Function at 0x40e850
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
push esi
push edi
je 0x40f9e3
mov edi, dword [ebp + 0xc]
mov esi, dword [0x4a8978]
mov dword [ebp - 0x2c], esi
test edi, edi
jne 0x40e89b
push 7
push str.Blind
push ebx
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40e89b
add ebx, 7
mov byte [0x4ab1e1], 1
mov dword [ebp + 8], ebx
jmp 0x40e8a6
mov byte [0x4ab1e1], 0
test edi, edi
jne 0x40e8ca
push 6
push 0x49c238
push ebx
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40e8ca
mov dword [ebp + 0xc], 2
mov edi, dword [ebp + 0xc]
add ebx, 6
mov dword [ebp + 8], ebx
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x64]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], ecx
cmp eax, 1
je 0x40e8e3
cmp eax, 3
jne 0x40e94b
cmp dword [0x4ada58], 0
je 0x40e921
call fcn.00408af0
test al, al
jne 0x40e91e
test edi, edi
jne 0x40e915
call fcn.00408b60
test al, al
je 0x40e915
push str.Click
mov eax, ebx
call fcn.00474400
add esp, 4
test eax, eax
jne 0x40e91e
mov dword [ebp + 0x10], 1
jmp 0x40e94b
mov eax, dword [ebp + 0x10]
cmp eax, 3
jne 0x40e92f
mov dword [ebp + 0x10], 2
jmp 0x40e94b
xor eax, eax
mov dword [ebp + 0x10], eax
cmp dword [esi + 0x5c], eax
jge 0x40e941
cmp dword [esi + 0x64], eax
jge 0x40e941
or eax, 0xffffffff
mov dword [esi + 0x64], eax
mov dword [esi + 0x5c], 0xffffffff
xor ebx, ebx
mov byte [ebp - 0xf], 0
cmp dword [ebp + 0x14], ebx
je 0x40e9a6
mov edx, dword [ebp + 0x14]
push ebx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
mov dword [ebp - 0x4c], edi
test edi, edi
je 0x40ead7
cmp edi, dword [0x4ad250]
je 0x40ead7
mov esi, dword [ebp + 0x14]
call fcn.00478e50
test al, al
jne 0x40ead4
mov eax, dword [0x4ad250]
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [ebp - 0xf]
mov ebx, edi
jmp 0x40ead4
test byte [0x4ad865], 0xc0
je 0x40ea8f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ad85c]
cmp eax, 0x32
jae 0x40ea8f
cmp dword [ebp + 0x10], 2
je 0x40ea8f
cmp byte [0x4ab1e1], bl
jne 0x40ea8f
cmp edi, 2
je 0x40ea8f
cmp byte [0x4ada46], bl
je 0x40ea8f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4ad250]
jne 0x40ea8f
mov eax, dword [ebp + 8]
test edi, edi
mov edi, 0x49c4e4
je 0x40ea64
call fcn.00409270
test eax, eax
setne al
test al, al
je 0x40ea8f
mov ebx, 1
xor edi, edi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
jne 0x40ea48
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x40ea8f
push ebx
push 0x8000012f
mov dword [0x4a88ec], edi
call fcn.004013c0
add esp, 8
mov dword [0x4a88ec], ebx
jmp 0x40ea26
call fcn.00409270
test eax, eax
je 0x40ea8f
inc eax
mov edi, 0x49c4e8
call fcn.00409270
test eax, eax
je 0x40ea1f
cmp byte [eax], 0x7b
je 0x40ea1f
mov edi, 0x49c4e4
call fcn.00409270
test eax, eax
jne 0x40ea6d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebx, ebx
test eax, eax
je 0x40ead4
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebx
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0xac]
push eax
push ebx
mov dword [ebp - 0xac], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x40ead4
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x40ead4
push 0
push eax
call esi
mov ebx, eax
mov esi, dword [ebp - 0x2c]
