Function at 0x417bb0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0x1c], ebx
cmp byte [esi], 0
je 0x418b93
mov eax, dword [0x4e498c]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4ea0c0]
mov dword [ebp - 0x64], eax
mov eax, dword fs:[0x24]
mov dword [ebp - 0x48], eax
test ebx, ebx
jne 0x417c09
push 7
push str.Blind
push esi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x417c09
mov byte [0x4ea334], 1
add esi, 7
jmp 0x417c14
mov byte [0x4ea334], 0
test ebx, ebx
jne 0x417c32
push 6
push 0x4d6110
push esi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x417c32
mov dword [ebp - 0x1c], 2
add esi, 6
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
mov dword [ebp - 0x68], eax
mov eax, dword [edx + 0x64]
mov dword [ebp - 0x54], eax
cmp ecx, 1
je 0x417c52
cmp ecx, 3
jne 0x417cfe
mov eax, dword [0x4ea294]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x417c64
push eax
call ebx
push str.AHK_Keybd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4ea294], 0
mov dword [ebp - 0x30], eax
je 0x417c8f
mov dword [0x4ea294], edi
jmp 0x417c99
test edi, edi
je 0x417c99
push edi
call ebx
mov eax, dword [ebp - 0x30]
cmp eax, 0xb7
je 0x417cc8
cmp dword [ebp - 0x1c], 0
jne 0x417cbf
call fcn.00412160
test al, al
je 0x417cbf
mov edx, str.Click
mov ecx, esi
call fcn.0049a8f0
test eax, eax
jne 0x417cc8
mov dword [ebp + 8], 1
jmp 0x417cfe
cmp dword [ebp + 8], 3
jne 0x417cd7
mov dword [ebp + 8], 2
jmp 0x417cfe
mov edx, dword [ebp - 0x28]
mov dword [ebp + 8], 0
cmp dword [edx + 0x5c], 0
jge 0x417cf2
cmp dword [edx + 0x64], 0
jge 0x417cf2
or eax, 0xffffffff
jmp 0x417cf4
xor eax, eax
mov dword [edx + 0x64], eax
mov dword [edx + 0x5c], 0xffffffff
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov byte [ebp - 0xb], 0
test ebx, ebx
je 0x417d58
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x417dfb
cmp eax, dword [0x4e9a38]
je 0x417dfb
mov ecx, ebx
call fcn.004a0580
test al, al
jne 0x417dfb
mov ebx, dword [ebp - 0x38]
push 1
push ebx
push dword [0x4e9a38]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov edi, ebx
setne byte [ebp - 0xb]
jmp 0x417dfb
test byte [0x4ea085], 0xc0
je 0x417de6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ea07c]
cmp eax, 0x32
jae 0x417de6
cmp dword [ebp + 8], 2
je 0x417de6
cmp byte [0x4ea334], 0
jne 0x417de6
mov ebx, dword [ebp - 0x1c]
cmp ebx, 2
je 0x417de6
cmp byte [0x4ea24b], 0
je 0x417de6
mov eax, dword [ebp - 0x48]
cmp eax, dword [0x4e9a38]
jne 0x417de6
mov edx, 0x4d6398
mov ecx, esi
call fcn.00405fc0
test ebx, ebx
jne 0x417e42
test eax, eax
je 0x417de6
nop dword [eax]
lea ecx, [eax + 1]
mov edx, 0x4d639c
call fcn.00405fc0
test eax, eax
je 0x417e46
cmp byte [eax], 0x7b
je 0x417e46
mov edx, 0x4d6398
mov ecx, eax
call fcn.00405fc0
test eax, eax
jne 0x417dc0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
call fcn.0041bb90
mov edi, eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x38], eax
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov dword [0x4ea310], eax
mov ecx, eax
call fcn.0041bc30
mov cl, 1
mov dword [0x4ea314], eax
call fcn.0041b620
mov bl, al
and byte [0x4ea2bf], bl
cmp dword [0x4e7970], 0
je 0x417e88
mov al, byte [0x4e82be]
mov cl, byte [0x4e82bc]
mov bh, al
not al
and bh, cl
and al, cl
jmp 0x417eac
test eax, eax
je 0x417de6
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, 0x8000
push 0x5b
call edi
test bx, ax
jne 0x417e63
push 0x5c
call edi
test bx, ax
je 0x417de6
mov edx, 1
mov dword [0x4e4984], 0
mov ecx, 0x8000012f
call fcn.00401a30
mov dword [0x4e4984], 1
jmp 0x417e51
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ea07c]
cmp eax, dword [0x4e5b8c]
jae 0x417ea6
mov cl, byte [0x4ea085]
and cl, bl
jmp 0x417ea8
xor cl, cl
mov bh, cl
xor al, al
not bh
mov byte [ebp - 3], cl
and bh, byte [0x4ea2be]
and bh, bl
mov byte [ebp - 6], al
cmp byte [0x4ea334], 0
mov byte [ebp - 1], bh
mov byte [0x4ea2be], bh
je 0x417edb
not bh
and bh, bl
mov al, bh
mov bh, bl
mov byte [ebp - 1], bh
jmp 0x417edd
xor al, al
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x10], bh
cmp byte [eax + 0xd3], 0
je 0x417f0f
cmp byte [0x4ea334], 0
jne 0x417f0f
cmp dword [ebp - 0x1c], 2
je 0x417f0f
mov edx, 2
mov cl, 0x14
call fcn.0041aea0
mov dword [ebp - 0x30], eax
jmp 0x417f16
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp + 8]
mov eax, 0x1f4
mov dword [0x4ea330], ecx
mov edx, 0x5dc
test ecx, ecx
je 0x417f8f
cmp ecx, 1
cmovne eax, edx
mov edx, 0x2ee0
mov dword [0x4ea31c], eax
mov eax, 0x36b0
cmovne eax, edx
call fcn.004c78d0
mov eax, dword [0x4e6380]
mov ecx, esp
mov byte [0x4ea324], bl
mov byte [0x4ea325], 0
mov dword [0x4ea318], 0
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [0x4ea328], 0x80000000
mov dword [0x4ea32c], 0x80000000
mov byte [0x4ea326], 0
mov byte [0x4ea327], 1
mov al, byte [0x4e79e8]
mov byte [ebp - 0x1e], al
mov eax, dword [0x4e499c]
cmp eax, 8
je 0x417fa6
cmp eax, 0xa
jne 0x417fc6
mov edi, dword [ebp + 0xc]
test ecx, ecx
jne 0x417fc9
test edi, edi
jne 0x417fc9
push 1
mov byte [ebp - 0xc], 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e79e8], 1
jmp 0x417fcd
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0xc], 0
xor bl, bl
mov byte [ebp - 0xa], bl
cmp byte [esi], bl
je 0x4188f2
jmp 0x417fe3
mov edi, dword [ebp + 0xc]
cmp dword [0x4ea330], 0
mov byte [ebp - 5], 0
jne 0x41804f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e498c]
sub eax, dword [0x4ea0c4]
cmp eax, dword [ecx + 0xb8]
jbe 0x41804f
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x418044
mov edx, 1
mov dword [0x4e4984], 0
or ecx, 0xffffffff
call fcn.00401a30
mov dword [0x4e4984], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea0c4], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x41881c
movsx eax, byte [esi]
push eax
push 0x4d63a0
call fcn.004b7be9
add esp, 8
test eax, eax
je 0x418858
movsx eax, byte [esi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x418089.34
movzx eax, byte [eax + 0x418bbc]
jmp dword [eax*4 + 0x418ba0]
test bh, 3
jne case.0x418089.34
or bl, 1
jmp 0x4188dd
test bh, 0x30
jne case.0x418089.34
or bl, 0x10
jmp 0x4188dd
test bh, 0xc
jne case.0x418089.34
or bl, 4
jmp 0x4188dd
test bh, 0xc0
jne case.0x418089.34
or bl, 0x40
jmp 0x4188dd
lea edi, [esi + 1]
push 0x7d
push edi
call fcn.004b7be9
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je case.0x418089.34
mov esi, edi
nop
mov cl, byte [esi]
cmp cl, 0x20
je 0x4180fc
cmp cl, 9
jne 0x4180ff
inc esi
jmp 0x4180f0
mov edi, eax
sub edi, esi
mov dword [ebp - 0x34], edi
jne 0x41817e
lea edi, [eax + 1]
mov al, byte [edi]
cmp al, 0x7d
jne 0x41811b
mov dword [ebp - 0x18], edi
mov edi, 1
jmp 0x41817b
cmp al, 0x20
je 0x41812f
cmp al, 9
jne 0x418814
cmp al, 0x20
je 0x41812f
cmp al, 9
jne 0x418135
mov al, byte [edi + 1]
inc edi
jmp 0x418127
push 4
push str.Down
push edi
call fcn.004b2c54
add esp, 0xc
test eax, eax
je 0x418161
push 2
push 0x4d5890
push edi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x418814
push 0x7d
push edi
call fcn.004b7be9
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je case.0x418089.34
mov edi, eax
sub edi, esi
mov dword [ebp - 0x34], edi
push 5
push 0x4d49d4
push esi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x41822c
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 5]
mov byte [eax], 0
nop
mov al, byte [ecx]
cmp al, 0x20
je 0x4181aa
cmp al, 9
jne 0x4181ad
inc ecx
jmp 0x4181a0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x44]
call fcn.00419860
mov eax, dword [ebp - 0x18]
add esp, 0x14
push dword [ebp - 0x4c]
mov byte [eax], 0x7d
mov eax, dword [ebp - 0x3c]
cmp eax, 1
jge 0x418202
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x44]
movzx eax, byte [eax + 0xcf]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0041a370
mov esi, dword [ebp - 0x18]
add esp, 0xc
jmp 0x4188db
push dword [ebp - 0x50]
mov cl, byte [ebp - 2]
xor edx, edx
push dword [ebp - 0x44]
push dword [ebp + 0xc]
push 0
push dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xa]
call fcn.00418c40
mov esi, dword [ebp - 0x18]
add esp, 0x24
jmp 0x4188db
push 3
push 0x4d63a8
push esi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x41824f
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 1
jmp 0x4188db
push 4
push str.Text
push esi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x41828b
lea ecx, [esi + 4]
mov al, byte [ecx]
cmp al, 0x20
je 0x418270
cmp al, 9
jne 0x418273
inc ecx
jmp 0x418266
cmp ecx, dword [ebp - 0x18]
jne 0x418814
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 2
jmp 0x4188db
mov eax, dword [ebp - 0x18]
mov ebx, 1
mov edx, 0x4d5ff4
mov dword [ebp - 0x14], 2
mov ecx, esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], edi
mov byte [eax], 0
call fcn.00405fc0
mov dword [ebp - 0x58], eax
test eax, eax
je 0x41835c
mov cl, byte [eax]
lea edi, [eax + 1]
mov byte [ebp - 0x1d], cl
mov ecx, eax
sub ecx, esi
mov byte [eax], 0
mov dword [ebp - 0x40], ecx
nop
mov al, byte [edi]
cmp al, 0x20
je 0x4182da
cmp al, 9
jne 0x4182dd
inc edi
jmp 0x4182d0
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x41835c
push 4
push str.Down
push edi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x418336
push 4
add edi, 4
mov dword [ebp - 0x14], eax
push str.Temp
push edi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x418317
mov dword [ebp - 0x2c], eax
jmp 0x41835c
xor eax, eax
cmp byte [edi], 0x52
sete al
push eax
call fcn.004b8d62
add esp, 4
mov edi, eax
neg edi
sbb edi, edi
neg edi
inc edi
mov dword [ebp - 0x2c], edi
jmp 0x41835c
push 0x4d5890
push edi
call fcn.004b218a
add esp, 8
test eax, eax
jne 0x41834d
mov dword [ebp - 0x14], ebx
jmp 0x41835c
mov ecx, edi
call fcn.00417810
mov ebx, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], ebx
push dword [0x4ea310]
lea eax, [ebp - 0xa]
mov ecx, esi
push eax
lea eax, [ebp - 0x5c]
push eax
lea edx, [ebp - 2]
call fcn.0041c190
mov eax, dword [ebp - 0x58]
add esp, 0xc
test eax, eax
je 0x418383
mov cl, byte [ebp - 0x1d]
mov byte [eax], cl
mov eax, dword [ebp - 0x18]
mov byte [eax], 0x7d
cmp ebx, 1
jl 0x418811
mov bh, byte [ebp - 2]
