Function at 0x30076f87
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x3001d1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp + 0x14]
push 0
push eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
call edi
mov esi, dword [ebp + 0xc]
cmp esi, 0x14
mov ebx, eax
ja 0x30077594
je 0x300774ee
cmp esi, 0xb
ja 0x300772ed
je 0x300772b9
mov eax, esi
dec eax
dec eax
je 0x30077269
dec eax
je 0x30077246
dec eax
dec eax
je 0x3007706c
dec eax
dec eax
je 0x30076ffe
dec eax
je 0x30077003
jmp 0x30077fac
call fcn.300e725d
cmp byte [0x30225c9d], 0
je 0x30077045
test dword [0x3022ca34], 0x80000
jne 0x30077045
cmp esi, 7
jne 0x3007703e
test byte [ebx + 0xa], 1
je 0x30077031
mov eax, dword [0x3022ca38]
test eax, eax
je 0x3007703a
cmp dword [eax], 0
je 0x3007703a
push 0
call fcn.3010684c
jmp 0x30077058
push 1
jmp 0x30077033
push 0
call fcn.3010684c
cmp esi, 8
jne 0x30077058
call fcn.301065f8
push eax
push dword [ebx + 4]
call fcn.30106772
xor eax, eax
cmp esi, 7
sete al
push eax
push ebx
call fcn.3006faad
jmp 0x30077232
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xfffffffffffffff0
push dword [ebp - 0x50]
call edi
test eax, 0x800000
je 0x300770fa
push dword [ebx]
mov word [ebp - 0x8c], 0x78
call fcn.3005131c
mov esi, eax
mov eax, dword [0x302ae81c]
mov edi, eax
mov eax, dword [eax + 0x50]
test eax, eax
je 0x300770b1
push eax
call dword [sym.imp.MSO.dll_Ordinal_2795]
mov dword [edi + 0x4c], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push 1
lea eax, [ebp - 0x8c]
push eax
push dword [edi + 0x4c]
call fcn.3005e65a
mov eax, dword [ebp - 0x74]
cdq
xor ecx, ecx
and edx, 3
add eax, edx
sar eax, 2
inc ecx
sub ecx, eax
mov eax, dword [ebp - 0x78]
push ecx
cdq
sub eax, edx
xor ecx, ecx
sar eax, 1
inc ecx
sub ecx, eax
push ecx
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push esi
call fcn.3005131c
push dword [ebp - 0x68]
lea esi, [ebp - 0x70]
push dword [ebp - 0x70]
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.3007f8c2
push dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
push dword [ebp - 0x54]
call fcn.3007f8c2
mov dword [ebp - 0x64], eax
push dword [ebx + 0x20]
lea edi, [ebx + 0x1c]
push dword [edi]
lea eax, [ebp - 0x60]
push eax
call fcn.3005998f
test byte [ebx + 8], 0x10
lea esi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x70]
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x3007714f
mov dword [ebp - 0x58], 0x3fffffff
push dword [ebp - 0x58]
push dword [ebp - 0x60]
call fcn.3007f8c2
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x54]
call fcn.3007f8c2
push dword [ebx + 0x10]
lea edi, [ebx + 0xc]
push dword [edi]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x60]
push eax
call fcn.3005998f
lea esi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x1c]
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc dword [ebp - 0x58]
test dword [ebx + 8], 0x20000000
je 0x300771c5
test byte [0x3022cf84], 2
lea esi, [ebp - 0x60]
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x300771bd
lea eax, [ebp - 0x84]
push eax
push dword [ebx]
call fcn.301414fd
lea eax, [ebp - 0x84]
jmp 0x300771c8
lea eax, [ebp - 0x60]
push eax
push dword [0x302ae7e8]
push ebx