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x4ab208], eax
push eax
xor eax, eax
call fcn.00412f30
add esp, 4
push 1
mov dword [0x4ab204], eax
call fcn.004129c0
mov bl, al
and byte [0x4acb26], bl
add esp, 4
cmp dword [0x4ac3fc], 0
mov byte [ebp - 8], bl
je 0x40eb2d
mov cl, byte [0x4ac2c9]
mov dl, byte [0x4ac2cb]
mov al, cl
not cl
and al, dl
and cl, dl
mov byte [ebp - 2], dl
mov byte [ebp - 9], cl
jmp 0x40eb58
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ad85c]
cmp eax, dword [0x4a88e4]
jae 0x40eb4d
mov al, byte [0x4ad865]
and al, bl
mov byte [ebp - 2], al
jmp 0x40eb54
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 9], 0
mov cl, byte [0x4acb13]
not al
and al, bl
and cl, al
mov al, byte [0x4ab1e1]
mov byte [0x4acb13], cl
test al, al
je 0x40eb7f
not cl
and cl, bl
mov byte [ebp - 3], cl
mov byte [ebp - 7], bl
jmp 0x40eb86
mov byte [ebp - 3], 0
mov byte [ebp - 7], cl
cmp byte [esi + 0xd3], 0
je 0x40ebad
test al, al
jne 0x40ebad
cmp dword [ebp + 0xc], 2
je 0x40ebad
push 2
mov bl, 0x14
call fcn.00412200
mov bl, byte [ebp - 8]
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x40ebb4
mov dword [ebp - 0x48], 0
mov esi, dword [ebp + 0x10]
mov dword [0x4acb4c], esi
test esi, esi
je 0x40ec26
cmp esi, 1
jne 0x40ebd7
mov eax, 0x36b0
mov dword [0x4ab1f8], 0x1f4
jmp 0x40ebe6
mov eax, 0x2ee0
mov dword [0x4ab1f8], 0x5dc
call fcn.00490ae0
mov eax, esp
mov dword [0x4ab200], eax
mov eax, SysReAllocString
mov byte [0x4ab1e9], bl
mov dword [0x4ab1ec], eax
mov dword [0x4ab1f0], eax
mov byte [0x4ab1e8], 0
mov dword [0x4ab1fc], 0
mov byte [0x4ab1e3], 0
mov byte [0x4ab1e2], 1
mov eax, dword [0x4a8988]
mov cl, byte [0x4acadd]
mov byte [ebp - 0x1e], cl
cmp eax, 8
je 0x40ec3e
cmp eax, 0xa
jne 0x40ec79
test esi, esi
jne 0x40ec79
cmp dword [ebp + 0x14], esi
jne 0x40ec79
test byte [0x4ae314], 1
mov byte [ebp - 8], 1
jne 0x40ec7f
or dword [0x4ae314], 1
push str.BlockInput
push str.user32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4ae310], eax
jmp 0x40ec84
mov byte [ebp - 8], 0
jmp 0x40ec93
mov eax, dword [0x4ae310]
test eax, eax
je 0x40ec8c
push 1
call eax
mov byte [0x4acadd], 1
mov edx, dword [ebp + 8]
xor bl, bl
mov byte [ebp - 1], bl
cmp byte [edx], bl
je 0x40f645
jmp 0x40ecb0
cmp dword [0x4acb4c], 0
mov esi, dword [ebp + 8]
mov byte [ebp - 0xa], 0
jne 0x40ed19
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x4ad89c]
mov ecx, dword [0x4a8978]
cmp eax, dword [ecx + 0xb8]
jbe 0x40ed19
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40ed12
push 1
push 0xffffffffffffffff
mov dword [0x4a88ec], 0
call fcn.004013c0
add esp, 8
mov dword [0x4a88ec], 1
call edi
mov dword [0x4ad89c], eax
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x40f55a
movsx eax, byte [esi]
push eax
push str._
call fcn.004880b1
add esp, 8
test eax, eax
je 0x40f5af
movsx eax, byte [esi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x40ed53.34
movzx eax, byte [eax + 0x40fa0c]
jmp dword [eax*4 + 0x40f9f0]
test byte [ebp - 7], 3
jne case.0x40ed53.34
or bl, 1
jmp 0x40f629
test byte [ebp - 7], 0x30
jne case.0x40ed53.34
or bl, 0x10
jmp 0x40f629
test byte [ebp - 7], 0xc
jne case.0x40ed53.34
or bl, 4
jmp 0x40f629
test byte [ebp - 7], 0xc0
jne case.0x40ed53.34