mov edi, dword [ebp - 0x5c]
test bh, bh
jne 0x418756
test di, di
jne 0x418756
movzx eax, byte [esi]
push eax
call fcn.004b253f
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x40]
je 0x418460
cmp eax, 1
jbe 0x418463
cmp dword [0x4ea330], 0
je 0x4183f5
mov ecx, esi
call fcn.00417810
push eax
push 0
push 0
xor dl, dl
xor cl, cl
call fcn.0041a6a0
mov bh, byte [ebp - 1]
add esp, 0xc
mov esi, dword [ebp - 0x18]
jmp 0x4188db
mov eax, dword [ebp - 0x48]
mov dword [0x4e4984], 0
cmp dword [0x4e9a38], eax
je 0x418438
mov ecx, esi
call fcn.00417810
test eax, eax
js 0x418438
mov ecx, esi
call fcn.00417810
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov bh, byte [ebp - 1]
mov esi, dword [ebp - 0x18]
mov dword [0x4e4984], 1
jmp 0x4188db
mov ecx, esi
call fcn.00417810
mov edx, 1
mov ecx, eax
call fcn.00401a30
mov bh, byte [ebp - 1]
mov esi, dword [ebp - 0x18]
mov dword [0x4e4984], 1
jmp 0x4188db
cmp eax, 1
jne 0x4184c4
cmp dword [ebp - 0x14], 1
je 0x418811
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4184a3
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jle 0x418811
movsx eax, byte [esi]
push 0
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
sub ebx, 1
jne 0x418481
mov bh, byte [ebp - 1]
mov esi, dword [ebp - 0x18]
jmp 0x4188db
mov al, byte [ebp - 0xa]
mov bh, byte [ebp - 1]
mov edx, dword [ebp - 0x24]
or al, bh
mov cl, byte [esi]
movzx eax, al
push eax
call fcn.00418df0
mov esi, dword [ebp - 0x18]
add esp, 4
jmp 0x4188db
mov ebx, dword [ebp + 0xc]
mov ecx, esi
mov edi, dword [ebp - 0x34]
test ebx, ebx
mov edx, edi
sete al
movzx eax, al
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041c260
add esp, 0xc
mov byte [ebp - 2], al
test al, al
je 0x4185e3
mov esi, dword [ebp - 0x14]
mov edi, ebx
test edi, edi
jne 0x41850b
test esi, esi
jne 0x418504
mov byte [ebp - 5], al
jmp 0x41850b
mov cl, al
call fcn.00417a30
cmp dword [0x4ea330], 0
je 0x41851b
mov al, byte [0x4ea324]
jmp 0x418522
xor cl, cl
call fcn.0041b620
push 0xffc3d44d
push 0
mov dl, al
mov al, byte [ebp - 0x10]
push 0
push edi
mov cl, al
mov byte [ebp - 1], al
call fcn.0041afb0
mov ebx, dword [ebp - 0x24]
add esp, 0x10
test ebx, ebx
jle 0x418811
nop dword [eax]
mov dl, byte [ebp - 2]
mov ecx, esi
push 0xffc3d44d
push 1
push edi
push 0
call fcn.00419200
add esp, 0x10
cmp dword [0x4ea330], 0
jne 0x4185cf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e498c]
sub eax, dword [0x4ea0c4]
cmp eax, dword [ecx + 0xb8]
jbe 0x4185cf
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4185c4
mov edx, 1
mov dword [0x4e4984], 0
or ecx, 0xffffffff
call fcn.00401a30
mov dword [0x4e4984], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea0c4], eax
sub ebx, 1
jne 0x418550
mov bh, byte [ebp - 1]
mov esi, dword [ebp - 0x18]
jmp 0x4188db
cmp edi, 4
jbe 0x41864f
push 4
push str.ASC
push esi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x41864f
test ebx, ebx
jne 0x41864f
lea ecx, [esi + 3]
mov al, byte [ecx]
cmp al, 0x20
je 0x41860d
cmp al, 9
jne 0x418610
inc ecx
jmp 0x418603
call fcn.00418f20
cmp dword [0x4ea330], 2
mov eax, dword [0x4e498c]
jne 0x418639
mov ecx, dword [eax + 0x60]
call fcn.0041aca0
mov bh, byte [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 1], bh
jmp 0x4188db
mov ecx, dword [eax + 0x5c]
call fcn.0041aca0
mov bh, byte [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 1], bh
jmp 0x4188db
cmp edi, 2
jbe 0x418641
push 2
push 0x4d63bc
push esi
call fcn.004b2c54
add esp, 0xc
test eax, eax
jne 0x418641
push 0x10
push eax
lea eax, [esi + 2]
push eax
call fcn.004b2b92
mov edx, eax
add esp, 0xc
cmp edx, 0x10000
jb 0x4186ac
sub edx, 0x10000
mov ecx, edx
mov eax, edx
shr ecx, 0xa
and eax, 0x3ff
and ecx, 0x3ff
sub ecx, 0x2800
sub eax, 0x2400
movzx ecx, cx
movzx esi, ax
jmp 0x4186b1
movzx ecx, dx
xor esi, esi
mov edi, ebx
mov bh, byte [ebp - 0x10]
mov byte [ebp - 1], bh
test edi, edi
je 0x4186e8
push 0
movzx eax, cx
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
test si, si
je 0x418728
push 0
movzx eax, si
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x418728
cmp dword [0x4ea330], 2
je 0x41870d
mov bl, byte [ebp - 0xa]
or bl, bh
mov dl, bl
call fcn.00417ab0
test si, si
je 0x418728
mov dl, bl
mov ecx, esi
call fcn.00417ab0
jmp 0x418728
push 0xa
lea eax, [ebp - 0x6f]
mov byte [ebp - 0x70], 0x30
push eax
push edx
call fcn.004b20b1
add esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.00418f20
cmp dword [0x4ea330], 2
mov eax, dword [0x4e498c]
jne 0x418746
mov ecx, dword [eax + 0x60]
call fcn.0041aca0
mov esi, dword [ebp - 0x18]
jmp 0x4188db
mov ecx, dword [eax + 0x5c]
call fcn.0041aca0
mov esi, dword [ebp - 0x18]
jmp 0x4188db
push 0
mov edx, edi
mov cl, bh
call fcn.0041b830
mov esi, dword [ebp - 0x14]
mov bl, al
add esp, 4
mov byte [ebp - 0x60], bl
test bl, bl
je 0x4187e9
cmp dword [ebp + 0xc], 0
jne 0x4187e9
test esi, esi
jne 0x4187a4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 5], bh
cmp eax, 1
jne 0x418792
mov al, byte [ebp - 1]
or byte [0x4ea2be], bl
or al, bl
jmp 0x4187e3
cmp eax, 2
jne 0x41879d
or byte [0x4ea2bf], bl
mov al, byte [ebp - 1]
or al, bl
jmp 0x4187e3
cmp esi, 1
jne 0x4187e9
mov cl, bh
call fcn.00417a30
mov cl, byte [ebp - 4]
not bl
and byte [0x4ea2bf], bl
mov al, bl
and al, byte [0x4ea2be]
and cl, bl
mov byte [0x4ea2be], al
mov byte [ebp - 4], cl
cmp bh, 0xa5
jne 0x4187e1
cmp dword [0x4ea314], 3
jne 0x4187e1
and cl, 0xfe
mov byte [ebp - 4], cl
or al, cl
mov byte [ebp - 0x10], al
mov byte [ebp - 1], al
push 0
push connect
push connect
push dword [ebp + 0xc]
mov edx, edi
mov cl, bh
push dword [ebp - 0x60]
push esi
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push dword [ebp - 0xa]
call fcn.00418c40
add esp, 0x24
mov bh, byte [ebp - 1]
mov esi, dword [ebp - 0x18]
jmp 0x4188db
cmp eax, 2
jne 0x41885b
movsx eax, byte [esi]
add eax, 0xfffffff8
cmp eax, 5
ja case.0x41882c.11
jmp dword [eax*4 + 0x418c1c]
cmp byte [esi + 1], 0xa
lea eax, [esi + 1]
cmove esi, eax
mov al, 0xd
mov byte [ebp - 2], al
jmp 0x418884
mov al, 8
mov byte [ebp - 2], al
jmp 0x418884
mov al, 9
mov byte [ebp - 2], al
jmp 0x418884
mov byte [ebp - 2], 0
jmp 0x4188ae
mov eax, dword [ebp - 0x1c]
or bl, bh
je 0x418867
test eax, eax
jne 0x418867
mov al, 1
jmp 0x418869
xor al, al
mov cl, byte [esi]
lea edx, [ebp - 0xa]
push eax
push dword [0x4ea310]
call fcn.0041c0c0
add esp, 8
mov byte [ebp - 2], al
test al, al
je 0x4188ab
push 0
push connect
push connect
push edi
push 0
push 2
push 1
push dword [ebp - 0x10]
xor edx, edx
mov cl, al
push dword [ebp - 0xa]
call fcn.00418c40
add esp, 0x24
jmp 0x4188db
mov bl, byte [ebp - 0xa]
mov cl, byte [esi]
test edi, edi
je 0x4188c8
push 0
movsx eax, cl
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4188db
or bl, bh
mov edx, 1
movzx eax, bl
push eax
call fcn.00418df0
add esp, 4
xor bl, bl
mov byte [ebp - 0xa], bl
mov al, byte [ebp - 5]
inc esi
mov byte [0x4ea2bd], al
cmp byte [esi], 0
jne 0x417fe0
cmp dword [0x4ea330], 0
je 0x41899c
or esi, 0xffffffff
cmp byte [0x4ea326], 0
mov dword [ebp - 0x2c], esi
jne 0x41895c
cmp dword [0x4ea318], 0
jbe 0x41895c
cmp byte [0x4ea334], 0
je 0x418924
xor bl, bl
jmp 0x41892c
mov bl, byte [ebp - 6]
not bl
and bl, byte [ebp - 3]
or bl, byte [0x4ea2bf]
mov dl, byte [0x4ea324]
or bl, bh
push 0xffc3d44d
push 1
push 1
push 0
mov cl, bl
call fcn.0041afb0
add esp, 0x10
lea ecx, [ebp - 0x2c]
mov dl, bl
call fcn.0041aa90
mov esi, dword [ebp - 0x2c]
cmp dword [0x4ea330], 1
mov eax, 0x5dc
mov ecx, 0x1f4
cmove eax, ecx
cmp dword [0x4ea31c], eax
jbe 0x418986
push dword [0x4e8448]
call fcn.004b2343
add esp, 4
mov ecx, esi
mov dword [0x4ea330], 0
call fcn.0041aca0
jmp 0x418a28
cmp dword [0x4e7970], 0
je 0x4189b0
mov cl, byte [0x4e82bc]
mov dl, byte [ebp - 3]
jmp 0x4189d9
cmp dword [0x4e5b8c], 0
jl 0x4189d4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ea07c]
cmp eax, dword [0x4e5b8c]
jb 0x4189d4
mov dl, byte [ebp - 3]
xor cl, cl
jmp 0x4189d9
mov dl, byte [ebp - 3]
mov cl, dl
or cl, byte [0x4ea2bf]
cmp byte [0x4ea334], 0
je 0x4189fa
mov al, cl
xor al, dl
mov bl, al
and al, cl
and bl, dl
not bl
and bl, bh
or bl, al
jmp 0x418a03
mov bl, byte [ebp - 6]
not bl
and bl, cl
or bl, bh
push 0xffc3d44d
push 1
push 1
push dword [ebp + 0xc]
xor cl, cl
call fcn.0041b620
or al, byte [0x4e82af]
mov cl, bl
mov dl, al
call fcn.0041afb0
add esp, 0x10
cmp dword [0x4e7970], 0
je 0x418a4b
mov cl, byte [0x4e82bd]
mov al, cl
xor al, byte [0x4e82be]
and al, cl
not al
and cl, al
mov byte [0x4e82bd], cl
cmp dword [ebp - 0x30], 1
jne 0x418ae7
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test al, 1
jne 0x418ae7
push 0x14
call esi
mov ecx, 0x8000
test cx, ax
je 0x418a8f
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 1
call fcn.00419200
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 2
call fcn.00419200
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
add esp, 0x10
push 0
call ebx
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call esi
cmp eax, dword [0x4e9a38]
jne 0x418af3
mov edx, 1
mov dword [0x4e4984], 0
or ecx, 0xffffffff
call fcn.00401a30
mov dword [0x4e4984], 1
jmp 0x418af3
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp byte [ebp - 0xb], 0
je 0x418b0a
push 0
push dword [ebp - 0x38]
push dword [0x4e9a38]
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp - 0xc], 0
je 0x418b25
cmp byte [ebp - 0x1e], 0
jne 0x418b25
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e79e8], 0
mov eax, dword [ebp + 8]
test eax, eax
jne 0x418b4f
mov eax, dword [ebp - 0x64]
cmp dword [0x4ea0c0], eax
je 0x418b84
call fcn.00404140
test eax, eax
je 0x418b84
mov edx, 1
or ecx, 0xffffffff
call fcn.00401a30
jmp 0x418b84
cmp eax, 1
jne 0x418b84
push 0
call ebx
push eax
call esi
cmp eax, dword [0x4e9a38]
jne 0x418b84
mov edx, 1
mov dword [0x4e4984], 0
or ecx, 0xffffffff
call fcn.00401a30
mov dword [0x4e4984], 1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x68]
mov dword [eax + 0x5c], ecx
mov ecx, dword [ebp - 0x54]
mov dword [eax + 0x64], ecx
lea esp, [ebp - 0x9c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret