Function at 0x4b0aff
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c0
push ebx
push esi
push edi
push 1
mov esi, ecx
pop edi
mov dword [ebp - 0x40], edi
mov ebx, dword [esi + 0x190]
call fcn.004ba36a
mov dword [esi + 0x190], ebx
xor ebx, ebx
mov dword [esi + 0x128], ebx
mov eax, dword [0x62ae3c]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [eax + 0x1864], ebx
je 0x4b0b65
mov eax, dword [ebp + 8]
cmp eax, 0x1b
je 0x4b0b4c
cmp eax, 0xd
jne 0x4b0b4e
mov ebx, edi
xor ecx, ecx
cmp eax, 8
sete cl
push ebx
push ecx
push eax
mov ecx, esi
call fcn.004c3ce2
jmp 0x4b1b18
mov eax, dword [esi + 0x3c]
cmp dword [eax + 0x498], ebx
jne 0x4b1b18
cmp dword [esi + 0x298], ebx
je 0x4b0b95
push edi
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004bfd49
test eax, eax
jne 0x4b1b18
cmp dword [esi + 0x20c], ebx
je 0x4b0ba4
mov dword [ebp - 0x40], 2
cmp dword [esi + 0x1f4], ebx
je 0x4b0c84
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xc]
je 0x4b0bd4
mov ecx, esi
call fcn.004b58ae
jmp 0x4b1b18
mov eax, dword [ebp + 8]
cmp eax, 9
jne 0x4b0c3b
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004b5b18
xor eax, eax
cmp dword [esi + 0x190], ebx
mov ecx, esi
sete al
mov dword [esi + 0x190], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004b5c0f
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push ebx
push dword [esi + 0x1c]
call fcn.00463ca0
mov ecx, dword [0x62ae3c]
cmp dword [ecx + 0x193c], ebx
je 0x4b1b18
push dword [ebp + 0x10]
push 9
call fcn.004842af
jmp 0x4b1b18
cmp dword [esi + 0x190], ebx
je 0x4b0c56
cmp eax, 8
je 0x4b1b18
cmp eax, 0xd
jne 0x4b0c7c
jmp 0x4b1b18
cmp eax, 0x30
jb 0x4b0c60
cmp eax, 0x39
jbe 0x4b0c7c
cmp eax, 0x61
jb 0x4b0c6a
cmp eax, 0x66
jbe 0x4b0c7c
cmp eax, 0x41
jb 0x4b1b18
cmp eax, 0x46
ja 0x4b1b18
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0xc], edi
jmp 0x4b0c95
mov eax, dword [0x62ae3c]
mov eax, dword [eax + 0x1938]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 9
jne 0x4b0ef8
lea eax, [ebp - 0x1c0]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, byte [ebp - 0x1b0]
and al, 0x80
cmp al, 0x80
jne 0x4b0cc7
mov dword [ebp - 4], 1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
push ebx
push dword [ebp - 8]
push 0xc9
push dword [esi + 0x1c]
call edi
push ebx
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x20]
push 0xc9
push dword [esi + 0x1c]
call edi
cmp dword [esi + 0x20c], ebx
je 0x4b0d0e
mov ecx, dword [ebp - 8]
add ecx, ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x20]
add ecx, ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x3c], eax
je 0x4b0d47
cmp dword [esi + 0x288], ebx
jne 0x4b0d47
mov ecx, esi
call fcn.004ba36a
cmp dword [ebp - 4], ebx
je 0x4b0d39
push dword [esi + 0x284]
mov ecx, esi
call fcn.004ce72d
jmp 0x4b1b18
push 0xffffffffffffffff
mov ecx, esi
call fcn.004ce114
jmp 0x4b1b18
mov eax, dword [esi + 0x2a0]
cmp dword [eax*4 + 0x62abc8], ebx
je 0x4b0ef5
mov eax, dword [esi + 0x284]
push 1
pop ecx
mov dword [ebp + 0x10], eax
cmp eax, ecx
jg 0x4b0d6d
mov dword [ebp + 0x10], ecx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
push ebx
push dword [ebp - 8]
push 0xc9
push dword [esi + 0x1c]
call edi
push ebx
push eax
push 0xbb
mov dword [ebp - 0xc], eax
push dword [esi + 0x1c]
call edi
mov ecx, dword [ebp - 8]
push ebx
push eax
push 0xc1
push dword [esi + 0x1c]
sub ecx, eax
mov dword [ebp - 4], ecx
call edi
cmp dword [esi + 0x20c], ebx
mov dword [ebp + 8], eax
je 0x4b0dbe
add eax, eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 8]
push eax
push dword [ebp - 0xc]
add ecx, 2
mov word [eax], cx
mov dword [ebp + 0xc], eax
push 0x507
push dword [esi + 0x1c]
call edi
cmp dword [esi + 0x20c], ebx
je 0x4b0df1
add eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp + 0xc]
push eax
push dword [ebp - 0xc]
mov word [eax], cx
push 0xc4
push dword [esi + 0x1c]
call edi
cmp dword [esi + 0x20c], ebx
mov dword [ebp + 8], ebx
je 0x4b0e4b
mov eax, dword [ebp - 4]
cmp eax, ebx
jle 0x4b0e7e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp word [eax], 9
jne 0x4b0e3d
mov eax, dword [ebp + 8]
cdq
idiv dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
sub eax, edx
add dword [ebp + 8], eax
jmp 0x4b0e40
inc dword [ebp + 8]
add dword [ebp - 4], 2
dec dword [ebp - 0xc]
jne 0x4b0e23
jmp 0x4b0e7e
xor eax, eax
cmp dword [ebp - 4], ebx
mov dword [ebp - 0xc], eax
jle 0x4b0e7e
mov ecx, dword [ebp + 0xc]
cmp byte [eax + ecx], 9
jne 0x4b0e6f
mov eax, dword [ebp + 8]
cdq
idiv dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
sub eax, edx
add dword [ebp + 8], eax
jmp 0x4b0e72
inc dword [ebp + 8]
mov eax, dword [ebp - 0xc]
inc eax
cmp eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jl 0x4b0e55
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
push ebx
cdq
idiv dword [ebp + 0x10]
mov eax, dword [ebp - 8]
push ebx
push ebx
push ebx
push 8
mov ecx, esi
mov dword [ebp + 8], edx
cdq
add eax, dword [esi + 0xf0]
adc edx, dword [esi + 0xf4]
push edx
push eax
call fcn.0050cae7
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 8], eax
jge 0x4b0ed1
sub eax, dword [ebp + 8]
mov dword [ebp + 8], eax
push 1
push 0x20
push 0x102
push dword [esi + 0x1c]
call edi
dec dword [ebp + 8]
jne 0x4b0ebe
mov eax, dword [ebp - 8]
push ebx
cdq
add eax, dword [esi + 0xf0]
push ebx
push ebx
push ebx
adc edx, dword [esi + 0xf4]
push 9
mov ecx, esi
push edx
push eax
call fcn.0050cae7
jmp 0x4b1b18
mov eax, dword [ebp + 8]
mov ecx, dword [0x62ae3c]
cmp dword [ecx + 0x193c], ebx
je 0x4b0f1a
cmp dword [0x62ad60], ebx
jne 0x4b0f1a
push dword [ebp + 0x10]
push eax
call fcn.004842af
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + 0x190], ebx
je 0x4b0f54
cmp dword [esi + 0x20c], ebx
jne 0x4b0f54
cmp eax, 0x7f
jbe 0x4b0f54
lea ecx, [ebp - 0x50]
push 0xc
push ecx
push eax
mov byte [ebp - 0x50], bl
call fcn.004a9f52
add esp, 0xc
cmp eax, 1
jne 0x4b1020
movsx eax, byte [ebp - 0x50]
mov dword [ebp + 8], eax
cmp dword [0x628aec], ebx
je 0x4b0f88
mov ecx, dword [esi + 0x2a4]
imul ecx, ecx, 0x3c
cmp byte [ecx + 0x62a687], 0xff
jne 0x4b0f88
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
lea eax, [ebp + 0xb]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
movzx eax, byte [ebp + 0xb]
mov dword [ebp + 8], eax
mov ecx, esi
call fcn.004b7d99
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0x100]
and eax, dword [esi + 0x104]
mov dword [ebp - 0x48], edx
cmp eax, 0xffffffff
jne 0x4b0fbe
mov ecx, dword [esi + 0x108]
lea eax, [esi + 0x108]
and ecx, dword [eax + 4]
