Function at 0x437cf6
Capabilities:
Get keyboard layout
Log keystrokes via polling
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
mov esi, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x437d41
push 0x100
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.00440010
add esp, 0xc
jmp 0x437db5
cmp dword [ebp + 8], 0x12
jne 0x437d5a
mov eax, esi
shr eax, 0x10
test ah, 1
je 0x437d5a
mov al, byte [ebp - 0x112]
mov byte [ebp - 0x7f], al
mov eax, dword [0x4679f8]
cmp eax, 3
je 0x437d7e
cmp eax, 1
jg 0x437da8
mov eax, dword [0x46662c]
cmp dword [eax + 0x124], ebx
je 0x437da8
cmp dword [0x467a00], ebx
jne 0x437da8
cmp dword [ebp + 8], 0x90
jne 0x437da8
test byte [ebp - 0x114], 0x80
jne 0x437da8
mov eax, esi
shr eax, 0x10
test ah, 0xc0
mov dword [ebp + 8], 0x2b
jne 0x437da8
xor byte [ebp - 0x94], 1
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, dword [0x46662c]
cmp dword [edx + 0x12c], ebx
je 0x437dd6
mov eax, esi
shr eax, 0x10
and ax, 0xc000
cmp ax, 0x4000
je 0x438ab8
shr esi, 0x10
test si, 0x2000
mov dword [ebp - 8], esi
je 0x437df0
test byte [ebp - 0x7f], 0x80
jne 0x437df0
mov dword [ebp - 4], 1
movzx eax, si
mov esi, eax
shr esi, 0xf
not esi
and esi, 1
cmp dword [ebp - 4], ebx
mov dword [ebp - 0x24], esi
je 0x437e26
test byte [ebp - 0x113], 0x80
je 0x437e26
cmp dword [0x467a60], ebx
je 0x437e1f
mov byte [ebp - 0x112], 0
jmp 0x437e26
mov byte [ebp - 0x7f], 0x80
mov dword [ebp - 4], ebx
movzx ecx, byte [ebp - 0x114]
and eax, 0x81ff
mov dword [ebp - 0x14], eax
movzx eax, byte [ebp - 0x113]
shr eax, 7
shr ecx, 7
lea eax, [ecx + eax*2]
mov ecx, dword [0x465a24]
cmp ecx, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x4679f8]
jne 0x437e90
cmp dword [0x467a5c], 0
mov dword [0x465a78], 0x100
je 0x437e80
cmp dword [ebp + 8], 0x12
jne 0x437e80
test byte [ebp - 7], 1
je 0x437ee4
mov dword [0x465a78], 0x12
cmp dword [ebp + 8], 0x5d
jne 0x437e90
mov dword [0x465a78], 0x5d
mov ebx, dword [0x465a78]
cmp dword [ebp + 8], ebx
jne 0x437ebe
test ecx, ecx
jne 0x437ea8
test byte [ebp - 7], 0xc0
jne 0x437edc
inc ecx
jmp 0x437ede
cmp ecx, 1
jne 0x437edc
test byte [ebp - 7], 0x80
je 0x437edc
push 2
pop ecx
mov dword [0x465a24], ecx
jmp 0x437ed6
cmp ecx, 1
jne 0x437ed4
cmp dword [ebp + 8], 0x11
je 0x437ee4
xor ecx, ecx
mov dword [0x465a24], ecx
cmp ecx, 1
jle 0x437ee4
cmp dword [ebp - 4], 0
je 0x437eea
xor ecx, ecx
mov dword [0x465a24], ecx
cmp dword [ebp - 4], 0
jne 0x437f12
xor ebx, ebx
cmp dword [edx + 0x124], ebx
je 0x437f01
cmp dword [0x467a00], ebx
jne 0x437f01
cmp eax, 2
jne 0x437f12
cmp eax, 3
je 0x437f12
cmp dword [0x467a28], ebx
jne 0x437f12
cmp ecx, ebx
je 0x437f8a
test byte [ebp - 7], 1
jne 0x437f8a
mov edx, dword [ebp + 8]
cmp edx, 0x25
ja 0x437f4d
je 0x437f49
sub edx, 0xc
je 0x437f45
sub edx, 0x15
je 0x437f41
dec edx
je 0x437f3d
dec edx
je 0x437f39
dec edx
jne 0x437f8a
push 0x67
jmp 0x437f72
push 0x61
jmp 0x437f72
push 0x63
jmp 0x437f72
push 0x69
jmp 0x437f72
push 0x65
jmp 0x437f72
push 0x64
jmp 0x437f72
sub edx, 0x26
je 0x437f70
dec edx
je 0x437f6c
dec edx
je 0x437f68
sub edx, 5
je 0x437f64
dec edx
jne 0x437f8a
push 0x6e
jmp 0x437f72
push 0x60
jmp 0x437f72
push 0x62
jmp 0x437f72
push 0x66
jmp 0x437f72
push 0x68
test byte [ebp - 0x94], 1
mov ebx, dword [ebp - 0xc]
pop edx
je 0x437f85
or ebx, 1
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], edx
jmp 0x437f8d
mov ebx, dword [ebp - 0xc]
test esi, esi
je 0x4387bc
test byte [ebp - 0x7f], 0x80
jne 0x4387bc
test ecx, ecx
jne 0x4387bc
mov ecx, dword [ebp - 4]
test ecx, ecx
mov edx, dword [ebp + 0xc]
je 0x437fba
lea edi, [edx + 1]
mov byte [edx], 0x1b
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
cmp esi, 0x21
mov eax, dword [0x4679f8]
jne 0x437ff1
cmp ebx, 1
jne 0x437fe6
push 0
push 2
push 0x115
push dword [0x468854]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x438ab8
cmp ebx, 2
jne 0x438027
push 0
push 0
jmp 0x437fd0
cmp esi, 0x22
jne 0x43800c
cmp ebx, 1
jne 0x438001
push 0
push 3
jmp 0x437fd0
cmp ebx, 2
jne 0x438027
push 0
push 1
jmp 0x437fd0
cmp esi, 0x2d
jne 0x438027
cmp ebx, 1
jne 0x438027
push dword [0x46662c]
call fcn.0042b465
pop ecx
jmp 0x438ab8
test ecx, ecx
je 0x438094
cmp esi, 0x73
jne 0x438041
cmp dword [0x467a34], 0
je 0x4380af
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp esi, 0x20
jne 0x438069
cmp dword [0x467a38], 0
je 0x4380af
push 0
push 0xf100
push 0x112
push dword [0x468854]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x438039
cmp esi, 0xd
jne 0x438094
cmp dword [0x467a4c], 0
je 0x4380af
cmp dword [0x467ca0], 1
je 0x4380af
mov eax, dword [ebp - 8]
and ax, 0xc000
cmp ax, 0x4000
je 0x438039
call fcn.00437382
jmp 0x438039
cmp esi, 0x13
jne 0x4380af
cmp ebx, 2
jne 0x4380af
mov eax, dword [0x46662c]
xor dword [eax + 0x124], 1
jmp 0x438ab8
cmp dword [0x467a28], 0
je 0x43814c
test ecx, ecx
jne 0x4382be
lea ecx, [esi - 0x61]
cmp ecx, 8
ja case.default.0x4380d0
jmp dword [ecx*4 + 0x438abf]
test ebx, ebx
sete al
dec al
and al, 0xe0
add al, 0x62
mov byte [edi], al
jmp 0x4383b7
test ebx, ebx
sete al
dec al
and al, 0xe0
add al, 0x6a
jmp 0x4380e2
test ebx, ebx
sete al
dec al
and al, 0xe0
add al, 0x6e
jmp 0x4380e2
test ebx, ebx
sete al
dec al
and al, 0xe0
add al, 0x68
jmp 0x4380e2
mov byte [edi], 0x2e
jmp 0x4383b7
test ebx, ebx
sete al
dec al
and al, 0xe0
add al, 0x6c
jmp 0x4380e2
test ebx, ebx
sete al
dec al
and al, 0xe0
add al, 0x79
jmp 0x4380e2
test ebx, ebx
sete al
dec al
and al, 0xe0
add al, 0x6b
jmp 0x4380e2
test ebx, ebx
sete al
dec al
and al, 0xe0
add al, 0x75
jmp 0x4380e2
test ecx, ecx
jne 0x4382be
xor edx, edx
cmp eax, 3
je 0x438176
cmp eax, 1
jg 0x43819a
mov ecx, dword [0x46662c]
cmp dword [ecx + 0x124], edx
je 0x43819a
cmp dword [0x467a00], edx
jne 0x43819a
mov ecx, esi
sub ecx, 0x2b
je 0x438197
sub ecx, 0x3f
je 0x438193
sub ecx, 3
je 0x43818f
dec ecx
dec ecx
jne 0x43819a
push 0x51
jmp 0x438199
push 0x53
jmp 0x438199
push 0x52
jmp 0x438199
push 0x50
pop edx
mov ecx, dword [0x46662c]
cmp dword [ecx + 0x124], 0
je 0x43827e
cmp dword [0x467a00], 0
jne 0x43827e
cmp esi, 0x67
ja 0x438222
je 0x43821e
cmp esi, 0x63
ja 0x438205
je 0x438201
mov ecx, esi
sub ecx, 0xd
je 0x4381f3
sub ecx, 0x53
je 0x4381ec
dec ecx
je 0x4381e5
dec ecx
jne 0x43827e
push 0x72
jmp 0x438278
push 0x71
jmp 0x438278
push 0x70
jmp 0x438278
test byte [ebp - 7], 1
je 0x43827e
push 0x4d
jmp 0x43827d
push 0x73
jmp 0x438278
mov ecx, esi
sub ecx, 0x64
je 0x43821a
dec ecx
je 0x438216
dec ecx
jne 0x43827e
push 0x76
jmp 0x438278
push 0x75
jmp 0x438278
push 0x74
jmp 0x438278
push 0x77
jmp 0x438278
mov ecx, esi
sub ecx, 0x68
je 0x43827b
dec ecx
je 0x438276
dec ecx
je 0x43826d
dec ecx
je 0x438252
dec ecx
dec ecx
je 0x438249
dec ecx
je 0x438245
dec ecx
jne 0x43827e
cmp eax, 2
jne 0x43827e
push 0x6f
jmp 0x43827d
push 0x6e
jmp 0x438278
cmp eax, 2
jne 0x43827e
push 0x6d
jmp 0x43827d
xor edx, edx
cmp eax, 2
jne 0x438263
test ebx, ebx
setne dl
add edx, 0x6b
jmp 0x438282
test ebx, ebx
setne dl
add edx, 0x6c
jmp 0x438282
cmp eax, 2
jne 0x43827e
push 0x6a
jmp 0x43827d
push 0x79
pop edx
jmp 0x438282
push 0x78
pop edx
test edx, edx
je 0x4382bb
mov eax, dword [0x46662c]
cmp dword [eax + 0x128], 0
je 0x4382b0
cmp edx, 0x50
jl 0x4382a5
cmp edx, 0x53
jg 0x4382a5
push edx
push 0x45a8bc
jmp 0x43876b
push edx
push str.e__c
jmp 0x43876b
push edx
push str.eO_c
jmp 0x43876b
mov edx, dword [ebp + 0xc]
cmp esi, 8
jne 0x4382f4
test ebx, ebx
jne 0x4382dd
cmp dword [0x4679f0], ebx
sete al
dec al
and al, 0x77
add al, 8
mov byte [edi], al
jmp 0x438787
cmp ebx, 1
jne 0x43834c
cmp dword [0x4679f0], 0
sete al
dec al
and al, 0x89
add al, 0x7f
jmp 0x4382d6
cmp esi, 9
jne 0x43830e
cmp ebx, 1
jne 0x43834c
mov byte [edi], 0x1b
inc edi
mov byte [edi], 0x5b
inc edi
mov byte [edi], 0x5a
jmp 0x4383b7
cmp esi, 0x20
jne 0x43832d
cmp ebx, 2
jne 0x438320
mov byte [edi], 0
jmp 0x4383b7
cmp ebx, 3
jne 0x43834c
mov byte [edi], 0xa0
jmp 0x4383b7
cmp esi, 3
jne 0x43833f
cmp ebx, 2
jne 0x438388
mov byte [edi], 3
jmp 0x438787
cmp esi, 0x13
jne 0x43834c
mov byte [edi], 0x1a
jmp 0x438787
cmp ebx, 2
jne 0x438388
cmp esi, 0x32
jb 0x438366
cmp esi, 0x38
ja 0x438366
mov al, byte [esi + 0x45ca6e]
jmp 0x4380e2
cmp esi, 0xbd
je 0x438376
cmp esi, 0xbf
jne 0x43837b
mov byte [edi], 0x1f
jmp 0x4383b7
cmp esi, 0xdf
jne 0x4383c1
mov byte [edi], 0x1c
jmp 0x4383b7
cmp ebx, 3
jne 0x43839a
cmp esi, 0xde
jne 0x4383c1
mov byte [edi], 0x1e
jmp 0x4383b7
test ebx, ebx
jne 0x4383c1
cmp esi, 0xd
jne 0x4383c1
mov eax, dword [0x46662c]
cmp dword [eax + 0x130], ebx
je 0x4383c1
mov byte [edi], 0xd
inc edi
mov byte [edi], 0xa
mov eax, edi
sub eax, edx
inc eax
jmp 0x43803c
lea edx, [esi - 0x70]
xor ecx, ecx
cmp edx, 0x13
mov dword [ebp - 0x18], edx
ja case.default.0x4383d2
jmp dword [edx*4 + 0x438ae3]
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xc
add ecx, 0xb
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xc
add ecx, 0xc
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xc
add ecx, 0xd
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xc
add ecx, 0xe
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xd
add ecx, 0xf
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xc
add ecx, 0x11
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xd
add ecx, 0x12
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xd
add ecx, 0x13
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xd
add ecx, 0x14
jmp case.default.0x4383d2
mov cl, byte [ebp - 0x114]
and cl, 0x80
neg cl
sbb ecx, ecx
and ecx, 0xd
add ecx, 0x15
jmp case.default.0x4383d2
push 0x17
jmp 0x4384e0
push 0x18
jmp 0x4384e0
push 0x19
jmp 0x4384e0
push 0x1a
jmp 0x4384e0
push 0x1c
jmp 0x4384e0
push 0x1d
jmp 0x4384e0
push 0x1f
jmp 0x4384e0
push 0x20
jmp 0x4384e0
push 0x21
jmp 0x4384e0
push 0x22
pop ecx
test byte [ebp - 0xc], 2
mov eax, dword [ebp + 8]
push 6
pop ebx
jne 0x43851d
mov edx, eax
sub edx, 0x21
je 0x43851a
dec edx
je 0x438516
dec edx
je 0x438512
dec edx
je 0x43850d
sub edx, 9
je 0x438509
dec edx
jne 0x43851d
push 3
jmp 0x43851c
push 2
jmp 0x43851c
xor ecx, ecx
inc ecx
jmp 0x43851d
push 4
jmp 0x43851c
mov ecx, ebx
jmp 0x43851d
push 5
pop ecx
cmp dword [0x4679f8], 3
jne 0x438531
cmp ecx, ebx
jg 0x438531
movsx ecx, byte [ecx + 0x45ca98]
mov esi, dword [0x46662c]
mov edx, dword [esi + 0x128]
test edx, edx
je 0x43855b
test ecx, ecx
jle 0x43855b
cmp ecx, ebx
jg 0x43855b
movsx eax, byte [ecx + str._HLMEIG]
push eax
push 0x45a8bc
jmp 0x4386ed
cmp dword [0x4679f8], 5
jne 0x438648
cmp ecx, 0xb
jl 0x438608
cmp ecx, 0x22
jg 0x438608
push 0xc
pop ecx
mov esi, str.MNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_____
lea edi, [ebp - 0x158]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x18]
xor eax, eax
cmp ecx, 0xb
movsb byte es:[edi], byte [esi]
ja case.default.0x438595
jmp dword [ecx*4 + 0x438b33]
xor eax, eax
jmp case.default.0x438595
xor eax, eax
inc eax
jmp case.default.0x438595
push 2
jmp 0x4385cb
push 3
jmp 0x4385cb
push 4
jmp 0x4385cb
push 5
jmp 0x4385cb
mov eax, ebx
jmp case.default.0x438595
push 7
jmp 0x4385cb
push 8
jmp 0x4385cb
push 9
jmp 0x4385cb
push 0xa
jmp 0x4385cb
push 0xb
pop eax
test byte [ebp - 0x114], 0x80
je 0x4385d8
add eax, 0xc
test byte [ebp - 0x113], 0x80
je 0x4385e4
add eax, 0x18
movsx eax, byte [ebp + eax - 0x158]
mov esi, dword [ebp - 0x10]
push eax
push 0x45a8a4
push esi
call fcn.0043ffad
sub esi, dword [ebp + 0xc]
add esp, 0xc
add eax, esi
jmp 0x43803c
cmp ecx, 1
jl 0x438648
cmp ecx, ebx
jg 0x438648
cmp ecx, 3
mov esi, str.HL.FIG
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x10]
jne 0x43862b
mov byte [esi], 0x7f
inc esi
jmp 0x438641
movsx eax, byte [ebp + ecx - 0x25]
push eax
