Function at 0x43afa0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4549ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb7c
xor eax, eax
push ebx
mov dword [0x47132c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_mouse_event]
push esi
lea ecx, [eax + eax*8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
shl ecx, 8
add ecx, eax
lea edx, [ecx*4 + 1]
mov dword [esp + 0x22c], edx
jmp 0x43b008
mov ebx, dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x22c]
add eax, ecx
mov ecx, dword [0x471114]
shl eax, 1
mov dword [esp + 0x38], eax
mov ax, word [eax + ecx]
test ax, ax
je 0x441df3
cmp ax, 0x100
jae 0x43b33f
mov eax, dword [ebp + 8]
push 0xa4
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov al, byte [ecx + edx*8 + 1]
mov byte [esp + 0x17], al
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov si, ax
push 0xa5
and esi, 0x8000
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa0
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa1
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa2
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa3
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
test esi, esi
mov dword [esp + 0x28], eax
je 0x43b0e8
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43b0ec
test al, 1
je 0x43b0ec
push 0
push 2
push 0
push 0xa4
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43b115
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43b115
test al, 1
je 0x43b115
push 0
push 3
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x43b13e
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43b13e
test al, 2
je 0x43b13e
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x43b167
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43b167
test al, 2
je 0x43b167
push 0
push 3
push 0
push 0xa1
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x43b190
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43b190
test al, 4
je 0x43b190
push 0
push 2
push 0
push 0xa2
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x43b1b9
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43b1b9
test al, 4
je 0x43b1b9
push 0
push 3
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x43b1d1
cmp dword [esp + 0x20], ecx
jne 0x43b1d1
test al, 1
mov dword [esp + 0x3c], 1
jne 0x43b1d5
mov dword [esp + 0x3c], ecx
cmp dword [esp + 0x24], ecx
je 0x43b1ed
cmp dword [esp + 0x20], ecx
jne 0x43b1ed
test al, 1
mov dword [esp + 0x4c], 2
jne 0x43b1f1
mov dword [esp + 0x4c], ecx
cmp dword [esp + 0x30], ecx
je 0x43b209
cmp dword [esp + 0x1c], ecx
jne 0x43b209
test al, 2
mov dword [esp + 0x24], 4
jne 0x43b20d
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x34], ecx
je 0x43b224
cmp dword [esp + 0x1c], ecx
jne 0x43b224
test al, 2
je 0x43b224
mov edx, 8
jmp 0x43b226
xor edx, edx
cmp dword [esp + 0x2c], ecx
je 0x43b23d
cmp dword [esp + 0x18], ecx
jne 0x43b23d
test al, 4
je 0x43b23d
mov ecx, 0x10
jmp 0x43b23f
xor ecx, ecx
mov esi, dword [esp + 0x28]
test esi, esi
je 0x43b25a
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x43b25a
test al, 4
je 0x43b25a
mov eax, 0x20
jmp 0x43b25c
xor eax, eax
add al, cl
mov cl, byte [esp + 0x4c]
add al, dl
mov dl, byte [esp + 0x24]
add al, dl
mov dl, byte [esp + 0x3c]
add al, cl
mov ecx, dword [0x471114]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
add al, dl
mov edx, dword [esp + 0x38]
mov byte [esp + 0x13], al
push 0
push 0
mov al, byte [edx + ecx]
push 0
push eax
call esi
mov ecx, dword [0x471114]
mov edx, dword [esp + 0x38]
push 0
push 2
mov al, byte [edx + ecx]
push 0
push eax
call esi
test byte [esp + 0x13], 1
je 0x43b2bc
push 0
push 0
push 0
push 0xa4
call esi
test byte [esp + 0x13], 2
je 0x43b2da
mov esi, 1
push 0
push esi
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x43b2df
mov esi, 1
test byte [esp + 0x13], 4
je 0x43b2f7
push 0
push 0
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
test byte [esp + 0x13], 8
je 0x43b30e
push 0
push esi
push 0
push 0xa1
call dword [sym.imp.USER32.dll_keybd_event]
test byte [esp + 0x13], 0x10
je 0x43b326
push 0
push 0
push 0
push 0xa2
call dword [sym.imp.USER32.dll_keybd_event]
test byte [esp + 0x13], 0x20
je 0x43b344
push 0
push esi
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x43b344
mov esi, 1
mov edx, dword [esp + 0x38]
mov ecx, dword [0x471114]
mov ax, word [edx + ecx]
cmp ax, 0x801
jne 0x43b62c
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov al, byte [ecx + edx*8 + 1]
mov byte [esp + 0x17], al
call ebx
mov si, ax
push 0xa5
and esi, 0x8000
call ebx
and eax, 0x8000
push 0xa0
mov dword [esp + 0x40], eax
call ebx
and eax, 0x8000
push 0xa1
mov dword [esp + 0x50], eax
call ebx
and eax, 0x8000
push 0xa2
mov dword [esp + 0x2c], eax
call ebx
and eax, 0x8000
push 0xa3
mov dword [esp + 0x30], eax
call ebx
and eax, 0x8000
test esi, esi
mov dword [esp + 0x24], eax
je 0x43b402
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43b40e
test al, 1
je 0x43b40e
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0xa4
call ebx
mov al, byte [esp + 0x13]
jmp 0x43b414
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
jmp 0x43b414
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x43b439
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43b439
test al, 1
je 0x43b439
push 0
push 3
push 0
push 0xa5
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43b45e
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43b45e
test al, 2
je 0x43b45e
push 0
push 2
push 0
push 0xa0
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x43b483
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43b483
test al, 2
je 0x43b483
push 0
push 3
push 0
push 0xa1
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x43b4a8
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43b4a8
test al, 4
je 0x43b4a8
push 0
push 2
push 0
push 0xa2
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43b4cd
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43b4cd
test al, 4
je 0x43b4cd
push 0
push 3
push 0
push 0xa3
call ebx
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x43b4e5
cmp dword [esp + 0x20], ecx
jne 0x43b4e5
test al, 1
mov dword [esp + 0x30], 1
jne 0x43b4e9
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x3c], ecx
je 0x43b501
cmp dword [esp + 0x20], ecx
jne 0x43b501
test al, 1
mov dword [esp + 0x3c], 2
jne 0x43b505
mov dword [esp + 0x3c], ecx
cmp dword [esp + 0x4c], ecx
je 0x43b51c
cmp dword [esp + 0x1c], ecx
jne 0x43b51c
test al, 2
je 0x43b51c
mov ebx, 4
jmp 0x43b51e
xor ebx, ebx
cmp dword [esp + 0x28], ecx
je 0x43b535
cmp dword [esp + 0x1c], ecx
jne 0x43b535
test al, 2
je 0x43b535
mov edx, 8
jmp 0x43b537
xor edx, edx
cmp dword [esp + 0x2c], ecx
je 0x43b54e
cmp dword [esp + 0x18], ecx
jne 0x43b54e
test al, 4
je 0x43b54e
mov ecx, 0x10
jmp 0x43b550
xor ecx, ecx
mov esi, dword [esp + 0x24]
test esi, esi
je 0x43b56b
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x43b56b
test al, 4
je 0x43b56b
mov eax, 0x20
jmp 0x43b56d
xor eax, eax
add al, cl
mov cl, byte [esp + 0x3c]
mov esi, dword [sym.imp.USER32.dll_mouse_event]
add al, dl
add al, bl
mov bl, byte [esp + 0x30]
push 0x1bd5
add al, cl
push 0
push 0
add al, bl
push 0
push 2
mov bl, al
call esi
push 0x1bd5
push 0
push 0
push 0
push 4
call esi
test bl, 1
je 0x43b5bf
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa4
call esi
jmp 0x43b5c5
mov esi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 2
je 0x43b5d7
push 0
push 1
push 0
push 0xa5
call esi
test bl, 4
je 0x43b5e9
push 0
push 0
push 0
push 0xa0
call esi
test bl, 8
je 0x43b5fb
push 0
push 1
push 0
push 0xa1
call esi
test bl, 0x10
je 0x43b60d
push 0
push 0
push 0
push 0xa2
call esi
test bl, 0x20
je 0x441dd9
push 0
push 1
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441ddf
cmp ax, 0x802
jne 0x43b8e3
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov al, byte [ecx + edx*8 + 1]
mov byte [esp + 0x17], al
call ebx
mov si, ax
push 0xa5
and esi, 0x8000
call ebx
and eax, 0x8000
push 0xa0
mov dword [esp + 0x40], eax
call ebx
and eax, 0x8000
push 0xa1
mov dword [esp + 0x50], eax
call ebx
and eax, 0x8000
push 0xa2
mov dword [esp + 0x2c], eax
call ebx
and eax, 0x8000
push 0xa3
mov dword [esp + 0x30], eax
call ebx
and eax, 0x8000
test esi, esi
mov dword [esp + 0x24], eax
je 0x43b6dc
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43b6e8
test al, 1
je 0x43b6e8
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0xa4
call ebx
mov al, byte [esp + 0x13]
jmp 0x43b6ee
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
jmp 0x43b6ee
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x43b713
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43b713
test al, 1
je 0x43b713
push 0
push 3
push 0
push 0xa5
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43b738
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43b738
test al, 2
je 0x43b738
push 0
push 2
push 0
push 0xa0
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x43b75d
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43b75d
test al, 2
je 0x43b75d
push 0
push 3
push 0
push 0xa1
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x43b782
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43b782
test al, 4
je 0x43b782
push 0
push 2
push 0
push 0xa2
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43b7a7
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43b7a7
test al, 4
je 0x43b7a7
push 0
push 3
push 0
push 0xa3
call ebx
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x43b7bf
cmp dword [esp + 0x20], ecx
jne 0x43b7bf
test al, 1
mov dword [esp + 0x30], 1
jne 0x43b7c3
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x3c], ecx
je 0x43b7db
cmp dword [esp + 0x20], ecx
jne 0x43b7db
test al, 1
mov dword [esp + 0x3c], 2
jne 0x43b7df
mov dword [esp + 0x3c], ecx
cmp dword [esp + 0x4c], ecx
je 0x43b7f6
cmp dword [esp + 0x1c], ecx
jne 0x43b7f6
test al, 2
je 0x43b7f6
mov ebx, 4
jmp 0x43b7f8
xor ebx, ebx
cmp dword [esp + 0x28], ecx
je 0x43b80f
cmp dword [esp + 0x1c], ecx
jne 0x43b80f
test al, 2
je 0x43b80f
mov edx, 8
jmp 0x43b811
xor edx, edx
cmp dword [esp + 0x2c], ecx
je 0x43b828
cmp dword [esp + 0x18], ecx
jne 0x43b828
test al, 4
je 0x43b828
mov ecx, 0x10
jmp 0x43b82a
xor ecx, ecx
mov esi, dword [esp + 0x24]
test esi, esi
je 0x43b845
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x43b845
test al, 4
je 0x43b845
mov eax, 0x20
jmp 0x43b847
xor eax, eax
add al, cl
mov cl, byte [esp + 0x3c]
mov esi, dword [sym.imp.USER32.dll_mouse_event]
add al, dl
add al, bl
mov bl, byte [esp + 0x30]
push 0x1bd5
add al, cl
push 0
push 0
add al, bl
push 0
push 8
mov bl, al
call esi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call esi
test bl, 1
je 0x43b899
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa4
call esi
jmp 0x43b89f
mov esi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 2
je 0x43b8b1
push 0
push 1
push 0
push 0xa5
call esi
test bl, 4
je 0x43b8c3
push 0
push 0
push 0
push 0xa0
call esi
test bl, 8
je 0x43b8d5
push 0
push 1
push 0
push 0xa1
call esi
test bl, 0x10
je 0x43b60d
jmp 0x43b600
cmp ax, 0x808
jne 0x43b903
push 0
push 0
push 0
push 0xa4
mov dword [esp + 0x30], esi
