, eax
cmp byte [ebx + 0xb76c], al
setne al
lea eax, [eax + eax*8 + 0x5b2]
shl eax, 5
add eax, ebx
jmp 0x40508e
xor eax, eax
cmp byte [ebx + 0xb52c], al
setne al
lea eax, [eax + eax*8 + 0x5a0]
shl eax, 5
add eax, ebx
jmp 0x40508e
cmp byte [ebp + 0x20], 0
jne 0x405141
mov edx, eax
mov eax, ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x2c]
movzx ecx, byte [edi + 0x14]
inc eax
add esi, 4
mov dword [esp + 0x2c], eax
cmp eax, ecx
jl 0x405032
jmp 0x405166
movzx eax, word [esi]
movzx edx, word [esi + 2]
mov dword [esp + 0x38], eax
mov ecx, 0x3fff
mov dword [esp + 0x10], edx
cmp dx, cx
je 0x4050a1
jmp 0x40507d
mov al, 0x11
jmp 0x405187
mov al, 0x12
jmp 0x405187
mov al, 0x10
mov ebx, dword [0x4a14d8]
movzx eax, al
lea ecx, [eax + eax*8]
shl ecx, 5
movzx eax, byte [ecx + ebx + 0x13]
lea esi, [ecx + ebx]
xor edi, edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x405251
add esi, 0x16
mov cl, byte [esi]
movzx eax, cl
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x40522f
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x40521d
cmp byte [ebp + 0x20], 0
jne 0x40523f
mov ecx, dword [esp + 0x18]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp dx, ax
je 0x40522f
mov dword [esp + 0x10], edx
movzx ecx, byte [esp + 0xd]
mov eax, ecx
sub eax, 0x10
je 0x405391
dec eax
je 0x405375
dec eax
je 0x405359
lea ecx, [ecx + ecx*8]
shl ecx, 5
add ecx, ebx
mov dword [0x49f94c], ecx
jmp case.default.0x4050b3
cmp byte [ebp + 0x20], 0
mov ebx, dword [0x4a14d8]
jne 0x40522f
mov edx, eax
mov byte [esp + 0xd], cl
inc edi
add esi, 4
cmp edi, dword [esp + 0x2c]
jl 0x4051b3
jmp 0x405249
mov cl, byte [esi]
movzx edx, word [esi + 2]
mov byte [esp + 0xd], cl
mov esi, dword [esp + 0x34]
mov dword [esp + 0x10], edx
mov eax, 0x3fff
cmp dx, ax
jne 0x4051ec
movzx eax, byte [esi + 0x14]
xor edi, edi
mov dword [esp + 0x2c], eax
test eax, eax
jle case.default.0x4050b3
add esi, 0xde
nop
movzx ecx, word [esi]
mov ebx, dword [0x4a14dc]
mov eax, ecx
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x4053b9
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x4053ad
cmp byte [ebp + 0x20], 0
jne 0x4053c9
mov ecx, dword [esp + 0x18]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp dx, ax
je 0x4053b9
mov dword [esp + 0x10], edx
movzx eax, word [esp + 0x38]
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4a14dc]
mov dword [0x49f94c], eax
mov eax, edx
and eax, 0x3fff
mov ecx, 0x3fff
mov esi, eax
cmp dx, cx
je 0x405402
mov eax, dword [0x49e4e0]
cmp si, word [eax]
jae 0x4053f9
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov esi, dword [ebp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x12]
push ecx
add edx, 0xb
push edx
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.004097f0
add esp, 0x14
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x4053eb
push eax
push 0x3fff
push edi
push esi
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
invalid
dec ebp