Function at 0x1000ef50
Capabilities:
Create thread
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004fc3a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2d8
mov eax, dword [0x10066080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a0], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1d4], 0
push 0x19
lea ecx, [ebp - 0x2bc]
movq qword [ebp - 0x1dc], xmm0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
call fcn.1001e7d0
mov esi, dword [ebp - 0x2bc]
mov eax, 0x19
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
add esi, 0x18
sub eax, 1
jne 0x1000efe2
push ecx
mov edx, esi
mov ecx, esi
call fcn.10019ae0
add esp, 4
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 4], 0
push 0x78
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d4], 0
call fcn.1002c73a
mov esi, eax
add esp, 4
lea eax, [ebp - 0x1dc]
mov dword [ebp - 0x1dc], esi
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 0x2b0], eax
lea ecx, [esi + 0x78]
mov dword [ebp - 0x1d4], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1e0], 0
movq qword [ebp - 0x1e8], xmm0
mov dword [ebp - 0x1e8], esi
mov dword [ebp - 0x1e4], esi
mov dword [ebp - 0x1e0], eax
mov byte [ebp - 4], 2
mov edi, 0xa
lea eax, [ebp - 0x2bc]
mov edx, esi
push eax
call fcn.10025fb0
add esi, 0xc
add esp, 4
mov dword [ebp - 0x1e4], esi
sub edi, 1
jne 0x1000f096
mov dword [ebp - 0x1d8], esi
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 4], 4
call fcn.10015cb0
lea edx, [ebp - 0x1dc]
call fcn.1000ec60
mov eax, dword [0xb93530]
cmp eax, 0x100000
jbe 0x1001026e
cmp dword [eax + 0x4810], edi
je 0x1001026e
mov esi, dword [ebp - 0x2a0]
cmp dword [0x10068958], edi
jne 0x1000f10b
push 0x10068958
push esi
call dword [sym.imp.d3dx9_43.dll_D3DXCreateSprite]
cmp dword [0x10068880], 0
mov edi, dword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileA]
jne 0x1000f128
push 0x10068880
push dword [0x10068994]
push esi
call edi
cmp dword [0x100689e8], 0
jne 0x1000f13f
push 0x100689e8
push dword [0x10068a04]
push esi
call edi
cmp dword [0x100689bc], 0
jne 0x1000f16e
push 0x100689bc
push str.Times_New_Roman
push 0
push 4
push 0
push 1
push 0
push 1
push 0x2bc
push 0
push 0x10
push esi
call dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
mov ecx, dword [0x10068958]
push 0x10
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
push 0x10068a60
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x10068a60
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov al, byte [0x100688f8]
or ecx, 0xffffffff
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, al
mov edx, 0x80ffffff
cmovne ecx, edx
mov dword [ebp - 0x2b0], ecx
je 0x100101a9
movups xmm1, xmmword [0x1005a854]
mov eax, dword [0x10068af8]
movq xmm0, qword [0x10068af0]
movq qword [ebp - 0x1b4], xmm0
movaps xmm0, xmm1
mov dword [ebp - 0x1ac], eax
psrldq xmm0, 8
movd eax, xmm0
movd ecx, xmm1
movups xmmword [ebp - 0x218], xmm1
push 0xffffffffffffffff
sub eax, ecx
mov ecx, dword [0x100688ac]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x1b4]
movss dword [ebp - 0x1b4], xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
psrldq xmm1, 4
movd ecx, xmm1
sub eax, ecx