or bl, 0x40
jmp 0x40f629
mov esi, dword [ebp + 8]
inc esi
push 0x7d
push esi
call fcn.004880b1
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
test edi, edi
je case.0x40ed53.34
mov edi, edi
mov al, byte [esi]
cmp al, 0x20
je 0x40edca
cmp al, 9
jne 0x40edcd
inc esi
jmp 0x40edc0
mov eax, edi
sub eax, esi
mov dword [ebp - 0x14], esi
mov dword [ebp + 8], esi
mov dword [ebp - 0x28], eax
jne 0x40ee57
mov al, byte [edi + 1]
inc edi
cmp al, 0x7d
jne 0x40edf0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], 1
jmp 0x40ee54
cmp al, 0x20
je 0x40ee00
cmp al, 9
jne 0x40f54f
lea esp, [esp]
mov al, byte [edi]
cmp al, 0x20
je 0x40ee0a
cmp al, 9
jne 0x40ee0d
inc edi
jmp 0x40ee00
push 4
push str.Down
push edi
call fcn.00487b40
add esp, 0xc
test eax, eax
je 0x40ee39
push 2
push 0x49ab38
push edi
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40f54f
push 0x7d
push edi
call fcn.004880b1
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je case.0x40ed53.34
sub eax, esi
mov dword [ebp - 0x28], eax
mov edi, dword [ebp - 0x1c]
push 5
push 0x49b964
push esi
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40eefd
mov byte [edi], al
lea eax, [esi + 5]
mov cl, byte [eax]
cmp cl, 0x20
je 0x40ee80
cmp cl, 9
jne 0x40ee83
inc eax
jmp 0x40ee74
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0xe]
push edx
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.00410b70
mov ecx, dword [ebp - 0x24]
add esp, 0x18
mov byte [edi], 0x7d
cmp ecx, 1
jge 0x40eeda
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0xcf]
mov eax, dword [ebp - 0x34]
push eax
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x3c]
call fcn.004117e0
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x40f627
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
push edx
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp + 0x14]
push edx
mov edx, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 7]
push 0
push edx
push eax
push 0
mov al, bl
jmp 0x40f543
push 3
push 0x49c4f4
push esi
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40ef23
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0xc], 1
mov dword [ebp + 8], eax
jmp 0x40f627
push 4
push str.Text
push esi
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40ef67
add esi, 4
lea ebx, [ebx]
mov al, byte [esi]
cmp al, 0x20
je 0x40ef4a
cmp al, 9
jne 0x40ef4d
inc esi
jmp 0x40ef40
cmp esi, edi
jne 0x40f54f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0xc], 2
mov dword [ebp + 8], eax
jmp 0x40f627
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
mov edi, 0x49c11c
mov eax, esi
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x24], 1
mov byte [ecx], 0
call fcn.00409270
mov ebx, eax
test ebx, ebx
je 0x40f033
mov dl, byte [ebx]
sub eax, esi
mov byte [ebp - 0x1d], dl
mov byte [ebx], 0
mov dword [ebp + 8], eax
lea edi, [ebx + 1]
mov al, byte [edi]
cmp al, 0x20
je 0x40efb1
cmp al, 9
jne 0x40efb4
inc edi
jmp 0x40efa7
mov eax, dword [ebp - 0x1c]
sub eax, edi
je 0x40f033
push 4
push str.Down
push edi
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40f00b
push 4
add edi, 4
push str.Temp
push edi
mov dword [ebp - 0x18], eax
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40efee
mov dword [ebp - 0x38], eax
jmp 0x40f033
xor ecx, ecx
cmp byte [edi], 0x52
sete cl
push ecx
call fcn.00488cd2
add esp, 4
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [ebp - 0x38], eax
jmp 0x40f033
push 0x49ab38
push edi
call fcn.004870c1
add esp, 8
test eax, eax
jne 0x40f026
mov dword [ebp - 0x18], 1
jmp 0x40f033
mov esi, edi
call fcn.0040e2c0
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4ab208]
lea edx, [ebp - 0xe]
push edx
lea ecx, [ebp - 1]
lea edi, [ebp - 0x30]
mov edx, esi
call fcn.00413460
add esp, 4
test ebx, ebx
je 0x40f055
mov al, byte [ebp - 0x1d]
mov byte [ebx], al
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, 1
mov byte [ecx], 0x7d
cmp edi, eax
jl 0x40f54f
mov bl, byte [ebp - 0xe]
test bl, bl
jne 0x40f499
cmp word [ebp - 0x30], 0
jne 0x40f499
cmp dword [ebp + 8], eax
jne 0x40f0e6
cmp dword [ebp - 0x18], eax
je 0x40f54f
cmp dword [ebp + 0x14], 0
je 0x40f0c3
test edi, edi
jle 0x40f54f
lea ecx, [ecx]
movsx edx, byte [esi]
mov eax, dword [ebp + 0x14]
push 0
push edx
push 0x102
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
dec edi
jne 0x40f0a0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x40f627
mov cl, byte [ebp - 1]
or cl, byte [ebp - 7]
movzx eax, byte [esi]
movzx edx, cl
push edx
push eax
mov eax, edi
call fcn.0040fea0
mov eax, dword [ebp - 0x1c]
add esp, 8
mov dword [ebp + 8], eax
jmp 0x40f627
cmp dword [ebp + 0x14], 0
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 7]
push ecx
lea edx, [ebp - 0x18]
sete bl
push edx
call fcn.00413510
add esp, 8
mov byte [ebp - 0xe], al
test al, al
je 0x40f30a
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x40f124
cmp dword [ebp - 0x18], edi
jne 0x40f11f
mov byte [ebp - 0xa], al
jmp 0x40f124
call fcn.0040e490
cmp dword [0x4acb4c], 0
je 0x40f137
mov al, byte [0x4ab1e9]
jmp 0x40f252
cmp dword [0x4ac3fc], 0
je 0x40f14a
mov al, byte [0x4ac2c9]
jmp 0x40f252
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov byte [ebp + 0xb], 0
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f169
mov byte [ebp + 0xb], 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x40f17e
or byte [ebp + 0xb], 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f193
or byte [ebp + 0xb], 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x40f1a8
or byte [ebp + 0xb], 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f1bd
or byte [ebp + 0xb], 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x40f1d2
or byte [ebp + 0xb], 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f1e4
or byte [ebp + 0xb], 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x40f1f6
or byte [ebp + 0xb], 0x80
cmp dword [0x4ac3fc], 0
je 0x40f24e
mov bl, byte [ebp + 0xb]
not bl
and bl, byte [0x4ac2c9]
je 0x40f24e
mov cl, byte [0x4ac2cb]
mov al, bl
not al
and byte [0x4ac2c9], al
and byte [0x4ac2ca], al
and cl, al
mov al, cl
mov byte [0x4ac2cb], cl
mov ecx, 0x4ac2f0
call fcn.00412af0
mov eax, dword [0x4ab1dc]
test eax, eax
je 0x40f24e
test byte [eax + 8], bl
je 0x40f24e
mov dword [0x4ab1dc], 0
movzx eax, byte [ebp + 0xb]
push 0
push 0
push edi
push eax
mov eax, dword [ebp - 7]
push eax
mov eax, 0xffc3d44d
call fcn.00412310
mov eax, dword [ebp - 0x24]
add esp, 0x14
test eax, eax