push 0x45a8a4
push esi
call fcn.0043ffad
add esp, 0xc
add esi, eax
mov eax, esi
jmp 0x438778
xor ebx, ebx
cmp edx, ebx
jne 0x438657
cmp dword [0x4679f8], 4
jne 0x438678
cmp ecx, 0xb
jl 0x438678
cmp ecx, 0x18
jg 0x438678
xor eax, eax
cmp ecx, 0xf
jle 0x438669
inc eax
cmp ecx, 0x15
jle 0x43866f
inc eax
sub ecx, eax
add ecx, 0x45
test edx, edx
jmp 0x4386ae
cmp dword [0x4679f8], 1
jne 0x438696
cmp ecx, 0xb
jl 0x4386ba
cmp ecx, 0xf
jg 0x4386ba
add ecx, 0x36
push ecx
push str.e___c
jmp 0x4386ed
cmp dword [0x4679f8], 2
jne 0x4386ba
cmp ecx, 0xb
jl 0x4386ba
cmp ecx, 0xe
jg 0x4386ba
add ecx, 0x45
cmp edx, ebx
push ecx
je 0x4382b1
jmp 0x43829b
cmp dword [0x4679f4], ebx
je 0x4386e3
cmp ecx, 1
je 0x4386dc
cmp ecx, 4
jne 0x4386e3
mov eax, 0x45a8a0
push eax
push edi
call fcn.0043ffad
pop ecx
pop ecx
jmp 0x4386f6
mov eax, 0x45a89c
jmp 0x4386d1
cmp ecx, ebx
je 0x438700
push ecx
push str.e__d
push edi
call fcn.0043ffad
add esp, 0xc
sub edi, dword [ebp + 0xc]
add eax, edi
jmp 0x43803c
mov ecx, eax
sub ecx, 0xc
je 0x438725
sub ecx, 0x19
je 0x438721
dec ecx
je 0x43871d
dec ecx
je 0x438719
dec ecx
jne 0x438780
mov cl, 0x42
jmp 0x438727
mov cl, 0x43
jmp 0x438727
mov cl, 0x41
jmp 0x438727
mov cl, 0x44
jmp 0x438727
mov cl, 0x47
cmp edx, ebx
je 0x438734
movsx eax, cl
push eax
jmp 0x43829b
cmp dword [esi + 0x120], ebx
je 0x438749
cmp dword [0x4679fc], ebx
jne 0x438749
xor eax, eax
inc eax
jmp 0x43874b
xor eax, eax
cmp dword [ebp - 0xc], 2
jne 0x43875a
xor edx, edx
test eax, eax
sete dl
mov eax, edx
test eax, eax
movsx eax, cl
push eax
jne 0x4382b1
push 0x45a8a4
push edi
call fcn.0043ffad
add esp, 0xc
add edi, eax
mov eax, edi
sub eax, dword [ebp + 0xc]
jmp 0x43803c
cmp eax, 0xd
jne 0x438793
mov byte [edi], al
push 0xfffffffffffffffe
mov byte [edi + 1], 0
pop eax
jmp 0x43803c
cmp dword [ebp - 4], ebx
je 0x4387b6
cmp eax, 0x60
jb 0x4387b6
cmp eax, 0x69
ja 0x4387b6
mov ecx, dword [0x465a70]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*2 - 0x60]
mov dword [0x465a70], eax
jmp 0x4387bc
mov dword [0x465a70], ebx
xor esi, esi
cmp dword [0x4682a8], esi
mov dword [ebp - 0x18], esi
je 0x4387e4
cmp byte [ebp - 0x110], 0
je 0x4387e4
xor eax, eax
cmp dword [ebp - 4], esi
mov byte [ebp - 0x110], 0
sete al
mov dword [ebp - 0x18], eax
cmp dword [0x466590], 2
push dword [ebp - 0x1c]
push esi
jne 0x438823
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x10], eax
xor eax, eax
movzx cx, byte [ebp + eax + 0xc]
mov word [eax*2 + 0x46558c], cx
inc eax
cmp eax, 3
jl 0x43880d
jmp 0x43883e
push 0x46558c
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jle 0x438a5e
push dword [0x46662c]
call fcn.0042a845
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x10], ebx
pop ecx
jle 0x438a4b
xor edi, edi
inc edi
mov ecx, dword [0x465a24]
cmp ecx, 2
mov al, byte [esi*2 + 0x46558c]
mov byte [ebp + 0xf], al
jne 0x438897
test al, al
js 0x4388f4
cmp al, 0x20
jbe 0x4388f4
movzx eax, al
mov dword [0x465a74], eax
mov dword [0x465a24], 3
jmp 0x438a41
cmp ecx, 3
jne 0x4388f4
test al, al
js 0x4388f4
cmp al, 0x20
jbe 0x4388f4
movzx eax, al
push eax
push dword [0x465a74]
mov dword [0x465a24], ebx
call fcn.0043de02
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x438a54
push dword [0x46662c]
mov dword [ebp - 8], eax
call fcn.0042b2cb
mov eax, dword [0x464a60]
cmp eax, ebx
pop ecx
je 0x438a41
push edi
push edi
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.00406d30
add esp, 0x10
jmp 0x438a41
cmp dword [ebp - 0x24], ebx
mov dword [0x465a24], ebx
jne 0x4389a2
mov ecx, dword [0x465a70]
cmp ecx, ebx
je 0x43897f
mov eax, dword [0x46662c]
cmp dword [eax + 0xdc], ebx
jne 0x438952
mov edx, dword [eax + 0x106c]
cmp dword [edx + 0xc], 0xfde9
je 0x438952
cmp dword [0x464a6c], ebx
jne 0x438952
push eax
mov byte [ebp + 0xf], cl
call fcn.0042b2cb
mov eax, dword [0x464a60]
cmp eax, ebx
pop ecx
je 0x438974
push edi
push edi
lea ecx, [ebp + 0xf]
push ecx
push eax
call fcn.0040663c
jmp 0x438971
push eax
mov dword [ebp - 8], ecx
call fcn.0042b2cb
mov eax, dword [0x464a60]
cmp eax, ebx
pop ecx
je 0x438974
push edi
push edi
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.00406d30
add esp, 0x10
mov dword [0x465a70], ebx
jmp 0x438a3a
push dword [0x46662c]
call fcn.0042b2cb
mov eax, dword [0x464a60]
cmp eax, ebx
pop ecx
je 0x438a3a
push edi
push edi
lea ecx, [ebp + 0xf]
jmp 0x438a2a
cmp dword [ebp - 0x18], ebx
je 0x4389f7
cmp al, 0x80
jae 0x4389f7
movzx eax, al
push eax
mov word [ebp - 0x14], 0x1b
call fcn.0043dd60
push dword [0x46662c]
mov word [ebp - 0x12], ax
call fcn.0042b2cb
mov eax, dword [0x464a60]
cmp eax, ebx
pop ecx
pop ecx
je 0x438a3a
xor ecx, ecx
cmp dword [ebp - 4], ebx
push edi
setne cl
inc ecx
push ecx
xor ecx, ecx
cmp dword [ebp - 4], ebx
sete cl
lea ecx, [ebp + ecx*2 - 0x14]
push ecx
push eax
call fcn.00406d30
add esp, 0x10
jmp 0x438a3a
push dword [0x46662c]
mov byte [ebp - 0xa], 0x1b
mov byte [ebp - 9], al
call fcn.0042b2cb
mov eax, dword [0x464a60]
cmp eax, ebx
pop ecx
je 0x438a3a
xor ecx, ecx
cmp dword [ebp - 4], ebx
push edi
setne cl
inc ecx
push ecx
xor ecx, ecx
cmp dword [ebp - 4], ebx
sete cl
lea ecx, [ebp + ecx - 0xa]
push ecx
push dword [0x464640]
push eax
call fcn.00406e31
add esp, 0x14
xor eax, eax
call fcn.00435acc
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x438863
mov word [0x46558c], bx
jmp 0x438ab8
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x438ab8
cmp dword [ebp - 4], esi
jne 0x438a6c
mov word [0x46558c], si
jmp 0x438aa2
cmp word [0x46558c], si
je 0x438aa2
mov eax, dword [0x46662c]
cmp dword [eax + 0xdc], esi
jne 0x438a99
mov eax, dword [eax + 0x106c]
cmp dword [eax + 0xc], 0xfde9
je 0x438a99
cmp dword [0x464a6c], esi
je 0x438aa2
mov word [0x46558c], 0xa
cmp dword [ebp + 8], 0x12
jne 0x438039
cmp dword [0x467a3c], esi
jne 0x438039
xor eax, eax
jmp 0x43803c