mov ecx, dword [0x10068a3c]
cdq
sub eax, edx
lea edx, [ebp - 0x1b4]
sar eax, 1
sub ecx, eax
push edx
push 0
lea edx, [ebp - 0x218]
movd xmm0, ecx
mov ecx, dword [0x10068958]
cvtdq2ps xmm0, xmm0
push edx
push dword [0x10068880]
addss xmm0, dword [ebp - 0x1b0]
push ecx
movss dword [ebp - 0x1b0], xmm0
mov eax, dword [ecx]
call dword [eax + 0x24]
movups xmm1, xmmword [0x1005ab28]
mov eax, dword [0x1005af6c]
movq xmm0, qword [0x1005af64]
movq qword [ebp - 0x1b4], xmm0
movaps xmm0, xmm1
mov dword [ebp - 0x1ac], eax
psrldq xmm0, 8
movd eax, xmm0
movd ecx, xmm1
movups xmmword [ebp - 0x218], xmm1
sub eax, ecx
mov ecx, dword [0x100688ac]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x1b4]
movss dword [ebp - 0x1b4], xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
psrldq xmm1, 4
movd ecx, xmm1
sub eax, ecx
mov ecx, dword [0x10068a3c]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x1b0]
movss dword [ebp - 0x1b0], xmm0
mov ecx, dword [0x10068958]
lea edx, [ebp - 0x1b4]
push 0xffffffffffffffff
push edx
push 0
mov eax, dword [ecx]
lea edx, [ebp - 0x218]
push edx
push dword [0x10068880]
push ecx
call dword [eax + 0x24]
cmp byte [0x100687eb], 0
jne 0x1000f3b4
push 4
call fcn.1002c73a
add esp, 4
mov dword [ebp - 0x208], eax
mov dword [eax], 0x1000ebd0
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 5
push ecx
push 0
push eax
push 0x10025f50
push 0
push 0
call fcn.1003ab42
add esp, 0x18
mov dword [ebp - 0x1b0], eax
test eax, eax
je 0x1001029e
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1ac]
test ecx, ecx
je 0x10010297
push ecx
push eax
call fcn.1002c3b9
add esp, 8
test eax, eax
jne 0x10010297
mov byte [0x100687eb], 1
mov byte [ebp - 4], 4
call fcn.1000cb90
mov edx, 0x10066bc8
lea ecx, [ebp - 0x29c]
call fcn.1000e3d0
mov edx, 0x10066b80
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x284]
call fcn.1000e3d0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2dc]
mov edx, dword [0x1006882c]
call fcn.10018480
mov byte [ebp - 4], 9
mov ecx, dword [0x1006895c]
mov edi, ecx
lea edx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x1000f401
mov esi, dword [ebp - 0x2cc]
sub edi, edx
mov eax, dword [ebp - 0x2c8]
sar edi, 1
sub eax, esi
mov dword [ebp - 0x2a4], esi
cmp edi, eax
ja 0x1000f4e6
cmp dword [ebp - 0x2c8], 7
lea eax, [esi + edi]
lea edx, [ebp - 0x2dc]
mov dword [ebp - 0x2cc], eax
cmova edx, dword [ebp - 0x2dc]
lea eax, [ecx + edi*2]
mov dword [ebp - 0x2a8], edx
cmp eax, edx
jbe 0x1000f479
lea eax, [edx + esi*2]
cmp ecx, eax
ja 0x1000f479
cmp edx, ecx
ja 0x1000f46b
xor esi, esi
mov dword [ebp - 0x2a0], esi
jmp 0x1000f481
mov esi, edx
sub esi, ecx
sar esi, 1
mov dword [ebp - 0x2a0], esi
jmp 0x1000f481
mov esi, edi
mov dword [ebp - 0x2a0], edi
mov eax, dword [ebp - 0x2a4]
lea ecx, [edx + edi*2]
lea eax, [eax*2 + 2]
push eax
push edx
push ecx
call fcn.1002df40
add esp, 0xc
add esi, esi
push esi
push dword [0x1006895c]
push dword [ebp - 0x2a8]
call fcn.1002df40
mov edx, dword [ebp - 0x2a0]
add esp, 0xc
mov ecx, dword [ebp - 0x2a8]
mov eax, edi
sub eax, edx
add ecx, esi
add eax, eax
push eax
lea eax, [edx + edi]
mov edx, dword [0x1006895c]
lea eax, [edx + eax*2]
push eax
push ecx
call fcn.1002df40
add esp, 0xc
lea eax, [ebp - 0x2dc]
jmp 0x1000f502
push edi
push ecx
push ecx
mov byte [ebp - 0x2a4], 0
lea ecx, [ebp - 0x2dc]
push dword [ebp - 0x2a4]
push edi
call fcn.10025a90
mov dword [ebp - 0x1bc], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1cc], xmm0
mov dword [ebp - 0x1b8], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1cc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1bc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1cc]
cmp dword [ebp - 0x1b8], 7
movups xmm0, xmmword [0x1005aab4]
cmova ecx, dword [ebp - 0x1cc]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.1000b120
mov byte [ebp - 4], 9
add esp, 0x10
mov ecx, dword [ebp - 0x1b8]
cmp ecx, 7
jbe 0x1000f5bd
mov edx, dword [ebp - 0x1cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000f5b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100102af
push ecx
push edx
call fcn.1002c76a
add esp, 8
xor eax, eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1b8], 7
mov word [ebp - 0x1cc], ax
cmp ecx, 7
jbe 0x1000f61e
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000f614
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100102af
push ecx
push edx
call fcn.1002c76a
add esp, 8
lea eax, [ebp - 0x29c]
mov edx, 0x10066bb0
push eax
lea ecx, [ebp - 0x1cc]
call fcn.10019560
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0xb
cmp dword [ecx + 0x14], 7
jbe 0x1000f646
mov ecx, dword [ecx]
movups xmm0, xmmword [0x1005a884]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.1000b120
mov byte [ebp - 4], 8
add esp, 0x10
mov ecx, dword [ebp - 0x1b8]
cmp ecx, 7
jbe 0x1000f6a1
mov edx, dword [ebp - 0x1cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000f697
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100102b4
push ecx
push edx
call fcn.1002c76a
add esp, 8
lea eax, [ebp - 0x284]
mov edx, 0x10066b98
push eax
lea ecx, [ebp - 0x1cc]
call fcn.10019560
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0xc
cmp dword [ecx + 0x14], 7
jbe 0x1000f6c9
mov ecx, dword [ecx]
movups xmm0, xmmword [0x1005ad20]
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.1000b120
mov byte [ebp - 4], 8
add esp, 0x10
mov ecx, dword [ebp - 0x1b8]
cmp ecx, 7
jbe 0x1000f724
mov edx, dword [ebp - 0x1cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000f71a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100102b9
push ecx
push edx
call fcn.1002c76a
add esp, 8
mov eax, dword [0x100688ac]
lea edi, [ebp - 0x19c]
add eax, 0xffffff10
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2c0], eax
mov eax, dword [0x10068a3c]
add eax, 0xffffff06
xor esi, esi
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a0], esi
mov ecx, dword [ebp - 0x2ac]
mov eax, 0x66666667
imul esi
movss xmm3, dword [0x1005f7b8]
sar edx, 1
mov esi, edx
shr esi, 0x1f
add esi, edx
lea eax, [esi + esi*4]
sub ecx, eax
imul eax, ecx, 0x63
imul ecx, esi, 0x63
mov esi, dword [ebp - 0x2ac]
add eax, dword [ebp - 0x2c0]
add ecx, dword [ebp - 0x2c4]
mov dword [ebp - 0x218], eax
add eax, 0x5a
cmp byte [esi + 0x10068a68], 0
mov dword [ebp - 0x210], eax
lea eax, [ecx + 0x5a]
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x20c], eax
movups xmm0, xmmword [ebp - 0x218]
movups xmmword [edi - 0xc], xmm0
je 0x1000f866
movd xmm2, dword [edi - 4]
lea edx, [ebp - 0x26c]
movd xmm0, dword [edi - 0xc]
movd xmm1, dword [edi - 8]
cvtdq2ps xmm2, xmm2
mov ecx, dword [0x10068958]
push 0xffffffffffffffff
push edx
push 0
cvtdq2ps xmm0, xmm0
lea edx, [ebp - 0x1f8]
mov dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
push edx
mov dword [ebp - 0x264], eax
push dword [0x10068880]
addss xmm2, xmm0
movd xmm0, dword [edi]
cvtdq2ps xmm1, xmm1
push ecx
cvtdq2ps xmm0, xmm0
mulss xmm2, xmm3
addss xmm1, xmm0
movups xmm0, xmmword [0x1005a9dc]
subss xmm2, dword [0x1005f7e0]
movups xmmword [ebp - 0x1f8], xmm0
mulss xmm1, xmm3
subss xmm1, dword [0x1005f7e4]
unpcklps xmm2, xmm1
movq qword [ebp - 0x26c], xmm2
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x1000fa57
mov eax, dword [0x1006882c]
cmp eax, 9
ja 0x1000fa57
mov ecx, dword [ebp - 0x1dc]
lea edi, [eax + eax*2]
mov eax, dword [ecx + edi*4]
mov ecx, dword [ecx + edi*4 + 4]
sub ecx, eax
mov dword [ebp - 0x2a4], eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x1000fa51
xorps xmm0, xmm0
mov dword [ebp - 0x1bc], 0
xor eax, eax
mov dword [ebp - 0x1b8], 7
movups xmmword [ebp - 0x1cc], xmm0
mov word [ebp - 0x1cc], ax
mov eax, dword [ebp - 0x2a0]
add eax, dword [ebp - 0x2a4]
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x14], 0xf
jbe 0x1000f8e4
mov eax, dword [eax]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov dword [ebp - 0x1d0], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002c778
mov ecx, dword [ebp - 0x1dc]
add esp, 4
mov esi, eax
mov dword [ebp - 0x2a4], esi
mov ecx, dword [ecx + edi*4]
add ecx, dword [ebp - 0x2a0]
cmp dword [ecx + 0x14], 0xf
jbe 0x1000f936
mov ecx, dword [ecx]
push dword [ebp - 0x1d0]
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f952
mov eax, dword [ebp - 0x1b8]
sub ecx, edx
sar ecx, 1
cmp ecx, eax
ja 0x1000f9a2
lea esi, [ecx + ecx]
mov dword [ebp - 0x1bc], ecx
cmp eax, 7
lea edi, [ebp - 0x1cc]
push esi
cmova edi, dword [ebp - 0x1cc]
push dword [ebp - 0x2a4]
push edi
call fcn.1002df40
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
mov esi, dword [ebp - 0x2a4]
jmp 0x1000f9bc
push esi
mov byte [ebp - 0x208], 0
push dword [ebp - 0x208]
push ecx
lea ecx, [ebp - 0x1cc]
call fcn.1001a530
cmp dword [ebp - 0x1b8], 7
lea edi, [ebp - 0x1f8]
mov ecx, dword [0x100689bc]
lea edx, [ebp - 0x1cc]
movups xmm0, xmmword [ebp - 0x218]
cmova edx, dword [ebp - 0x1cc]
push 0xffffffffffffffff
push 0x15
push edi
push 0xffffffffffffffff
push edx
push dword [0x10068958]
movups xmmword [ebp - 0x1f8], xmm0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x3c]
push esi
call fcn.1002c735
mov byte [ebp - 4], 8
add esp, 4
mov ecx, dword [ebp - 0x1b8]
cmp ecx, 7
jbe 0x1000fa4b
mov edx, dword [ebp - 0x1cc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000fa41
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100102af
push ecx
push edx
call fcn.1002c76a
add esp, 8
mov esi, dword [ebp - 0x2ac]
mov edi, dword [ebp - 0x2a8]
call fcn.1000c830
test al, al
je 0x1000fbf0
movups xmm1, xmmword [0x1005ad54]
mov eax, dword [0x1005ae1c]
movq xmm0, qword [0x1005ae14]
movq qword [ebp - 0x224], xmm0
movaps xmm0, xmm1
mov dword [ebp - 0x21c], eax
psrldq xmm0, 8
movd eax, xmm0
movd ecx, xmm1
movups xmmword [ebp - 0x1f8], xmm1
push 0xffffffffffffffff
sub eax, ecx
mov ecx, dword [0x100688ac]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x224]
movss dword [ebp - 0x224], xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
psrldq xmm1, 4
movd ecx, xmm1
sub eax, ecx
mov ecx, dword [0x10068a3c]
cdq
sub eax, edx
lea edx, [ebp - 0x224]
sar eax, 1
sub ecx, eax
push edx
push 0
lea edx, [ebp - 0x1f8]
movd xmm0, ecx
mov ecx, dword [0x10068958]
cvtdq2ps xmm0, xmm0
push edx
push dword [0x10068880]
addss xmm0, dword [ebp - 0x220]
push ecx
movss dword [ebp - 0x220], xmm0
mov eax, dword [ecx]
call dword [eax + 0x24]
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8001
test cx, ax
je 0x1000fbf0
mov eax, dword [0x100688ac]
movq xmm0, qword [0x1005ae14]
add eax, 0xffffffe3
movd xmm2, dword [0x10068a60]
movq qword [ebp - 0x254], xmm0
cvtdq2ps xmm2, xmm2
movd xmm1, eax
mov eax, dword [0x10068a3c]
add eax, 0xffffffe2
cvtdq2ps xmm1, xmm1
movd xmm0, eax
addss xmm1, dword [ebp - 0x254]
cvtdq2ps xmm0, xmm0
comiss xmm2, xmm1
addss xmm0, dword [ebp - 0x250]
movss dword [ebp - 0x254], xmm1
movss dword [ebp - 0x250], xmm0
jbe 0x1000fbf0
addss xmm1, dword [0x1005f878]
subss xmm1, dword [0x1005f860]
comiss xmm1, xmm2
jbe 0x1000fbf0
movd xmm1, dword [0x10068a64]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x1000fbf0
addss xmm0, dword [0x1005f804]
subss xmm0, dword [0x1005f7f8]
comiss xmm0, xmm1
jbe 0x1000fbf0
cmp byte [0x100688f9], 0
jne 0x1000fbfd
cmp byte [0x100687e9], 0
mov byte [0x100688f9], 1
sete byte [0x100687e9]
jmp 0x1000fbfd
cmp byte [0x100688f9], 0
je 0x100100f1
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8001
test cx, ax
je 0x1000fd32
mov eax, dword [0x100688ac]
movq xmm0, qword [0x1005b024]
add eax, 0xffffffe0
movd xmm2, dword [0x10068a60]
movq qword [ebp - 0x260], xmm0
cvtdq2ps xmm2, xmm2
movd xmm1, eax
mov eax, dword [0x10068a3c]
add eax, 0xfffffff5
cvtdq2ps xmm1, xmm1
movd xmm0, eax
addss xmm1, dword [ebp - 0x260]
cvtdq2ps xmm0, xmm0
comiss xmm2, xmm1
addss xmm0, dword [ebp - 0x25c]
movss dword [ebp - 0x260], xmm1
movss dword [ebp - 0x25c], xmm0
jbe 0x1000fd32
addss xmm1, dword [0x1005f7f0]
subss xmm1, dword [0x1005f7c8]
comiss xmm1, xmm2
jbe 0x1000fd32
movd xmm1, dword [0x10068a64]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x1000fd32
addss xmm0, dword [0x1005f884]
subss xmm0, dword [0x1005f880]
comiss xmm0, xmm1
jbe 0x1000fd32
push 4
call fcn.1002c73a
add esp, 4
mov dword [ebp - 0x1d0], eax
mov dword [eax], 0x1000ec10
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0xe
push ecx
push 0
push eax
push 0x10025f50
push 0
push 0
call fcn.1003ab42
add esp, 0x18
mov dword [ebp - 0x1b0], eax
test eax, eax
je 0x1001029e
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x1ac]
test ecx, ecx
je 0x10010297
push ecx
push eax
call fcn.1002c3b9
add esp, 8
test eax, eax
jne 0x10010297
xorps xmm0, xmm0
mov byte [0x100688f9], al
movlpd qword [ebp - 0x1b0], xmm0
mov byte [ebp - 4], 8
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, dword [0x10068a3c]
mov ecx, 0x8001
test cx, ax
mov dword [ebp - 0x2a4], edx
mov ecx, dword [0x100688ac]
mov dword [ebp - 0x1d0], ecx
je 0x1000fdf5
movq xmm0, qword [0x1005af4c]
lea eax, [ecx - 0x20]
movd xmm2, dword [0x10068a60]
movq qword [ebp - 0x204], xmm0
movd xmm1, eax
lea eax, [edx - 0xb]
movd xmm0, eax
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
addss xmm1, dword [ebp - 0x204]
addss xmm0, dword [ebp - 0x200]
cvtdq2ps xmm2, xmm2
movss dword [ebp - 0x204], xmm1
comiss xmm2, xmm1
movss dword [ebp - 0x200], xmm0
jbe 0x1000fdf5
addss xmm1, dword [0x1005f800]
subss xmm1, dword [0x1005f7f4]
comiss xmm1, xmm2
jbe 0x1000fdf5
movd xmm1, dword [0x10068a64]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x1000fdf5
addss xmm0, dword [0x1005f884]
subss xmm0, dword [0x1005f880]
comiss xmm0, xmm1
jbe 0x1000fdf5
mov byte [0x100688f9], 0
movups xmm1, xmmword [0x1005aa5c]
mov eax, dword [0x1005aeb8]
movq xmm0, qword [0x1005aeb0]
movq qword [ebp - 0x230], xmm0
movaps xmm0, xmm1
mov dword [ebp - 0x228], eax
psrldq xmm0, 8
movd eax, xmm0
movd ecx, xmm1
movups xmmword [ebp - 0x1f8], xmm1
push 0xffffffffffffffff
sub eax, ecx
mov ecx, dword [ebp - 0x1d0]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x230]
movss dword [ebp - 0x230], xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
psrldq xmm1, 4
movd ecx, xmm1
sub eax, ecx
mov ecx, dword [ebp - 0x2a4]
cdq
sub eax, edx
lea edx, [ebp - 0x230]
sar eax, 1
sub ecx, eax
push edx
push 0
lea edx, [ebp - 0x1f8]
movd xmm0, ecx
mov ecx, dword [0x10068958]
cvtdq2ps xmm0, xmm0
push edx
push dword [0x10068880]
addss xmm0, dword [ebp - 0x22c]
push ecx
movss dword [ebp - 0x22c], xmm0
mov eax, dword [ecx]
call dword [eax + 0x24]
movups xmm1, xmmword [0x1005ace0]
mov eax, dword [0x1005b02c]
movq xmm0, qword [0x1005b024]
movq qword [ebp - 0x23c], xmm0
movaps xmm0, xmm1
mov dword [ebp - 0x234], eax
psrldq xmm0, 8
movd eax, xmm0
movd ecx, xmm1
movups xmmword [ebp - 0x1f8], xmm1
sub eax, ecx
mov ecx, dword [0x100688ac]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x23c]
movss dword [ebp - 0x23c], xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
psrldq xmm1, 4
movd ecx, xmm1
sub eax, ecx
mov ecx, dword [0x10068a3c]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x238]
movss dword [ebp - 0x238], xmm0
mov ecx, dword [0x10068958]
lea edx, [ebp - 0x23c]
push 0xffffffffffffffff
push edx
push 0
mov eax, dword [ecx]
lea edx, [ebp - 0x1f8]
push edx
push dword [0x10068880]
push ecx
call dword [eax + 0x24]
movups xmm1, xmmword [0x1005a784]
mov eax, dword [0x1005af54]
movq xmm0, qword [0x1005af4c]
movq qword [ebp - 0x248], xmm0
movaps xmm0, xmm1
mov dword [ebp - 0x240], eax
psrldq xmm0, 8
movd eax, xmm0
movd ecx, xmm1
movups xmmword [ebp - 0x1f8], xmm1
push 0xffffffffffffffff
sub eax, ecx
mov ecx, dword [0x100688ac]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x248]
movss dword [ebp - 0x248], xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
psrldq xmm1, 4
movd ecx, xmm1
sub eax, ecx
mov ecx, dword [0x10068a3c]
cdq
sub eax, edx
lea edx, [ebp - 0x248]
sar eax, 1
sub ecx, eax
push edx
push 0
lea edx, [ebp - 0x1f8]
movd xmm0, ecx
mov ecx, dword [0x10068958]
cvtdq2ps xmm0, xmm0
push edx
push dword [0x10068880]
addss xmm0, dword [ebp - 0x244]
push ecx
movss dword [ebp - 0x244], xmm0
mov eax, dword [ecx]
call dword [eax + 0x24]
movups xmm1, xmmword [0x1005ad54]
mov eax, dword [0x1005ae1c]
movq xmm0, qword [0x1005ae14]
movq qword [ebp - 0x1e8], xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
mov dword [ebp - 0x1e0], eax
movd eax, xmm0
movd ecx, xmm1
movups xmmword [ebp - 0x1f8], xmm1
sub eax, ecx
mov ecx, dword [0x100688ac]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebp - 0x1e8]
movss dword [ebp - 0x1e8], xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
psrldq xmm1, 4
push dword [ebp - 0x2b0]
movd ecx, xmm1
sub eax, ecx
mov ecx, dword [0x10068a3c]
cdq
sub eax, edx
lea edx, [ebp - 0x1e8]
sar eax, 1
sub ecx, eax
push edx
push 0
lea edx, [ebp - 0x1f8]
movd xmm0, ecx
mov ecx, dword [0x10068958]
cvtdq2ps xmm0, xmm0
push edx
push dword [0x10068880]
addss xmm0, dword [ebp - 0x1e4]
push ecx
movss dword [ebp - 0x1e4], xmm0
mov eax, dword [ecx]
call dword [eax + 0x24]
mov eax, dword [ebp - 0x2a0]
inc esi
add eax, 0x18
mov dword [ebp - 0x2ac], esi
add edi, 0x10
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x2a8], edi
cmp eax, 0x258
jl 0x1000f75e
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x270]
cmp ecx, 7
jbe 0x1001015f
mov edx, dword [ebp - 0x284]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010155
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100102be
push ecx
push edx
call fcn.1002c76a
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x288]
cmp ecx, 7
jbe 0x100101a3
mov edx, dword [ebp - 0x29c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010199
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100102be
push ecx
push edx
call fcn.1002c76a
add esp, 8
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
test ax, ax
jns 0x1001023e
mov eax, dword [0x100688ac]
movq xmm0, qword [0x1005af64]
add eax, 0xfffffff6
movd xmm2, dword [0x10068a60]
movq qword [ebp - 0x204], xmm0
cvtdq2ps xmm2, xmm2
movd xmm1, eax
mov eax, dword [0x10068a3c]
add eax, 0xfffffff8
cvtdq2ps xmm1, xmm1
movd xmm0, eax
addss xmm1, dword [ebp - 0x204]
cvtdq2ps xmm0, xmm0
comiss xmm2, xmm1
addss xmm0, dword [ebp - 0x200]
jbe 0x1001023e
addss xmm1, dword [0x1005f864]
subss xmm1, dword [0x1005f85c]
comiss xmm1, xmm2
jbe 0x1001023e
movd xmm1, dword [0x10068a64]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x1001023e
addss xmm0, dword [0x1005f7ec]
subss xmm0, dword [0x1005f7e8]
comiss xmm0, xmm1
ja 0x10010247
push 0x1b
call esi
test ax, ax
jns 0x10010263
mov byte [0x100688f8], 0
mov byte [0x100687eb], 0
mov byte [0x100687e9], 0
mov byte [0x100688f9], 0
mov eax, dword [0x10068958]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x1dc]
call fcn.100156c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002c727
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 1
call fcn.1002b806
push 6
mov dword [ebp - 0x1ac], 0
call fcn.1002b806
call fcn.1003c339
call fcn.1003c339
call fcn.1003c339
call fcn.1003c339
int3