cmp ecx, 0xffffffff
je 0x4b10af
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
cmp dword [esi + 0x20c], ebx
je 0x4b0fe6
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
add eax, eax
mov dword [ebp - 0x20], eax
mov ecx, esi
call fcn.004ba36a
mov ecx, dword [esi + 0x104]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x100]
mov dword [ebp - 0x10], edx
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
jne 0x4b106a
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0xf0]
cdq
add ecx, eax
mov eax, dword [esi + 0xf4]
adc eax, edx
push eax
push ecx
jmp 0x4b106c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
mov ecx, dword [esi + 0xf0]
lea eax, [ebp - 0x50]
push ebx
push eax
mov eax, dword [ebp - 8]
push ebx
cdq
add ecx, eax
mov eax, dword [esi + 0xf4]
push ebx
push 6
adc eax, edx
push eax
push ecx
mov ecx, esi
call fcn.0050cae7
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x506
push dword [esi + 0x1c]
call edi
jmp 0x4b1b18
push ecx
push eax
mov ecx, esi
call fcn.004aeb94
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0xf0]
cmp ecx, dword [eax + 4]
jl 0x4b10af
jg 0x4b108a
mov edx, dword [ebp - 0x14]
cmp edx, dword [eax]
jb 0x4b10af
cmp ecx, dword [esi + 0xfc]
lea eax, [esi + 0xf8]
jg 0x4b10af
jl 0x4b10a1
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
ja 0x4b10af
push ebx
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b9ac9
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.004b7b3c
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 0xf0]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
cdq
add eax, ecx
mov ecx, dword [esi + 0xf4]
adc edx, ecx
cmp dword [0x5c1d80], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
je 0x4b118d
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 8], eax
je 0x4b118d
mov edx, dword [esi + 0x148]
cmp edx, dword [ebp - 0x14]
jne 0x4b1122
mov edx, dword [esi + 0x14c]
cmp edx, dword [ebp - 0x10]
jne 0x4b1122
imul eax, dword [ebp - 0x40]
cdq
add eax, dword [esi + 0xf0]
adc edx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
sub edi, dword [esi + 0xf0]
cdq
mov dword [ebp - 0x3c], edi
mov edi, dword [ebp - 0x10]
push edx
push eax
mov eax, dword [ebp - 0x3c]
sbb edi, ecx
push edi
push eax
call fcn.005291e0
push eax
push eax
push ebx
mov dword [ebp - 8], eax
push dword [esi + 0x1c]
call fcn.00463ca0
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
or eax, 0xffffffff
mov dword [esi + 0x108], eax
mov dword [esi + 0x100], eax
mov dword [esi + 0x148], eax
mov dword [esi + 0x110], eax
mov dword [ebp - 0x30], ebx
mov dword [esi + 0x10c], eax
mov dword [esi + 0x104], eax
mov dword [esi + 0x14c], eax
mov dword [esi + 0x114], eax
cmp dword [esi + 0x288], ebx
mov dword [ebp - 4], ebx
je 0x4b11d2
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x20]
je 0x4b11d2
cdq
idiv dword [ebp - 0x40]
push ebx
push eax
push 0xc9
push dword [esi + 0x1c]
call edi
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
cdq
idiv dword [ebp - 0x40]
push ebx
push eax
push 0xc9
push dword [esi + 0x1c]
call edi
cmp dword [ebp - 0x3c], eax
je 0x4b11d2
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x108]
and eax, dword [esi + 0x10c]
cmp eax, 0xffffffff
jne 0x4b1214
cmp dword [ebp - 4], ebx
je 0x4b14e2
mov eax, dword [ebp + 8]
cmp eax, 0x2e
jne 0x4b11fc
cmp dword [esi + 0x294], ebx
jne 0x4b121e
cmp eax, 8
je 0x4b1214
cmp eax, 0x20
jae 0x4b1214
cmp eax, 0xd
je 0x4b1214
cmp eax, 9
jne 0x4b14e2
cmp dword [ebp + 8], 0x1b
je 0x4b14e2
mov ecx, esi
call fcn.004ae8d2
cmp dword [esi + 0x288], ebx
je 0x4b13ac
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 8], eax
je 0x4b13ac
mov ecx, dword [esi + 0x108]
and ecx, dword [esi + 0x10c]
cmp ecx, 0xffffffff
jne 0x4b1267
cdq
add eax, dword [esi + 0xf0]
adc edx, dword [esi + 0xf4]
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], edx
mov ecx, esi
call fcn.004bc2db
mov eax, dword [esi + 0x28c]
mov edi, dword [esi + 0x290]
mov ecx, dword [ebp + 8]
xor edx, edx
cmp eax, edi
sete dl
cmp ecx, 0x2e
jne 0x4b1291
cmp dword [esi + 0x294], ebx
jne 0x4b129e
cmp ecx, 8
jne 0x4b130d
cmp eax, ebx
jle 0x4b1386
cmp edx, ebx
je 0x4b130d
cmp ecx, 8
jne 0x4b12e6
push 1
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b8088
push 1
mov edi, eax
push dword [esi + 0x10c]
mov ecx, esi
inc edi
push dword [esi + 0x108]
call fcn.004b8088
mov ecx, dword [esi + 0x290]
inc eax
dec ecx
push ecx
mov ecx, esi
push dword [esi + 0x28c]
push eax
push edi
call fcn.004c00cc
push 1
pop eax
push ebx
push ebx
mov dword [esi + 0x200], eax
push eax
push eax
push ebx
push ebx
push ebx
push 0x803c
mov ecx, esi
call fcn.004bc9e0
mov dword [esi + 0x2d0], ebx
jmp 0x4b1b18
cmp ecx, 0x2e
jne 0x4b131a
cmp dword [esi + 0x294], ebx
jne 0x4b1386
cmp ecx, 8
je 0x4b1386
cmp ecx, 0xd
je 0x4b1386
cmp edx, ebx
je 0x4b132d
push 1
pop edi
jmp 0x4b1339
cmp eax, edi
jle 0x4b1337
sub eax, edi
mov edi, eax
jmp 0x4b1339
sub edi, eax
lea eax, [edi + 1]
push eax
call fcn.005444b9
push edi
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
push eax
call fcn.00524810
mov edx, dword [ebp + 0x10]
add esp, 0x10
mov byte [edx + edi], bl
mov eax, dword [esi + 0x28c]
mov ecx, dword [esi + 0x290]
mov dword [esi + 0x200], 1
cmp eax, ecx
jl 0x4b1374
mov eax, ecx
push ebx
push ebx
push 1
push edi
push ebx
push eax
push edx
push 0x803a
jmp 0x4b12fb
cmp edx, ebx
je 0x4b138f
push 1
pop eax
jmp 0x4b139b
cmp eax, edi
jle 0x4b1397
sub eax, edi
jmp 0x4b139b
sub edi, eax
mov eax, edi
push 1
pop ecx
push ebx
push ebx
mov dword [esi + 0x200], ecx
push ecx
jmp 0x4b12f2
mov eax, dword [esi + 0x3c]
cmp dword [eax + 0x1bc], ebx
jle 0x4b13fb
cmp dword [ebp + 8], 0xd
mov dword [ebp - 0xc], ebx
jne 0x4b13c7
mov dword [ebp - 0xc], 1
push dword [esi + 0x10c]
mov ecx, esi
push dword [esi + 0x108]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004c2272
sub dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0xfffffffffffffffe
push dword [esi + 0x1c]
call fcn.00469843
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
push eax
call fcn.004778cf
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [esi + 0x10c]
mov ecx, esi
push dword [esi + 0x108]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b8343
mov dword [ebp - 0x2c], eax
and eax, edx
cmp eax, 0xffffffff
mov dword [ebp - 0x28], edx
jne 0x4b1434
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov ecx, dword [esi + 0x3c]
push 0xffffffffffffffff
push ebx
push ebx
call fcn.0050ddcb
cmp dword [esi + 0x288], ebx
je 0x4b1455
push dword [ebp - 0x28]
mov ecx, esi
push dword [ebp - 0x2c]
call fcn.004aeb94
push 1
mov ecx, esi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.004b9b3b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
mov eax, dword [esi + 0x1c8]
mov ecx, esi
cdq
sub eax, edx
sar eax, 1
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.004b9ac9
cmp dword [esi + 0x288], ebx
mov dword [ebp - 0xc], 1
je 0x4b14c1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
push dword [ebp - 0x20]
push dword [ebp - 8]
push ebx
push dword [esi + 0x1c]
call fcn.00463ca0
cmp dword [ebp + 8], 8
je 0x4b14d6
push 1
push dword [ebp + 8]
push 0x102
push dword [esi + 0x1c]
call edi
mov ecx, esi
call fcn.004bd2fa
jmp 0x4b15b6
push dword [esi + 0x1c]
call fcn.00463c70
test eax, eax
je 0x4b14f5
mov dword [ebp - 0xc], 1
cmp dword [ebp + 8], 0xd
jne 0x4b1515
push ebx
push ebx
push ebx
push ebx
push 8
mov ecx, esi
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x14]
call fcn.0050cae7
push ebx
push ebx
push dword [ebp + 8]
mov ecx, esi
push dword [ebp + 0xc]
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0050cae7
mov eax, dword [esi + 0x3c]
cmp dword [eax + 0x1bc], ebx
jle 0x4b15af
cmp dword [ebp + 8], 0xd
mov dword [ebp - 0x18], ebx
jne 0x4b1547
mov dword [ebp - 0x18], 1
cmp dword [ebp + 8], 8
jne 0x4b158b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x20]
jne 0x4b158b
lea eax, [ebp - 0x36]
mov byte [ebp - 0x31], 0xa
push eax
push 0xffffffffffffffff
push dword [esi + 0x1c]
call fcn.00463959
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + 0x164], 2
jne 0x4b1577
mov byte [ebp - 0x31], 0xd
cmp eax, 1
jne 0x4b158b
movzx eax, byte [ebp - 0x36]
movsx ecx, byte [ebp - 0x31]
cmp eax, ecx
jne 0x4b158b
dec dword [ebp - 0x18]
push dword [esi + 0x1c]
call fcn.00469c48
sub dword [ebp - 0x18], eax
pop ecx
push dword [ebp - 0x18]
push 0xfffffffffffffffe
push dword [esi + 0x1c]
call fcn.00469843
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
push eax
call fcn.004778cf
mov ecx, esi
call fcn.00540ac0
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x2a8], eax
mov eax, dword [ebp - 0x10]
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0x2ac], eax
call fcn.004c0909
cmp dword [esi + 0x294], ebx
jne 0x4b1955
cmp dword [ebp + 8], 8
je 0x4b1955
cmp dword [ebp + 8], 0x1b
je 0x4b1955
cmp dword [ebp - 0x44], ebx
je 0x4b1955
mov eax, dword [esi + 0x2b4]
cmp dword [eax + 0xd4], ebx
je 0x4b1955
cmp dword [esi + 0x150], ebx
jne 0x4b1955
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
push ebx
push dword [ebp - 0x54]
push 0xc9
push dword [esi + 0x1c]
call edi
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
cmp dword [eax + 0x160], ebx
jl 0x4b188e
push ebx
push dword [ebp - 0x24]
push 0xc9
push dword [esi + 0x1c]
call edi
cmp dword [ebp + 8], 0xd
mov dword [ebp - 0x38], eax
jne 0x4b166d
dec dword [ebp - 0x38]
push ebx
push dword [ebp - 0x38]
push 0xbb
push dword [esi + 0x1c]
call edi
push ebx
push eax
push 0xc1
mov dword [ebp - 0x28], eax
push dword [esi + 0x1c]
call edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0x38]
push dword [esi + 0x1c]
call fcn.00469a65
add esp, 0xc
cmp dword [esi + 0x20c], ebx
je 0x4b16b2
mov eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xb
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 4]
push eax
push dword [ebp - 0x38]
add ecx, 2
mov word [eax], cx
mov dword [ebp - 0x18], eax
push 0x507
push dword [esi + 0x1c]
call edi
cmp dword [esi + 0x20c], ebx
je 0x4b172e
cmp dword [ebp - 0x18], ebx
jne 0x4b16ed
mov dword [ebp - 4], ebx
jmp 0x4b1718
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
add eax, 3
and al, 0xfc
call fcn.00524e70
mov eax, esp
push dword [ebp - 4]
push dword [ebp - 0x18]
push eax
call fcn.0053f142
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 0x18]
call fcn.005254b0
push dword [ebp - 4]
call fcn.00525390
add esp, 0xc
cmp dword [0x62ad58], ebx
je 0x4b173b
or ecx, 0xffffffff
jmp 0x4b1741
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
xor edx, edx
cmp dword [ebp + 8], 0xd
sete dl
push edx
push ecx
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x44]
push ebx
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.004b0989
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x44], ebx
je 0x4b188e
cmp dword [ebp - 0x1c], ebx
jne 0x4b1798
push ebx
push ebx
push ebx
push ebx
push 8
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0050cae7
mov dword [ebp - 0x1c], 1
mov eax, dword [0x62ad58]
neg eax
sbb eax, eax
push eax
lea eax, [ebp - 4]
push dword [esi + 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x9c0]
push eax
push dword [esi + 0x1c]
call fcn.004684ea
push dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x18]
sub eax, dword [ebp - 4]
add eax, dword [ebp - 0x38]
push 1
push dword [esi + 0x1c]
mov dword [ebp - 0x28], eax
call fcn.00463ca0
cmp dword [esi + 0x20c], ebx
je 0x4b17ee
mov eax, dword [ebp - 0x18]
add eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x9c0]
push ebx
push eax
mov eax, dword [ebp - 0x18]
cdq
add eax, dword [esi + 0xf0]
push ebx
push ebx
push 6
adc edx, dword [esi + 0xf4]
mov ecx, esi
push edx
push eax
call fcn.0050cae7
lea eax, [ebp - 0x9c0]
push eax
push ebx
push 0x506
push dword [esi + 0x1c]
call edi
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push dword [ebp - 0x24]
push ebx
push dword [esi + 0x1c]
call fcn.00463ca0
cmp dword [0x62ad58], ebx
je 0x4b188e
cmp dword [esi + 0x20c], ebx
je 0x4b1852
mov eax, dword [ebp - 0x24]
add eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x38], ebx
je 0x4b188e
lea eax, [ebp - 0x9c0]
push ebx
push eax
mov eax, dword [ebp - 0x24]
cdq
add eax, dword [esi + 0xf0]
push ebx
push ebx
push 6
adc edx, dword [esi + 0xf4]
mov ecx, esi
push edx
push eax
call fcn.0050cae7
lea eax, [ebp - 0x9c0]
push eax
push ebx
push 0x506
push dword [esi + 0x1c]
call edi
cmp dword [ebp + 8], 0xd
jne 0x4b1955
lea eax, [ebp - 0x9c0]
push 0x800
push eax
push dword [esi + 0x1c]
call fcn.00463841
cmp dword [esi + 0x20c], ebx
je 0x4b18bc
mov ecx, dword [ebp - 0x24]
add ecx, ecx
mov dword [ebp - 0x24], ecx
cmp eax, ebx
je 0x4b1916
cmp dword [ebp - 0x1c], ebx
jne 0x4b18df
push ebx
push ebx
push ebx
push ebx
push 8
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0050cae7
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x9c0]
push ebx
push eax
mov eax, dword [ebp - 0x24]
cdq
add eax, dword [esi + 0xf0]
push ebx
push ebx
push 6
adc edx, dword [esi + 0xf4]
mov ecx, esi
push edx
push eax
call fcn.0050cae7
lea eax, [ebp - 0x9c0]
push eax
push ebx
push 0x506
push dword [esi + 0x1c]
call edi
cmp dword [ebp - 0x3c], ebx
je 0x4b1955
cmp dword [ebp - 0x1c], ebx
jne 0x4b193a
push ebx
push ebx
push ebx
push ebx
push 8
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0050cae7
mov dword [ebp - 0x1c], 1
push 1
pop eax
push eax
push 9
push 0x102
mov dword [0x62ad60], eax
push dword [esi + 0x1c]
call edi
mov dword [0x62ad60], ebx
mov ecx, dword [0x62ae3c]
call fcn.00493613
cmp dword [0x5c46ec], ebx
je 0x4b197b
mov eax, dword [esi + 0x3c]
cmp dword [eax + 0x160], 0xffffffff
je 0x4b197b
mov ecx, esi
call fcn.004c404e
cmp dword [ebp - 0x1c], ebx
je 0x4b1993
push ebx
push ebx
push ebx
push ebx
push 9
mov ecx, esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0050cae7
cmp dword [esi + 0x1f4], ebx
je 0x4b19a9
mov ecx, esi
call fcn.004b59cb
mov ecx, esi
call fcn.004b58ae
mov ecx, esi
call fcn.004b7d99
mov edi, eax
mov ecx, edx
sub edi, dword [ebp - 0x4c]
sbb ecx, dword [ebp - 0x48]
mov eax, edi
mov dword [ebp - 0x2c], edi
or eax, ecx
mov dword [ebp - 0x28], ecx
je 0x4b19d8
push ecx
push edi
push dword [ebp - 0x10]
mov ecx, esi
push dword [ebp - 0x14]
call fcn.004b6803
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp + 0xc]
cmp ecx, ebx
mov dword [ebp - 0x1c], eax
jl 0x4b1a1b
jg 0x4b19e8
cmp edi, ebx
jbe 0x4b1a1b
cmp dword [ebp + 8], 0xd
jne 0x4b1a12
mov eax, dword [esi + 0x2b4]
cmp dword [eax + 0xd4], ebx
je 0x4b1a09
cmp dword [esi + 0x150], ebx
jne 0x4b1a09
mov dword [ebp - 0x1c], edi
jmp 0x4b1a74
mov dword [ebp - 0x1c], 2
jmp 0x4b1a74
mov dword [ebp - 0x1c], 1
jmp 0x4b1a74
cmp dword [ebp + 8], 8
je 0x4b1a5a
cmp dword [ebp + 8], 0x2e
je 0x4b1a5a
or edi, ecx
jne 0x4b1a35
cmp dword [ebp + 8], 0x1b
je 0x4b1ac5
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg edi
adc ecx, ebx
cdq
neg ecx
cmp eax, edi
jne 0x4b1a4d
cmp edx, ecx
je 0x4b1a74
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
jmp 0x4b1a74
cmp dword [ebp - 0x30], ebx
jne 0x4b1a71
mov eax, dword [ebp - 0x40]
cdq
push edx
push eax
push ecx
push edi
call fcn.005291e0
mov dword [ebp - 0x1c], eax
jmp 0x4b1a74
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x2c]
or eax, dword [ebp - 0x28]
jne 0x4b1aa1
cmp dword [ebp + 8], 0x1b
je 0x4b1ac5
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
push eax
cdq
mov ecx, eax
mov eax, dword [ebp - 0x30]
mov edi, edx
cdq
add ecx, eax
adc edi, edx
add ecx, dword [ebp - 0x14]
adc edi, dword [ebp - 0x10]
push edi
push ecx
push ebx
jmp 0x4b1ab6
mov eax, dword [ebp - 0x30]
push dword [ebp - 0xc]
cdq
add eax, dword [ebp - 0x14]
push dword [ebp - 0x1c]
adc edx, dword [ebp - 0x10]
push edx
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x10]
mov ecx, dword [esi + 0x3c]
push dword [ebp - 0x14]
push esi
call fcn.0046dc1d
cmp dword [esi + 0x298], ebx
je 0x4b1ae2
push ebx
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004bfd49
test eax, eax
jne 0x4b1b18
cmp dword [0x62ad44], ebx
je 0x4b1b0a
push dword [ebp + 8]
call fcn.00524015
test eax, eax
pop ecx
jne 0x4b1b0a
cmp dword [ebp + 8], 8
je 0x4b1b0a
cmp dword [ebp + 8], 0x1b
je 0x4b1b0a
mov ecx, esi
call fcn.004bf412
mov ecx, esi
call fcn.004ab21f
mov ecx, esi
call fcn.004bc3f3
lea esp, [ebp - 0x9cc]
pop edi
pop esi
pop ebx
leave
ret 0xc