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441ddf
cmp ax, 0x809
jne 0x43b927
push 0
push 2
push 0
push 0xa4
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441ddf
cmp ax, 0x80a
jne 0x43b947
push 0
push 0
push 0
push 0xa0
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441ddf
cmp ax, 0x80b
jne 0x43b96b
push 0
push 2
push 0
push 0xa0
mov dword [esp + 0x2c], 0
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441ddf
cmp ax, 0x80c
jne 0x43b98b
push 0
push 0
push 0
push 0xa2
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441ddf
cmp ax, 0x80d
jne 0x43b9af
push 0
push 2
push 0
push 0xa2
mov dword [esp + 0x28], 0
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441ddf
cmp ax, 0x80e
jne 0x43b9f0
mov eax, dword [0x471300]
test eax, eax
je 0x43b9d7
fld qword [0x4712f8]
fmul qword [0x45b968]
call sub.MSVCRT.dll__ftol
push eax
call edi
jmp 0x441ddf
fld qword [0x45b8b8]
fmul qword [0x45b968]
call sub.MSVCRT.dll__ftol
push eax
call edi
jmp 0x441ddf
cmp ax, 0x80f
jne 0x43ba31
mov eax, dword [0x471300]
test eax, eax
je 0x43ba18
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
jmp 0x441ddf
fld qword [0x45b8b8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
jmp 0x441ddf
cmp ax, 0x810
jne 0x43ba4e
push 0x32
call fcn.00439f80
add esp, 4
test eax, eax
je 0x441df3
jmp 0x441ddf
cmp ax, 0x811
jne 0x43ba5b
push 0xc8
jmp 0x43ba39
cmp ax, 0x812
jne 0x43ba68
push 0x1f4
jmp 0x43ba39
cmp ax, 0x813
jne 0x43ba75
push 0x3e8
jmp 0x43ba39
cmp ax, 0x814
jne 0x43ba82
push 0x7d0
jmp 0x43ba39
cmp ax, 0x818
jne 0x43ba8c
push 0x64
jmp 0x43ba39
cmp ax, 0x819
jne 0x43ba99
push 0x1388
jmp 0x43ba39
cmp ax, 0x81a
jne 0x43babe
mov eax, dword [ebp + 8]
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov eax, dword [esp + 0x48]
lea edx, [eax + edx*2]
mov eax, dword [ecx + edx*4 + 0x804]
push eax
jmp 0x43ba39
cmp ax, 0x815
jne 0x43bd54
lea ecx, [esp + 0x2d0]
mov dword [esp + 0x4b0], 0xf5c28f5c
push ecx
mov dword [esp + 0x4b8], 0x3fe55c28
mov dword [esp + 0x4bc], 0xae147ae1
mov dword [esp + 0x4c0], 0x3fe6e147
mov dword [esp + 0x4c4], 0xf5c28f5c
mov dword [esp + 0x4c8], 0x3fe55c28
mov dword [esp + 0x4cc], 0xae147ae1
mov dword [esp + 0x4d0], 0x3fe6e147
mov dword [esp + 0x4d4], 0xf5c28f5c
mov dword [esp + 0x4d8], 0x3fe55c28
mov dword [esp + 0x4dc], 0xae147ae1
mov dword [esp + 0x4e0], 0x3fe6e147
mov dword [esp + 0x514], 0x4816f007
mov dword [esp + 0x518], 0x3feafc50
mov dword [esp + 0x51c], 0x4816f007
mov dword [esp + 0x520], 0x3feafc50
mov dword [esp + 0x524], 0x51eb851f
mov dword [esp + 0x528], 0x3fed1eb8
mov dword [esp + 0x52c], 0x51eb851f
mov dword [esp + 0x530], 0x3fed1eb8
mov dword [esp + 0x534], 0x9930be0e
mov dword [esp + 0x538], 0x3fef182a
mov dword [esp + 0x53c], 0x9930be0e
mov dword [esp + 0x540], 0x3fef182a
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x47107c]
lea edx, [esp + 0x270]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [0x471328], 1
xor esi, esi
mov ecx, dword [esp + 0x278]
mov edx, dword [esp + 0x270]
sub ecx, edx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [esp + esi + 0x4b0]
fiadd dword [esp + 0x270]
call sub.MSVCRT.dll__ftol
mov edx, dword [esp + 0x27c]
mov dword [esp + 0x15c], eax
sub edx, dword [esp + 0x274]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [esp + esi + 0x510]
fiadd dword [esp + 0x274]
call sub.MSVCRT.dll__ftol
mov ecx, dword [0x47107c]
mov dword [esp + 0x160], eax
lea eax, [esp + 0x15c]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x160]
mov eax, dword [esp + 0x15c]
push edx
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0
push 0
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
push 0x1bd5
push 0
push 0
push 0
push 8
call ebx
push 1
call edi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call ebx
fld qword [0x4712f8]
fmul qword [0x45b960]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov ecx, dword [esp + 0x2d4]
mov edx, dword [esp + 0x2d0]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
fld qword [0x4712f8]
fmul qword [0x45b960]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
push 1
call edi
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
fld qword [0x4712f8]
fmul qword [0x45b958]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
add esi, 8
cmp esi, 0x30
jl 0x43bbfe
jmp 0x43c0a2
cmp ax, 0x816
jne 0x43bd92
xor eax, eax
mov dword [0x47131c], eax
mov dword [0x471324], eax
push esi
call fcn.00439f80
add esp, 4
test eax, eax
je 0x441df3
mov eax, dword [0x471324]
test eax, eax
jne 0x441df3
mov eax, dword [0x47131c]
test eax, eax
je 0x43bd66
jmp 0x441ddf
cmp ax, 0x817
jne 0x43bdc1
mov dword [0x471320], 0
push esi
call fcn.00439f80
add esp, 4
test eax, eax
je 0x441df3
mov eax, dword [0x471320]
test eax, eax
je 0x43bda2
jmp 0x441ddf
cmp ax, 0x81b
jne 0x43c0c7
lea eax, [esp + 0x2c0]
mov dword [esp + 0x4e0], 0xf5c28f5c
push eax
mov dword [esp + 0x4e8], 0x3fe55c28
mov dword [esp + 0x4ec], 0xae147ae1
mov dword [esp + 0x4f0], 0x3fe6e147
mov dword [esp + 0x4f4], 0xf5c28f5c
mov dword [esp + 0x4f8], 0x3fe55c28
mov dword [esp + 0x4fc], 0xae147ae1
mov dword [esp + 0x500], 0x3fe6e147
mov dword [esp + 0x504], 0xf5c28f5c
mov dword [esp + 0x508], 0x3fe55c28
mov dword [esp + 0x50c], 0xae147ae1
mov dword [esp + 0x510], 0x3fe6e147
mov dword [esp + 0x484], 0x4816f007
mov dword [esp + 0x488], 0x3feafc50
mov dword [esp + 0x48c], 0x4816f007
mov dword [esp + 0x490], 0x3feafc50
mov dword [esp + 0x494], 0x51eb851f
mov dword [esp + 0x498], 0x3fed1eb8
mov dword [esp + 0x49c], 0x51eb851f
mov dword [esp + 0x4a0], 0x3fed1eb8
mov dword [esp + 0x4a4], 0x9930be0e
mov dword [esp + 0x4a8], 0x3fef182a
mov dword [esp + 0x4ac], 0x9930be0e
mov dword [esp + 0x4b0], 0x3fef182a
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x47107c]
lea ecx, [esp + 0x260]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x244]
push 0
lea ecx, [esp + 0x240]
push eax
push ecx
call fcn.0044ac70
add esp, 0xc
lea ecx, [esp + 0x23c]
call sub.MFC42u.DLL_CString::CString
mov dword [0x471328], 1
xor esi, esi
mov ecx, dword [esp + 0x244]
lea edx, [esp + 0x550]
lea eax, [esp + 0x56c]
push edx
push eax
push esi
push ecx
call fcn.0044a7d0
add esp, 0x10
test eax, eax
je 0x43c098
mov edx, dword [esp + 0x268]
mov eax, dword [esp + 0x260]
sub edx, eax
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [esp + esi*8 + 0x4e0]
fiadd dword [esp + 0x260]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x264]
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x26c]
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [esp + esi*8 + 0x480]
fiadd dword [esp + 0x264]
call sub.MSVCRT.dll__ftol
mov edx, dword [0x47107c]
lea ecx, [esp + 0x13c]
push ecx
push edx
mov dword [esp + 0x148], eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0
push 0
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
push 0x1bd5
push 0
push 0
push 0
push 8
call ebx
push 1
call edi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call ebx
fld qword [0x4712f8]
fmul qword [0x45b960]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov edx, dword [esp + 0x2c4]
mov eax, dword [esp + 0x2c0]
push edx
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
fld qword [0x4712f8]
fmul qword [0x45b960]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
push 1
call edi
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
fld qword [0x4712f8]
fmul qword [0x45b958]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
inc esi
cmp esi, 6
jl 0x43bf28
call fcn.00431750
push 0
push 2
push 0
push 0xa0
mov dword [0x471328], 0
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441ddf
cmp ax, 0x899
jne 0x43c0f1
mov dword [0x471328], esi
push 0
call fcn.0043a010
add esp, 4
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x89a
jne 0x43c100
mov dword [0x471328], esi
push esi
jmp 0x43c0d5
cmp ax, 0x89b
jne 0x43c110
mov dword [0x471328], esi
push 2
jmp 0x43c0d5
cmp ax, 0x89c
jne 0x43c120
mov dword [0x471328], esi
push 3
jmp 0x43c0d5
cmp ax, 0x89d
jne 0x43c130
mov dword [0x471328], esi
push 4
jmp 0x43c0d5
cmp ax, 0x89e
jne 0x43c140
mov dword [0x471328], esi
push 5
jmp 0x43c0d5
cmp ax, 0x89f
jne 0x43c150
mov dword [0x471328], esi
push 6
jmp 0x43c0d5
cmp ax, 0x8a0
jne 0x43c168
push 0
mov dword [0x471328], esi
call fcn.0043a1b0
jmp 0x43c0da
cmp ax, 0x8a1
jne 0x43c17f
push esi
mov dword [0x471328], esi
call fcn.0043a1b0
jmp 0x43c0da
cmp ax, 0x8a2
jne 0x43c197
push 2
mov dword [0x471328], esi
call fcn.0043a1b0
jmp 0x43c0da
cmp ax, 0x8a3
jne 0x43c1af
push 3
mov dword [0x471328], esi
call fcn.0043a1b0
jmp 0x43c0da
cmp ax, 0x8a4
jne 0x43c1c7
push 4
mov dword [0x471328], esi
call fcn.0043a1b0
jmp 0x43c0da
cmp ax, 0x8a5
jne 0x43c1df
push 5
mov dword [0x471328], esi
call fcn.0043a1b0
jmp 0x43c0da
cmp ax, 0x8a6
jne 0x43c1f7
push 6
mov dword [0x471328], esi
call fcn.0043a1b0
jmp 0x43c0da
cmp ax, 0x8a7
jne 0x43c323
lea ecx, [esp + 0x2b8]
mov dword [0x471328], esi
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x47107c]
lea edx, [esp + 0x330]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x338]
mov edx, dword [esp + 0x330]
sub ecx, edx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [0x45b950]
call sub.MSVCRT.dll__ftol
mov edx, dword [esp + 0x33c]
mov dword [esp + 0x17c], eax
sub edx, dword [esp + 0x334]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [0x45b948]
call sub.MSVCRT.dll__ftol
mov ecx, dword [0x47107c]
mov dword [esp + 0x180], eax
lea eax, [esp + 0x17c]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
mov edx, dword [esp + 0x180]
mov eax, dword [esp + 0x17c]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push edx
push eax
call esi
fld qword [0x4712f8]
fmul qword [0x45b940]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
mov ecx, dword [esp + 0x2bc]
mov edx, dword [esp + 0x2b8]
push ecx
push edx
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8a8
jne 0x43c44f
lea eax, [esp + 0x308]
mov dword [0x471328], esi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x47107c]
lea ecx, [esp + 0x360]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x368]
mov ecx, dword [esp + 0x360]
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x45b950]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x36c]
mov dword [esp + 0x14c], eax
sub ecx, dword [esp + 0x364]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [0x45b948]
call sub.MSVCRT.dll__ftol
mov dword [esp + 0x150], eax
mov eax, dword [0x47107c]
lea edx, [esp + 0x14c]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
mov ecx, dword [esp + 0x150]
mov edx, dword [esp + 0x14c]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push ecx
push edx
call esi
fld qword [0x4712f8]
fmul qword [0x45b940]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 8
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call ebx
mov eax, dword [esp + 0x30c]
mov ecx, dword [esp + 0x308]
push eax
push ecx
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8a9
jne 0x43c467
push 0
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8aa
jne 0x43c47e
push esi
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8ab
jne 0x43c496
push 2
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8ac
jne 0x43c4ae
push 3
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8ad
jne 0x43c4c6
push 4
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8ae
jne 0x43c4de
push 5
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8af
jne 0x43c4f6
push 6
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8b0
jne 0x43c50e
push 7
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8b1
jne 0x43c526
push 8
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8b2
jne 0x43c53e
push 9
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8b3
jne 0x43c556
push 0xa
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8b4
jne 0x43c56e
push 0xb
mov dword [0x471328], esi
call fcn.0043a9a0
jmp 0x43c0da
cmp ax, 0x8b5
jne 0x43c586
push 0
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8b6
jne 0x43c59d
push esi
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8b7
jne 0x43c5b5
push 2
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8b8
jne 0x43c5cd
push 3
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8b9
jne 0x43c5e5
push 4
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8ba
jne 0x43c5fd
push 5
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8bb
jne 0x43c615
push 6
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8bc
jne 0x43c62d
push 7
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8bd
jne 0x43c645
push 8
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8be
jne 0x43c65d
push 9
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8bf
jne 0x43c675
push 0xa
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8c0
jne 0x43c68d
push 0xb
mov dword [0x471328], esi
call fcn.0043aca0
jmp 0x43c0da
cmp ax, 0x8c1
jne 0x43c6a5
push 0
mov dword [0x471328], esi
call fcn.0043a740
jmp 0x43c0da
cmp ax, 0x8c2
jne 0x43c6bc
push esi
mov dword [0x471328], esi
call fcn.0043a740
jmp 0x43c0da
cmp ax, 0x8c3
jne 0x43c6d4
push 2
mov dword [0x471328], esi
call fcn.0043a740
jmp 0x43c0da
cmp ax, 0x8c4
jne 0x43c6ec
push 3
mov dword [0x471328], esi
call fcn.0043a740
jmp 0x43c0da
cmp ax, 0x8c5
jne 0x43c704
push 4
mov dword [0x471328], esi
call fcn.0043a740
jmp 0x43c0da
cmp ax, 0x8c6
jne 0x43c71c
push 5
mov dword [0x471328], esi
call fcn.0043a740
jmp 0x43c0da
cmp ax, 0x8c7
jne 0x43c734
push 0
mov dword [0x471328], esi
call fcn.0043a540
jmp 0x43c0da
cmp ax, 0x8c8
jne 0x43c74b
push esi
mov dword [0x471328], esi
call fcn.0043a540
jmp 0x43c0da
cmp ax, 0x8c9
jne 0x43c763
push 2
mov dword [0x471328], esi
call fcn.0043a540
jmp 0x43c0da
cmp ax, 0x8ca
jne 0x43c77b
push 3
mov dword [0x471328], esi
call fcn.0043a540
jmp 0x43c0da
cmp ax, 0x8cb
jne 0x43c793
push 4
mov dword [0x471328], esi
call fcn.0043a540
jmp 0x43c0da
cmp ax, 0x8cc
jne 0x43c7ab
push 5
mov dword [0x471328], esi
call fcn.0043a540
jmp 0x43c0da
cmp ax, 0x8cd
jne 0x43c8f3
lea edx, [esp + 0x2c8]
mov dword [0x471328], esi
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x47107c]
lea eax, [esp + 0x3e0]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x3e8]
mov esi, dword [esp + 0x3e0]
sub edx, esi
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [0x45b938]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x3e4]
mov dword [esp + 0x16c], eax
mov eax, dword [esp + 0x3ec]
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x45b930]
call sub.MSVCRT.dll__ftol
mov edx, dword [0x47107c]
lea ecx, [esp + 0x16c]
push ecx
push edx
mov dword [esp + 0x178], eax
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov eax, dword [esp + 0x170]
mov ecx, dword [esp + 0x16c]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push eax
push ecx
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov edx, dword [esp + 0x2cc]
mov eax, dword [esp + 0x2c8]
push edx
push eax
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8ce
jne 0x43ca38
lea ecx, [esp + 0x318]
mov dword [0x471328], esi
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x47107c]
lea edx, [esp + 0x380]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x388]
mov edx, dword [esp + 0x380]
sub ecx, edx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [0x45b920]
call sub.MSVCRT.dll__ftol
mov edx, dword [esp + 0x38c]
mov dword [esp + 0x124], eax
sub edx, dword [esp + 0x384]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [0x45b918]
call sub.MSVCRT.dll__ftol
mov ecx, dword [0x47107c]
mov dword [esp + 0x128], eax
lea eax, [esp + 0x124]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x124]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push edx
push eax
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov ecx, dword [esp + 0x31c]
mov edx, dword [esp + 0x318]
push ecx
push edx
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8cf
jne 0x43cb7d
lea eax, [esp + 0x2d8]
mov dword [0x471328], esi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x47107c]
lea ecx, [esp + 0x3c0]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x3c8]
mov ecx, dword [esp + 0x3c0]
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x45b910]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x3cc]
mov dword [esp + 0x134], eax
sub ecx, dword [esp + 0x3c4]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [0x45b908]
call sub.MSVCRT.dll__ftol
mov dword [esp + 0x138], eax
mov eax, dword [0x47107c]
lea edx, [esp + 0x134]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push ecx
push edx
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov eax, dword [esp + 0x2dc]
mov ecx, dword [esp + 0x2d8]
push eax
push ecx
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8d0
jne 0x43ccc5
lea edx, [esp + 0x328]
mov dword [0x471328], esi
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x47107c]
lea eax, [esp + 0x340]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x348]
mov esi, dword [esp + 0x340]
sub edx, esi
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [0x45b900]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x344]
mov dword [esp + 0x144], eax
mov eax, dword [esp + 0x34c]
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x45b8f8]
call sub.MSVCRT.dll__ftol
mov edx, dword [0x47107c]
lea ecx, [esp + 0x144]
push ecx
push edx
mov dword [esp + 0x150], eax
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x144]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push eax
push ecx
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov edx, dword [esp + 0x32c]
mov eax, dword [esp + 0x328]
push edx
push eax
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8d1
jne 0x43cd10
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
push 0xa
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
jmp 0x441ddf
cmp ax, 0x8d2
jne 0x43cd26
push 0x470a58
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x441ddf
cmp ax, 0x8d3
jne 0x43cd45
mov ecx, dword [0x470a5c]
mov edx, dword [0x470a58]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x441ddf
cmp ax, 0x8d4
jne 0x43cd7d
push str.Sound_notify.wav
lea eax, [esp + 0x244]
push 0x471068
push eax
call sub.MFC42u.DLL_operator
mov ecx, dword [eax]
push esi
push ecx
call dword [sym.imp.WINMM.dll_sndPlaySoundW]
lea ecx, [esp + 0x240]
call sub.MFC42u.DLL_CString::CString
jmp 0x441ddf
cmp ax, 0x8d5
jne 0x43d0db
lea edx, [esp + 0x110]
push 0
lea eax, [esp + 0x25c]
push edx
push eax
call fcn.0044ac70
add esp, 0xc
lea ecx, [esp + 0x258]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x110]
test eax, eax
jbe 0x441dd9
xor eax, eax
mov edx, dword [esp + 0x48]
mov dword [esp + 0xa5], eax
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 8]
mov esi, dword [esp + 0x34]
mov byte [esp + 0xa4], 0
lea ecx, [eax + eax*8]
shl ecx, 8
add ecx, eax
lea eax, [edx + ecx*2]
lea edi, [eax*4 + 0x804]
mov eax, dword [esp + 0x110]
lea ecx, [esp + 0x554]
lea edx, [esp + 0xa4]
push ecx
push edx
push esi
push eax
call fcn.0044a7d0
mov ecx, dword [0x471114]
mov eax, dword [esp + 0xb4]
add esp, 0x10
mov edx, dword [edi + ecx]
cmp edx, eax
je 0x43ce32
inc esi
cmp esi, 6
jl 0x43cdee
mov dword [esp + 0x34], esi
jmp 0x441dd9
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
mov dword [esp + 0x38], esi
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov al, byte [ecx + edx*8 + 1]
mov byte [esp + 0x17], al
call edi
mov si, ax
push 0xa5
and esi, 0x8000
call edi
mov bx, ax
push 0xa0
and ebx, 0x8000
call edi
and eax, 0x8000
push 0xa1
mov dword [esp + 0x40], eax
call edi
and eax, 0x8000
push 0xa2
mov dword [esp + 0x50], eax
call edi
and eax, 0x8000
push 0xa3
mov dword [esp + 0x2c], eax
call edi
mov di, ax
and edi, 0x8000
test esi, esi
je 0x43ced4
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43ced8
test al, 1
je 0x43ced8
push 0
push 2
push 0
push 0xa4
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x43cefd
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43cefd
test al, 1
je 0x43cefd
push 0
push 3
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x43cf26
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43cf26
test al, 2
je 0x43cf26
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43cf4f
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43cf4f
test al, 2
je 0x43cf4f
push 0
push 3
push 0
push 0xa1
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x43cf78
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43cf78
test al, 4
je 0x43cf78
push 0
push 2
push 0
push 0xa2
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test edi, edi
je 0x43cf9d
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43cf9d
test al, 4
je 0x43cf9d
push 0
push 3
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x43cfb5
cmp dword [esp + 0x20], ecx
jne 0x43cfb5
test al, 1
mov dword [esp + 0x24], 1
jne 0x43cfb9
mov dword [esp + 0x24], ecx
cmp ebx, ecx
je 0x43cfcf
cmp dword [esp + 0x20], ecx
jne 0x43cfcf
test al, 1
mov dword [esp + 0x2c], 2
jne 0x43cfd3
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x3c], ecx
je 0x43cfea
cmp dword [esp + 0x1c], ecx
jne 0x43cfea
test al, 2
je 0x43cfea
mov edx, 4
jmp 0x43cfec
xor edx, edx
cmp dword [esp + 0x4c], ecx
je 0x43d003
cmp dword [esp + 0x1c], ecx
jne 0x43d003
test al, 2
je 0x43d003
mov ebx, 8
jmp 0x43d005
xor ebx, ebx
cmp dword [esp + 0x28], ecx
je 0x43d01a
cmp dword [esp + 0x18], ecx
jne 0x43d01a
test al, 4
je 0x43d01a
mov ecx, 0x10
test edi, edi
je 0x43d031
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x43d031
test al, 4
je 0x43d031
mov eax, 0x20
jmp 0x43d033
xor eax, eax
add al, cl
mov cl, byte [esp + 0x2c]
add al, bl
mov bl, byte [esp + 0x24]
add al, dl
add al, cl
mov ecx, dword [esp + 0x34]
add al, bl
push ecx
mov bl, al
call fcn.0043a940
add esp, 4
test bl, 1
je 0x43d06e
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa4
call esi
jmp 0x43d074
mov esi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 2
je 0x43d086
push 0
push 1
push 0
push 0xa5
call esi
test bl, 4
je 0x43d098
push 0
push 0
push 0
push 0xa0
call esi
test bl, 8
je 0x43d0aa
push 0
push 1
push 0
push 0xa1
call esi
test bl, 0x10
je 0x43d0bc
push 0
push 0
push 0
push 0xa2
call esi
test bl, 0x20
je 0x441dd9
push 0
push 1
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x441dd9
cmp ax, 0x8d6
jne 0x43d1ab
lea edx, [esp + 0x118]
push 0
lea eax, [esp + 0x258]
push edx