call fcn.30071b0c
push dword [0x302ae7e8]
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push ebx
call fcn.3006ef2b
xor edi, edi
push edi
push ebx
call fcn.3006f900
mov esi, dword [ebx + 8]
shr esi, 1
and esi, 1
mov dword [ebp - 0x78], eax
je 0x3007720e
push edi
push ebx
call fcn.300764a5
push 0x7ffff
push edi
push ebx
call fcn.3006fc7e
cmp esi, edi
je 0x30077226
push 1
push ebx
call fcn.300764a5
push dword [ebp - 0x78]
push ebx
call fcn.3006f900
mov esi, dword [ebp + 0xc]
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push esi
push dword [ebp - 0x50]
call fcn.30106662
jmp 0x30077934
cmp byte [0x30225c9d], 0
je 0x30077232
test dword [0x3022ca34], 0x40000
je 0x30077232
test byte [ebx + 8], 2
je 0x30077232
push ebx
call fcn.30074c63
jmp 0x30077232
mov eax, dword [ebx + 0xd8]
test eax, eax
je 0x30077279
push eax
call fcn.3007ad95
push dword [ebx]
call fcn.3005131c
push 0x3020a1f8
mov edi, eax
call fcn.3004fdce
mov eax, dword [ebx + 0x98]
test eax, eax
je 0x3007729c
push eax
call fcn.30050f49
push edi
call fcn.3005131c
push 0x302ade50
push dword [ebx]
call fcn.30062af5
push ebx
call fcn.30067be3
jmp 0x30077232
mov ebx, dword [ebx + 8]
test bl, 2
je 0x30077232
test bl, 1
je 0x30077232
cmp dword [ebp - 0x48], 0
push dword [ebp - 0x50]
je 0x300772e2
call dword [sym.imp.USER32.dll_ShowCaret]
jmp 0x30077232
call dword [sym.imp.USER32.dll_HideCaret]
jmp 0x30077232
mov eax, esi
sub eax, 0xc
je 0x30077924
dec eax
je 0x30077f59
dec eax
je 0x300774e3
dec eax
jne 0x30077fac
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_HideCaret]
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_BeginPaint]
push dword [ebx]
call fcn.3005131c
mov dword [ebp - 0x4c], eax
mov eax, dword [0x302ae81c]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x88], ecx
mov eax, dword [eax + 0x18]
push dword [ebx + 4]
mov dword [ebp - 0x74], eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edi, dword [sym.imp.MSO.dll_Ordinal_497]
mov dword [ebp - 0x48], eax
call edi
test eax, eax
je 0x3007738d
call edi
push eax
call dword [sym.imp.MSO.dll_Ordinal_114]
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
cmp esi, eax
jne 0x3007738d
cmp dword [ebp - 0x48], 0
jne 0x30077384
test byte [0x3022b750], 8
je 0x30077384
push 0x43
jmp 0x30077386
push 0x41
pop eax
push eax
call fcn.3007896b
cmp dword [ebp - 0x48], 0
jne 0x300773a7
push 0x11
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
call fcn.300517f1
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [ebp - 0x40], 0
jne 0x300774ad
mov eax, dword [0x302ae81c]
mov edi, eax
mov eax, dword [eax + 0x50]
test eax, eax
je 0x300773d6
push eax
call dword [sym.imp.MSO.dll_Ordinal_2795]
mov dword [edi + 0x4c], eax
push 0
push dword [edi + 0x4c]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, dword [0x302ae81c]
lea esi, [ebx + 0x1c]
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
mov eax, dword [eax + 0x50]
test eax, eax
je 0x30077403
push eax
call dword [sym.imp.MSO.dll_Ordinal_2795]
mov dword [esi + 0x4c], eax
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [esi + 0x4c]
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov eax, dword [0x302ae81c]
mov esi, eax
mov eax, dword [eax + 0x50]
test eax, eax
je 0x30077430
push eax
call dword [sym.imp.MSO.dll_Ordinal_2795]
mov dword [esi + 0x4c], eax
xor eax, eax
push eax
push eax
push eax
lea ecx, [ebp - 0x70]
push ecx
push 6
push eax
push eax
push dword [esi + 0x4c]
call fcn.300805d8
lea esi, [ebx + 0x1c]
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc dword [ebp - 0x58]
test dword [ebx + 8], 0x20000000
je 0x30077487
test byte [0x3022cf84], 2
lea esi, [ebp - 0x60]
lea edi, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x3007747f
lea eax, [ebp - 0x9c]
push eax
push dword [ebx]
call fcn.301414fd
lea eax, [ebp - 0x9c]
jmp 0x3007748a
lea eax, [ebp - 0x60]
push eax
push dword [0x302ae7e8]
push ebx
call fcn.30071b0c
push dword [0x302ae7e8]
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
lea eax, [ebp - 0x3c]
push eax
push ebx
call fcn.3006f9bf
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_EndPaint]
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_ShowCaret]
cmp dword [ebp - 0x48], 0
jne 0x300774dc
lea eax, [ebp - 0x74]
push eax
call fcn.300517f1
xor esi, esi
jmp 0x30077579
push ebx
call fcn.30067b17
jmp 0x30077934
push dword [ebx]
call fcn.3005131c
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
call dword [sym.imp.USER32.dll_HideCaret]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x302ae81c]
mov eax, dword [eax + 0x1c]
mov edi, dword [sym.imp.MSO.dll_Ordinal_497]
mov dword [ebp - 0x88], eax
call edi
test eax, eax
je 0x30077563
call edi
push eax
call dword [sym.imp.MSO.dll_Ordinal_114]
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
cmp esi, eax
jne 0x30077563
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x3007755a
test byte [0x3022b750], 8
je 0x3007755a
push 0x43
jmp 0x3007755c
push 0x41
pop eax
push eax
call fcn.3007896b
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.30072a6e
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_ShowCaret]
xor esi, esi
inc esi
lea eax, [ebp - 0x88]
push eax
call fcn.300518d4
push dword [ebp - 0x4c]
call fcn.3005131c
mov eax, esi
jmp 0x30077934
mov eax, 0x10e
cmp esi, eax
ja 0x30077bed
je 0x30077b64
add eax, 0xffffffaf
cmp esi, eax
ja 0x30077997
je 0x3007805b
mov eax, 0xb0
cmp esi, eax
ja 0x30077908
je 0x300778fd
mov eax, esi
sub eax, 0x30
je 0x300777e1
sub eax, 0x20
je 0x300777c1
dec eax
je 0x300776d0
sub eax, 0x30
je 0x300775fe
sub eax, 6
jne 0x30077fac
mov eax, 0x89
jmp 0x30077934
push dword [ebp - 0x4c]
mov esi, dword [ebp - 0x50]
push dword [ebp - 0x48]
push 0x81
push esi
call fcn.30106662
test eax, eax
jne 0x3007761d
xor eax, eax
jmp 0x30077934
lea eax, [ebp - 0x70]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xfffffffffffffff0
push esi
mov dword [ebp - 0x68], 0x3fffffff
call edi
push 0xa4
mov edi, eax
call dword [sym.imp.MSO.dll_Ordinal_815]
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x30077616
push eax
push eax
push eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x302ade50
push ebx
call fcn.300624f8
mov eax, edi
shr eax, 0x15
and eax, 1
push eax
shr edi, 2
and edi, 1
push edi
lea eax, [ebp - 0x70]
push eax
push eax
push ebx
push esi
call fcn.30072f59
mov edi, eax
test edi, edi
jne 0x3007768a
push ebx
call dword [sym.imp.MSO.dll_Ordinal_652]
jmp 0x30077616
mov eax, dword [edi + 8]
test eax, 0x20000000
je 0x3007769c
and eax, 0xfbffffff
mov dword [edi + 8], eax
or dword [edi + 8], 0x400000
call fcn.3007ca02
push ebx
call fcn.3005131c
push 0x41
call fcn.3007896b
push 0x40
call fcn.3007894f
call fcn.3007ca2e
push edi
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x30077931
push dword [ebp - 0x4c]
call dword [sym.imp.MSO.dll_Ordinal_7356]
test dword [ebx + 8], 0x20000000
je 0x300776f0
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 0x51
push ebx
call fcn.30141d37
cmp byte [0x30225c9d], 0
je 0x30077232
mov eax, dword [0x3022ca38]
test eax, eax
je 0x30077710
cmp dword [eax], 0
je 0x30077710
xor edi, edi
inc edi
jmp 0x30077712
xor edi, edi
cmp byte [0x30225c90], 0
mov ebx, dword [ebp - 0x4c]
mov cl, byte [ebp - 0x48]
movsx eax, bx
mov byte [0x30225c24], cl
mov dword [0x30225c28], eax
je 0x30077765
xor eax, eax
cmp dword [0x30225c8c], eax
je 0x30077740
mov eax, 0x80
jmp 0x3007777a
cmp dword [0x30225c88], eax
je 0x3007774f
mov eax, 0x81
jmp 0x3007777a
xor edx, edx
cmp dword [0x30225c84], eax
setne dl
lea edx, [edx + edx + 0x86]
mov eax, edx
jmp 0x3007777a
test byte [0x3022cf88], 1
mov eax, 0xde
jne 0x3007777a
movzx eax, byte [0x302ae936]
movzx ecx, cl
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [0x30225c78], 0
mov dword [0x30225c20], ecx
je 0x300777a1
test edi, edi
jne 0x300777a5
push ebx
call fcn.3007fcf6
test eax, eax
jne 0x300777b1
test edi, edi
je 0x300777b7
mov eax, ebx
and ax, 0x3ff
cmp ax, 4
jne 0x300777b7
mov dword [0x3022ca2c], ebx
call fcn.301074b5
jmp 0x30077232
cmp byte [0x30225c9d], 0
je 0x30077232
call fcn.301065f8
push eax
push dword [ebp - 0x50]
call fcn.30106772
jmp 0x30077232
cmp dword [ebp - 0x48], 0
je 0x30077931
push 1
push 0xffffffffffffffff
push 0
push dword [ebp - 0x48]
call fcn.300525e4
test eax, eax
je 0x30077931
push 0x7a
push 0x61
push eax
push ebx
mov dword [ebx + 0x98], eax
call fcn.30071fc5
lea eax, [ebp - 0x70]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, eax
lea eax, [ebp - 0x70]
push eax
push esi
call edi
lea eax, [ebp - 0x68]
push eax
push esi
call edi
test dword [ebx + 8], 0x20000
mov ecx, dword [ebx + 0x7c]
mov esi, ecx
je 0x3007785c
mov eax, dword [ebp - 0x64]
sub eax, ecx
sub eax, dword [ebp - 0x6c]
jmp 0x30077858
add esi, ecx
cmp esi, eax
jl 0x30077856
push 0xfffffffffffffff0
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x800000
je 0x300778cc
push dword [ebx]
mov word [ebp - 0x78], 0x78
call fcn.3005131c
mov dword [ebp - 0x4c], eax
mov eax, dword [0x302ae81c]
mov edi, eax
mov eax, dword [eax + 0x50]
test eax, eax
je 0x30077896
push eax
call dword [sym.imp.MSO.dll_Ordinal_2795]
mov dword [edi + 0x4c], eax
lea eax, [ebp - 0x74]
push eax
push 0
push 1
lea eax, [ebp - 0x78]
push eax
push dword [edi + 0x4c]
call fcn.3005e65a
push dword [ebp - 0x4c]
call fcn.3005131c
mov eax, dword [ebp - 0x74]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, eax
cmp eax, ecx
je 0x300778ca
dec ecx
add esi, ecx
mov eax, dword [ebp - 0x6c]
lea ecx, [eax + esi]
push 4
mov dword [ebp - 0x64], ecx
mov ecx, dword [ebp - 0x68]
sub ecx, dword [ebp - 0x70]
push esi
push ecx
push eax
push dword [ebp - 0x70]
xor esi, esi
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
push esi
push 5
push dword [ebx + 4]
call fcn.30076f87
jmp 0x30077931
mov eax, dword [ebx + 0x68]
shl eax, 0x10
or eax, dword [ebx + 0x64]
jmp 0x30077934
mov eax, esi
sub eax, 0xb1
je 0x30077964
sub eax, 7
je 0x3007795c
dec eax
je 0x3007794e
dec eax
je 0x30077945
dec eax
dec eax
jne 0x30077fac
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push esi
push ebx
call fcn.30076d3f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3020156b
leave
ret 0x10
movzx eax, byte [ebx + 0xd0]
jmp 0x30077934
push dword [ebp - 0x48]
push ebx
call fcn.30068d94
jmp 0x30077232
push ebx
call fcn.30068d81
jmp 0x30077934
mov edi, 0x7fff
cmp dword [ebp - 0x4c], edi
je 0x30077984
cmp dword [ebp - 0x48], edi
je 0x30077984
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push ebx
call fcn.3006b9b7
jmp 0x30077616
push 2
push 0xfffffffffffffffe
push edi
push edi
push 0
push ebx
call fcn.3006927f
jmp 0x30077616
mov edi, pe_nt_image_headers32
cmp esi, edi
ja 0x30077a05
je 0x30077a80
mov eax, esi
sub eax, 0xc2
je 0x300779e5
sub eax, 3
je 0x300779da
dec eax
je 0x300779cf
dec eax
je 0x30077f2d
sub eax, 0xe
jne 0x30077fac
mov eax, dword [ebx + 0x4c]
jmp 0x30077934
mov eax, dword [ebx + 0xb4]
jmp 0x30077934
mov eax, dword [ebp - 0x48]
mov dword [ebx + 0x4c], eax
jmp 0x30077232
push ebx
call fcn.30067b24
push dword [ebp - 0x4c]
call dword [sym.imp.MSO.dll_Ordinal_295]
push 0
push eax
push dword [ebp - 0x4c]
push ebx
call fcn.30073362
jmp 0x30077934
mov eax, esi
sub eax, 0x102
je 0x30077a94
dec eax
dec eax
je 0x30077a80
dec eax
dec eax
je 0x30077a94
sub eax, 7
jne 0x30077fac
cmp byte [0x30225c9d], 0
je 0x30077232
call fcn.30079beb
push dword [0x30225c28]
call fcn.30106282
mov eax, dword [0x3022ca34]
or eax, 4
cmp byte [0x30225c9d], 0
mov dword [0x3022ca34], eax
je 0x30077a61
test eax, 0x80000
jne 0x30077616
and eax, 0xe00
cmp eax, 0x600
jne 0x30077232
test byte [ebx + 0xa], 1
jne 0x30077232
jmp 0x30077616
call fcn.300605ef
push eax
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x4c]
shl eax, 0x10
jmp 0x30077b52
push 0x6e
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x30077ac6
call fcn.300605ef
test ax, 0x400
je 0x30077ac6
movzx eax, word [0x302ae118]
cmp dword [ebp - 0x48], eax
je 0x30077232
cmp dword [ebp - 0x48], 0x2e
je 0x30077232
cmp byte [0x30225c9d], 0
je 0x30077b39
call fcn.30079beb
push dword [0x30225c28]
call fcn.30106282
cmp byte [0x30225c9d], 0
je 0x30077b02
test dword [0x3022ca34], 0x100000
je 0x30077b02
test word [ebp - 0x48], 0xff00
je 0x30077b02
movzx esi, word [ebp - 0x48]
jmp 0x30077b12
push dword [ebp - 0x50]
push 1
push dword [ebp - 0x48]
call fcn.3005fe25
movzx esi, ax
call fcn.300605ef
push eax
push dword [ebp - 0x4c]
movzx eax, si
push eax
push edi
push ebx
call fcn.30070178
test eax, eax
je 0x3007722f
push ebx
call fcn.3007699f
jmp 0x30077616
call fcn.300605ef
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 1
push dword [ebp - 0x48]
call fcn.3005fe25
movzx eax, ax
push eax
push edi
push ebx
call fcn.30070178
test eax, eax
je 0x30077232
jmp 0x30077b2e
cmp byte [0x30225c9d], 0
je 0x30077232
cmp byte [0x30225c9e], 0
je 0x30077232
test dword [0x3022ca34], 0x80000
jne 0x30077232
cmp dword [0x3022ca4c], 0
mov edi, 0x200
jne 0x30077bc3
call fcn.301066a9
shl eax, 9
xor eax, dword [0x3022ca30]
and eax, edi
xor dword [0x3022ca30], eax
mov eax, dword [0x3022ca30]
shr eax, 9
and eax, 1
je 0x30077232
test dword [0x3022ca30], edi
je 0x30077232
push 0x3022c79c
call dword [sym.imp.MSO.dll_Ordinal_1681]
and dword [0x3022c798], 0
and dword [0x3022c78c], 0
jmp 0x30077232
mov eax, 0x300
cmp esi, eax
ja 0x30077f06
je 0x30077efb
mov eax, 0x201
cmp esi, eax
ja 0x30077dd2
je 0x30077e45
mov eax, esi
sub eax, 0x10f
je 0x30077d26
sub eax, 6
je 0x30077d0f
sub eax, 0xb9
je 0x30077c95
dec eax
je 0x30077c8d
sub eax, 0x31
jne 0x30077fac
cmp byte [0x30225c9d], 0
je 0x30077c5e
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push 0x200
push ebx
call fcn.30106df4
test eax, eax
jne 0x30077931
cmp dword [0x302ae7b8], 0
je 0x30077232
movsx eax, word [ebp - 0x4c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x4c]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x7c]
push eax
push ebx
call fcn.30076e80
jmp 0x30077eaf
mov eax, dword [ebx + 0x48]
jmp 0x30077934
push ebx
call fcn.30067b24
push 0
push ebx
call fcn.3006f900
push dword [ebx + 0x48]
mov esi, eax
call dword [sym.imp.MSO.dll_Ordinal_652]
mov edi, dword [ebp - 0x4c]
push edi
call dword [sym.imp.MSO.dll_Ordinal_295]
mov dword [ebx + 0x48], edi
mov edi, 0x7fff
push edi
mov dword [ebx + 0x40], eax
push 0
inc eax
push ebx
mov dword [ebx + 0x44], eax
call fcn.3006fc7e
mov ecx, dword [ebx + 0x20]
sub ecx, dword [ebx + 0x10]
lea eax, [ebx + 0xc]
push ecx
mov ecx, dword [ebx + 0x1c]
sub ecx, dword [eax]
push ecx
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push ebx
call fcn.3007699f
push edi
push 0
push ebx
call fcn.3006b9b7
neg esi
sbb esi, esi
and esi, 2
push esi
push ebx
call fcn.3006f900
push ebx
call fcn.30071920
jmp 0x30077931
movsx eax, word [ebp - 0x46]
push eax
movsx eax, word [ebp - 0x48]
push eax
push dword [ebp - 0x50]
call fcn.30076ef2
jmp 0x30077616
cmp byte [0x30225c9d], 0
je 0x30077232
cmp byte [0x30225c9e], 0
je 0x30077dc4
mov eax, dword [0x3022ca34]
test eax, 0x80000
jne 0x30077dc4
cmp dword [0x3022ca4c], 0
mov edi, 0x200
jne 0x30077d82
call fcn.301066a9
shl eax, 9
xor eax, dword [0x3022ca30]
and eax, edi
xor dword [0x3022ca30], eax
mov eax, dword [0x3022ca30]
shr eax, 9
and eax, 1
je 0x30077dc4
mov eax, dword [0x3022ca34]
test dword [0x3022ca30], edi
je 0x30077dc4
and eax, 0xe00
cmp eax, 0x600
jne 0x30077dc4
mov edi, 0x3022c79c
push edi
call dword [sym.imp.MSO.dll_Ordinal_1681]
push 0x6c
push 0
push 0x3022c788
call sub.MSVCR80.dll_memset
mov eax, dword [ebp - 0x4c]
add esp, 0xc
push edi
and eax, 0x38
push eax
push dword [ebx + 4]
call dword [sym.imp.MSO.dll_Ordinal_1804]
push dword [ebp - 0x4c]
push ebx
call fcn.30076a90
jmp 0x30077eaf
mov eax, 0x202
cmp esi, eax
je 0x30077ec8
inc eax
cmp esi, eax
je 0x30077e45
jbe 0x30077fac
cmp esi, 0x206
jbe 0x30077e1e
cmp esi, 0x288
jne 0x30077fac
cmp byte [0x30225c9d], 0
je 0x30077232
push 0
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push ebx
call fcn.30107408
jmp 0x30077934
cmp byte [0x30225c9d], 0
je 0x30077232
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push esi
push ebx
call fcn.30106df4
test eax, eax
je 0x30077232
jmp 0x30077931
cmp byte [0x30225c9d], 0
je 0x30077e85
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push esi
push ebx
call fcn.30106df4
test eax, eax
jne 0x30077931
cmp byte [0x30225c9d], al
je 0x30077e85
test dword [0x3022ca34], 0x40000
je 0x30077e85
call fcn.301065f8
push eax
push dword [ebp - 0x50]
call fcn.30106772
movsx eax, word [ebp - 0x4c]
push dword [ebp - 0x48]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x4c]
shr eax, 0x10
cmp dword [0x302ae7b8], 0
movsx eax, ax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x7c]
je 0x30077ebc
push eax
push esi
push ebx
call fcn.3007655a
test eax, eax
je 0x30077232
jmp 0x30077616
push 0
push eax
push esi
push ebx
call fcn.3006bee7
jmp 0x30077eaf
cmp byte [0x30225c9d], 0
je 0x30077ee6
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push eax
push ebx
call fcn.30106df4
test eax, eax
jne 0x30077931
cmp dword [0x302ae7b8], 0
je 0x30077232
push ebx
call fcn.30076666
jmp 0x30077eaf
push ebx
call fcn.3006c536
jmp 0x30077934
mov eax, 0x522
cmp esi, eax
ja 0x30077f86
je 0x30077f59
mov eax, esi
sub eax, 0x301
je 0x30077f4e
dec eax
je 0x30077f43
dec eax
je 0x30077f38
dec eax
je 0x30077f2d
sub eax, 0x21d
jmp 0x3007791e
push ebx
call fcn.3006ff9a
jmp 0x30077934
push ebx
call fcn.3006c1aa
jmp 0x30077934
push ebx
call fcn.3006bf16
jmp 0x30077934
push ebx
call fcn.300690fa
jmp 0x30077934
mov eax, dword [ebp - 0x48]
test eax, eax
jbe 0x30077616
dec eax
push eax
push dword [ebx + 0x40]
call fcn.3007f8d4
push dword [ebp - 0x48]
mov edi, eax
push dword [ebp - 0x4c]
push edi
push dword [ebx + 0x48]
call fcn.3007e07e
mov eax, edi
jmp 0x30077934
mov eax, esi
sub eax, 0x523
je 0x30077924
dec eax
je 0x3007805b
sub eax, 0x7ae6
je 0x3007804f
dec eax
je 0x30078043
cmp byte [0x30225c9d], 0
je 0x30077232
test esi, esi
je 0x30077232
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x30002910
call edi
cmp esi, eax
jne 0x30077fe3
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push ebx
call fcn.3010723f
jmp 0x30077934
push 0x30002920
call edi
cmp esi, eax
jne 0x30077fff
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push ebx
call fcn.301065a6
jmp 0x30077934
cmp byte [0x30225c9d], 0
je 0x30078018
test dword [0x3022ca34], 0x80000
jne 0x30077232
push 0x30002934
call edi
cmp esi, eax
jne 0x30077232
cmp dword [ebp - 0x48], 1
jne 0x30077232
push 0
push dword [ebp - 0x4c]
push 6
push ebx
call fcn.301073ee
jmp 0x30077934
movzx eax, byte [ebx + 0xa]
and eax, 1
jmp 0x30077934
or dword [ebx + 8], 0x10000
jmp 0x30077232
mov eax, dword [ebx + 0xd8]
test eax, eax
je 0x3007806b
push eax
call fcn.3007ad95
mov eax, dword [ebx + 0x40]
and dword [ebx + 0xd8], 0
lea eax, [eax + eax + 2]
push eax
call fcn.3007ad31
test eax, eax
mov dword [ebx + 0xd8], eax
je 0x30077616
mov ecx, dword [ebx + 0x40]
lea edx, [ecx + 1]
push edx
push dword [eax]
push ecx
push dword [ebx + 0x48]
call fcn.3007e07e
mov eax, dword [ebx + 0xd8]
jmp 0x30077934