Function at 0x435c8e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x988
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x30], ebx
mov eax, dword [esi + 0x3c]
mov dword [esi + 0xd8], ebx
mov dword [ebp - 0x3c], ebx
cmp dword [eax + 0x2dc], ebx
jne 0x436980
cmp dword [esi + 0x1f8], ebx
push 1
pop edi
je 0x435cdb
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043fda1
test eax, eax
jne 0x436980
cmp dword [esi + 0x198], ebx
je 0x435dbb
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [esi + 0x1c]
call fcn.0042412e
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
je 0x435d0b
mov ecx, esi
call fcn.00438cf8
jmp 0x436980
mov eax, dword [ebp + 8]
cmp eax, 9
jne 0x435d72
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00438f31
lea eax, [esi + 0x134]
xor ecx, ecx
cmp dword [eax], ebx
sete cl
mov dword [eax], ecx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.00439028
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push ebx
push dword [esi + 0x1c]
call fcn.004241df
mov esi, dword [esi + 0x208]
cmp dword [esi + 0xe0e], ebx
je 0x436980
push dword [ebp + 0x10]
mov ecx, esi
push 9
call fcn.00460fcd
jmp 0x436980
cmp dword [esi + 0x134], ebx
je 0x435d8d
cmp eax, 8
je 0x436980
cmp eax, 0xd
jne 0x435db3
jmp 0x436980
cmp eax, 0x30
jb 0x435d97
cmp eax, 0x39
jbe 0x435db3
cmp eax, 0x61
jb 0x435da1
cmp eax, 0x66
jbe 0x435db3
cmp eax, 0x41
jb 0x436980
cmp eax, 0x46
ja 0x436980
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], edi
jmp 0x435dcd
mov eax, dword [esi + 0x208]
mov eax, dword [eax + 0xe0a]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 9
jne 0x435fac
lea eax, [ebp - 0x188]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, byte [ebp - 0x178]
and al, 0x80
cmp al, 0x80
jne 0x435dff
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x1c]
call fcn.0042412e
push ebx
push dword [ebp - 0x14]
push 0xc9
push dword [esi + 0x1c]
call edi
push ebx
mov dword [ebp - 0x38], eax
push dword [ebp - 0x18]
push 0xc9
push dword [esi + 0x1c]
call edi
cmp dword [esi + 0x1a8], ebx
je 0x435e46
mov ecx, dword [ebp - 0x14]
add ecx, ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x18]
add ecx, ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x38], eax
je 0x435e83
cmp dword [esi + 0x1ec], ebx
jne 0x435e83
mov ecx, esi
call fcn.0043c2bf
cmp dword [ebp - 4], ebx
je 0x435e75
mov eax, dword [esi + 0x48]
push 4
cdq
pop ecx
idiv ecx
mov ecx, esi
push eax
call fcn.004467c5
jmp 0x436980
push 0xffffffffffffffff
mov ecx, esi
call fcn.00446475
jmp 0x436980
mov eax, dword [esi + 0x200]
cmp dword [eax*4 + 0x4f4b9c], ebx
je 0x435fa9
mov eax, dword [esi + 0x48]
push 4
cdq
pop ecx
idiv ecx
mov dword [ebp + 8], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x1c]
call fcn.0042412e
push ebx
push dword [ebp - 0x14]
push 0xc9
push dword [esi + 0x1c]
call edi
push ebx
push eax
push 0xbb
mov dword [ebp - 0x38], eax
push dword [esi + 0x1c]
call edi
mov ecx, dword [ebp - 0x14]
push ebx
push eax
push 0xc1
push dword [esi + 0x1c]
sub ecx, eax
mov dword [ebp + 0xc], ecx
call edi
cmp dword [esi + 0x1a8], ebx
mov dword [ebp + 0x10], eax
je 0x435ef3
add eax, eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp - 0x38]
add ecx, 2
mov word [eax], cx
mov dword [ebp - 4], eax
push 0x507
push dword [esi + 0x1c]
call edi
cmp dword [esi + 0x1a8], ebx
je 0x435f50
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jle 0x435f76
mov ecx, dword [ebp - 4]
mov dword [ebp + 0x10], eax
cmp word [ecx], 9
jne 0x435f46
mov eax, ebx
cdq
idiv dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, edx
add ebx, eax
jmp 0x435f47
inc ebx
inc ecx
inc ecx
dec dword [ebp + 0x10]
jne 0x435f31
jmp 0x435f76
xor ecx, ecx
cmp dword [ebp + 0xc], ebx
jle 0x435f76
mov eax, dword [ebp - 4]