push eax
call fcn.0044ac70
add esp, 0xc
lea ecx, [esp + 0x254]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x118]
test eax, eax
jbe 0x441dd9
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x48]
xor esi, esi
mov byte [esp + 0xd4], 0
lea ecx, [eax + eax*8]
mov dword [esp + 0xd5], esi
shl ecx, 8
add ecx, eax
lea eax, [edx + ecx*2]
lea edi, [eax*4 + 0x804]
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x55c]
lea edx, [esp + 0xd4]
push ecx
push edx
push esi
push eax
call fcn.0044a7d0
mov ecx, dword [0x471114]
mov eax, dword [esp + 0xe4]
add esp, 0x10
mov edx, dword [edi + ecx]
cmp edx, eax
je 0x43d184
inc esi
cmp esi, 6
jl 0x43d144
jmp 0x441dd9
push esi
mov dword [0x471328], 1
call fcn.0043a540
add esp, 4
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441dd9
cmp ax, 0x8d7
jne 0x43d1bc
mov dword [0x471328], esi
jmp 0x441ddf
cmp ax, 0x8d8
je 0x43c0dd
cmp ax, 0x8d9
jne 0x43d30b
lea eax, [esp + 0x320]
mov dword [0x471328], esi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x47107c]
lea ecx, [esp + 0x350]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x358]
mov ecx, dword [esp + 0x350]
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x45b938]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x35c]
mov dword [esp + 0x154], eax
sub ecx, dword [esp + 0x354]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [0x45b930]
call sub.MSVCRT.dll__ftol
mov dword [esp + 0x158], eax
mov eax, dword [0x47107c]
lea edx, [esp + 0x154]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov ecx, dword [esp + 0x158]
mov edx, dword [esp + 0x154]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push ecx
push edx
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 8
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov eax, dword [esp + 0x324]
mov ecx, dword [esp + 0x320]
push eax
push ecx
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8da
jne 0x43d453
lea edx, [esp + 0x2f0]
mov dword [0x471328], esi
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x47107c]
lea eax, [esp + 0x370]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x378]
mov esi, dword [esp + 0x370]
sub edx, esi
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [0x45b920]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x374]
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x37c]
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x45b918]
call sub.MSVCRT.dll__ftol
mov edx, dword [0x47107c]
lea ecx, [esp + 0x164]
push ecx
push edx
mov dword [esp + 0x170], eax
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x164]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push eax
push ecx
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 8
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov edx, dword [esp + 0x2f4]
mov eax, dword [esp + 0x2f0]
push edx
push eax
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8db
jne 0x43d598
lea ecx, [esp + 0x310]
mov dword [0x471328], esi
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x47107c]
lea edx, [esp + 0x390]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x398]
mov edx, dword [esp + 0x390]
sub ecx, edx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [0x45b910]
call sub.MSVCRT.dll__ftol
mov edx, dword [esp + 0x39c]
mov dword [esp + 0x174], eax
sub edx, dword [esp + 0x394]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [0x45b908]
call sub.MSVCRT.dll__ftol
mov ecx, dword [0x47107c]
mov dword [esp + 0x178], eax
lea eax, [esp + 0x174]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov edx, dword [esp + 0x178]
mov eax, dword [esp + 0x174]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push edx
push eax
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 8
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov ecx, dword [esp + 0x314]
mov edx, dword [esp + 0x310]
push ecx
push edx
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8dc
jne 0x43d6dd
lea eax, [esp + 0x300]
mov dword [0x471328], esi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x47107c]
lea ecx, [esp + 0x3b0]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x3b8]
mov ecx, dword [esp + 0x3b0]
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x45b900]
call sub.MSVCRT.dll__ftol
mov ecx, dword [esp + 0x3bc]
mov dword [esp + 0x11c], eax
sub ecx, dword [esp + 0x3b4]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [0x45b8f8]
call sub.MSVCRT.dll__ftol
mov dword [esp + 0x120], eax
mov eax, dword [0x47107c]
lea edx, [esp + 0x11c]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x11c]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push ecx
push edx
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 8
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov eax, dword [esp + 0x304]
mov ecx, dword [esp + 0x300]
push eax
push ecx
call esi
call fcn.00431750
mov dword [0x471328], 0
jmp 0x441ddf
cmp ax, 0x8dd
jne 0x43d6f7
mov edx, dword [0x4710ac]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x441ddf
cmp ax, 0x8de
jne 0x43d772
mov eax, dword [0x47107c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x79
push 0x100
push eax
call esi
mov ecx, dword [0x47107c]
push 0
push 0x79
push 0x101
push ecx
call esi
mov edx, dword [0x47107c]
push 0
push 0x4d
push 0x100
push edx
call esi
mov eax, dword [0x47107c]
push 0
push 0x4d
push 0x101
push eax
call esi
mov ecx, dword [0x47107c]
push 0
push 0x1b
push 0x100
push ecx
call esi
mov edx, dword [0x47107c]
push 0
push 0x1b
push 0x101
push edx
call esi
jmp 0x441ddf
cmp ax, 0x8df
jne 0x43d7f1
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa4
call ebx
push 0xa
call edi
mov eax, dword [0x47107c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x51
push 0x100
push eax
call esi
mov ecx, dword [0x47107c]
push 0
push 0x51
push 0x101
push ecx
call esi
push 0xa
call edi
push 0
push 2
push 0
push 0xa4
call ebx
mov edx, dword [0x47107c]
push 0
push 0x51
push 0x100
push edx
call esi
mov eax, dword [0x47107c]
push 0
push 0x51
push 0x101
push eax
call esi
jmp 0x441ddf
cmp ax, 0x8e0
jne 0x43d807
push 0x470a50
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x441ddf
cmp ax, 0x8e1
jne 0x43d826
mov ecx, dword [0x470a54]
mov edx, dword [0x470a50]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x441ddf
cmp ax, 0x8e2
jne 0x43d83c
push 0x470a48
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x441ddf
cmp ax, 0x8e3
jne 0x43d85a
mov eax, dword [0x470a4c]
mov ecx, dword [0x470a48]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x441ddf
cmp ax, 0x8e4
jne 0x43d870
push 0x470a40
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x441ddf
cmp ax, 0x8e5
jne 0x43d88e
mov edx, dword [0x470a44]
mov eax, dword [0x470a40]
push edx
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x441ddf
cmp ax, 0x8e6
jne 0x43d8a4
push 0x470a38
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x441ddf
cmp ax, 0x8e7
jne 0x43d8c3
mov ecx, dword [0x470a3c]
mov edx, dword [0x470a38]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x441ddf
cmp ax, 0x8e8
jne 0x43d90c
mov eax, dword [ebp + 8]
mov dword [esp + 0x2e4], 0
push ecx
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov eax, dword [esp + 0x4c]
lea edx, [eax + edx*2]
mov eax, dword [ecx + edx*4 + 0x804]
mov dword [esp + 0x2e4], eax
fild qword [esp + 0x2e4]
fstp dword [esp]
call fcn.0044bb80
add esp, 4
jmp 0x441ddf
cmp ax, 0x8e9
jne 0x43d9ee
mov eax, dword [ebp + 8]
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov eax, dword [esp + 0x48]
lea edx, [eax + edx*2]
lea eax, [ecx + edx*4 + 0x804]
mov ecx, dword [ecx + edx*4 + 0x804]
shr ecx, 0x10
movsx edx, cx
movsx eax, word [eax]
sub edx, 0x7530
sub eax, 0x7530
mov dword [esp + 0x14], edx
mov edx, dword [0x47107c]
fild dword [esp + 0x14]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x3d0]
push ecx
push edx
fmul qword [0x45b8f0]
fstp qword [esp + 0x54]
fild dword [esp + 0x1c]
fmul qword [0x45b8e8]
fstp qword [esp + 0x44]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x2e8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x3dc]
mov eax, dword [esp + 0x3d4]
sub ecx, eax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [esp + 0x3c]
fiadd dword [esp + 0x2ec]
call sub.MSVCRT.dll__ftol
mov edx, dword [esp + 0x3d8]
mov esi, dword [esp + 0x3d0]
sub edx, esi
push eax
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
fmul qword [esp + 0x50]
fiadd dword [esp + 0x2ec]
call sub.MSVCRT.dll__ftol
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x441ddf
cmp ax, 0x8ea
jne 0x43dca3
lea eax, [esp + 0x78]
mov dword [esp + 0x440], 0x47ae147b
push eax
mov dword [esp + 0x448], 0x3f947ae1
mov dword [esp + 0x44c], 0x39581062
mov dword [esp + 0x450], 0x3fc6c8b4
mov dword [esp + 0x454], 0x1eb851ec
mov dword [esp + 0x458], 0x3fa1eb85
mov dword [esp + 0x45c], 0xd70a3d71
mov dword [esp + 0x460], 0x3fc570a3
mov dword [esp + 0x424], 0xa7ef9db2
mov dword [esp + 0x428], 0x3fef4bc6
mov dword [esp + 0x42c], 0x4189374c
mov dword [esp + 0x430], 0x3fe8e560
mov dword [esp + 0x434], 0x4fdf3b64
mov dword [esp + 0x438], 0x3fec978d
mov dword [esp + 0x43c], 0xa3d70a4
mov dword [esp + 0x440], 0x3feca3d7
call fcn.0044b070
add esp, 4
lea ecx, [esp + 0x78]
mov dword [esp + 0xb90], 0
call sub.MFC42u.DLL_CString::MakeLower
push str.dota
lea ecx, [esp + 0x7c]
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x43dae5
mov dword [esp + 0x38], 0
jmp 0x43db03
push str.chenghai
lea ecx, [esp + 0x7c]
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x43dc8a
mov dword [esp + 0x38], 2
lea ecx, [esp + 0x25c]
lea edx, [esp + 0x10c]
push ecx
lea eax, [esp + 0x564]
push edx
push eax
mov dword [0x471328], esi
call fcn.0044a970
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp eax, 2
jne 0x43db46
cmp dword [esp + 0x25c], 6
sbb ecx, ecx
add ecx, 2
mov dword [esp + 0x10c], ecx
lea edx, [esp + 0x2f8]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x47107c]
lea eax, [esp + 0x3f0]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3f8]
lea esi, [edx + eax]
mov edx, dword [esp + 0x3f0]
sub ecx, edx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
shl esi, 3
fmul qword [esp + esi + 0x438]
call sub.MSVCRT.dll__ftol
mov edx, dword [esp + 0x3fc]
mov dword [esp + 0x184], eax
sub edx, dword [esp + 0x3f4]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [esp + esi + 0x418]
call sub.MSVCRT.dll__ftol
mov ecx, dword [0x47107c]
mov dword [esp + 0x188], eax
lea eax, [esp + 0x184]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov edx, dword [esp + 0x188]
mov eax, dword [esp + 0x184]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push edx
push eax
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 2
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 4
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov ecx, dword [esp + 0x2fc]
mov edx, dword [esp + 0x2f8]
push ecx
push edx
call esi
call fcn.00431750
mov dword [0x471328], 0
lea ecx, [esp + 0x78]
mov dword [esp + 0xb90], 0xffffffff
call sub.MFC42u.DLL_CString::CString
jmp 0x441ddf
cmp ax, 0x8eb
jne 0x43df63
lea eax, [esp + 0x84]
mov dword [esp + 0x460], 0x47ae147b
push eax
mov dword [esp + 0x468], 0x3f947ae1
mov dword [esp + 0x46c], 0x39581062
mov dword [esp + 0x470], 0x3fc6c8b4
mov dword [esp + 0x474], 0x1eb851ec
mov dword [esp + 0x478], 0x3fa1eb85
mov dword [esp + 0x47c], 0xd70a3d71
mov dword [esp + 0x480], 0x3fc570a3
mov dword [esp + 0x404], 0xa7ef9db2
mov dword [esp + 0x408], 0x3fef4bc6
mov dword [esp + 0x40c], 0x4189374c
mov dword [esp + 0x410], 0x3fe8e560
mov dword [esp + 0x414], 0x4fdf3b64
mov dword [esp + 0x418], 0x3fec978d
mov dword [esp + 0x41c], 0xa3d70a4
mov dword [esp + 0x420], 0x3feca3d7
call fcn.0044b070
add esp, 4
lea ecx, [esp + 0x84]
mov dword [esp + 0xb90], esi
call sub.MFC42u.DLL_CString::MakeLower
push str.dota
lea ecx, [esp + 0x88]
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x43dd9f
mov dword [esp + 0x38], 0
jmp 0x43ddc0
push str.chenghai
lea ecx, [esp + 0x88]
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x43df47
mov dword [esp + 0x38], 2
lea ecx, [esp + 0x218]
lea edx, [esp + 0xe8]
push ecx
lea eax, [esp + 0x544]
push edx
push eax
mov dword [0x471328], esi
call fcn.0044a970
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp eax, 2
jne 0x43de03
cmp dword [esp + 0x218], 6
sbb ecx, ecx
add ecx, 2
mov dword [esp + 0xe8], ecx
lea edx, [esp + 0x2a8]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x47107c]
lea eax, [esp + 0x3a0]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0xe8]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3a8]
lea esi, [edx + eax]
mov edx, dword [esp + 0x3a0]
sub ecx, edx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
shl esi, 3
fmul qword [esp + esi + 0x458]
call sub.MSVCRT.dll__ftol
mov edx, dword [esp + 0x3ac]
mov dword [esp + 0x12c], eax
sub edx, dword [esp + 0x3a4]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fmul qword [esp + esi + 0x3f8]
call sub.MSVCRT.dll__ftol
mov ecx, dword [0x47107c]
mov dword [esp + 0x130], eax
lea eax, [esp + 0x12c]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x12c]
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push edx
push eax
call esi
fld qword [0x4712f8]
fmul qword [0x45b928]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 8
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
push 0x1bd5
push 0
push 0
push 0
push 0x10
call ebx
fld qword [0x4712f8]
fmul qword [0x45b8c0]
call sub.MSVCRT.dll__ftol
push eax
call edi
mov ecx, dword [esp + 0x2ac]
mov edx, dword [esp + 0x2a8]
push ecx
push edx
call esi
call fcn.00431750
mov dword [0x471328], 0
lea ecx, [esp + 0x84]
mov dword [esp + 0xb90], 0xffffffff
call sub.MFC42u.DLL_CString::CString
jmp 0x441ddf
cmp ax, 0x8ec
jne 0x43e334
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea eax, [esp + 0x5b8]
push 4
push eax
call fcn.0044daa3
lea ecx, [esp + 0x5ac]
push 0
push ecx
push 0
push 7
push 0xfffffffffffffffe
mov dword [esp + 0xba4], 2
call fcn.0044be80
mov ebx, dword [ebp + 8]
mov esi, eax
mov eax, dword [esp + 0x5c]
add esp, 0x14
lea edx, [ebx + ebx*8]
shl edx, 8
add edx, ebx
lea ecx, [eax + edx*2]
mov edx, dword [0x471114]
mov eax, dword [edx + ecx*4 + 0x804]
lea ecx, [esp + 0x1f4]
push ecx
lea ecx, [esp + 0xf4]
mov dword [esp + 0x1f8], eax
mov byte [esp + 0x1fc], 0
call fcn.0044d46a
test esi, esi
mov byte [esp + 0xb90], 3
mov dword [esp + 0x34], 0
jle 0x43e2fa
lea edx, [esp + 0x5ac]
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0xf0]
push eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43e04b
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
inc eax
add edx, 4
cmp eax, esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
jl 0x43e012
jmp 0x43e2fa
mov ecx, dword [0x471114]
lea eax, [ebx + ebx*8]
shl eax, 8
add eax, ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
mov dl, byte [ecx + eax*8 + 1]
mov byte [esp + 0x17], dl
call ebx
mov si, ax
push 0xa5
and esi, 0x8000
call ebx
and eax, 0x8000
push 0xa0
mov dword [esp + 0x40], eax
call ebx
and eax, 0x8000
push 0xa1
mov dword [esp + 0x50], eax
call ebx
and eax, 0x8000
push 0xa2
mov dword [esp + 0x2c], eax
call ebx
and eax, 0x8000
push 0xa3
mov dword [esp + 0x30], eax
call ebx
and eax, 0x8000
test esi, esi
mov dword [esp + 0x24], eax
je 0x43e0f4
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43e100
test al, 1
je 0x43e100
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0xa4
call ebx
mov al, byte [esp + 0x13]
jmp 0x43e106
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
jmp 0x43e106
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x43e12b
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43e12b
test al, 1
je 0x43e12b
push 0
push 3
push 0
push 0xa5
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43e150
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43e150
test al, 2
je 0x43e150
push 0
push 2
push 0
push 0xa0
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x43e175
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43e175
test al, 2
je 0x43e175
push 0
push 3
push 0
push 0xa1
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x43e19a
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43e19a
test al, 4
je 0x43e19a
push 0
push 2
push 0
push 0xa2
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43e1bf
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43e1bf
test al, 4
je 0x43e1bf
push 0
push 3
push 0
push 0xa3
call ebx
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x43e1d7
cmp dword [esp + 0x20], ecx
jne 0x43e1d7
test al, 1
mov dword [esp + 0x30], 1
jne 0x43e1db
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x3c], ecx
je 0x43e1f3
cmp dword [esp + 0x20], ecx
jne 0x43e1f3
test al, 1
mov dword [esp + 0x3c], 2
jne 0x43e1f7
mov dword [esp + 0x3c], ecx
cmp dword [esp + 0x4c], ecx
je 0x43e20e
cmp dword [esp + 0x1c], ecx
jne 0x43e20e
test al, 2
je 0x43e20e
mov ebx, 4
jmp 0x43e210
xor ebx, ebx
cmp dword [esp + 0x28], ecx
je 0x43e227
cmp dword [esp + 0x1c], ecx
jne 0x43e227
test al, 2
je 0x43e227
mov edx, 8
jmp 0x43e229
xor edx, edx
cmp dword [esp + 0x2c], ecx
je 0x43e240
cmp dword [esp + 0x18], ecx
jne 0x43e240
test al, 4
je 0x43e240
mov ecx, 0x10
jmp 0x43e242
xor ecx, ecx
mov esi, dword [esp + 0x24]
test esi, esi
je 0x43e25d
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x43e25d
test al, 4
je 0x43e25d
mov eax, 0x20
jmp 0x43e25f
xor eax, eax
add al, cl
mov cl, byte [esp + 0x3c]
add al, dl
add al, bl
mov bl, byte [esp + 0x30]
add al, cl
add al, bl
mov bl, al
mov eax, dword [esp + 0x34]
push eax
call fcn.0043a350
add esp, 4
test bl, 1
je 0x43e29a
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa4
call esi
jmp 0x43e2a0
mov esi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 2
je 0x43e2b2
push 0
push 1
push 0
push 0xa5
call esi
test bl, 4
je 0x43e2c4
push 0
push 0
push 0
push 0xa0
call esi
test bl, 8
je 0x43e2d6
push 0
push 1
push 0
push 0xa1
call esi
test bl, 0x10
je 0x43e2e8
lea ecx, [esp + 0xf0]
mov byte [esp + 0xb90], 2
call sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString
push 7
lea ecx, [esp + 0x5b4]
push 4
push ecx
mov dword [esp + 0xba0], 0xffffffff
call fcn.0044d9af
jmp 0x441ddf
cmp ax, 0x8ed
jne 0x43e44a
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea edx, [esp + 0x5f0]
push 4
push edx
call fcn.0044daa3
lea eax, [esp + 0x5e4]
push 0
push eax
push 0
push 7
push 0xfffffffffffffffe
mov dword [esp + 0xba4], 4
call fcn.0044be80
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x5c]
add esp, 0x14
lea ecx, [eax + eax*8]
shl ecx, 8
add ecx, eax
lea eax, [edx + ecx*2]
mov ecx, dword [0x471114]
mov edx, dword [ecx + eax*4 + 0x804]
lea eax, [esp + 0x1b8]
push eax
lea ecx, [esp + 0xfc]
mov dword [esp + 0x1bc], edx
mov byte [esp + 0x1c0], 0
call fcn.0044d46a
xor ebx, ebx
mov byte [esp + 0xb90], 5
test esi, esi
jle 0x43e410
lea ecx, [esp + 0x5e4]
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0xf8]
push edx
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43e407
mov ecx, dword [esp + 0x38]
inc ebx
add ecx, 4
cmp ebx, esi
mov dword [esp + 0x38], ecx
jl 0x43e3d9
jmp 0x43e410
push ebx
call fcn.0043a010
add esp, 4
lea ecx, [esp + 0xf8]
mov byte [esp + 0xb90], 4
call sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString
push 7
lea edx, [esp + 0x5ec]
push 4
push edx
mov dword [esp + 0xba0], 0xffffffff
call fcn.0044d9af
jmp 0x441ddf
cmp ax, 0x8ee
jne 0x43e560
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea eax, [esp + 0x628]
push 4
push eax
call fcn.0044daa3
lea ecx, [esp + 0x61c]
push 0
push ecx
push 0
push 7
push 0xfffffffffffffffe
mov dword [esp + 0xba4], 6
call fcn.0044be80
mov esi, eax
mov eax, dword [ebp + 8]
add esp, 0x14
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov eax, dword [esp + 0x48]
lea ecx, [eax + edx*2]
mov edx, dword [0x471114]
mov eax, dword [edx + ecx*4 + 0x804]
lea ecx, [esp + 0x1e4]
push ecx
lea ecx, [esp + 0x104]
mov dword [esp + 0x1e8], eax
mov byte [esp + 0x1ec], 0
call fcn.0044d46a
xor ebx, ebx
mov byte [esp + 0xb90], 7
test esi, esi
jle 0x43e526
lea edx, [esp + 0x61c]
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x100]
push eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43e51d
mov ecx, dword [esp + 0x38]
inc ebx
add ecx, 4
cmp ebx, esi
mov dword [esp + 0x38], ecx
jl 0x43e4ef
jmp 0x43e526
push ebx
call fcn.0043a1b0
add esp, 4
lea ecx, [esp + 0x100]
mov byte [esp + 0xb90], 6
call sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString
push 7
lea eax, [esp + 0x624]
push 4
push eax
mov dword [esp + 0xba0], 0xffffffff
call fcn.0044d9af
jmp 0x441ddf
cmp ax, 0x8ef
jne 0x43e8d8
push 0
lea ecx, [esp + 0xa04]
push 0
push ecx
push 7
push 0xfffffffffffffffe
call fcn.0044be80
add esp, 0x14
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x38], 0
jle 0x441dd9
mov eax, dword [ebp + 8]
lea ebx, [esp + 0xa00]
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov eax, dword [esp + 0x48]
lea ecx, [eax + edx*2]
lea edx, [ecx*4 + 0x804]
mov dword [esp + 0x24], edx
xor esi, esi
mov edx, dword [ebx]
lea eax, [esp + 0x568]
lea ecx, [esp + 0xc4]
push eax
push ecx
push esi
push edx
mov byte [esp + 0xd4], 0
mov dword [esp + 0xd5], 0
call fcn.0044a7d0
mov ecx, dword [0x471114]
mov eax, dword [esp + 0x34]
add esp, 0x10
mov edx, dword [eax + ecx]
mov eax, dword [esp + 0xc4]
cmp edx, eax
je 0x43e623
inc esi
cmp esi, 6
jl 0x43e5bc
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x38], eax
jge 0x441ddf
jmp 0x43e5ba
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov al, byte [ecx + edx*8 + 1]
mov byte [esp + 0x17], al
call ebx
mov si, ax
push 0xa5
and esi, 0x8000
call ebx
and eax, 0x8000
push 0xa0
mov dword [esp + 0x40], eax
call ebx
and eax, 0x8000
push 0xa1
mov dword [esp + 0x50], eax
call ebx
and eax, 0x8000
push 0xa2
mov dword [esp + 0x2c], eax
call ebx
and eax, 0x8000
push 0xa3
mov dword [esp + 0x30], eax
call ebx
and eax, 0x8000
test esi, esi
mov dword [esp + 0x24], eax
je 0x43e6c9
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43e6d5
test al, 1
je 0x43e6d5
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0xa4
call ebx
mov al, byte [esp + 0x13]
jmp 0x43e6db
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
jmp 0x43e6db
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x43e700
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43e700
test al, 1
je 0x43e700
push 0
push 3
push 0
push 0xa5
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43e725
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43e725
test al, 2
je 0x43e725
push 0
push 2
push 0
push 0xa0
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x43e74a
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43e74a
test al, 2
je 0x43e74a
push 0
push 3
push 0
push 0xa1
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x43e76f
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43e76f
test al, 4
je 0x43e76f
push 0
push 2
push 0
push 0xa2
call ebx
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43e794
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43e794
test al, 4
je 0x43e794
push 0
push 3
push 0
push 0xa3
call ebx
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x43e7ac
cmp dword [esp + 0x20], ecx
jne 0x43e7ac
test al, 1
mov dword [esp + 0x30], 1
jne 0x43e7b0
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x3c], ecx
je 0x43e7c8
cmp dword [esp + 0x20], ecx
jne 0x43e7c8
test al, 1
mov dword [esp + 0x3c], 2
jne 0x43e7cc
mov dword [esp + 0x3c], ecx
cmp dword [esp + 0x4c], ecx
je 0x43e7e3
cmp dword [esp + 0x1c], ecx
jne 0x43e7e3
test al, 2
je 0x43e7e3
mov ebx, 4
jmp 0x43e7e5
xor ebx, ebx
cmp dword [esp + 0x28], ecx
je 0x43e7fc
cmp dword [esp + 0x1c], ecx
jne 0x43e7fc
test al, 2
je 0x43e7fc
mov edx, 8
jmp 0x43e7fe
xor edx, edx
cmp dword [esp + 0x2c], ecx
je 0x43e815
cmp dword [esp + 0x18], ecx
jne 0x43e815
test al, 4
je 0x43e815
mov ecx, 0x10
jmp 0x43e817
xor ecx, ecx
mov esi, dword [esp + 0x24]
test esi, esi
je 0x43e832
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x43e832
test al, 4
je 0x43e832
xor eax, eax
add al, cl
mov cl, byte [esp + 0x3c]
add al, dl
add al, bl
mov bl, byte [esp + 0x30]
add al, cl
mov ecx, dword [esp + 0x38]
add al, bl
push ecx
mov bl, al
call fcn.0043a350
add esp, 4
test bl, 1
je 0x43e86f
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa4
call esi
jmp 0x43e875
mov esi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 2
je 0x43e887
cmp ax, 0x8f0
jne 0x43ef25
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea edx, [esp + 0x698]
push 4
push edx
call fcn.0044daa3
lea eax, [esp + 0x68c]
push 0
lea ecx, [esp + 0x8d0]
push eax
push ecx
push 7
push 0xfffffffffffffffe
mov dword [esp + 0xba4], 8
call fcn.0044be80
mov ebx, eax
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x5c]
mov ecx, dword [0x471114]
lea edi, [eax + eax*8]
add esp, 0x14
shl edi, 8
add edi, eax
mov dword [esp + 0x34], ebx
shl edi, 1
lea eax, [edi + edx]
mov edx, dword [ecx + eax*4 + 0x804]
lea eax, [esp + 0x18c]
push eax
lea ecx, [esp + 0xe8]
mov dword [esp + 0x190], edx
mov byte [esp + 0x194], 0
call fcn.0044d46a
xor esi, esi
mov byte [esp + 0xb90], 9
test ebx, ebx
mov dword [esp + 0x38], 0xffffffff
jle 0x43eef1
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [esp + esi*4 + 0x8cc]
lea ecx, [esp + 0x108]
push ecx
mov ecx, dword [0x4710ac]
lea edx, [esp + 0x80]
push 4
add eax, 0x16c
push edx
push eax
push ecx
call ebx
mov edx, dword [esp + 0x7c]
push edx
call fcn.0044b6e0
add esp, 4
lea ecx, [esp + 0x108]
lea edx, [esp + esi*4 + 0x894]
add eax, 0x78
push ecx
push 4
push edx
mov dword [esp + 0x88], eax
push eax
mov eax, dword [0x4710ac]
push eax
call ebx
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + esi*4 + 0x6d8]
add eax, 4
push 4
push edx
mov dword [esp + 0x88], eax
push eax
mov eax, dword [0x4710ac]
push eax
call ebx
mov eax, dword [esp + esi*4 + 0x68c]
mov ecx, dword [esp + 0xe4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x43ea34
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x34]
inc esi
cmp esi, eax
jl 0x43e990
cmp dword [esp + 0x38], 0xffffffff
je 0x43eef1
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
xor eax, eax
lea ecx, [esp + edx*4 + 0x6d4]
lea edx, [esp + edx*4 + 0x894]
fld dword [esp + eax*4 + 0x6d4]
fsub dword [ecx]
fld dword [esp + eax*4 + 0x894]
fsub dword [edx]
inc eax
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
cmp eax, esi
faddp st(1)
fsqrt
fstp dword [esp + eax*4 + 0x650]
fstp st(0)
fstp st(0)
jl 0x43ea64
mov edx, dword [esp + 0x48]
mov ecx, dword [0x471114]
xor ebx, ebx
lea eax, [edi + edx]
mov edx, dword [ecx + eax*4 + 0x2804]
mov dword [esp + 0x3c], edx
fld dword [0x45b8e0]
or esi, 0xffffffff
xor edx, edx
lea ecx, [esp + 0x654]
cmp dword [ecx], 0xbf800000
je 0x43ead5
fcom dword [ecx]
fnstsw ax
test ah, 0x41
jne 0x43ead5
fstp st(0)
fld dword [ecx]
mov esi, edx
mov eax, dword [esp + 0x34]
inc edx
add ecx, 4
cmp edx, eax
jl 0x43eabe
mov eax, dword [esp + 0x3c]
test eax, eax
fstp st(0)
jbe 0x43eb39
lea ecx, [esi*4]
mov dword [esp + 0x2b0], eax
mov dword [esp + 0x2b4], 0
fld dword [esp + ecx + 0x654]
fild qword [esp + 0x2b0]
fmul qword [0x45b8d8]
fcompp
fnstsw ax
test ah, 1
je 0x43eb39
mov dword [esp + ebx*4 + 0x904], 0
mov dword [esp + ebx*4 + 0x93c], 0xffffffff
jmp 0x43eb55
lea ecx, [esi*4]
mov dword [esp + ebx*4 + 0x93c], esi
mov edx, dword [esp + ecx + 0x8cc]
mov dword [esp + ebx*4 + 0x904], edx
mov eax, dword [esp + 0x34]
inc ebx
cmp ebx, eax
mov dword [esp + ecx + 0x654], 0xbf800000
jl 0x43eaac
lea eax, [esp + 0x904]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov esi, dword [ecx]
test esi, esi
je 0x43ebdb
lea edx, [esp + 0x558]
lea eax, [esp + 0xac]
push edx
push eax
push ebx
push esi
mov byte [esp + 0xbc], 0
mov dword [esp + 0xbd], 0
call fcn.0044a7d0
mov ecx, dword [esp + 0x58]
mov eax, dword [0x471114]
add esp, 0x10
lea edx, [edi + ecx]
mov ecx, dword [eax + edx*4 + 0x1804]
mov edx, dword [esp + 0xac]
cmp ecx, edx
je 0x43ec0a
inc ebx
cmp ebx, 6
mov dword [esp + 0x14], ebx
jl 0x43eb8c
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], edx
jge 0x43eef1
jmp 0x43eb80
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea edx, [ecx + ecx*8]
shl edx, 8
add edx, ecx
mov al, byte [eax + edx*8 + 1]
mov byte [esp + 0x17], al
call edi
mov si, ax
push 0xa5
and esi, 0x8000
call edi
mov bx, ax
push 0xa0
and ebx, 0x8000
call edi
and eax, 0x8000
push 0xa1
mov dword [esp + 0x40], eax
call edi
and eax, 0x8000
push 0xa2
mov dword [esp + 0x50], eax
call edi
and eax, 0x8000
push 0xa3
mov dword [esp + 0x2c], eax
call edi
mov di, ax
and edi, 0x8000
test esi, esi
je 0x43eca8
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43ecac
test al, 1
je 0x43ecac
push 0
push 2
push 0
push 0xa4
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x43ecd1
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43ecd1
test al, 1
je 0x43ecd1
push 0
push 3
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x43ecfa
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43ecfa
test al, 2
je 0x43ecfa
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43ed23
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43ed23
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x43ed4c
lea ecx, [esp + 0xe4]
mov byte [esp + 0xb90], 8
call sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString
push 7
mov dword [esp + 0xb98], 0xffffffff
push 4
lea edx, [esp + 0x698]
jmp 0x441dd3
cmp ax, 0x8f1
jne 0x43f622
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea eax, [esp + 0x6fc]
push 4
push eax
call fcn.0044daa3
mov eax, dword [ebp + 8]
mov edx, dword [0x471114]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea ecx, [eax + eax*8]
mov dword [esp + 0xb94], 0xa
shl ecx, 8
add ecx, eax
mov al, byte [edx + ecx*8 + 1]
mov byte [esp + 0x17], al
call ebx
mov si, ax
push 0xa5
and esi, 0x8000
call ebx
mov di, ax
push 0xa0
and edi, 0x8000
call ebx
mov bx, ax
push 0xa1
and ebx, 0x8000
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa2
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa3
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
test esi, esi
mov dword [esp + 0x4c], eax
je 0x43f005
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43f009
test al, 1
je 0x43f009
push 0
push 2
push 0
push 0xa4
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test edi, edi
je 0x43f02e
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43f02e
test al, 1
je 0x43f02e
push 0
push 3
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x43f053
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43f053
test al, 2
je 0x43f053
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x43f07c
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43f07c
test al, 2
je 0x43f07c
push 0
push 3
push 0
push 0xa1
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x43f0a5
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43f0a5
test al, 4
je 0x43f0a5
push 0
push 2
push 0
push 0xa2
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43f0ce
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43f0ce
test al, 4
je 0x43f0ce
push 0
push 3
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x43f0e6
cmp dword [esp + 0x20], ecx
jne 0x43f0e6
test al, 1
mov dword [esp + 0x2c], 1
jne 0x43f0ea
mov dword [esp + 0x2c], ecx
cmp edi, ecx
je 0x43f100
cmp dword [esp + 0x20], ecx
jne 0x43f100
test al, 1
mov dword [esp + 0x28], 2
jne 0x43f104
mov dword [esp + 0x28], ecx
cmp ebx, ecx
je 0x43f119
cmp dword [esp + 0x1c], ecx
jne 0x43f119
test al, 2
je 0x43f119
mov edx, 4
jmp 0x43f11b
xor edx, edx
cmp dword [esp + 0x14], ecx
je 0x43f132
cmp dword [esp + 0x1c], ecx
jne 0x43f132
test al, 2
je 0x43f132
mov ebx, 8
jmp 0x43f134
xor ebx, ebx
cmp dword [esp + 0x3c], ecx
je 0x43f14b
cmp dword [esp + 0x18], ecx
jne 0x43f14b
test al, 4
je 0x43f14b
mov ecx, 0x10
jmp 0x43f14d
xor ecx, ecx
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x43f168
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x43f168
test al, 4
je 0x43f168
mov eax, 0x20
jmp 0x43f16a
xor eax, eax
add al, cl
mov cl, byte [esp + 0x28]
add al, bl
mov bl, byte [esp + 0x2c]
mov esi, dword [sym.imp.USER32.dll_mouse_event]
add al, dl
add al, cl
push 0x1bd5
add al, bl
push 0
push 0
mov bl, al
push 0
push 2
mov byte [esp + 0x27], bl
mov dword [0x471328], 1
call esi
push 0x1bd5
push 0
push 0
push 0
push 4
call esi
lea ecx, [esp + 0x298]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
fld qword [0x4712f8]
fmul qword [0x45b8d0]
call sub.MSVCRT.dll__ftol
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0xa0]
push 0
lea eax, [esp + 0x238]
push edx
push eax
mov dword [esp + 0xac], 0
call fcn.0044ac70
add esp, 0xc
lea ecx, [esp + 0x234]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x43f578
lea ecx, [esp + 0x6f0]
push 0
lea edx, [esp + 0x978]
push ecx
push edx
push 7
push 0xfffffffffffffffe
call fcn.0044be80
mov edx, dword [esp + 0xb4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0x14
mov edi, eax
lea eax, [esp + 0x74]
lea ecx, [esp + 0x64]
push eax
mov eax, dword [0x4710ac]
push 4
add edx, 0x16c
push ecx
push edx
push eax
call ebx
mov ecx, dword [esp + 0x64]
push ecx
call fcn.0044b6e0
add esp, 4
lea edx, [esp + 0x74]
lea ecx, [esp + 0x220]
add eax, 0x78
push edx
mov edx, dword [0x4710ac]
push 4
push ecx
push eax
push edx
mov dword [esp + 0x78], eax
call ebx
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x250]
add eax, 4
push 4
push edx
mov dword [esp + 0x70], eax
push eax
mov eax, dword [0x4710ac]
push eax
call ebx
xor esi, esi
test edi, edi
jle 0x43f32a
mov eax, dword [esp + esi*4 + 0x974]
lea ecx, [esp + 0x74]
push ecx
mov ecx, dword [0x4710ac]
lea edx, [esp + 0x68]
push 4
add eax, 0x16c
push edx
push eax
push ecx
call ebx
mov edx, dword [esp + 0x64]
push edx
call fcn.0044b6e0
add esp, 4
lea ecx, [esp + 0x74]
lea edx, [esp + esi*4 + 0xa1c]
add eax, 0x78
push ecx
push 4
push edx
mov dword [esp + 0x70], eax
push eax
mov eax, dword [0x4710ac]
push eax
call ebx
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + esi*4 + 0xb1c]
add eax, 4
push 4
push edx
mov dword [esp + 0x70], eax
push eax
mov eax, dword [0x4710ac]
push eax
call ebx
inc esi
cmp esi, edi
jl 0x43f2b4
xor eax, eax
test edi, edi
jle 0x43f368
call fcn.00431750
test bl, 1
mov dword [0x471328], 0
je 0x43f5a1
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa4
call esi
jmp 0x43f5a7
mov esi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 2
je 0x43f5b9
cmp ax, 0x8f2
jne 0x43fc25
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea edx, [esp + 0x59c]
push 4
push edx
call fcn.0044daa3
lea eax, [esp + 0x590]
push 0
lea ecx, [esp + 0x72c]
push eax
push ecx
push 7
push 0xfffffffffffffffe
mov dword [esp + 0xba4], 0xb
call fcn.0044be80
mov ebx, eax
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x5c]
mov ecx, dword [0x471114]
lea edi, [eax + eax*8]
add esp, 0x14
shl edi, 8
add edi, eax
mov dword [esp + 0x34], ebx
shl edi, 1
lea eax, [edi + edx]
mov edx, dword [ecx + eax*4 + 0x804]
lea eax, [esp + 0x194]
push eax
lea ecx, [esp + 0x108]
mov dword [esp + 0x198], edx
mov byte [esp + 0x19c], 0
call fcn.0044d46a
xor esi, esi
mov byte [esp + 0xb90], 0xc
test ebx, ebx
mov dword [esp + 0x14], 0xffffffff
jle 0x43fbf0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [esp + esi*4 + 0x728]
lea ecx, [esp + 0xec]
push ecx
mov ecx, dword [0x4710ac]
lea edx, [esp + 0x8c]
push 4
add eax, 0x16c
push edx
push eax
push ecx
call ebx
mov edx, dword [esp + 0x88]
push edx
call fcn.0044b6e0
add esp, 4
lea ecx, [esp + 0xec]
lea edx, [esp + esi*4 + 0x878]
add eax, 0x78
push ecx
push 4
push edx
mov dword [esp + 0x94], eax
push eax
mov eax, dword [0x4710ac]
push eax
call ebx
mov eax, dword [esp + 0x88]
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + esi*4 + 0x860]
add eax, 4
push 4
push edx
mov dword [esp + 0x94], eax
push eax
mov eax, dword [0x4710ac]
push eax
call ebx
mov eax, dword [esp + esi*4 + 0x590]
mov ecx, dword [esp + 0x104]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x43f788
mov ecx, esi
mov dword [esp + 0x14], ecx
jmp 0x43f78c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
inc esi
cmp esi, eax
jl 0x43f6da
cmp ecx, 0xffffffff
je 0x43fbf0
mov esi, dword [esp + 0x34]
lea edx, [esp + ecx*4 + 0x85c]
xor eax, eax
lea ecx, [esp + ecx*4 + 0x878]
fld dword [esp + eax*4 + 0x85c]
fsub dword [edx]
fld dword [esp + eax*4 + 0x878]
fsub dword [ecx]
inc eax
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
cmp eax, esi
faddp st(1)
fsqrt
fstp dword [esp + eax*4 + 0x570]
fstp st(0)
fstp st(0)
jl 0x43f7b6
mov edx, dword [esp + 0x48]
mov ecx, dword [0x471114]
xor ebx, ebx
lea eax, [edi + edx]
mov edx, dword [ecx + eax*4 + 0x2804]
mov dword [esp + 0x14], edx
fld dword [0x45b8e0]
or esi, 0xffffffff
xor edx, edx
lea ecx, [esp + 0x574]
cmp dword [ecx], 0xbf800000
je 0x43f827
fcom dword [ecx]
fnstsw ax
test ah, 0x41
jne 0x43f827
fstp st(0)
fld dword [ecx]
mov esi, edx
mov eax, dword [esp + 0x34]
inc edx
add ecx, 4
cmp edx, eax
jl 0x43f810
mov eax, dword [esp + 0x14]
test eax, eax
fstp st(0)
jbe 0x43f88b
lea ecx, [esi*4]
mov dword [esp + 0x280], eax
mov dword [esp + 0x284], 0
fld dword [esp + ecx + 0x574]
fild qword [esp + 0x280]
fmul qword [0x45b8d8]
fcompp
fnstsw ax
test ah, 1
je 0x43f88b
mov dword [esp + ebx*4 + 0x990], 0
mov dword [esp + ebx*4 + 0x760], 0xffffffff
jmp 0x43f8a7
lea ecx, [esi*4]
mov dword [esp + ebx*4 + 0x760], esi
mov edx, dword [esp + ecx + 0x728]
mov dword [esp + ebx*4 + 0x990], edx
mov eax, dword [esp + 0x34]
inc ebx
cmp ebx, eax
mov dword [esp + ecx + 0x574], 0xbf800000
jl 0x43f7fe
lea eax, [esp + 0x990]
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
xor esi, esi
mov ebx, dword [ecx]
test ebx, ebx
je 0x43f929
lea edx, [esp + 0x564]
lea eax, [esp + 0xcc]
push edx
push eax
push esi
push ebx
mov byte [esp + 0xdc], 0
mov dword [esp + 0xdd], 0
call fcn.0044a7d0
mov ecx, dword [esp + 0x58]
mov eax, dword [0x471114]
add esp, 0x10
lea edx, [edi + ecx]
mov ecx, dword [eax + edx*4 + 0x1804]
mov edx, dword [esp + 0xcc]
cmp ecx, edx
je 0x43f951
inc esi
cmp esi, 6
jl 0x43f8da
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], edx
jge 0x43fbf0
jmp 0x43f8d2
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea edx, [ecx + ecx*8]
shl edx, 8
add edx, ecx
mov al, byte [eax + edx*8 + 1]
mov byte [esp + 0x17], al
call edi
mov si, ax
push 0xa5
and esi, 0x8000
call edi
mov bx, ax
push 0xa0
and ebx, 0x8000
call edi
and eax, 0x8000
push 0xa1
mov dword [esp + 0x18], eax
call edi
and eax, 0x8000
push 0xa2
mov dword [esp + 0x40], eax
call edi
and eax, 0x8000
push 0xa3
mov dword [esp + 0x50], eax
call edi
mov di, ax
and edi, 0x8000
test esi, esi
je 0x43f9ef
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43f9f3
test al, 1
je 0x43f9f3
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x43fa18
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43fa18
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x43fa41
lea ecx, [esp + 0x104]
mov byte [esp + 0xb90], 0xb
call sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString
push 7
lea eax, [esp + 0x598]
push 4
mov dword [esp + 0xb9c], 0xffffffff
push eax
jmp 0x441dd4
cmp ax, 0x8f3
jne 0x4402aa
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea ecx, [esp + 0x7dc]
push 4
push ecx
call fcn.0044daa3
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
mov dword [esp + 0xb94], 0xd
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov eax, dword [0x471114]
mov cl, byte [eax + edx*8 + 1]
mov byte [esp + 0x17], cl
call ebx
mov si, ax
push 0xa5
and esi, 0x8000
call ebx
mov di, ax
push 0xa0
and edi, 0x8000
call ebx
mov bx, ax
push 0xa1
and ebx, 0x8000
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa2
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa3
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
test esi, esi
mov dword [esp + 0x4c], eax
je 0x43fd04
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x43fd08
test al, 1
je 0x43fd08
push 0
push 2
push 0
push 0xa4
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test edi, edi
je 0x43fd2d
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x43fd2d
test al, 1
je 0x43fd2d
push 0
push 3
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x43fd52
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43fd52
test al, 2
je 0x43fd52
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x43fd7b
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x43fd7b
test al, 2
je 0x43fd7b
push 0
push 3
push 0
push 0xa1
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x43fda4
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43fda4
test al, 4
je 0x43fda4
push 0
push 2
push 0
push 0xa2
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x43fdcd
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x43fdcd
test al, 4
je 0x43fdcd
push 0
push 3
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x43fde5
cmp dword [esp + 0x20], ecx
jne 0x43fde5
test al, 1
mov dword [esp + 0x2c], 1
jne 0x43fde9
mov dword [esp + 0x2c], ecx
cmp edi, ecx
je 0x43fdff
cmp dword [esp + 0x20], ecx
jne 0x43fdff
test al, 1
mov dword [esp + 0x28], 2
jne 0x43fe03
mov dword [esp + 0x28], ecx
cmp ebx, ecx
je 0x43fe18
cmp dword [esp + 0x1c], ecx
jne 0x43fe18
test al, 2
je 0x43fe18
mov edx, 4
jmp 0x43fe1a
xor edx, edx
cmp dword [esp + 0x14], ecx
je 0x43fe31
cmp dword [esp + 0x1c], ecx
jne 0x43fe31
test al, 2
je 0x43fe31
mov ebx, 8
jmp 0x43fe33
xor ebx, ebx
cmp dword [esp + 0x3c], ecx
je 0x43fe4a
cmp dword [esp + 0x18], ecx
jne 0x43fe4a
test al, 4
je 0x43fe4a
xor ecx, ecx
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x43fe67
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x43fe67
xor eax, eax
add al, cl
mov cl, byte [esp + 0x28]
add al, bl
mov bl, byte [esp + 0x2c]
mov esi, dword [sym.imp.USER32.dll_mouse_event]
add al, dl
add al, cl
push 0x1bd5
add al, bl
push 0
push 0
mov bl, al
push 0
push 2
mov byte [esp + 0x27], bl
mov dword [0x471328], 1
call esi
push 0x1bd5
push 0
push 0
push 0
push 4
call esi
lea edx, [esp + 0x6b0]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
fld qword [0x4712f8]
fmul qword [0x45b8d0]
call sub.MSVCRT.dll__ftol
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x94]
push 0
lea ecx, [esp + 0x214]
push eax
push ecx
mov dword [esp + 0xa0], 0
call fcn.0044ac70
add esp, 0xc
lea ecx, [esp + 0x210]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x94]
test eax, eax
je 0x440201
cmp ax, 0x8f4
jne 0x440944
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea eax, [esp + 0x644]
push 4
push eax
call fcn.0044daa3
lea ecx, [esp + 0x638]
push 0
lea edx, [esp + 0x9cc]
push ecx
push edx
push 7
push 0xfffffffffffffffe
mov dword [esp + 0xba4], 0xe
call fcn.0044be80
mov ebx, eax
mov eax, dword [ebp + 8]
mov edx, dword [0x471114]
add esp, 0x14
lea edi, [eax + eax*8]
mov dword [esp + 0x3c], ebx
shl edi, 8
add edi, eax
mov eax, dword [esp + 0x48]
shl edi, 1
lea ecx, [edi + eax]
mov eax, dword [edx + ecx*4 + 0x804]
lea ecx, [esp + 0x1b0]
push ecx
lea ecx, [esp + 0x118]
mov dword [esp + 0x1b4], eax
mov byte [esp + 0x1b8], 0
call fcn.0044d46a
xor esi, esi
mov byte [esp + 0xb90], 0xf
test ebx, ebx
mov dword [esp + 0x14], 0xffffffff
jle 0x44090f
mov ecx, dword [esp + esi*4 + 0x9c8]
lea edx, [esp + 0xf4]
push edx
mov edx, dword [0x4710ac]
lea eax, [esp + 0x84]
push 4
add ecx, 0x16c
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [esp + 0x80]
push eax
call fcn.0044b6e0
add esp, 4
lea ecx, [esp + 0xf4]
lea edx, [esp + esi*4 + 0x808]
add eax, 0x78
push ecx
push 4
push edx
mov dword [esp + 0x8c], eax
push eax
mov eax, dword [0x4710ac]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0xf4]
push ecx
lea edx, [esp + esi*4 + 0x8ec]
add eax, 4
push 4
push edx
mov dword [esp + 0x8c], eax
push eax
mov eax, dword [0x4710ac]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [esp + esi*4 + 0x638]
mov ecx, dword [esp + 0x114]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x440417
mov edx, esi
mov dword [esp + 0x14], edx
jmp 0x44041b
mov edx, dword [esp + 0x14]
inc esi
cmp esi, ebx
jl 0x44035c
cmp edx, 0xffffffff
je 0x44090f
lea ecx, [esp + edx*4 + 0x8e8]
xor eax, eax
lea edx, [esp + edx*4 + 0x808]
fld dword [esp + eax*4 + 0x8e8]
fsub dword [ecx]
fld dword [esp + eax*4 + 0x808]
fsub dword [edx]
inc eax
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
cmp eax, ebx
faddp st(1)
fsqrt
fstp dword [esp + eax*4 + 0x83c]
fstp st(0)
fstp st(0)
jl 0x44043d
mov dword [esp + 0x34], 0
fld dword [0x45b8e0]
or esi, 0xffffffff
xor edx, edx
lea ecx, [esp + 0x840]
cmp dword [ecx], 0xbf800000
je 0x44049c
fcom dword [ecx]
fnstsw ax
test ah, 0x41
jne 0x44049c
fstp st(0)
fld dword [ecx]
mov esi, edx
inc edx
add ecx, 4
cmp edx, ebx
jl 0x440485
mov eax, dword [esp + 0x34]
mov edx, dword [esp + esi*4 + 0x9c8]
fstp st(0)
mov dword [esp + eax*4 + 0xac4], edx
mov dword [esp + eax*4 + 0xafc], esi
inc eax
mov dword [esp + esi*4 + 0x840], 0xbf800000
cmp eax, ebx
mov dword [esp + 0x34], eax
jl 0x440473
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], 0
add edi, eax
lea ebx, [esp + 0xac4]
lea ecx, [edi*4 + 0x1804]
mov dword [esp + 0x14], ecx
push 0x4701fc
lea ecx, [esp + 0x200]
call sub.MFC42u.DLL_CString::CString_4
xor edx, edx
push sub.MFC42u.DLL_CString::CString
mov dword [esp + 0x204], edx
push sub.MFC42u.DLL_CString::CString_5
mov dword [esp + 0x20c], edx
push 4
lea eax, [esp + 0x20c]
mov dword [esp + 0x214], edx
push 4
push eax
mov byte [esp + 0xba4], 0x10
mov dword [esp + 0x220], edx
call fcn.0044daa3
mov edx, dword [ebx]
lea ecx, [esp + 0x1fc]
push ecx
push edx
mov byte [esp + 0xb98], 0x11
call fcn.0044c050
mov eax, dword [0x471114]
mov ecx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [ecx + eax]
lea eax, [esp + 0x1c0]
push eax
lea ecx, [esp + 0xa0]
mov dword [esp + 0x1c4], edx
mov byte [esp + 0x1c8], 0
call fcn.0044d46a
mov byte [esp + 0xb90], 0x12
xor edi, edi
lea esi, [esp + 0x1fc]
mov eax, dword [esi]
mov ecx, dword [esp + 0x9c]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x440624
inc edi
add esi, 4
cmp edi, 5
jl 0x4405a0
lea ecx, [esp + 0x9c]
mov byte [esp + 0xb90], 0x11
call sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString
push 4
lea edx, [esp + 0x208]
push 4
push edx
mov byte [esp + 0xba0], 0x10
call fcn.0044d9af
lea ecx, [esp + 0x1fc]
mov byte [esp + 0xb90], 0xf
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x34], eax
jge 0x44090f
jmp 0x4404f3
mov eax, dword [ebp + 8]
mov edx, dword [0x471114]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea ecx, [eax + eax*8]
shl ecx, 8
add ecx, eax
mov al, byte [edx + ecx*8 + 1]
mov byte [esp + 0x17], al
call edi
mov si, ax
push 0xa5
and esi, 0x8000
call edi
mov bx, ax
push 0xa0
and ebx, 0x8000
call edi
and eax, 0x8000
push 0xa1
mov dword [esp + 0x18], eax
call edi
and eax, 0x8000
push 0xa2
mov dword [esp + 0x40], eax
call edi
and eax, 0x8000
push 0xa3
mov dword [esp + 0x50], eax
call edi
mov di, ax
and edi, 0x8000
test esi, esi
je 0x4406c8
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x4406cc
test al, 1
je 0x4406cc
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x4406f1
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x4406f1
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x44071a
lea ecx, [esp + 0x114]
mov byte [esp + 0xb90], 0xe
call sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString
push 7
lea ecx, [esp + 0x640]
push 4
mov dword [esp + 0xb9c], 0xffffffff
push ecx
jmp 0x441dd4
cmp ax, 0x8f5
jne 0x4412e6
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea edx, [esp + 0x718]
push 4
push edx
call fcn.0044daa3
mov eax, dword [ebp + 8]
mov edx, dword [0x471114]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea ecx, [eax + eax*8]
mov dword [esp + 0xb94], 0x13
shl ecx, 8
add ecx, eax
lea eax, [ecx*8 + 1]
mov dword [esp + 0x38], eax
mov al, byte [eax + edx]
mov byte [esp + 0x17], al
call ebx
mov si, ax
push 0xa5
and esi, 0x8000
call ebx
mov di, ax
push 0xa0
and edi, 0x8000
call ebx
mov bx, ax
push 0xa1
and ebx, 0x8000
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa2
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa3
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
test esi, esi
mov dword [esp + 0x4c], eax
je 0x440a2e
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x440a32
test al, 1
je 0x440a32
push 0
push 2
push 0
push 0xa4
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test edi, edi
je 0x440a57
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x440a57
test al, 1
je 0x440a57
push 0
push 3
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x440a7c
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x440a7c
test al, 2
je 0x440a7c
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x440aa5
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x440aa5
test al, 2
je 0x440aa5
push 0
push 3
push 0
push 0xa1
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x440ace
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x440ace
test al, 4
je 0x440ace
push 0
push 2
push 0
push 0xa2
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x440af7
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x440af7
test al, 4
je 0x440af7
push 0
push 3
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x440b0f
cmp dword [esp + 0x20], ecx
jne 0x440b0f
test al, 1
mov dword [esp + 0x2c], 1
jne 0x440b13
mov dword [esp + 0x2c], ecx
cmp edi, ecx
je 0x440b29
cmp dword [esp + 0x20], ecx
jne 0x440b29
test al, 1
mov dword [esp + 0x28], 2
jne 0x440b2d
mov dword [esp + 0x28], ecx
cmp ebx, ecx
je 0x440b42
cmp dword [esp + 0x1c], ecx
jne 0x440b42
test al, 2
je 0x440b42
xor edx, edx
cmp dword [esp + 0x14], ecx
je 0x440b5b
cmp dword [esp + 0x1c], ecx
jne 0x440b5b
xor ebx, ebx
cmp dword [esp + 0x3c], ecx
je 0x440b74
cmp ax, 0x8f6
jne 0x44178f
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea ecx, [esp + 0x750]
push 4
push ecx
call fcn.0044daa3
lea edx, [esp + 0x744]
push 0
lea eax, [esp + 0xa74]
push edx
push eax
push 7
push 0xfffffffffffffffe
mov dword [esp + 0xba4], 0x17
call fcn.0044be80
add esp, 0x14
mov dword [esp + 0x14], eax
test eax, eax
jle 0x441769
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x48]
lea ecx, [eax + eax*8]
shl ecx, 8
add ecx, eax
lea eax, [edx + ecx*2]
mov ecx, dword [0x471114]
mov edx, dword [ecx + eax*4 + 0x804]
lea eax, [esp + 0x1ec]
push eax
lea ecx, [esp + 0x100]
mov dword [esp + 0x1f0], edx
mov byte [esp + 0x1f4], 0
call fcn.0044d46a
mov byte [esp + 0xb90], 0x18
mov dword [esp + 0x24], 0
lea ebx, [esp + 0xa70]
push 0x4701fc
lea ecx, [esp + 0x1cc]
call sub.MFC42u.DLL_CString::CString_4
xor ecx, ecx
push sub.MFC42u.DLL_CString::CString
mov dword [esp + 0x1d0], ecx
push sub.MFC42u.DLL_CString::CString_5
mov dword [esp + 0x1d8], ecx
push 4
lea edx, [esp + 0x1d8]
mov dword [esp + 0x1e0], ecx
push 4
push edx
mov byte [esp + 0xba4], 0x19
mov dword [esp + 0x1ec], ecx
call fcn.0044daa3
mov ecx, dword [ebx]
lea eax, [esp + 0x1c8]
push eax
push ecx
mov byte [esp + 0xb98], 0x1a
call fcn.0044c050
add esp, 8
xor edi, edi
lea esi, [esp + 0x1c8]
mov eax, dword [esi]
mov edx, dword [esp + 0xfc]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x44147f
inc edi
add esi, 4
cmp edi, 5
jl 0x44140f
push sub.MFC42u.DLL_CString::CString
push 4
lea eax, [esp + 0x1d4]
push 4
push eax
mov byte [esp + 0xba0], 0x19
call fcn.0044d9af
lea ecx, [esp + 0x1c8]
mov byte [esp + 0xb90], 0x18
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x24], eax
jge 0x44174f
jmp 0x441399
mov eax, dword [ebp + 8]
mov edx, dword [0x471114]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
lea ecx, [eax + eax*8]
shl ecx, 8
add ecx, eax
mov al, byte [edx + ecx*8 + 1]
mov byte [esp + 0x17], al
call edi
mov si, ax
push 0xa5
and esi, 0x8000
call edi
mov bx, ax
push 0xa0
and ebx, 0x8000
call edi
and eax, 0x8000
push 0xa1
mov dword [esp + 0x18], eax
call edi
and eax, 0x8000
push 0xa2
mov dword [esp + 0x40], eax
call edi
and eax, 0x8000
push 0xa3
mov dword [esp + 0x50], eax
call edi
mov di, ax
and edi, 0x8000
test esi, esi
je 0x441523
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x441527
test al, 1
je 0x441527
push 0
push 2
push 0
push 0xa4
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x44154c
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x44154c
test al, 1
je 0x44154c
push 0
push 3
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x441575
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x441575
test al, 2
je 0x441575
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x44159e
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x44159e
test al, 2
je 0x44159e
push 0
push 3
push 0
push 0xa1
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x4415c7
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x4415c7
test al, 4
je 0x4415c7
push 0
push 2
push 0
push 0xa2
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test edi, edi
je 0x4415ec
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x4415ec
test al, 4
je 0x4415ec
xor ecx, ecx
cmp esi, ecx
je 0x441604
cmp dword [esp + 0x20], ecx
jne 0x441604
mov dword [esp + 0x2c], ecx
cmp ebx, ecx
je 0x44161e
lea ecx, [esp + 0xfc]
mov byte [esp + 0xb90], 0x17
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push sub.MFC42u.DLL_CString::CString
push 7
lea eax, [esp + 0x74c]
push 4
push eax
mov dword [esp + 0xba0], 0xffffffff
call fcn.0044d9af
jmp 0x441ddf
cmp ax, 0x8f7
jne 0x441ddf
push sub.MFC42u.DLL_CString::CString
push sub.MFC42u.DLL_CString::CString_5
push 7
lea ecx, [esp + 0x830]
push 4
push ecx
call fcn.0044daa3
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa4
mov dword [esp + 0xb94], 0x1b
lea edx, [eax + eax*8]
shl edx, 8
add edx, eax
mov eax, dword [0x471114]
mov cl, byte [eax + edx*8 + 1]
mov byte [esp + 0x17], cl
call ebx
mov si, ax
push 0xa5
and esi, 0x8000
call ebx
mov di, ax
push 0xa0
and edi, 0x8000
call ebx
mov bx, ax
push 0xa1
and ebx, 0x8000
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa2
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
push 0xa3
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
test esi, esi
mov dword [esp + 0x4c], eax
je 0x44186e
mov eax, dword [esp + 0x20]
test eax, eax
mov al, byte [esp + 0x13]
jne 0x441872
test al, 1
je 0x441872
push 0
push 2
push 0
push 0xa4
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test edi, edi
je 0x441897
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x441897
test al, 1
je 0x441897
push 0
push 3
push 0
push 0xa5
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
test ebx, ebx
je 0x4418bc
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x4418bc
test al, 2
je 0x4418bc
push 0
push 2
push 0
push 0xa0
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4418e5
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x4418e5
test al, 2
je 0x4418e5
push 0
push 3
push 0
push 0xa1
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x44190e
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x44190e
test al, 4
je 0x44190e
push 0
push 2
push 0
push 0xa2
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x441937
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x441937
test al, 4
je 0x441937
push 0
push 3
push 0
push 0xa3
call dword [sym.imp.USER32.dll_keybd_event]
mov al, byte [esp + 0x13]
xor ecx, ecx
cmp esi, ecx
je 0x44194f
cmp dword [esp + 0x20], ecx
jne 0x44194f
test al, 1
mov dword [esp + 0x2c], 1
jne 0x441953
mov dword [esp + 0x2c], ecx
cmp edi, ecx
je 0x441969
cmp dword [esp + 0x20], ecx
jne 0x441969
mov dword [esp + 0x28], ecx
cmp ebx, ecx
je 0x441982
push edx
call fcn.0044d9af
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x48]
inc eax
cmp eax, 0x400
mov dword [esp + 0x48], eax
jl 0x43b002
mov ecx, dword [esp + 0xb88]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret