Function at 0x7f2d8dd9
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x7f307090]
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0x20]
mov edi, dword [ebp + 0x18]
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.7f2da1da
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 0x20], eax
jne 0x7f2d8e23
xor eax, eax
cmp dword [ebp + 0x1c], eax
jne 0x7f2d8e3c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push edi
call dword [sym.imp.USER32.dll_CallWindowProcA]
jmp 0x7f2d9e04
push esi
xor esi, esi
cmp dword [ebp + 0x1c], esi
je 0x7f2d8e5b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call edi
jmp 0x7f2d9e03
push eax
push eax
push eax
push eax
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push 0x800
call fcn.7f2d7c7f
jmp 0x7f2d9e04
mov ebx, dword [ebp + 0xc]
mov eax, 0x18f
cmp ebx, eax
ja 0x7f2d93e3
je 0x7f2d936c
add eax, 0xffffff80
cmp ebx, eax
ja 0x7f2d9267
je 0x7f2d9111
mov eax, 0x81
cmp ebx, eax
ja 0x7f2d8fc5
je 0x7f2d8efa
cmp ebx, 1
je 0x7f2d8efa
cmp ebx, 0xc
je 0x7f2d90ee
cmp ebx, 0xd
je 0x7f2d9926
cmp ebx, 0x19
jbe 0x7f2d99c2
cmp ebx, 0x1b
jbe 0x7f2d90ee
cmp ebx, 0x2f
jne 0x7f2d99c2
mov eax, dword [ebp + 0x10]
and eax, 0xffff
push 1
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0xc]
push eax
push dword [0x7f307088]
lea eax, [ebp + 0x1c]
push eax
push esi
push dword [0x7f307ac8]
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
jmp 0x7f2d9df9
mov esi, dword [ebp + 0x14]
xor eax, eax
push 0xc
pop ecx
push dword [0x7f307ac8]
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
push dword [esi + 0x24]
call fcn.7f2d5499
push dword [0x7f307ac8]
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
push dword [esi + 0x28]
call fcn.7f2d5499
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [ebp + 0x18]
cmp dword [ebp + 0x14], 3
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, eax
jne 0x7f2d8fa2
cmp dword [ebp - 0x18], 0
je 0x7f2d8fa2
push dword [ebp - 0x18]
push 0
call ebx
push eax
call esi
cmp dword [ebp + 0xc], 3
jne 0x7f2d9e01
cmp dword [ebp - 0x14], 0
je 0x7f2d9e01
push dword [ebp - 0x14]
push 0
call ebx
push eax
call esi
jmp 0x7f2d9e01
cmp ebx, 0xc2
je 0x7f2d90ee
mov edi, 0xc4
cmp ebx, edi
je 0x7f2d907f
cmp ebx, 0xcc
je 0x7f2d9012
cmp ebx, 0x101
jbe 0x7f2d99c2
cmp ebx, 0x103
jbe 0x7f2d9012
cmp ebx, 0x105
jbe 0x7f2d99c2
cmp ebx, 0x107
ja 0x7f2d99c2
mov eax, dword [0x7f307ac8]
cmp eax, 0x3a4
je 0x7f2d92af
cmp eax, 0x3b5
je 0x7f2d92af
cmp eax, 0x3b6
je 0x7f2d92af
cmp eax, 0x3a8
je 0x7f2d92af
cmp eax, 0x551
je 0x7f2d92af
cmp eax, 0xd698
je 0x7f2d92af
push 1
lea ecx, [ebp + 0xc]
push ecx
push dword [0x7f307088]
lea ecx, [ebp + 0x10]
push ecx
push esi
push eax
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
jmp 0x7f2d9c74
mov eax, dword [ebp + 0x14]
movzx ebx, word [eax]
inc ebx
lea eax, [ebx + ebx]
cmp eax, esi
je 0x7f2d909f
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x7f2d90a1
xor eax, eax
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x7f2d90ab
mov word [eax], bx
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [ebp + 0x18]
mov edi, eax
cmp edi, esi
je 0x7f2d90dd
push esi
push esi
push ebx
push dword [ebp + 0x14]
inc edi
push edi
push dword [ebp + 0xc]
push esi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp edi, esi
je 0x7f2d90dd
dec edi
cmp dword [ebp + 0xc], esi
je 0x7f2d9e01
push dword [ebp + 0xc]
jmp 0x7f2d9d82
push dword [0x7f307ac8]
lea eax, [ebp + 0x14]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x14]
call fcn.7f2d5499
push dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
push dword [ebp + 0x10]
push ebx
jmp 0x7f2d981e
mov eax, dword [ebp + 0x10]
test ah, 0xff
mov dword [ebp + 0x1c], eax
je 0x7f2d9129
xor eax, eax
mov ah, byte [ebp + 0x10]
mov al, byte [ebp + 0x11]
mov dword [ebp + 0x10], eax
jmp 0x7f2d9130
and dword [ebp + 0x10], 0xff
push dword [ebp + 0x11]
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
test eax, eax
je 0x7f2d9161
push 1
lea eax, [ebp + 0x1c]
push eax
push 2
lea eax, [ebp + 0x10]
push eax
push esi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x7f2d9257
mov eax, 0x800
test dword [ebp + 0x14], eax
je 0x7f2d9170
mov dword [ebp + 0xc], eax
jmp 0x7f2d9181
test byte [ebp + 0x14], 8
je 0x7f2d9257
mov dword [ebp + 0xc], 8
push dword [ebp + 8]
call sub.IMM32.dll_ImmGetContext
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x7f2d9257
cmp dword [0x7f307acc], esi
jne 0x7f2d91b2
cmp byte [0x7f30708d], 0
jne 0x7f2d91b2
push esi
push esi
push dword [ebp + 0xc]
push eax
call sub.IMM32.dll_ImmGetCompositionStringA
jmp 0x7f2d91bd
push esi
push esi
push dword [ebp + 0xc]
push eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov ebx, eax
cmp ebx, esi
jle 0x7f2d924c
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, esi
je 0x7f2d924c
cmp dword [0x7f307acc], esi
jne 0x7f2d91fd
cmp byte [0x7f30708d], 0
jne 0x7f2d91fd
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call sub.IMM32.dll_ImmGetCompositionStringA
jmp 0x7f2d920a
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
cmp eax, esi
jle 0x7f2d923d
cmp dword [0x7f307acc], esi
jne 0x7f2d9237
cmp byte [0x7f30708d], 0
jne 0x7f2d9237
push 1
lea eax, [ebp + 0x1c]
push eax
push 2
push edi
push esi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x7f2d923d
movzx eax, word [edi]
mov dword [ebp + 0x1c], eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.IMM32.dll_ImmReleaseContext
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0x10f
jmp 0x7f2d9df9
cmp ebx, 0x14d
ja 0x7f2d932b
cmp ebx, 0x14c
jae 0x7f2d929e
mov eax, ebx
sub eax, 0x120
je 0x7f2d9012
sub eax, 0x23
je 0x7f2d929e
dec eax
dec eax
je 0x7f2d929e
sub eax, 3
je 0x7f2d92b7
dec eax
dec eax
jne 0x7f2d99c2
push esi
push dword [ebp + 8]
call fcn.7f2d78a7
test eax, eax
je 0x7f2d90ee
push dword [ebp + 0x14]
jmp 0x7f2d9c71
push esi
push dword [ebp + 8]
call fcn.7f2d78a7
test eax, eax
je 0x7f2d92d4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x148
jmp 0x7f2d9df9
push esi
push dword [ebp + 0x10]
push 0x149
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
inc ebx
lea eax, [ebx + ebx]
cmp eax, esi
je 0x7f2d9305
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 0xc], eax
jmp 0x7f2d9308
mov dword [ebp + 0xc], esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0x148
push dword [ebp + 8]
call dword [ebp + 0x18]
mov edi, eax
cmp edi, esi
je 0x7f2d93d0
cmp dword [ebp + 0xc], esi
jmp 0x7f2d93ca
cmp ebx, 0x158
je 0x7f2d929e
cmp ebx, 0x17f
jbe 0x7f2d99c2
cmp ebx, 0x181
jbe 0x7f2d936c
mov edi, 0x189
cmp ebx, edi
je 0x7f2d9373
cmp ebx, 0x18b
jbe 0x7f2d99c2
cmp ebx, 0x18d
ja 0x7f2d99c2
push 1
jmp 0x7f2d929f
push 1
push dword [ebp + 8]
call fcn.7f2d78a7
test eax, eax
jne 0x7f2d9df2
push esi
push dword [ebp + 0x10]
push 0x18a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
inc ebx
lea eax, [ebx + ebx]
cmp eax, esi
je 0x7f2d93b6
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 0xc], eax
jmp 0x7f2d93b9
mov dword [ebp + 0xc], esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [ebp + 0x18]
mov edi, eax
cmp edi, esi
jne 0x7f2d90be
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x7f2d90dd
mov byte [eax], 0
jmp 0x7f2d90dd
mov eax, 0x415
cmp ebx, eax
ja 0x7f2d98b2
je 0x7f2d990e
mov edi, 0x286
cmp ebx, edi
ja 0x7f2d97a4
je 0x7f2d9763
mov eax, ebx
sub eax, 0x196
je 0x7f2d936c
sub eax, 0xc
je 0x7f2d936c
sub eax, 0x77
je 0x7f2d9536
sub eax, 7
je 0x7f2d9482
sub eax, 0x63
jne 0x7f2d99c2
mov eax, dword [ebp + 0x10]
sub eax, 9
je 0x7f2d945e
dec eax
push dword [ebp + 0x14]
jne 0x7f2d9451
lea eax, [ebp - 0x68]
push eax
call fcn.7f2d5a72
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0x10]
push 0x283
jmp 0x7f2d9df9
lea eax, [ebp - 0x48]
push eax
push 9
push 0x283
push dword [ebp + 8]
call dword [ebp + 0x18]
push dword [ebp + 0x14]
mov edi, eax
lea eax, [ebp - 0x48]
push eax
call fcn.7f2d5a3d
jmp 0x7f2d9e01
mov esi, dword [ebp + 0x14]
xor eax, eax
push 9
pop ecx
push dword [0x7f307ac8]
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push eax
push 0xffffffffffffffff
push dword [esi + 4]
call fcn.7f2d5499
push dword [0x7f307ac8]
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
push 0xffffffffffffffff
push dword [esi]
call fcn.7f2d5499
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x10]
push 0x220
push dword [ebp + 8]
call dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp ebx, 3
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, eax
jne 0x7f2d951a
cmp dword [ebp - 0x2c], 0
je 0x7f2d951a
push dword [ebp - 0x2c]
push 0
call esi
push eax
call ebx
cmp dword [ebp + 0x14], 3
jne 0x7f2d9e01
cmp dword [ebp - 0x30], 0
je 0x7f2d9e01
push dword [ebp - 0x30]
jmp 0x7f2d9b4b
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x8000
jb 0x7f2d9755
mov edx, 0x8006
cmp ecx, edx
ja 0x7f2d9755
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx + 4]
cmp eax, 5
jne 0x7f2d95eb
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea esi, [eax + eax + 0x1c]
xor edi, edi
cmp esi, edi
mov dword [ebp + 0x14], eax
je 0x7f2d9591
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
jmp 0x7f2d9594
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0xc], edi
je 0x7f2d96dc
mov eax, dword [ebp - 0xc]
push dword [ebp + 0x14]
mov dword [eax], esi
mov ecx, dword [ebx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [eax + 8], ecx
lea edi, [eax + 0xc]
lea esi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add eax, 0x1c
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
push 0
movsd dword es:[edi], dword [esi]
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp - 0xc]
push dword [ebp + 0x10]
push 0x219
push dword [ebp + 8]
call dword [ebp + 0x18]
push dword [ebp - 0xc]
jmp 0x7f2d9673
cmp eax, 3
jne 0x7f2d967c
lea eax, [ebx + 0xc]
push eax
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi + 0xc]
test eax, eax
je 0x7f2d9624
lea eax, [edi + edi + 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x7f2d9626
xor esi, esi
test esi, esi
jne 0x7f2d9639
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x7f2d9e01
lea eax, [edi + edi + 0xc]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
push edi
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x14]
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push dword [ebp + 0x10]
push 0x219
push dword [ebp + 8]
call dword [ebp + 0x18]
push esi
mov edi, eax
push 0
jmp 0x7f2d9d83
cmp eax, 6
jne 0x7f2d9752
cmp ecx, edx
jne 0x7f2d9752
mov eax, dword [ebx + 0x24]
xor edi, edi
cmp eax, edi
jle 0x7f2d9752
lea eax, [eax + ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx + 0x24]
inc eax
mov dword [ebp + 0x14], eax
lea eax, [ecx + eax*2 + 0x28]
test al, 1
mov dword [ebp + 0xc], eax
je 0x7f2d96bb
inc eax
mov dword [ebp + 0xc], eax
cmp eax, edi
je 0x7f2d96d4
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
jmp 0x7f2d96d7
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0xc], edi
jne 0x7f2d96e9
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2d9e01
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebp - 0xc]
add ecx, 0x28
mov edx, ecx
shr ecx, 2
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [eax + 0x24]
test cl, 1
je 0x7f2d9715
inc ecx
mov dword [eax + 0x24], ecx
cmp dword [ebp + 0x14], 0
mov esi, dword [ebp - 0xc]
je 0x7f2d9741
push dword [ebp + 0x14]
mov eax, dword [esi + 0x24]
lea eax, [esi + eax*2 + 0x28]
push eax
mov eax, dword [ebx + 0x24]
push 0xffffffffffffffff
lea eax, [eax + ebx + 0x28]
push eax
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esi + 0x24]
add eax, dword [ebp + 0x14]
and word [esi + eax*2 + 0x28], 0
jmp 0x7f2d9663
push ebx
jmp 0x7f2d9758
push dword [ebp + 0x14]
push ecx
push 0x219
jmp 0x7f2d9df9
test byte [ebp + 0x11], 0xff
mov dword [ebp + 0xc], esi
je 0x7f2d9779
xor eax, eax
mov ah, byte [ebp + 0x10]
mov al, byte [ebp + 0x11]
mov dword [ebp + 0x10], eax
jmp 0x7f2d9780
and dword [ebp + 0x10], 0xff
push 1
lea eax, [ebp + 0xc]
push eax
push 2
lea eax, [ebp + 0x10]
push eax
push esi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
jmp 0x7f2d9df8
mov edi, 0x288
cmp ebx, edi
je 0x7f2d9893
cmp ebx, 0x30c
je 0x7f2d9926
mov edi, 0x401
cmp ebx, edi
je 0x7f2d9841
cmp ebx, 0x40b
jbe 0x7f2d99c2
cmp ebx, 0x40d
jbe 0x7f2d990e
cmp ebx, 0x414
jne 0x7f2d99c2
push dword [ebp + 8]
call fcn.7f2d71d6
test eax, eax
je 0x7f2d92af
push dword [0x7f307ac8]
lea eax, [ebp + 0x14]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x14]
call fcn.7f2d5499
push dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
push dword [ebp + 0x10]
push ebx
call fcn.7f2d788d
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
cmp dword [ebp + 0xc], 3
mov edi, eax
jne 0x7f2d9e01
cmp dword [ebp + 0x14], esi
je 0x7f2d9e01
push dword [ebp + 0x14]
jmp 0x7f2d9d82
push dword [ebp + 8]
call fcn.7f2d71a5
test eax, eax
je 0x7f2d9df2
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x5c
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
push edi
push dword [ebp + 8]
call dword [ebp + 0x18]
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 0x14]
call fcn.7f2d5a3d
cmp dword [ebp + 0xc], esi
je 0x7f2d9e01
push dword [ebp + 0xc]
push esi
call ebx
jmp 0x7f2d9d89
cmp dword [ebp + 0x10], 3
push dword [ebp + 0x14]
jne 0x7f2d9df5
lea eax, [ebp - 0x68]
push eax
call fcn.7f2d5a72
lea eax, [ebp - 0x68]
push eax
jmp 0x7f2d9df5
mov edi, 0x464
cmp ebx, edi
ja 0x7f2d999c