cmp byte [ecx + eax], 9
jne 0x435f6f
mov eax, ebx
cdq
idiv dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, edx
add ebx, eax
jmp 0x435f70
inc ebx
inc ecx
cmp ecx, dword [ebp + 0xc]
jl 0x435f57
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp + 8]
mov eax, ebx
cdq
idiv ecx
cmp edx, ecx
jge 0x436980
sub ecx, edx
mov ebx, ecx
push 1
push 0x20
push 0x102
push dword [esi + 0x1c]
call edi
dec ebx
jne 0x435f93
jmp 0x436980
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x208]
cmp dword [ecx + 0xe0e], ebx
je 0x435fc6
push dword [ebp + 0x10]
push eax
call fcn.00460fcd
mov eax, dword [ebp + 8]
cmp dword [0x4f4b10], ebx
je 0x435ff1
cmp byte [0x4f4def], 0xff
jne 0x435ff1
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
lea eax, [ebp + 0xb]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
movzx eax, byte [ebp + 0xb]
mov dword [ebp + 8], eax
mov ecx, esi
call fcn.0043a7e3
cmp dword [esi + 0xc4], 0xffffffff
mov dword [ebp - 0x48], eax
jne 0x43600d
cmp dword [esi + 0xc8], 0xffffffff
je 0x436077
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x1c]
call fcn.0042412e
cmp dword [esi + 0x1a8], ebx
je 0x436035
mov eax, dword [ebp - 0x14]
add eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
add eax, eax
mov dword [ebp - 0x18], eax
mov ecx, esi
call fcn.0043c2bf
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc4]
cmp eax, 0xffffffff
jne 0x436053
mov eax, dword [esi + 0xbc]
add eax, dword [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004349d7
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0xbc]
jl 0x436077
cmp eax, dword [esi + 0xc0]
jg 0x436077
push ebx
push eax
mov ecx, esi
call fcn.0043bc63
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0043a6f9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
sub eax, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0xbc]
add eax, ecx
cmp dword [esi + 0x1ec], ebx
mov dword [ebp - 0x1c], eax
je 0x4360d5
cmp ecx, dword [ebp - 0x18]
je 0x4360d5
push ebx
push ecx
push 0xc9
push dword [esi + 0x1c]
call edi
push ebx
mov dword [ebp - 0x38], eax
push dword [ebp - 0x18]
push 0xc9
push dword [esi + 0x1c]
call edi
cmp dword [ebp - 0x38], eax
je 0x4360d5
mov dword [ebp - 4], 1
cmp dword [esi + 0xc8], 0xffffffff
jne 0x43614f
cmp dword [ebp - 4], ebx
je 0x4360ff
mov eax, dword [ebp + 8]
cmp eax, 0x2e
je 0x43614f
cmp eax, 8
je 0x43614f
cmp eax, 0x20
jae 0x43614f
cmp eax, 0xd
je 0x43614f
cmp eax, 9
je 0x43614f
push dword [esi + 0x1c]
call fcn.004241af
test eax, eax
je 0x436112
mov dword [ebp - 0x30], 1
cmp dword [ebp + 8], 0xd
jne 0x43612f
push ebx
push ebx
push ebx
push ebx
push 8
mov ecx, esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], 1
call fcn.004763f3
push ebx
push ebx
push dword [ebp + 8]
mov ecx, esi
push dword [ebp + 0xc]
push 1
push dword [ebp - 0x1c]
call fcn.004763f3
mov ecx, esi
call fcn.00497d93
jmp 0x436362
mov ecx, esi
call fcn.004347a4
mov ecx, esi
call fcn.0043c2bf
cmp dword [esi + 0x1ec], ebx
mov dword [ebp - 4], eax
je 0x436287
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], eax
je 0x436287
cmp dword [esi + 0xc8], 0xffffffff
jne 0x43618f
mov ecx, dword [esi + 0xbc]
add ecx, eax
mov dword [esi + 0xc8], ecx
mov ecx, esi
call fcn.0043d368
mov eax, dword [esi + 0x1f0]
mov edi, dword [esi + 0x1f4]
mov ecx, dword [ebp + 8]
xor edx, edx
cmp eax, edi
sete dl
cmp ecx, 0x2e
je 0x4361be
cmp ecx, 8
jne 0x43620f
cmp eax, ebx
jle 0x43626c
cmp edx, ebx
je 0x43620f
cmp ecx, 8
jne 0x4361f9
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0043a9fa
push dword [esi + 0xc8]
mov edi, eax
mov ecx, esi
inc edi
call fcn.0043a9fa
mov ecx, dword [esi + 0x1f4]
inc eax
dec ecx
push ecx
mov ecx, esi
push dword [esi + 0x1f0]
push eax
push edi
call fcn.004400fc
push 1
push ebx
push ebx
push ebx
push 0x803c
mov ecx, esi
call fcn.0043d914
jmp 0x436980
cmp ecx, 0x2e
je 0x43626c
cmp ecx, 8
je 0x43626c
cmp ecx, 0xd
je 0x43626c
cmp edx, ebx
je 0x436227
push 1
pop edi
jmp 0x436233
cmp eax, edi
jle 0x436231
sub eax, edi
mov edi, eax
jmp 0x436233
sub edi, eax
push edi
call fcn.0049bdea
push edi
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
push eax
call fcn.004843d0
mov edx, dword [ebp + 0x10]
add esp, 0x10
mov byte [edx + edi], bl
mov eax, dword [esi + 0x1f0]
mov ecx, dword [esi + 0x1f4]
cmp eax, ecx
jl 0x436261
mov eax, ecx
push edi
push ebx
push eax
push edx
push 0x803a
jmp 0x436203
cmp edx, ebx
je 0x436275
push 1
pop eax
jmp 0x436281
cmp eax, edi
jle 0x43627d
sub eax, edi
jmp 0x436281
sub edi, eax
mov eax, edi
push eax
jmp 0x4361fb
push ebx
push ebx
push 1
push ebx
push ebx
mov ecx, esi
push dword [esi + 0xc8]
push dword [ebp - 0x1c]
call fcn.0043abe2
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x4362ab
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov ecx, dword [esi + 0x3c]
push 0xffffffffffffffff
push ebx
call fcn.00477237
cmp dword [esi + 0x1ec], ebx
je 0x4362c8
push dword [ebp - 8]
mov ecx, esi
call fcn.004349d7
push 1
mov ecx, esi
push dword [ebp - 8]
push dword [ebp - 8]
call fcn.0043bcd5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x1c]
call fcn.0042412e
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jle 0x436302
push dword [ebp - 0x14]
mov ecx, esi
push eax
push dword [esi + 0x1ec]
call fcn.0043d5e9
jmp 0x436318
mov eax, dword [esi + 0x16c]
mov ecx, esi
cdq
sub eax, edx
sar eax, 1
push eax
push dword [ebp - 8]
call fcn.0043bc63
cmp dword [esi + 0x1ec], ebx
mov dword [ebp - 0x30], 1
je 0x436346
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x1c]
call fcn.0042412e
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push ebx
push dword [esi + 0x1c]
call fcn.004241df
cmp dword [ebp + 8], 8
je 0x43635b
push 1
push dword [ebp + 8]
push 0x102
push dword [esi + 0x1c]
call edi
mov ecx, esi
call fcn.0043ddc3
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov ecx, esi
mov dword [esi + 0x204], eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044069d
cmp dword [ebp + 8], 0xd
jne 0x436884
cmp dword [ebp - 0x28], ebx
je 0x436884
mov eax, dword [esi + 0x20c]
cmp dword [eax + 0xd4], ebx
je 0x436884
cmp dword [esi + 0xf8], ebx
jne 0x436884
cmp dword [ebp - 0x3c], ebx
jne 0x4363c7
push ebx
push ebx
push ebx
push ebx
push 8
mov ecx, esi
push dword [ebp - 0x1c]
call fcn.004763f3
mov dword [ebp - 0x3c], 1
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x1c]
call fcn.0042412e
push ebx
push dword [ebp - 0x44]
push 0xc9
push dword [esi + 0x1c]
call edi
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], ebx
mov eax, dword [eax + 0x58]
cmp eax, ebx
jl 0x43681a
cmp dword [eax*4 + 0x4fb8e0], ebx
je 0x43681a
push ebx
push dword [ebp - 0x20]
push 0xc9
push dword [esi + 0x1c]
call edi
dec eax
push ebx
push eax
push 0xbb
push dword [esi + 0x1c]
mov dword [ebp - 4], eax
call edi
push ebx
push eax
push 0xc1
push dword [esi + 0x1c]
call edi
cmp dword [esi + 0x1a8], ebx
mov dword [ebp - 0x24], eax
je 0x436440
add eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 0x24]
push eax
push dword [ebp - 4]
inc ecx
mov word [eax], cx
mov dword [ebp - 0x2c], eax
push 0x507
push dword [esi + 0x1c]
call edi
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x1a8]
cmp eax, ebx
je 0x4364ce
mov ecx, dword [ebp - 0x24]
add ecx, ecx
cmp eax, ebx
mov dword [ebp - 0x24], ecx
je 0x4364ce
cmp dword [ebp - 0x2c], ebx
jne 0x43648a
mov dword [ebp - 4], ebx
jmp 0x4364b5
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
add eax, 3
and al, 0xfc
call fcn.00484450
mov eax, esp
push dword [ebp - 4]
push dword [ebp - 0x2c]
push eax
call fcn.0049bda6
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 0x2c]
call fcn.004838f0
push dword [ebp - 4]
call fcn.00483b20
add esp, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
add eax, ecx
cmp eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
jbe 0x436501
dec dword [ebp - 8]
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
push eax
call fcn.004845c3
test eax, eax
pop ecx
je 0x4364fe
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 8], eax
ja 0x4364e0
jmp 0x436501
inc dword [ebp - 8]
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + 0x58]
mov eax, dword [eax*4 + 0x4fb8e0]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x43663e
jmp 0x43651e
mov eax, dword [ebp - 0xc]
cmp byte [eax], bl
je 0x43663e
push 0x4e9c54
push dword [ebp - 0xc]
call fcn.00484860
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
je 0x43663e
inc dword [ebp - 0xc]
push 0x4e9c54
push dword [ebp - 0xc]
call fcn.00484860
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0x28], eax
je 0x436635
sub eax, dword [ebp - 0xc]
cmp eax, 0x1f
mov dword [ebp - 0x10], eax
jb 0x43656b
push 0x1f
pop eax
push eax
lea eax, [ebp - 0x88]
push dword [ebp - 0xc]
push eax
call fcn.00483fe0
add esp, 0xc
cmp dword [ebp - 0x10], 0x1f
jae 0x436589
mov eax, dword [ebp - 0x10]
jmp 0x43658c
push 0x1f
pop eax
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
jb 0x43659e
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x1f
jb 0x43659e
push 0x1f
pop ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x10]
cmp eax, edx
mov dword [ebp - 0xc], edx
ja 0x4365b7
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
push ecx
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00483fe0
add esp, 0xc
cmp dword [ebp - 0x10], 0x1f
jae 0x4365d0
mov ecx, dword [ebp - 0x10]
jmp 0x4365d3
push 0x1f
pop ecx
push 0x1f
pop eax
cmp dword [ebp - 0x10], eax
jae 0x4365de
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x88], bl
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x88]
push eax
mov byte [ebp + ecx - 0x68], bl
call fcn.00485250
pop ecx
test eax, eax
pop ecx
jne 0x43662e
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x2c], eax
jae 0x436627
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
movsx eax, byte [eax]
push eax
call fcn.004845eb
test eax, eax
pop ecx
jne 0x43662e
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x5f
je 0x43662e
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jne 0x43651b
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jae 0x43666a
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
movsx eax, byte [eax]
push eax
call fcn.004845c3
test eax, eax
pop ecx
je 0x436667
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jb 0x436649
jmp 0x43666a
dec dword [ebp - 8]
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + 0x58]
mov eax, dword [eax*4 + 0x4f7ae0]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x436779
jmp 0x436687
mov eax, dword [ebp - 0xc]
cmp byte [eax], bl
je 0x436779
push 0x4e9c54
push dword [ebp - 0xc]
call fcn.00484860
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
je 0x436779
inc dword [ebp - 0xc]
push 0x4e9c54
push dword [ebp - 0xc]
call fcn.00484860
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0x28], eax
je 0x436770
sub eax, dword [ebp - 0xc]
cmp eax, 0x1f
mov dword [ebp - 0x10], eax
jb 0x4366d4
push 0x1f
pop eax
push eax
lea eax, [ebp - 0x88]
push dword [ebp - 0xc]
push eax
call fcn.00483fe0
add esp, 0xc
cmp dword [ebp - 0x10], 0x1f
jae 0x4366f2
mov ecx, dword [ebp - 0x10]
jmp 0x4366f5
push 0x1f
pop ecx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
sub eax, dword [ebp - 8]
add eax, edx
cmp eax, ecx
jb 0x43670f
mov eax, dword [ebp - 0x10]
cmp eax, 0x1f
jb 0x43670f
push 0x1f
pop eax
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], ecx
jae 0x43671a
mov ecx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x68]
push ecx
push eax
call fcn.00483fe0
add esp, 0xc
cmp dword [ebp - 0x10], 0x1f
jae 0x436733
mov ecx, dword [ebp - 0x10]
jmp 0x436736
push 0x1f
pop ecx
push 0x1f
pop eax
cmp dword [ebp - 0x10], eax
jae 0x436741
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x88], bl
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x88]
push eax
mov byte [ebp + ecx - 0x68], bl
call fcn.00485250
pop ecx
test eax, eax
pop ecx
jne 0x436769
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jne 0x436684
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x40], ebx
je 0x43681a
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x988]
push eax
push dword [esi + 0x1c]
call fcn.00427bb2
push dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
push dword [ebp - 4]
sub eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x28]
push 1
push dword [esi + 0x1c]
mov dword [ebp - 8], eax
call fcn.004241df
lea eax, [ebp - 0x988]
push ebx
push eax
mov eax, dword [esi + 0xbc]
add eax, dword [ebp - 4]
push ebx
push ebx
push 6
push eax
mov ecx, esi
call fcn.004763f3
lea eax, [ebp - 0x988]
push eax
push ebx
push 0x506
push dword [esi + 0x1c]
call edi
mov eax, dword [ebp - 8]
add dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp - 0x20]
push ebx
push dword [esi + 0x1c]
call fcn.004241df
cmp dword [esi + 0x1a8], ebx
je 0x436815
mov eax, dword [ebp - 0x20]
add eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x28], ebx
jmp 0x436840
lea eax, [ebp - 0x988]
push 0x800
push eax
push dword [esi + 0x1c]
call fcn.00423e5e
cmp dword [esi + 0x1a8], ebx
je 0x43683e
mov ecx, dword [ebp - 0x20]
add ecx, ecx
mov dword [ebp - 0x20], ecx
cmp eax, ebx
je 0x436871
lea eax, [ebp - 0x988]
push ebx
push eax
mov eax, dword [esi + 0xbc]
add eax, dword [ebp - 0x20]
push ebx
push ebx
push 6
push eax
mov ecx, esi
call fcn.004763f3
lea eax, [ebp - 0x988]
push eax
push ebx
push 0x506
push dword [esi + 0x1c]
call edi
cmp dword [ebp - 0x38], ebx
je 0x436884
push 1
push 9
push 0x102
push dword [esi + 0x1c]
call edi
cmp dword [ebp - 0x3c], ebx
je 0x436899
push ebx
push ebx
push ebx
push ebx
push 9
mov ecx, esi
push dword [ebp - 0x1c]
call fcn.004763f3
cmp dword [esi + 0x198], ebx
je 0x4368af
mov ecx, esi
call fcn.00438e15
mov ecx, esi
call fcn.00438cf8
mov ecx, esi
call fcn.0043a7e3
mov edi, eax
sub edi, dword [ebp - 0x48]
je 0x4368c8
push edi
mov ecx, esi
push dword [ebp - 0x1c]
call fcn.00439944
mov eax, dword [ebp + 0xc]
cmp edi, ebx
jle 0x4368f8
cmp dword [ebp + 8], 0xd
jne 0x4368f3
mov eax, dword [esi + 0x20c]
cmp dword [eax + 0xd4], ebx
je 0x4368ef
cmp dword [esi + 0xf8], ebx
jne 0x4368ef
mov eax, edi
jmp 0x436929
push 2
jmp 0x4368f5
push 1
pop eax
jmp 0x436929
cmp dword [ebp + 8], 8
je 0x43691e
cmp dword [ebp + 8], 0x2e
je 0x43691e
cmp edi, ebx
jne 0x43690e
cmp dword [ebp + 8], 0x1b
je 0x43695c
mov ecx, edi
neg ecx
cmp dword [ebp - 0x34], ecx
je 0x436929
mov eax, dword [ebp - 0x34]
add eax, edi
jmp 0x436929
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
not eax
and eax, edi
cmp edi, ebx
jne 0x436944
cmp dword [ebp + 8], 0x1b
je 0x43695c
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
push eax
add eax, ecx
add eax, dword [ebp - 0x34]
push eax
push ebx
push ecx
jmp 0x436953
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x1c]
add ecx, eax
push ecx
push edi
push eax
mov ecx, dword [esi + 0x3c]
push esi
call fcn.0042a9b5
cmp dword [esi + 0x1f8], ebx
je 0x436979
push ebx
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043fda1
test eax, eax
jne 0x436980
mov ecx, esi
call fcn.0043d46e
lea esp, [ebp - 0x994]
pop edi
pop esi
pop ebx
leave
ret 0xc