Function at 0x402ff2
Capabilities:
Check for foreground window switch
Check if file exists
Create process on windows
Encode data using base64
Get file attributes
Log keystrokes via polling
Open clipboard
Parse credit card information
Query environment variable
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x403007
xor eax, eax
jmp 0x403c9f
test byte [ebp + 0xc], 0x20
push ebx
push esi
jne 0x40302d
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x1d
call esi
movzx ebx, ax
push 0x11
shr ebx, 1
call esi
movzx eax, ax
or ebx, eax
shr ebx, 8
or dword [ebp + 0xc], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
mov ebx, dword [ebp + 8]
mov al, byte [ebx]
cmp al, 0xd
ja 0x403044
cmp al, 9
jne 0x403c6f
and dword [ebp - 0x1c], 0
cmp al, 0x3b
mov dword [ebp - 0x10], ebx
je 0x403c52
cmp al, 0x3d
je 0x40305b
cmp al, 0x2d
jne 0x403068
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0xa
jbe 0x403c52
mov al, byte [ebx]
cmp al, 0x20
je 0x403072
cmp al, 9
jne 0x403075
inc ebx
jmp 0x403068
cmp byte [ebx], 0x2a
jne 0x4030b4
mov al, byte [ebx + 1]
cmp al, 0x30
jl 0x4030b4
and eax, 0x4f
cmp eax, 0x40
jl 0x40308c
sub eax, 0x37
test al, 1
je 0x40309e
mov ecx, eax
xor ecx, dword [ebp + 0xc]
test cl, 2
jne 0x403c4f
test al, 4
je 0x4030ad
xor eax, dword [ebp + 0xc]
test al, 8
jne 0x403c4f
inc ebx
inc ebx
mov dword [ebp - 0x10], ebx
jmp 0x403068
mov eax, dword [ebx]
and dword [ebp - 4], 0
and eax, 0xdfdfdfdf
xor edi, edi
cmp eax, 0x50545448
mov dword [ebp - 0x10], ebx
mov esi, ebx
jne 0x4030d3
cmp byte [ebx + 4], 0x3a
je 0x4030e0
cmp eax, 0x4c454853
jne 0x4030e9
cmp byte [ebx + 5], 0x3a
jne 0x4030e9
mov dword [ebp - 4], 2
jmp 0x403115
mov al, byte [ebx]
cmp al, 0x22
jne 0x4030fb
lea esi, [ebx + 1]
mov dword [ebp - 4], 0x10
jmp 0x403115
cmp al, 0x25
je 0x40310e
cmp word [ebx], 0x5c5c
je 0x40310e
cmp word [ebx + 1], 0x5c3a
jne 0x403115
mov dword [ebp - 4], 8
mov al, byte [esi]
cmp al, 0xa
je 0x4031b0
test al, al
je 0x4031aa
cmp dword [ebp - 4], 0x10
jne 0x40313a
cmp al, 0x22
jne 0x4031a4
mov dword [ebp - 4], 0x14
jmp 0x4031a4
cmp al, 9
jne 0x403147
and byte [esi], 0
or dword [ebp - 4], 1
jmp 0x4031a4
cmp al, 0x20
jne 0x4031a4
test byte [ebp - 4], 3
jne 0x4031a4
test byte [ebp - 4], 0x10
jne 0x40319e
test byte [ebp - 4], 8
je 0x40319e
cmp byte [esi - 4], 0x2e
je 0x40319e
mov al, byte [esi + 1]
cmp al, 0x22
jl 0x40316e
cmp al, 0x28
jl 0x40319e
cmp al, 0x28
jne 0x40317d
cmp dword [esi + 2], 0x29363878
jne 0x40319e
cmp al, al
jle 0x403183
cmp al, 0x2f
jle 0x40319e
cmp al, 0x3a
jl 0x40318b
cmp al, 0x3f
jle 0x40319e
cmp word [esi + 1], 0x5c5c
je 0x40319e
mov al, byte [esi + 2]
cmp al, 0x3a
je 0x40319e
cmp al, 0x20
ja 0x4031a4
or dword [ebp - 4], 2
mov edi, esi
inc esi
jmp 0x403115
cmp byte [esi + 1], 0xa
jne 0x4031e2
lea eax, [esi - 1]
mov cl, byte [eax]
cmp cl, 0xd
je 0x4031bf
cmp cl, 0x20
jne 0x4031c5
and byte [eax], 0
dec eax
jmp 0x4031b3
test byte [ebp - 4], 1
jne 0x4031e2
test edi, edi
je 0x4031e2
and byte [esi], 0
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4031df
and byte [edi], al
mov byte [esi], 0xa
cmp byte [ebx], 0x3a
jne 0x4031f9
cmp byte [ebx + 1], 0x61
lea eax, [ebx + 1]
jl 0x4031f9
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], ebx
jmp 0x403200
and dword [ebp - 0x68], 0
push 1
pop eax
push 7
lea ecx, [ebp + eax*4 - 0x68]
pop edx
sub edx, eax
and dword [ecx], 0
cmp dword [ebp - 0x1c], 0
jne 0x403245
mov al, byte [ebx]
test al, al
je 0x403244
cmp al, 0xa
je 0x40323c
cmp al, 0x3b
je 0x403224
cmp al, 0xd
jne 0x40322a
cmp byte [ebx + 1], 0xa
jbe 0x40322c
mov dword [ecx], ebx
mov al, byte [ebx]
test al, al
je 0x403244
cmp al, 0xa
je 0x40323c
inc ebx
mov dword [ebp - 0x10], ebx
jmp 0x40322c
and byte [ebx], 0
mov dword [ebp - 0x1c], ebx
jmp 0x403245
inc ebx
add ecx, 4
dec edx
jne 0x403209
mov esi, dword [ebp - 0x64]
mov dword [ebp - 0x10], ebx
test esi, esi
je 0x403c3c
mov edi, dword [ebp - 0x14]
test edi, edi
jle 0x4032a9
cmp dword [esi], 0x304e2f
je 0x4032a3
cmp edi, 0x18
jg 0x4032a3
push 0x3d
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
jne 0x40328a
cmp edi, 0x10
jg 0x4032a0
jmp 0x40329a
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
jne 0x4032ad
inc edi
cmp edi, 0x18
jle 0x40326d
mov esi, dword [ebp - 0x64]
and dword [ebp - 0x18], 0
jmp 0x4032b0
jne 0x4032b0
jmp 0x4032a3
mov esi, dword [ebp - 0x64]
xor eax, eax
cmp byte [esi], 0x2f
mov dword [ebp - 0x14], eax
je 0x4034ca
cmp dword [ebp - 8], eax
jne 0x403c3c
mov dword [ebp - 0x74], 0x3c
mov dword [ebp - 0x70], 0x2000700
mov dword [ebp - 0x6c], eax
mov al, byte [esi]
cmp al, 0x5c
jne 0x4032e7
mov dword [ebp - 0x70], 0x2000780
jmp 0x403360
cmp al, 0x7b
jne 0x40331d
push 0xa
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.00403e07
add esp, 0xc
cmp byte [eax - 1], 0x7d
jne 0x40335d
lea ecx, [ebp - 0x44]
sub eax, ecx
cmp eax, 0x26
jne 0x40335d
mov dword [ebp - 0x4c], 0x6c656873
mov dword [ebp - 0x48], 0x3a3a3a6c
lea esi, [ebp - 0x4c]
jmp 0x403358
mov eax, dword [esi]
or eax, 0x202020
cmp eax, 0x2e6e706f
jne 0x403360
lea eax, [ebp - 4]
mov edi, 0x40658c
push eax
push edi
add esi, 3
push str.open
push esi
push 2
push 0x20
mov dword [ebp - 4], 0x100
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringA]
test eax, eax
mov esi, edi
je 0x403358
mov esi, dword [ebp - 0x60]
mov dword [ebp - 0x64], esi
jmp 0x403360
mov esi, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
xor edi, edi
cmp eax, edi
jne 0x4033cd
test byte [ebp + 0xc], 0x40
je 0x4033be
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4033bb
push 0x40
mov dword [0x4063f8], 0x202c4e2f
push dword [ebp - 0x64]
mov dword [0x4063fc], 0x4c45532f
mov dword [0x406400], 0x2c544345
push 0x406404
call fcn.00403e07
mov esi, 0x406164
add esp, 0xc
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], 0x4063f8
jmp 0x4033df
mov esi, dword [ebp - 0x64]
test byte [ebp + 0xc], 0x80
je 0x4033df
mov dword [ebp - 0x68], str.properties
jmp 0x4033db
mov eax, dword [eax]
and eax, 0xdfdfdfdf
cmp eax, 0x504f5250
jne 0x4033df
or dword [ebp - 0x70], 0xc
mov eax, dword [ebp - 0x60]
cmp eax, edi
je 0x403472
mov eax, dword [eax]
cmp eax, 0x424325
jne 0x4033f8
mov dword [ebp - 4], edi
jmp 0x40340d
cmp eax, 0x22424322
jne 0x403472
mov dword [ebp - 4], 1
mov byte [0x406514], 0x22
test byte [ebp + 0xc], 0x20
mov dword [ebp - 0x60], edi
jne 0x403472
push dword [0x406004]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40346f
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
cmp esi, edi
je 0x403469
push 0x5d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + 0x406514]
push eax
call fcn.00403e07
add esp, 0xc
cmp dword [ebp - 4], edi
je 0x40345b
mov dword [eax], 0x22
push esi
mov dword [ebp - 0x60], 0x406514
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [ebp - 0x64]
cmp word [esi], 0x5c5c
jne 0x403497
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x403497
cmp dword [ebp - 0x68], edi
jne 0x403497
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x64], 0x406164
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x58]
cmp eax, edi
je 0x4034a8
mov al, byte [eax]
and eax, 0xf
mov dword [ebp - 0x58], eax
jne 0x4034af
mov dword [ebp - 0x58], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 0x14], eax
jmp 0x403c3c
cmp dword [ebp - 8], eax
jne 0x403c0d
mov al, byte [esi + 2]
lea edx, [esi + 2]
and eax, 0x4f
cmp eax, 0x40
mov dword [ebp - 4], eax
jl 0x4034ea
sub eax, 0x37
mov dword [ebp - 4], eax
movsx ecx, byte [esi + 1]
cmp ecx, 0x46
jg 0x403807
je 0x403798
cmp ecx, 0x2e
jg 0x4035c8
je 0x4035bf
sub ecx, 0x21
je 0x4035a6
sub ecx, 3
je 0x403592
dec ecx
dec ecx
je 0x403533
sub ecx, 7
jne 0x403c3c
mov dword [ebp - 8], 1
jmp 0x403c3c
mov edx, dword [ebp - 0x60]
cmp byte [edx], 0x25
jne 0x403587
lea ecx, [edx + 1]
mov esi, ecx
mov al, byte [esi]
test al, al
je 0x403587
cmp al, 0x25
je 0x40354d
inc esi
jmp 0x403540
and byte [esi], 0
mov edi, 0x406410
push 0x104
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
mov dword [ebp - 4], eax
jle 0x403581
lea ecx, [esi + 1]
push 0x40
lea eax, [eax + 0x406410]
push ecx
push eax
call fcn.00403e07
add esp, 0xc
mov dword [ebp - 0x60], edi
mov byte [esi], 0x25
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jmp 0x403521
push dword [ebp - 0x5c]
and eax, 3
push dword [ebp - 0x60]
push eax
call fcn.00403eb7
add esp, 0xc
jmp 0x40358e
push eax
push 0
push 0x8010
push dword [0x406004]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x403c3c
and dword [ebp - 8], 0
jmp 0x403c3c
sub ecx, 0x3f
je 0x40378c
dec ecx
dec ecx
je 0x4036b2
dec ecx
je 0x403682
dec ecx
jne 0x403c3c
mov dx, word [edx]
cmp dx, 0x50
jne 0x403609
movsx ecx, word [0x406b64]
mov dword [ebp - 0x74], ecx
movsx ecx, word [0x406b66]
mov dword [ebp - 0x70], ecx
jmp 0x403873
cmp dx, 0x42
jne 0x403c3c
test byte [ebp + 0xc], 0x20
jne 0x403c3c
push dword [0x406004]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x403c3c
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x40365d
push 0x5e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push 0x406514
call fcn.00403e07
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x403c3c
mov eax, dword [ebp + 0xc]
or al, 0x20
push eax
push 0x406514
call fcn.00402ff2
pop ecx
pop ecx
jmp 0x403c3c
cmp dword [ebp - 0x60], 0
jne 0x403697
shl eax, 4
push eax
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x403c3c
not eax
and eax, 1
or eax, 0x22012
push eax
push 0
push dword [ebp - 0x60]
call dword [sym.imp.WINMM.dll_PlaySoundA]
jmp 0x403c3c
mov esi, dword [ebp - 0x60]
mov dword [ebp - 4], 0x10000
xor edi, edi
call dword [sym.imp.USER32.dll_GetMessagePos]
test byte [ebp + 0xc], 0x40
mov dword [ebp - 0x58], eax
jne 0x40377c
test esi, esi
je 0x40377c
mov al, byte [esi]
test al, al
je 0x40377c
cmp al, 0x30
jl 0x403713
cmp al, 0x39
jg 0x403713
lea edx, [esi - 1]
xor ecx, ecx
movsx eax, al
lea ecx, [ecx + ecx*4]
inc esi
lea ecx, [eax + ecx*2 - 0x30]
mov al, byte [esi]
cmp al, 0x30
jl 0x403705
cmp al, 0x39
jle 0x4036f0
cmp byte [edx], 0x2d
jne 0x40370c
neg ecx
mov word [ebp + edi*2 - 0x58], cx
jmp 0x4036d9
and eax, 0xdf
cmp eax, 0x4c
jg 0x40374f
je 0x403749
sub eax, 0xc
je 0x403744
sub eax, 0x38
je 0x40373e
dec eax
dec eax
je 0x403738
sub eax, 3
jne 0x403776
or byte [ebp - 3], 8
jmp 0x403776
or byte [ebp - 3], 0x20
jmp 0x403776
or byte [ebp - 3], 0x40
jmp 0x403776
push 1
pop edi
jmp 0x403776
or byte [ebp - 3], 0x10
jmp 0x403776
sub eax, 0x4d
je 0x403772
dec eax
dec eax
je 0x40376c
dec eax
je 0x403766
sub eax, 7
jne 0x403776
or byte [ebp - 3], 4
jmp 0x403776
or byte [ebp - 3], 0x80
jmp 0x403776
or byte [ebp - 3], 2
jmp 0x403776
or byte [ebp - 3], 1
inc esi
jmp 0x4036d9
push dword [ebp - 4]
push dword [ebp - 0x58]
push 0x8013
jmp 0x4035ae
mov dword [ebp - 4], 0x51024
jmp 0x40390f
mov dl, byte [edx]
and dl, 0xdf
cmp dl, 0x44
jne 0x4037b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
mov dword [ebp - 0xc], esi
jmp 0x403bf0
cmp dl, 0x50
jne 0x4037bf
mov esi, dword [0x406ca0]
jmp 0x4037aa
cmp dl, 0x54
jne 0x4037cc
mov esi, dword [0x406ca4]
jmp 0x4037aa
cmp dl, 0x4d
jne 0x4037d9
mov esi, dword [0x406004]
jmp 0x4037aa
cmp dword [ebp - 0x60], 0
jne 0x4037e7
mov esi, dword [0x406cc0]
jmp 0x4037aa
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push 2
call fcn.00403eb7
add esp, 0xc
test eax, eax
je 0x403c3c
mov esi, dword [0x4069c0]
jmp 0x4037aa
cmp ecx, 0x53
jg 0x403a1a
je 0x4039a8
sub ecx, 0x4b
je 0x403990
dec ecx
dec ecx
je 0x403904
dec ecx
je 0x403837
dec ecx
dec ecx
je 0x4039c0
jmp 0x403c3c
mov dl, byte [edx]
cmp dl, 0x50
jne 0x4038ea
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x406ca0]
je 0x403c3c
cmp eax, dword [0x406ca4]
je 0x403c3c
lea ecx, [ebp - 0x74]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x403c3c
mov eax, dword [ebp - 4]
push 2
lea esi, [ebp - 0x60]
pop edi
mov ecx, dword [esi]
test ecx, ecx
je 0x40388e
push ecx
call fcn.00403d8e
mov dword [esi - 0x14], eax
xor eax, eax
pop ecx
mov dword [ebp - 4], eax
add esi, 4
dec edi
jne 0x403879
test eax, eax
jne 0x4038cc
mov eax, dword [ebp - 0x64]
mov al, byte [eax + 1]
and eax, 8
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00404d44
mov eax, dword [ebp - 0x64]
pop ecx
pop ecx
cmp byte [eax + 1], 0x4e
jne 0x4038cc
xor eax, eax
push 0x15
push eax
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0x64]
cmp byte [eax + 1], 0x43
jne 0x403c3c
push dword [ebp - 0x70]
push dword [ebp - 0x74]
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x403c3c
cmp dl, 0x46
jne 0x403c3c
mov eax, dword [0x406cc0]
or dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x403c3c
shl eax, 4
or eax, 0x51000
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 0x5c], ecx
jne 0x40391d
mov dword [ebp - 0x5c], 0x406018
mov eax, dword [ebp - 0x60]
cmp eax, ecx
jne 0x40397b
mov dword [ebp - 0x60], 0x406018
push ecx
push ecx
push 0x800c
push dword [0x406004]
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [ebp - 4]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [0x406004]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x40395f
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x60]
cmp byte [eax], 0
je 0x403c3c
cmp word [eax], 0xa0d
jne 0x403978
mov word [eax], 0x2727
inc eax
inc eax
jmp 0x403962
cmp byte [eax], 0
je 0x40392b
cmp word [eax], 0x2727
jne 0x40398d
mov word [eax], 0xa0d
inc eax
inc eax
jmp 0x40397b
mov ecx, dword [ebp - 0x60]
test ecx, ecx
mov ebx, ecx
je 0x4039a1
movsx esi, byte [ecx]
jmp 0x403a48
xor esi, esi
jmp 0x403a48
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x4039b9
mov cl, byte [ecx]
and ecx, 0xf
mov dword [ebp - 0x58], ecx
jne 0x4039c0
mov dword [ebp - 0x58], 4
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call fcn.00403eb7
add esp, 0xc
mov esi, eax
dec esi
js 0x403c3c
mov eax, dword [ebp - 0x64]
mov edi, dword [esi*4 + 0x4069c0]
mov dword [ebp - 0xc], edi
mov al, byte [eax + 1]
cmp al, 0x50
jne 0x403b06
push dword [ebp - 0x50]
call fcn.00403d8e
pop ecx
push eax
push dword [ebp - 0x54]
call fcn.00403d8e
pop ecx
push eax
push dword [ebp - 0x58]
call fcn.00403d8e
pop ecx
push eax
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x403b40
sub ecx, 0x54
je 0x403b87
sub ecx, 3
je 0x403b55
dec ecx
je 0x4039c0
sub ecx, 0x13
jne 0x403c3c
push dword [ebp - 0x60]
xor ebx, ebx
call fcn.00403d8e
mov esi, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 0x58], 0x5b121110
xor edi, edi
push 1
mov ecx, edi
pop edx
shl edx, cl
test eax, edx
je 0x403a6f
xor eax, eax
push eax
push eax
push eax
mov al, byte [ebp + edi - 0x58]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp - 4]
inc edi
cmp edi, 3
jle 0x403a51
test esi, esi
je 0x403ad9
cmp esi, 1
je 0x403aa9
cmp esi, 2
je 0x403aa9
cmp esi, 4
je 0x403aa9
mov edi, dword [sym.imp.USER32.dll_keybd_event]
xor eax, eax
push eax
push eax
push eax
push esi
call edi
push 0xd
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push esi
call edi
jmp 0x403ac9
imul esi, esi
mov edi, dword [sym.imp.USER32.dll_mouse_event]
xor eax, eax
push eax
push eax
shl esi, 1
push eax
push eax
push esi
call edi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [esi + esi]
push eax
call edi
test ebx, ebx
je 0x403ad6
movsx esi, byte [ebx + 1]
inc ebx
test esi, esi
jne 0x403a79
mov eax, dword [ebp - 4]
push 3
pop esi
push 1
mov ecx, esi
pop edx
shl edx, cl
test eax, edx
je 0x403afb
mov al, byte [ebp + esi - 0x58]
push 0
push 2
push 0
push eax
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp - 4]
dec esi
jns 0x403adc
mov ebx, dword [ebp - 0x10]
jmp 0x403c3c
test byte [ebp - 4], 4
je 0x403b1e
cmp edi, dword [0x406cc0]
jne 0x403b1e
cmp dword [ebp - 0x60], 0
jne 0x4039d1
cmp al, 0x58
jne 0x403b36
push edi
call fcn.00403ca2
test esi, esi
pop ecx
jne 0x403b42
mov dword [ebp - 0x14], 2
jmp 0x403b40
push dword [ebp - 0x58]
push edi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
test esi, esi
jle 0x4039d1
push 0x3d
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4039d1
cmp dword [ebp - 0x60], 0
je 0x403b60
push dword [ebp - 0x60]
jmp 0x403b61
push edx
call fcn.00403d8e
test eax, eax
pop ecx
jg 0x403b70
push 0xd
pop eax
jmp 0x403b7b
mov ecx, 0x2710
cmp eax, ecx
jbe 0x403b7b
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403c3c
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push 2
call fcn.00403eb7
add esp, 0xc
test eax, eax
je 0x403c3c
mov esi, dword [0x4069c0]
cmp esi, dword [0x406ca0]
mov dword [ebp - 0xc], esi
je 0x403bea
mov eax, dword [ebp - 4]
and eax, 3
jne 0x403bca
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
sar eax, 3
and eax, 1
inc eax
jmp 0x403bd8
cmp eax, 3
jne 0x403bd8
test byte [ebp - 4], 4
jne 0x403bf0
or eax, 0xffffffff
xor ecx, ecx
push 0x13
push ecx
push ecx
push ecx
push ecx
neg eax
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
test byte [ebp - 4], 4
je 0x403c3c
xor eax, eax
push eax
push 2
push eax
push eax
call dword [sym.imp.USER32.dll_keybd_event]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0x14], 0x18
jmp 0x403c3c
movsx eax, byte [esi + 1]
sub eax, 0x24
je 0x403c34
dec eax
dec eax
je 0x403c34
sub eax, 7
je 0x403c2e
dec eax
je 0x403c29
sub eax, 0x11
je 0x403c34
jmp 0x403c3c
shr dword [ebp - 8], 1
jmp 0x403c3c
xor dword [ebp - 8], 1
jmp 0x403c3c
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x403c52
mov byte [eax], 0xa
inc eax
mov dword [ebp + 8], eax
jmp 0x403033
mov dword [ebp - 0x10], ebx
cmp byte [ebx], 0xa
je 0x403c66
inc ebx
mov eax, ebx
sub eax, dword [ebp + 8]
cmp eax, 0x400
jg 0x403c6f
jmp 0x403c52
inc ebx
mov dword [ebp + 8], ebx
jmp 0x403033
push dword [0x406004]
call dword [sym.imp.USER32.dll_IsWindowVisible]
pop esi
pop ebx
test eax, eax
je 0x403c9c
test byte [ebp + 0xc], 0x20
jne 0x403c9c
push 0
push 0x14f
push 5
push dword [0x406004]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp - 0x14]
pop edi
leave
ret