je 0x7f2d9968
cmp ebx, 0x417
je 0x7f2d97ea
cmp ebx, 0x419
je 0x7f2d97ea
cmp ebx, 0x442
je 0x7f2d97ea
cmp ebx, 0x443
je 0x7f2d990e
cmp ebx, 0x44f
jbe 0x7f2d99c2
cmp ebx, 0x451
jbe 0x7f2d97ea
jmp 0x7f2d99c2
push dword [ebp + 8]
call fcn.7f2d71d6
test eax, eax
je 0x7f2d92af
push ebx
call fcn.7f2d788d
mov ebx, eax
mov eax, dword [ebp + 0x10]
add eax, eax
cmp eax, esi
je 0x7f2d9944
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 0xc], eax
jmp 0x7f2d9947
mov dword [ebp + 0xc], esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [ebp + 0x18]
mov edi, eax
cmp edi, esi
je 0x7f2d93d0
push esi
push esi
push dword [ebp + 0x10]
jmp 0x7f2d90c1
push dword [ebp + 8]
call fcn.7f2d71bd
test eax, eax
je 0x7f2d9df2
mov eax, dword [ebp + 0x10]
add eax, eax
cmp eax, esi
je 0x7f2d9de3
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
jmp 0x7f2d9de5
mov eax, ebx
mov edi, 0x465
sub eax, edi
je 0x7f2d9da0
dec eax
je 0x7f2d9d12
dec eax
dec eax
je 0x7f2d9cc0
dec eax
dec eax
je 0x7f2d9c7a
mov eax, dword [0x7f307b18]
cmp eax, esi
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
jne 0x7f2d99dd
push 0x7f2d209c
call edi
mov dword [0x7f307b18], eax
cmp dword [0x7f307b38], esi
jne 0x7f2d99f6
push 0x7f2d2088
call edi
mov dword [0x7f307b38], eax
mov eax, dword [0x7f307b18]
cmp ebx, eax
mov esi, dword [ebp + 0x14]
jne 0x7f2d9b57
push 0x4c
pop edx
cmp dword [esi], edx
jne 0x7f2d9b57
push 0x13
pop ecx
push dword [0x7f307ac8]
xor eax, eax
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
push dword [esi + 0x14]
mov dword [ebp - 0x64], edx
push dword [esi + 0x10]
call fcn.7f2d5499
push dword [ebp - 0x54]
mov dword [ebp + 0x14], eax
call fcn.7f2da99a
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0x18]
pop ecx
push dword [0x7f307ac8]
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0x20]
lea ecx, [eax + eax]
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
push dword [esi + 0x1c]
call fcn.7f2d5499
push dword [ebp - 0x48]
mov dword [ebp + 0xc], eax
call fcn.7f2da99a
pop ecx
push dword [0x7f307ac8]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
push eax
push dword [esi + 0x28]
push dword [esi + 0x24]
call fcn.7f2d5499
push dword [ebp - 0x40]
mov dword [ebp + 0x1c], eax
call fcn.7f2da99a
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x30], eax
push 0
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x48]
call fcn.7f2dac75
lea eax, [ebp - 0xc]
push eax
call fcn.7f2da99a
mov esi, eax
lea eax, [ebp - 0x268]
push eax
call fcn.7f2da99a
add esi, eax
lea eax, [ebp - 0x468]
push eax
mov word [ebp - 0x2c], si
call fcn.7f2da99a
add eax, dword [ebp - 0x2c]
add esp, 0x24
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [ebp + 0x18]
cmp dword [ebp + 0x14], 3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, eax
jne 0x7f2d9b1e
cmp dword [ebp - 0x54], 0
je 0x7f2d9b1e
push dword [ebp - 0x54]
push 0
call esi
push eax
call ebx
cmp dword [ebp + 0xc], 3
jne 0x7f2d9b34
cmp dword [ebp - 0x48], 0
je 0x7f2d9b34
push dword [ebp - 0x48]
push 0
call esi
push eax
call ebx
cmp dword [ebp + 0x1c], 3
jne 0x7f2d9e01
cmp dword [ebp - 0x40], 0
je 0x7f2d9e01
push dword [ebp - 0x40]
push 0
call esi
push eax
call ebx
jmp 0x7f2d9e01
cmp ebx, dword [0x7f307b38]
je 0x7f2d9b67
cmp ebx, eax
jne 0x7f2d9c70
mov ecx, dword [esi]
cmp ecx, 0x28
jne 0x7f2d9bd2
push esi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [ebp + 0x18]
test byte [esi + 0xc], 0x40
mov edi, eax
je 0x7f2d9e01
mov eax, dword [esi + 0x20]
mov ebx, 0x7f2d77d7
cmp eax, ebx
je 0x7f2d9b9c
cmp eax, 0x7f2d77f1
jne 0x7f2d9e01
push 1
call fcn.7f2da704
mov ecx, dword [esi + 0x20]
cmp ecx, ebx
jne 0x7f2d9baf
mov eax, dword [eax + 0x48]
jmp 0x7f2d9bbe
cmp ecx, 0x7f2d77f1
jne 0x7f2d9e01
mov eax, dword [eax + 0x4c]
test eax, eax
mov dword [esi + 0x20], eax
jne 0x7f2d9e01
and byte [esi + 0xd], 0xfe
jmp 0x7f2d9e01
cmp ebx, eax
jne 0x7f2d9c70
push 0x3c
pop edx
cmp ecx, edx
jne 0x7f2d9c70
push 0xf
pop ecx
push dword [esi + 0xc]
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 8]
push dword [ebp - 0x3c]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x40], eax
call fcn.7f2d5a72
mov eax, dword [esi + 0x10]
push dword [0x7f307ac8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x2c], eax
mov ax, word [esi + 0x30]
mov word [ebp - 0x18], ax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
push dword [esi + 0x2c]
call fcn.7f2d5499
mov esi, eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [ebp + 0x18]
cmp esi, 3
mov edi, eax
jne 0x7f2d9e01
cmp dword [ebp - 0x1c], 0
je 0x7f2d9e01
push dword [ebp - 0x1c]
jmp 0x7f2d9675
push esi
push dword [ebp + 0x10]
push ebx
jmp 0x7f2d9df9
push dword [ebp + 8]
call fcn.7f2d71bd
test eax, eax
je 0x7f2d9cb0
push dword [0x7f307ac8]
lea eax, [ebp + 0x14]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x14]
call fcn.7f2d5499
push dword [ebp + 0x14]
mov ebx, eax
call fcn.7f2da99a
pop ecx
push dword [ebp + 0x14]
push eax
push 0x46a
jmp 0x7f2d9cf4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x46a
jmp 0x7f2d9df9
push dword [ebp + 8]
call fcn.7f2d71bd
test eax, eax
je 0x7f2d9d02
push dword [0x7f307ac8]
lea eax, [ebp + 0x14]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x14]
call fcn.7f2d5499
push dword [ebp + 0x14]
mov ebx, eax
call fcn.7f2da99a
pop ecx
push dword [ebp + 0x14]
push eax
push 0x468
push dword [ebp + 8]
call dword [ebp + 0x18]
cmp ebx, 3
jmp 0x7f2d9828
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x468
jmp 0x7f2d9df9
mov edi, dword [ebp + 8]
push edi
call fcn.7f2d71a5
test eax, eax
jne 0x7f2d9d92
push edi
call fcn.7f2d71bd
test eax, eax
je 0x7f2d9d92
mov eax, dword [ebp + 0x10]
add eax, eax
cmp eax, esi
je 0x7f2d9d46
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
jmp 0x7f2d9d48
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
push 0x466
push edi
call dword [ebp + 0x18]
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push esi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp ebx, esi
mov edi, eax
je 0x7f2d9e01
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x7f2d9e01
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x466
push edi
jmp 0x7f2d9dfc
push dword [ebp + 8]
call fcn.7f2d71a5
test eax, eax
je 0x7f2d9968
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x5c
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
push eax
call fcn.7f2d5a72
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [ebp + 0x18]
mov edi, eax
jmp 0x7f2d987f
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
jmp 0x7f2d9d52
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [ebp + 0x18]
mov edi, eax
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.7f2fd123
leave
ret 0x1c