jle 0x40f54f
mov ebx, dword [ebp - 0xe]
mov edi, eax
lea esp, [esp]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
push 0xffc3d44d
push 1
push ecx
push 0
push ebx
push edx
call fcn.004103f0
add esp, 0x18
cmp dword [0x4acb4c], 0
jne 0x40f2fc
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4ad89c]
mov ecx, dword [0x4a8978]
cmp eax, dword [ecx + 0xb8]
jbe 0x40f2fc
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40f2f5
push 1
push 0xffffffffffffffff
mov dword [0x4a88ec], 0
call fcn.004013c0
add esp, 8
mov dword [0x4a88ec], 1
call esi
mov dword [0x4ad89c], eax
dec edi
jne 0x40f280
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x40f627
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp edi, 4
jbe 0x40f381
push 4
push str.ASC
push esi
call fcn.00487b40
mov ebx, dword [ebp + 0x14]
add esp, 0xc
test eax, eax
jne 0x40f384
test ebx, ebx
jne 0x40f384
lea eax, [esi + 3]
mov cl, byte [eax]
cmp cl, 0x20
je 0x40f33f
cmp cl, 9
jne 0x40f342
inc eax
jmp 0x40f333
call fcn.0040ffc0
cmp dword [0x4acb4c], 2
jne 0x40f368
mov eax, dword [0x4a8978]
mov esi, dword [eax + 0x60]
call fcn.00411f50
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x40f627
mov ecx, dword [0x4a8978]
mov esi, dword [ecx + 0x5c]
call fcn.00411f50
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x40f627
mov ebx, dword [ebp + 0x14]
cmp edi, 2
jbe 0x40f54f
push 2
push 0x49c508
push esi
call fcn.00487b40
add esp, 0xc
test eax, eax
jne 0x40f54f
push 0x10
push eax
add esi, 2
push esi
call fcn.00488b65
add esp, 0xc
cmp eax, 0x10000
jb 0x40f3e7
sub eax, 0x10000
mov edx, eax
shr edx, 0xa
and edx, 0x3ff
mov ecx, eax
sub edx, 0x2800
and ecx, 0x3ff
sub ecx, 0x2400
movzx edi, dx
movzx esi, cx
jmp 0x40f3ec
movzx edi, ax
xor esi, esi
test ebx, ebx
je 0x40f419
movzx edx, di
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push edx
push 0x102
push ebx
call edi
test si, si
je 0x40f45f
push 0
movzx eax, si
push eax
push 0x102
push ebx
call edi
jmp 0x40f45f
cmp dword [0x4acb4c], 2
je 0x40f444
movzx ebx, byte [ebp - 1]
or bl, byte [ebp - 7]
push ebx
call fcn.0040e510
add esp, 4
test si, si
je 0x40f45f
push ebx
mov edi, esi
call fcn.0040e510
add esp, 4
jmp 0x40f45f
push 0xa
lea ecx, [ebp - 0x5b]
push ecx
push eax
mov byte [ebp - 0x5c], 0x30
call fcn.00486d52
add esp, 0xc
lea eax, [ebp - 0x5c]
call fcn.0040ffc0
cmp dword [0x4acb4c], 2
jne 0x40f481
mov edx, dword [0x4a8978]
mov esi, dword [edx + 0x60]
call fcn.00411f50
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x40f627
mov eax, dword [0x4a8978]
mov esi, dword [eax + 0x5c]
call fcn.00411f50
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x40f627
mov esi, dword [ebp - 0x30]
xor ecx, ecx
mov edx, esi
mov al, bl
call fcn.00412bc0
mov byte [ebp - 0x40], al
test al, al
je 0x40f521
cmp dword [ebp + 0x14], 0
jne 0x40f521
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x40f4e1
mov ecx, dword [ebp - 0x38]
mov byte [ebp - 0xa], bl
cmp ecx, 1
jne 0x40f4d1
or byte [0x4acb13], al
or byte [ebp - 7], al
jmp 0x40f521
cmp ecx, 2
jne 0x40f4dc
or byte [0x4acb26], al
or byte [ebp - 7], al
jmp 0x40f521
cmp ecx, 1
jne 0x40f521
mov al, bl
call fcn.0040e490
mov al, byte [ebp - 0x40]
mov cl, byte [0x4acb13]
not al
and byte [0x4acb26], al
and byte [ebp - 3], al
and cl, al
mov byte [0x4acb13], cl
cmp bl, 0xa5
jne 0x40f51b
cmp dword [0x4ab204], 3
jne 0x40f51b
and byte [ebp - 3], 0xfe
or cl, byte [ebp - 3]
mov byte [ebp - 7], cl
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
push 0
push SysReAllocString
push SysReAllocString
push ecx
mov ecx, dword [ebp - 7]
push edx
push eax
mov al, byte [ebp - 1]
push ecx
push esi
mov ecx, edi
mov edx, dword [ebp - 0xe]
push edx
call fcn.0040fa90
add esp, 0x24
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x40f627
cmp edi, 2
jne 0x40f5af
movsx eax, byte [esi]
add eax, 0xfffffff8
cmp eax, 5
ja case.0x40f56a.11
jmp dword [eax*4 + 0x40fa6c]
cmp byte [esi + 1], 0xa
jne case.0x40f56a.10
inc esi
mov dword [ebp + 8], esi
mov byte [ebp - 0xe], 0xd
jmp 0x40f5e0
mov byte [ebp - 0xe], 8
jmp 0x40f5e0
mov byte [ebp - 0xe], 9
jmp 0x40f5e0
mov byte [ebp - 0xe], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x40f60f
movsx edx, byte [ecx]
push 0
push edx
push 0x102
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40f627
or bl, byte [ebp - 7]
je 0x40f5bc
test edi, edi
jne 0x40f5bc
mov al, 1
jmp 0x40f5be
xor al, al
mov ecx, dword [0x4ab208]
mov edx, dword [ebp + 8]
mov bl, byte [edx]
push eax
push ecx
lea edi, [ebp - 1]
call fcn.004133a0
mov bl, byte [ebp - 1]
add esp, 8
mov byte [ebp - 0xe], al
test al, al
je 0x40f591
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 7]
mov edx, dword [ebp - 0xe]
push 0
push SysReAllocString
push SysReAllocString
push eax
push 0
push 2
push ecx
push 0
push edx
mov ecx, 1
mov al, bl
call fcn.0040fa90
add esp, 0x24
jmp 0x40f627
or bl, byte [ebp - 7]
movzx edx, byte [ecx]
movzx eax, bl
push eax
push edx
mov eax, 1
call fcn.0040fea0
add esp, 8
xor bl, bl
mov byte [ebp - 1], bl
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0xa]
inc eax
cmp byte [eax], 0
mov dword [ebp + 8], eax
mov byte [0x4acb12], cl
jne 0x40ecb0
mov eax, dword [0x4acb4c]
test eax, eax
je 0x40f6fc
cmp byte [0x4ab1e3], 0
mov dword [ebp + 8], 0xffffffff
jne 0x40f6c1
cmp dword [0x4ab1fc], 0
jbe 0x40f6c1
cmp byte [0x4ab1e1], 0
je 0x40f678
xor eax, eax
jmp 0x40f684
movzx eax, byte [ebp - 9]
movzx edx, byte [ebp - 2]
not eax
and eax, edx
or al, byte [0x4acb26]
push 1
or al, byte [ebp - 7]
push 1
mov byte [ebp - 0x14], al
movzx eax, byte [0x4ab1e9]
mov esi, dword [ebp - 0x14]
push 0
push eax
push esi
mov eax, 0xffc3d44d
call fcn.00412310
add esp, 0x14
lea ecx, [ebp + 8]
push esi
push ecx
call fcn.00411e00
mov eax, dword [0x4acb4c]
add esp, 8
dec eax
neg eax
sbb eax, eax
and eax, 0x3e8
add eax, 0x1f4
cmp dword [0x4ab1f8], eax
jbe 0x40f6e7
mov edx, dword [0x4ab200]
push edx
call fcn.004870d8
add esp, 4
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x4acb4c], edi
call fcn.00411f50
jmp 0x40f8a5
cmp dword [0x4ac3fc], 0
je 0x40f70d
mov cl, byte [0x4ac2cb]
jmp 0x40f731
cmp dword [0x4a88e4], 0
jl 0x40f72e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ad85c]
cmp eax, dword [0x4a88e4]
jb 0x40f72e
xor cl, cl
jmp 0x40f731
mov cl, byte [ebp - 2]
or cl, byte [0x4acb26]
cmp byte [0x4ab1e1], 0
je 0x40f759
mov dl, byte [ebp - 2]
mov al, cl
xor al, dl
mov bl, al
and bl, dl
not bl
and bl, byte [ebp - 7]
and al, cl
or bl, al
mov byte [ebp - 0x14], bl
jmp 0x40f766
mov al, byte [ebp - 9]
not al
and al, cl
or al, byte [ebp - 7]
mov byte [ebp - 0x14], al
cmp dword [0x4ac3fc], 0
je 0x40f779
mov al, byte [0x4ac2c9]
jmp 0x40f880
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov byte [ebp + 0xb], 0
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f798
mov byte [ebp + 0xb], 0x10
push 0xa1
call esi
mov edx, 0x8000
test dx, ax
je 0x40f7ad
or byte [ebp + 0xb], 0x20
push 0xa2
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f7c2
or byte [ebp + 0xb], 1
push 0xa3
call esi
mov edx, 0x8000
test dx, ax
je 0x40f7d7
or byte [ebp + 0xb], 2
push 0xa4
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f7ec
or byte [ebp + 0xb], 4
push 0xa5
call esi
mov edx, 0x8000
test dx, ax
je 0x40f801
or byte [ebp + 0xb], 8
push 0x5b
call esi
mov ecx, 0x8000
test cx, ax
je 0x40f813
or byte [ebp + 0xb], 0x40
push 0x5c
call esi
mov edx, 0x8000
test dx, ax
je 0x40f825
or byte [ebp + 0xb], 0x80
cmp dword [0x4ac3fc], 0
je 0x40f87d
mov bl, byte [ebp + 0xb]
not bl
and bl, byte [0x4ac2c9]
je 0x40f87d
mov cl, byte [0x4ac2cb]
mov al, bl
not al
and byte [0x4ac2c9], al
and byte [0x4ac2ca], al
and cl, al
mov al, cl
mov byte [0x4ac2cb], cl
mov ecx, 0x4ac2f0
call fcn.00412af0
mov eax, dword [0x4ab1dc]
test eax, eax
je 0x40f87d
test byte [eax + 8], bl
je 0x40f87d
mov dword [0x4ab1dc], 0
mov al, byte [ebp + 0xb]
or al, byte [0x4ac2ec]
mov ecx, dword [ebp + 0x14]
push 1
movzx edx, al
mov eax, dword [ebp - 0x14]
push 1
push ecx
push edx
push eax
mov eax, 0xffc3d44d
call fcn.00412310
add esp, 0x14
xor edi, edi
cmp dword [0x4ac3fc], edi
je 0x40f8c5
mov al, byte [0x4ac2ca]
mov cl, al
xor cl, byte [0x4ac2c9]
and cl, al
not cl
and al, cl
mov byte [0x4ac2ca], al
mov ebx, 1
cmp dword [ebp - 0x48], ebx
jne 0x40f93f
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test bl, al
jne 0x40f93f
push 0x14
call esi
mov edx, 0x8000
test dx, ax
je 0x40f8fe
push 0xffc3d44d
push edi
push edi
push edi
push 0x14
push ebx
call fcn.004103f0
add esp, 0x18
push 0xffc3d44d
push edi
push edi
push edi
push 0x14
push 2
call fcn.004103f0
add esp, 0x18
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4ad250]
jne 0x40f93f
push ebx
push 0xffffffffffffffff
mov dword [0x4a88ec], edi
call fcn.004013c0
add esp, 8
mov dword [0x4a88ec], ebx
cmp byte [ebp - 0xf], 0
je 0x40f957
mov eax, dword [ebp - 0x4c]
mov ecx, dword [0x4ad250]
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp - 8], 0
je 0x40f9a2
cmp byte [ebp - 0x1e], 0
jne 0x40f9a2
test byte [0x4ae314], bl
jne 0x40f98f
or dword [0x4ae314], ebx
push str.BlockInput
push str.user32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4ae310], eax
jmp 0x40f994
mov eax, dword [0x4ae310]
cmp eax, edi
je 0x40f99b
push edi
call eax
mov byte [0x4acadd], 0
cmp dword [ebp + 0x10], ebx
jne 0x40f9d4
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4ad250]
jne 0x40f9d4
push ebx
push 0xffffffffffffffff
mov dword [0x4a88ec], edi
call fcn.004013c0
add esp, 8
mov dword [0x4a88ec], ebx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x5c], edx
mov dword [eax + 0x64], ecx
lea esp, [ebp - 0xb8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret