Function at 0x404600
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x100
mov eax, dword [esp + 0x120]
push ebx
mov bl, byte [esp + 0x118]
push ebp
mov ebp, dword [esp + 0x120]
push esi
push edi
mov dword [esp + 0x24], 0x3fff
cmp eax, 0xffc3d44f
je 0x404641
cmp eax, 0xffc3d44e
je 0x404641
mov byte [esp + 0x12], 0
cmp eax, 0xffc3d44d
jne 0x404646
mov byte [esp + 0x12], 1
mov ecx, dword [0x4c2860]
test ecx, ecx
jne 0x40465d
lea edi, [esp + 0x3c]
mov dword [esp + 0x20], edi
jmp 0x404718
mov eax, dword [0x4c2864]
mov edi, eax
imul edi, edi, 0xd4
inc eax
add edi, ecx
mov dword [esp + 0x20], edi
mov dword [0x4c2864], eax
cmp eax, dword [0x4be3d8]
jl 0x404688
mov dword [0x4c2864], 0
mov al, byte [esp + 0x12c]
mov byte [edi], bl
mov byte [edi + 6], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, eax
sub ecx, dword [0x4c4df4]
mov dword [0x4c2868], eax
mov dword [esp + 0x38], ecx
fild dword [esp + 0x38]
jns 0x4046b7
fadd dword [0x4b8c80]
fdiv qword [0x4b8c78]
mov dword [0x4c4df4], eax
fstp dword [edi + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4046f9
cmp esi, dword [0x4c286c]
je 0x4046f1
mov eax, dword [0x4c1e48]
push esi
lea edx, [edi + 0xc]
push edx
push 0x418
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x404712
xor ecx, ecx
mov word [edi + 0xc], cx
jmp 0x404712
mov eax, 0x49e808
lea edx, [edi + 0xc]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x404703
mov dword [0x4c286c], esi
cmp bl, 0xe7
jne 0x404742
mov edx, dword [esp + 0x120]
mov ax, word [edx + 4]
mov ecx, 0x55
mov word [edi + 2], ax
mov word [edi + 4], cx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret
add bl, 0x64
mov word [edi + 2], bp
cmp bl, 3
ja 0x404757
xor ebp, ebp
mov dword [esp + 0x128], ebp
mov edx, dword [esp + 0x114]
cmp edx, dword [0x4c1f7c]
jne 0x404797
mov bl, byte [esp + 0x134]
and bl, 1
jne 0x404911
cmp byte [esp + 0x12c], bl
movzx ecx, byte [esp + 0x124]
setne al
dec al
and al, 0x80
mov byte [ecx + 0x4c1e68], al
jmp 0x404911
mov ebx, dword [esp + 0x134]
shr ebx, 4
and bl, 1
test ebp, 0x100
jne case.0x4047de.13
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je case.0x4047de.13
movzx eax, byte [esp + 0x124]
add eax, 0xfffffff4
cmp eax, 0x62
ja case.0x4047de.13
movzx edx, byte [eax + 0x406488]
jmp dword [edx*4 + 0x406458]
cmp byte [esp + 0x12c], 0
sete al
mov byte [0x4c0d3c], al
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete cl
mov byte [0x4c0d3d], cl
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete dl
mov byte [0x4c0d3e], dl
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete al
mov byte [0x4c0d3f], al
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete cl
mov byte [0x4c0d40], cl
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete dl
mov byte [0x4c0d41], dl
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete al
mov byte [0x4c0d42], al
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete cl
mov byte [0x4c0d43], cl
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete dl
mov byte [0x4c0d44], dl
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete al
mov byte [0x4c0d45], al
jmp case.0x4047de.13
cmp byte [esp + 0x12c], 0
sete cl
mov byte [0x4c0d46], cl
movzx esi, byte [esp + 0x124]
mov eax, dword [0x4c2884]
lea edx, [esi + esi*8]
shl edx, 5
cmp byte [edx + eax + 4], 0
jne 0x404911
test byte [esp + 0x134], 0x10
jne 0x404911
mov ecx, dword [esp + 0x12c]
mov al, byte [esp + 0x124]
push ecx
call fcn.004078a0
add esp, 4
test al, al
je 0x404911
cmp byte [esp + 0x12c], 0
setne dl
dec dl
and dl, 0x80
mov byte [esi + 0x4c1e68], dl
cmp byte [esp + 0x12], 0
je 0x40491c
mov al, 0x69
jmp 0x404928
neg bl
sbb bl, bl
and bl, 0x41
add bl, 0x20
mov al, bl
cmp byte [0x4c1f68], 0
cbw
mov word [edi + 4], ax
je 0x404989
mov al, byte [esp + 0x124]
cmp al, 0x5b
je 0x404946
cmp al, 0x5c
jne 0x404989
cmp byte [esp + 0x12c], 0
jne 0x404989
mov ecx, dword [esp + 0x124]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebp
push ecx
xor bl, bl
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0x138]
call fcn.00406580
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
cmp byte [0x4c0d5e], 0
je 0x404a48
cmp byte [esp + 0x124], 0x1b
jne 0x404a48
cmp byte [esp + 0x12c], 0
jne 0x404a48
push 0
push str.32771
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x404a48
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp esi, eax
jne 0x404a48
push 0xffc3d44d
push 0
push 0
push 0
push 0x1b
push 0
call fcn.0040ed30
mov dl, byte [0x4c1e45]
push 0xffc3d44d
shr dl, 3
push 0
and dl, 1
or dl, 0xa4
push 0
movzx eax, dl
push 0
push eax
push 1
call fcn.0040ed30
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x144]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebp
push 0x1b
xor bl, bl
call fcn.00406580
add esp, 0x48
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
mov edx, dword [0x4c2888]
movzx eax, bp
lea ecx, [eax + eax*8]
shl ecx, 5
mov dword [esp + 0x30], eax
lea eax, [ecx + edx]
mov edx, dword [0x4c1f78]
mov cl, byte [eax + 0x12]
mov byte [esp + 0x2c], cl
cmp dword [esp + 0x114], edx
jne 0x404a80
test cl, cl
je 0x404a80
mov esi, eax
mov dword [esp + 0x1c], eax
jmp 0x404a98
movzx eax, byte [esp + 0x124]
lea esi, [eax + eax*8]
shl esi, 5
add esi, dword [0x4c2884]
mov dword [esp + 0x1c], esi
cmp byte [esp + 0x12], 0
je 0x404afd
cmp dword [esp + 0x130], 0xffc3d44e
jne 0x404ad0
cmp byte [esp + 0x12c], 0
je 0x404ad0
cmp dword [0x4c0d60], esi
jne 0x404ad0
mov byte [esi + 0xc], 0
mov byte [esi + 0xf], 0
mov dword [0x4c0d60], 0
push 0
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x11c]
push 0x3fff
push edi
push eax
mov eax, dword [esp + 0x124]
push ecx
push edx
push eax
jmp 0x406432
cmp byte [esp + 0x12c], 0
jne 0x404b14
mov ecx, 0x3fff
mov byte [esi + 0x10], 0
mov word [esi + 6], cx
mov ebx, dword [esp + 0x114]
cmp ebx, edx
jne 0x404bdb
cmp byte [esp + 0x12c], 0
je 0x404c49
cmp byte [0x4c0d66], 0
mov al, byte [esp + 0x124]
je 0x404b45
cmp al, 0x5b
je 0x404b74
cmp byte [0x4c0d65], 0
je 0x404b52
cmp al, 0x5c
je 0x404b74
cmp byte [0x4c0d64], 0
je 0x404b5f
cmp al, 0xa4
je 0x404b74
cmp byte [0x4c0d5f], 0
je 0x404c49
cmp al, 0xa5
jne 0x404c49
movzx eax, al
add eax, 0xffffffa5
cmp eax, 0x4a
ja case.0x404b86.93
movzx edx, byte [eax + 0x406500]
jmp dword [edx*4 + 0x4064ec]
mov byte [0x4c0d66], 0
jmp case.0x404b86.93
mov byte [0x4c0d65], 0
jmp case.0x404b86.93
mov byte [0x4c0d64], 0
jmp case.0x404b86.93
mov byte [0x4c0d5f], 0
test byte [0x4c1e45], 3
jne 0x404c49
movzx eax, byte [0x4be385]
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 2
call fcn.0040ed30
add esp, 0x18
jmp 0x404c49
mov al, byte [esp + 0x124]
test al, al
jne 0x404c0e
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
push 0
push 0x3fff
push edi
push ecx
push edx
push eax
push ebx
xor cl, cl
jmp 0x406439
cmp al, 1
je 0x404c16
cmp al, 2
jne 0x404c49
cmp dword [0x4c1fd4], 0
jne 0x406405
push 0
push str.32768
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x404c49
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4c3f64]
je 0x406405
mov edx, dword [0x4c0d60]
mov ecx, dword [0x4c2884]
test edx, edx
je 0x404c85
cmp edx, esi
je 0x404c85
cmp byte [esp + 0x12c], 0
jne 0x404c85
cmp ebx, dword [0x4c1f78]
jne 0x404c79
xor eax, eax
cmp byte [esi + 4], al
sete al
jmp 0x404c7d
movzx eax, byte [edx + 4]
test eax, eax
je 0x404c85
mov byte [edx + 0x11], 1
cmp byte [esi + 8], 0
jne 0x404ca6
cmp byte [esi + 9], 0
jne 0x404ca6
mov ecx, dword [esp + 0x12c]
push 0
push 0x3fff
push edi
push ecx
jmp 0x406421
cmp byte [esp + 0x12c], 0
mov byte [esp + 0x2b], 0
mov dword [esp + 0x14], 0x3fff
mov dword [esp + 0x38], 0
je 0x404d00
mov al, byte [esi + 0xf]
mov dl, byte [esi + 0xc]
mov byte [esp + 0x13], al
movzx eax, word [esi + 6]
mov byte [esp + 0x1b], dl
mov edx, 0x3fff
mov byte [esi + 0xf], 0
cmp ax, dx
je 0x404cf2
mov dword [esp + 0x14], eax
mov byte [esp + 0x2b], 1
mov word [esi + 6], dx
mov edx, dword [0x4c0d60]
cmp byte [esp + 0x12c], 0
sete al
mov byte [esi + 0xc], al
mov eax, dword [0x4c1f78]
mov byte [esp + 0x12], 0
cmp ebx, eax
jne 0x404d89
cmp byte [esi + 4], 0
je 0x404dac
cmp byte [ecx + 0xb64c], 0
jne 0x404d34
cmp byte [ecx + 0xb76c], 0
jne 0x404d34
xor eax, eax
jmp 0x404d39
mov eax, 1
cmp byte [ecx + 0xb88c], 0
mov byte [ecx + 0x132c], al
jne 0x404d55
cmp byte [ecx + 0xb9ac], 0
jne 0x404d55
xor eax, eax
jmp 0x404d5a
mov eax, 1
cmp byte [ecx + 0xb40c], 0
mov byte [ecx + 0x144c], al
jne 0x404d7c
cmp byte [ecx + 0xb52c], 0
jne 0x404d7c
xor eax, eax
mov byte [ecx + 0x120c], al
jmp 0x404dac
mov eax, 1
mov byte [ecx + 0x120c], al
jmp 0x404dac
test eax, eax
jne 0x404dac
push 1
call fcn.00411330
mov edx, dword [0x4c0d60]
add esp, 4
mov byte [0x4c1e46], al
mov byte [0x4c1e45], al
mov byte [esp + 0x12], 1
mov eax, dword [esi]
test eax, eax
je 0x404dbc
cmp dword [eax], 7
mov byte [esp + 0x19], 1
je 0x404dc1
mov byte [esp + 0x19], 0
mov al, byte [esi + 8]
test al, al
je 0x404f43
cmp byte [esp + 0x12c], 0
jne 0x404f43
test edx, edx
je 0x404dec
cmp byte [esi + 9], 0
je 0x404dec
cmp esi, edx
jne 0x404f43
cmp al, 1
jne 0x404e19
cmp byte [esp + 0x2c], 0
mov eax, dword [esp + 0x30]
jne 0x404e03
movzx eax, byte [esp + 0x124]
mov ecx, dword [esp + 0x2c]
push ecx
push eax
call fcn.00409bb0
add esp, 8
test al, al
je 0x404e19
mov bl, 1
jmp 0x404e2c
xor bl, bl
cmp esi, dword [0x4c0d60]
je 0x404e2c
mov dword [0x4c0d60], esi
mov byte [esi + 0x11], bl
cmp byte [esi + 9], 0
je 0x404ee2
cmp byte [esp + 0x12], 0
jne 0x404e4c
push 1
mov byte [esp + 0x16], 1
call fcn.00411330
add esp, 4
mov al, byte [esi + 4]
mov cl, byte [0x4c1e46]
test al, al
je 0x404e5d
not al
and cl, al
test cl, cl
jne 0x404e65
test bl, bl
je 0x404ee2
mov edx, dword [0x4c1f78]
cmp dword [esp + 0x114], edx
jne 0x404e91
cmp byte [esp + 0x2c], 0
je 0x404e91
movzx eax, cl
mov ecx, dword [0x4c287c]
shl eax, 9
add eax, dword [esp + 0x30]
movzx ecx, word [ecx + eax*2]
jmp 0x404eab
movzx eax, byte [esp + 0x124]
movzx edx, cl
mov ecx, dword [0x4c2878]
shl edx, 8
add edx, eax
movzx ecx, word [ecx + edx*2]
mov dword [esp + 0x14], ecx
test ecx, 0x4000
je 0x404ebd
mov word [esi + 6], cx
jmp 0x404ef0
mov edx, dword [0x4bf5c4]
mov eax, ecx
and eax, 0x3fff
cmp ax, word [edx]
jae 0x404ee6
mov edx, dword [0x4c2880]
movzx eax, ax
mov ax, word [edx + eax*2]
mov word [esi + 6], ax
jmp 0x404ee6
mov ecx, dword [esp + 0x14]
mov edx, 0x3fff
cmp cx, dx
jne 0x404f43
test bl, bl
je 0x404f01
or byte [esi + 0xb], 8
mov eax, 0x23
mov word [edi + 4], ax
cmp byte [esi + 4], 0
jne 0x404f1c
test byte [esi + 0xb], 1
jne 0x404f1c
cmp byte [esp + 0x19], 0
jne 0x404f1c
test bl, bl
je 0x404950
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
push 0
push 0x3fff
push edi
push 0
push edx
push eax
push ecx
jmp 0x406432
cmp byte [esi + 9], 0
mov edx, dword [esp + 0x12c]
mov byte [esp + 0x1a], 0
je 0x404fea
test dl, dl
je 0x404fea
cmp dword [0x4c0d60], esi
jne 0x404f7a
cmp byte [esp + 0x13], 0
je 0x404fea
mov dword [0x4c0d60], 0
cmp byte [esi + 0xa], 0
jne 0x404fe5
mov al, byte [esi + 0xb]
test al, 8
je 0x404f90
xor cl, cl
and al, 0xf7
mov byte [esi + 0xb], al
jmp 0x404f92
mov cl, 1
cmp byte [esp + 0x13], 0
je 0x404fbf
test cl, cl
je 0x404fbf
mov edx, dword [esp + 0x124]
mov bl, byte [esp + 0x12c]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebp
push edx
jmp 0x404968
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
push 0
push 0x3fff
push edi
push edx
mov edx, dword [esp + 0x124]
push eax
push ecx
push edx
jmp 0x406432
mov byte [esp + 0x1a], 1
cmp byte [esi + 8], 0
je 0x40520c
test dl, dl
je 0x40520c
cmp dword [0x4c0d60], esi
jne 0x40500e
mov dword [0x4c0d60], 0
cmp byte [esi + 0xd], 0
je 0x40502f
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
mov byte [esi + 0xd], 0
call fcn.0040ed30
add esp, 0x18
cmp byte [esi + 0xe], 0
mov ebx, dword [0x4c2884]
je 0x40505c
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
mov byte [esi + 0xe], 0
call fcn.0040ed30
mov ebx, dword [0x4c2884]
add esp, 0x18
mov ecx, dword [esp + 0x14]
mov eax, 0x3fff
cmp cx, ax
jne 0x4050a3
mov al, byte [esi + 0xb]
test al, 8
je 0x4050a3
and al, 0xf7
mov byte [esi + 0xb], al
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
push 0
push 0x3fff
push edi
push ecx
mov ecx, dword [esp + 0x124]
push edx
push eax
push ecx
jmp 0x406432
cmp byte [esp + 0x19], 0
mov al, byte [esi + 0x11]
je 0x40514c
cmp al, 2
jne 0x405117
mov esi, dword [esp + 0x124]
push 0xffc3d44e
push 0
push 0
push ebp
push esi
push 1
call fcn.0040ed30
push 0xffc3d44d
push 0
push 0
push ebp
push esi
push 2
call fcn.0040ed30
push 0
push SysReAllocString
push 0x3fff
push edi
push ebp
mov bl, byte [esp + 0x170]
mov eax, dword [esp + 0x164]
mov ecx, dword [esp + 0x158]
push esi
call fcn.00406580
add esp, 0x48
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
cmp al, 1
jne 0x4051b3
push 0
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
push 0x3fff
push edi
push edx
mov edx, dword [esp + 0x124]
push eax
push ecx
push edx
jmp 0x406432
test al, al
je 0x4051b3
mov edx, 0x3fff
cmp cx, dx
jne 0x4051b3
cmp byte [esi + 4], 0
je 0x40516f
cmp al, 2
jne 0x405076
push 1
jmp 0x404ad2
test byte [esi + 0xb], 1
push 0
jne 0x405121
mov eax, dword [esp + 0x128]
push SysReAllocString
push 0x3fff
push edi
push ebp
push eax
mov bl, byte [esp + 0x144]
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0x138]
call fcn.00406580
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
cmp byte [esi + 9], 0
jne 0x4051fa
cmp byte [esi + 4], 0
jne 0x40511f
test byte [esi + 0xb], 1
jne 0x40511f
cmp byte [esp + 0x19], 0
jne 0x40511f
mov ecx, dword [esp + 0x124]
mov bl, byte [esp + 0x12c]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebp
push ecx
jmp 0x404968
cmp byte [esp + 0x1b], 0
jne 0x405212
cmp byte [esi + 0xa], 0
jne 0x405212
jmp 0x404ad0
mov ebx, dword [0x4c2884]
cmp byte [esp + 0x12], 0
mov esi, dword [esp + 0x14]
jne 0x405237
mov ecx, 0x3fff
cmp si, cx
jne 0x405237
push 1
call fcn.00411330
mov ebx, dword [0x4c2884]
add esp, 4
cmp dword [0x4c0d60], 0
mov byte [esp + 0x13], 0
je 0x405902
cmp byte [esp + 0x12c], 0
je 0x405261
mov edx, dword [esp + 0x1c]
cmp byte [edx + 0xa], 0
je 0x405902
mov eax, 0x3fff
cmp si, ax
jne 0x405b8e
mov edi, dword [esp + 0x1c]
xor ebp, ebp
cmp byte [edi + 0x13], 0
jbe 0x405370
lea esi, [edi + 0x16]
mov cl, byte [esi]
movzx eax, cl
lea edx, [eax + eax*8]
shl edx, 5
cmp byte [edx + ebx + 0xc], 0
je 0x4052cf
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x4052bb
cmp byte [esp + 0x12c], 0
jne 0x4052dd
mov word [edi + 6], ax
mov eax, 0x3fff
cmp word [esp + 0x14], ax
jne 0x4052f7
jmp 0x4052cf
cmp byte [esp + 0x12c], 0
jne 0x4052cf
mov edx, eax
mov dword [esp + 0x14], edx
mov byte [esp + 0x12], cl
movzx eax, byte [edi + 0x13]
inc ebp
add esi, 4
cmp ebp, eax
jl 0x405282
jmp 0x4052eb
movzx ecx, word [esi + 2]
mov dl, byte [esi]
mov dword [esp + 0x14], ecx
mov byte [esp + 0x12], dl
mov eax, 0x3fff
cmp word [esp + 0x14], ax
je 0x405370
movzx ecx, byte [esp + 0x12]
mov eax, ecx
sub eax, 0x10
je 0x405354
dec eax
je 0x405338
dec eax
je 0x40531c
lea ecx, [ecx + ecx*8]
shl ecx, 5
add ecx, ebx
mov dword [0x4c0d60], ecx
jmp 0x405415
xor eax, eax
cmp byte [ebx + 0xb9ac], al
setne al
lea eax, [eax + eax*8 + 0x5c4]
shl eax, 5
add eax, ebx
jmp 0x405410
xor eax, eax
cmp byte [ebx + 0xb76c], al
setne al
lea eax, [eax + eax*8 + 0x5b2]
shl eax, 5
add eax, ebx
jmp 0x405410
xor eax, eax
cmp byte [ebx + 0xb52c], al
setne al
lea eax, [eax + eax*8 + 0x5a0]
shl eax, 5
add eax, ebx
jmp 0x405410
xor ebp, ebp
cmp byte [edi + 0x14], 0
jbe 0x405425
lea esi, [edi + 0xde]
movzx ecx, word [esi]
mov eax, ecx
lea edx, [eax + eax*8]
mov eax, dword [0x4c2888]
shl edx, 5
cmp byte [edx + eax + 0xc], 0
je 0x4053d6
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x4053c0
cmp byte [esp + 0x12c], 0
jne 0x4053e4
mov ecx, 0x3fff
mov word [edi + 6], ax
cmp word [esp + 0x14], cx
jne 0x4053ff
jmp 0x4053d6
cmp byte [esp + 0x12c], 0
jne 0x4053d6
mov edx, eax
mov eax, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], eax
movzx ecx, byte [edi + 0x14]
inc ebp
add esi, 4
cmp ebp, ecx
jl 0x405382
jmp 0x4053f3
movzx edx, word [esi + 2]
movzx eax, word [esi]
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], eax
mov ecx, 0x3fff
cmp word [esp + 0x14], cx
je 0x405425
movzx eax, word [esp + 0x34]
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4c2888]
mov dword [0x4c0d60], eax
mov edx, 0x3fff
cmp word [esp + 0x14], dx
jne case.default.0x40543b
movzx eax, byte [esp + 0x124]
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x40543b
jmp dword [eax*4 + 0x40654c]
mov al, 0x11
jmp 0x40544c
mov al, 0x12
jmp 0x40544c
mov al, 0x10
movzx eax, al
lea edx, [eax + eax*8]
shl edx, 5
movzx ebp, byte [edx + ebx + 0x13]
add edx, ebx
xor edi, edi
test ebp, ebp
jle 0x4054d2
lea esi, [edx + 0x16]
mov cl, byte [esi]
movzx eax, cl
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x4054ba
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x4054a2
cmp byte [esp + 0x12c], 0
jne 0x4054c4
mov ecx, dword [esp + 0x1c]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp word [esp + 0x14], ax
jne 0x4054de
jmp 0x4054ba
cmp byte [esp + 0x12c], 0
mov ebx, dword [0x4c2884]
jne 0x4054ba
mov dword [esp + 0x14], eax
mov byte [esp + 0x12], cl
inc edi
add esi, 4
cmp edi, ebp
jl 0x405465
jmp 0x4054d2
movzx ecx, word [esi + 2]
mov al, byte [esi]
mov dword [esp + 0x14], ecx
mov byte [esp + 0x12], al
mov ecx, 0x3fff
cmp word [esp + 0x14], cx
je 0x405557
movzx ecx, byte [esp + 0x12]
mov eax, ecx
sub eax, 0x10
je 0x40553b
dec eax
je 0x40551f
dec eax
je 0x405503
lea ecx, [ecx + ecx*8]
shl ecx, 5
add ecx, ebx
mov dword [0x4c0d60], ecx
jmp case.default.0x40543b
xor eax, eax
cmp byte [ebx + 0xb9ac], al
setne al
lea eax, [eax + eax*8 + 0x5c4]
shl eax, 5
add eax, ebx
jmp 0x4055d4
xor eax, eax
cmp byte [ebx + 0xb76c], al
setne al
lea eax, [eax + eax*8 + 0x5b2]
shl eax, 5
add eax, ebx
jmp 0x4055d4
xor eax, eax
cmp byte [ebx + 0xb52c], al
setne al
lea eax, [eax + eax*8 + 0x5a0]
shl eax, 5
add eax, ebx
jmp 0x4055d4
movzx ebp, byte [edx + 0x14]
xor edi, edi
test ebp, ebp
jle case.default.0x40543b
lea esi, [edx + 0xde]
mov edx, dword [esp + 0x14]
jmp 0x405570
movzx ecx, word [esi]
mov ebx, dword [0x4c2888]
mov eax, ecx
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x40567b
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x40566b
cmp byte [esp + 0x12c], 0
jne 0x405689
mov ecx, dword [esp + 0x1c]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp dx, ax
je 0x40567b
mov dword [esp + 0x14], edx
movzx eax, word [esp + 0x34]
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4c2888]
mov dword [0x4c0d60], eax
mov eax, dword [esp + 0x14]
mov esi, eax
mov ecx, 0x3fff
and esi, 0x3fff
cmp ax, cx
je 0x4056bf
mov edx, dword [0x4bf5c4]
cmp si, word [edx]
jae 0x4056b5
mov ebx, dword [esp + 0x12c]
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x130]
lea eax, [esp + 0x14]
push ebx
push eax
add ecx, 0xb
lea esi, [ebp + 4]
lea eax, [esp + 0x1b]
call fcn.00409e00
add esp, 8
mov dword [esp + 0x38], eax
test eax, eax
jne 0x4056ab
push eax
push 0x3fff
push ebp
push ebx
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x124]
push ecx
mov cl, byte [esp + 0x138]
push edx
push eax
mov eax, dword [esp + 0x144]
jmp 0x40643b
cmp byte [esp + 0x12c], 0
jne 0x40567b
mov edx, eax
mov dword [esp + 0x34], ecx
inc edi
add esi, 4
cmp edi, ebp
jl 0x405570
jmp 0x405694
movzx eax, word [esi]
movzx edx, word [esi + 2]
mov dword [esp + 0x34], eax
mov ecx, 0x3fff
mov dword [esp + 0x14], edx
cmp dx, cx
je case.default.0x40543b
jmp 0x4055c3
mov esi, dword [esp + 0x14]
and esi, 0x3fff
mov ecx, dword [0x4c0d60]
mov byte [ecx + 0x11], 2
mov edx, 0x3ffe
cmp si, dx
je 0x4056d7
mov eax, 0x3ffd
cmp si, ax
jne 0x405902
cmp byte [esp + 0x12c], 0
jne 0x4056e9
mov ecx, dword [esp + 0x1c]
mov byte [ecx + 0xf], 1
test byte [0x4c1e45], 0xc
jne 0x405709
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040ed30
add esp, 0x18
mov al, byte [esp + 0x124]
cmp al, 0xa2
je 0x405718
cmp al, 0xa3
jne 0x405745
cmp byte [esp + 0x12c], 0
jne 0x405745
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x124]
push 0xffc3d44d
push 0
push 0
push edx
push eax
push 1
call fcn.0040ed30
add esp, 0x18
mov ecx, dword [0x4c0d60]
mov edx, 0x3ffd
mov byte [ecx + 0xd], 1
cmp si, dx
jne 0x405787
test byte [0x4c1e45], 0x30
jne 0x405779
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 0
call fcn.0040ed30
add esp, 0x18
mov eax, dword [0x4c0d60]
mov byte [eax + 0xe], 1
jmp 0x405817
mov ecx, 0x3ffe
cmp si, cx
jne 0x405817
mov al, byte [esp + 0x124]
cmp al, 0xa0
je 0x4057a4
cmp al, 0xa1
jne 0x4057d1
cmp byte [esp + 0x12c], 0
jne 0x4057d1
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x124]
push 0xffc3d44d
push 0
push 0
push edx
push eax
push 1
call fcn.0040ed30
add esp, 0x18
test byte [0x4c1e45], 0x10
je 0x4057f4
push 0xffc3d44d
push 0
push 0
push 0
push 0xa0
push 1
call fcn.0040ed30
add esp, 0x18
test byte [0x4c1e45], 0x20
je 0x405817
push 0xffc3d44d
push 0
push 0
push 0
push 0xa1
push 1
call fcn.0040ed30
add esp, 0x18
test byte [0x4c1e45], 1
je 0x40583a
push 0xffc3d44d
push 0
push 0
push 0
push 0xa2
push 1
call fcn.0040ed30
add esp, 0x18
test byte [0x4c1e45], 2
je 0x40585d
push 0xffc3d44d
push 0
push 0
push 0
push 0xa3
push 1
call fcn.0040ed30
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040ed30
mov ecx, 0x3ffd
add esp, 0x18
cmp si, cx
jne 0x4058bd
mov edx, dword [0x4c0d60]
cmp byte [edx + 0xe], 0
je 0x4058bd
mov al, byte [esp + 0x124]
cmp al, 0x60
jb 0x405899
cmp al, 0x69
jbe 0x40589d
cmp al, 0x6e
jne 0x4058bd
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
call fcn.0040ed30
mov eax, dword [0x4c0d60]
add esp, 0x18
mov byte [eax + 0xe], 0
cmp byte [esp + 0x12c], 0
mov eax, dword [esp + 0x20]
mov ecx, 0x68
mov word [eax + 4], cx
jne 0x4058dc
mov edx, dword [esp + 0x1c]
mov byte [edx + 0x10], 1
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
push 0
push SysReAllocString
push 0x3fff
push eax
push ecx
push edx
jmp 0x40518b
mov esi, dword [esp + 0x14]
mov eax, 0x3fff
cmp si, ax
jne 0x405b8e
mov edi, dword [esp + 0x1c]
mov cl, byte [edi + 4]
mov al, byte [0x4c1e46]
test cl, cl
je 0x405928
not cl
and al, cl
mov ebp, dword [esp + 0x114]
mov edx, dword [0x4c1f78]
cmp ebp, edx
jne 0x40595d
cmp byte [esp + 0x2c], 0
je 0x40595d
mov esi, dword [0x4c287c]
movzx ecx, al
shl ecx, 9
add ecx, dword [esp + 0x30]
movzx esi, word [esi + ecx*2]
mov cl, byte [esp + 0x124]
jmp 0x405979
mov cl, byte [esp + 0x124]
movzx esi, al
movzx ebx, cl
shl esi, 8
add esi, ebx
mov ebx, dword [0x4c2878]
movzx esi, word [ebx + esi*2]
mov ebx, 0x3fff
mov dword [esp + 0x14], esi
cmp si, bx
jne 0x4059ee
cmp byte [0x4c0d5e], 0
je 0x4059ee
cmp cl, 9
je 0x4059ee
and al, 0xf3
cmp ebp, edx
jne 0x4059b7
cmp byte [esp + 0x2c], 0
je 0x4059b7
movzx edx, al
mov eax, dword [0x4c287c]
shl edx, 9
add edx, dword [esp + 0x30]
movzx esi, word [eax + edx*2]
jmp 0x4059cc
movzx edx, al
movzx eax, cl
mov ecx, dword [0x4c2878]
shl edx, 8
add edx, eax
movzx esi, word [ecx + edx*2]
mov eax, esi
and eax, 0x3fff
mov ecx, 0x3ff9
mov dword [esp + 0x14], esi
cmp ax, cx
jbe 0x4059e8
mov edx, ebx
cmp ax, dx
jb 0x4059ee
mov esi, ebx
mov dword [esp + 0x14], esi
test esi, 0x4000
je 0x405a48
cmp byte [esp + 0x12c], 0
jne 0x405aab
mov word [edi + 6], si
lea eax, [edi + 6]
mov ecx, ebx
cmp word [eax], cx
jne 0x405b44
mov edx, dword [esp + 0x20]
push 0
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
push 0x3fff
push edx
push 0
push eax
mov eax, dword [esp + 0x13c]
push ecx
mov cl, byte [esp + 0x13c]
push ebp
jmp 0x40643b
mov eax, ebx
cmp si, ax
je 0x405ab6
mov eax, esi
and eax, 0x3fff
cmp byte [esp + 0x12c], 0
je 0x405a90
mov edx, dword [0x4bf5c4]
cmp ax, word [edx]
jae 0x405a87
mov ecx, dword [0x4c2880]
movzx eax, ax
movzx eax, word [ecx + eax*2]
mov edx, ebx
cmp ax, dx
je 0x405a87
mov esi, eax
mov dword [esp + 0x14], esi
jmp 0x405aab
cmp byte [esp + 0x1a], 0
jne 0x405ab6
jmp 0x405aab
mov ecx, dword [0x4bf5c4]
cmp ax, word [ecx]
jae 0x405aab
movzx edx, ax
mov eax, dword [0x4c2880]
mov cx, word [eax + edx*2]
mov word [edi + 6], cx
mov edx, ebx
cmp si, dx
jne 0x405b8e
cmp byte [esp + 0x12c], 0
je 0x405a08
cmp byte [edi + 4], 0
jne 0x405b0c
test byte [edi + 0xb], 1
jne 0x405b0c
cmp byte [edi + 8], 0
je 0x405b0c
cmp byte [esp + 0x19], 0
jne 0x405b0c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
mov bl, byte [esp + 0x12c]
push 0
push SysReAllocString
push 0x3fff
push eax
push ecx
push edx
mov ecx, ebp
jmp 0x40496f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x11c]
push 0
push 0x3fff
push eax
mov eax, dword [esp + 0x124]
push ecx
mov cl, byte [esp + 0x134]
push edx
push eax
mov eax, dword [esp + 0x140]
push ebp
jmp 0x40643b
push 1
lea ecx, [edi + 0xb]
push eax
xor esi, esi
lea eax, [esp + 0x1b]
xor edi, edi
call fcn.00409e00
mov edx, dword [esp + 0x28]
add esp, 8
cmp byte [esp + 0x13], 0
push edi
jne 0x405a1c
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x128]
push SysReAllocString
push 0x3fff
push edx
push eax
push ecx
xor bl, bl
mov ecx, ebp
jmp 0x405199
mov ebp, dword [esp + 0x1c]
mov al, byte [ebp + 0xb]
add ebp, 0xb
mov dword [esp + 0x34], ebp
test al, 8
je 0x405bb4
cmp byte [esp + 0x12c], 0
je 0x405bb4
and al, 0xf7
mov byte [esp + 0x13], 1
mov byte [ebp], al
mov edx, dword [0x4bf5c4]
mov ebx, dword [esp + 0x20]
and esi, 0x3fff
cmp si, word [edx]
jae 0x405cf0
cmp dword [esp + 0x38], 0
jne 0x405cf0
mov eax, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
push eax
lea ecx, [esp + 0x18]
push ecx
lea esi, [ebx + 4]
lea eax, [esp + 0x1b]
mov ecx, ebp
call fcn.00409e00
add esp, 8
mov dword [esp + 0x38], eax
test eax, eax
jne 0x405cf0
cmp byte [esp + 0x12c], al
je 0x405c58
mov edx, dword [esp + 0x1c]
push eax
cmp byte [edx + 0x10], al
je 0x405c45
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x128]
push SysReAllocString
push 0x3fff
mov eax, ebx
mov bl, byte [esp + 0x138]
push eax
push ecx
push edx
jmp 0x404968
mov eax, dword [esp + 0x130]
push 0x3fff
push ebx
push eax
jmp 0x405640
mov eax, dword [esp + 0x1c]
add eax, 6
mov ecx, 0x3fff
cmp word [eax], cx
jne 0x405c9e
push 0
mov edx, dword [esp + 0x120]
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
push 0x3fff
push ebx
push 0
push edx
push eax
mov eax, dword [esp + 0x140]
push ecx
mov cl, byte [esp + 0x140]
jmp 0x40643b
push 1
push eax
xor esi, esi
lea eax, [esp + 0x1b]
mov ecx, ebp
xor edi, edi
mov byte [esp + 0x1b], 0
call fcn.00409e00
add esp, 8
cmp byte [esp + 0x13], 0
push edi
jne 0x405c6b
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x12c]
and byte [ebp], 0xf7
push SysReAllocString
push 0x3fff
push eax
mov byte [edx + 0x10], 1
mov edx, dword [esp + 0x134]
push ecx
push edx
jmp 0x404966
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x114]
mov esi, dword [0x4c1f78]
mov dl, byte [0x4c1e45]
and ebp, 0x3fff
cmp edi, esi
jne 0x405d46
test dl, 0x3f
jne 0x405d67
mov eax, dword [0x4c2884]
test dl, 0x40
je 0x405d30
cmp byte [eax + 0x6668], 0
jne 0x405d30
mov byte [0x4c0d66], 1
test dl, dl
jns 0x405d6c
cmp byte [eax + 0x6788], 0
jne 0x405d6c
mov byte [0x4c0d65], 1
jmp 0x405d6c
test dl, 0xc
jne 0x405d67
mov eax, dword [0x4c2884]
test dl, 0x40
je 0x405d30
cmp byte [eax + 0x6668], 0
jne 0x405d30
mov byte [0x4c0d66], 1
jmp 0x405d6c
mov eax, dword [0x4c2884]
test dl, 4
je 0x405d9c
cmp byte [eax + 0xb888], 0
jne 0x405d9c
test esi, esi
je 0x405d87
mov byte [0x4c0d64], 1
jmp 0x405de8
movzx eax, byte [0x4be385]
push 0xffc3d44d
push 0
push 0
push 0
push eax
jmp 0x405dd8
test dl, 8
je 0x405de8
cmp byte [eax + 0xb9a8], 0
jne 0x405de8
call fcn.00411890
test al, al
jne 0x405de2
cmp dword [0x4c1f78], 0
je 0x405dc5
mov byte [0x4c0d5f], 1
jmp 0x405de2
movzx ecx, byte [0x4be385]
push 0xffc3d44d
push 0
push 0
push 0
push ecx
push 2
call fcn.0040ed30
add esp, 0x18
mov dl, byte [0x4c1e45]
mov eax, ebp
lea ecx, [eax - 0x3ffa]
cmp ecx, 4
ja case.default.0x405df9
jmp dword [ecx*4 + 0x406564]
cmp byte [0x4c0d5e], 0
jne case.0x405df9.16379
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
push 0
push 0x3fff
push ebx
push edx
push eax
mov eax, dword [esp + 0x13c]
push ecx
mov cl, byte [esp + 0x13c]
push edi
jmp 0x40643b
xor al, al
mov byte [esp + 0x12], al
test dl, 4
je 0x405e4c
mov al, 0xa4
jmp 0x405e53
test dl, 8
je 0x405e57
mov al, 0xa5
mov byte [esp + 0x12], al
cmp byte [0x4c0d5e], 0
je 0x405ed5
mov ecx, 0x3ffb
cmp bp, cx
je case.0x405df9.16381
test al, al
movzx eax, al
jne 0x405e7a
mov eax, 0x12
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040ed30
mov edx, dword [esp + 0x34]
add esp, 0x18
cmp byte [edx + 4], 0
je 0x405ec9
mov eax, dword [esp + 0x124]
cmp al, 0x5b
je 0x405ec9
cmp al, 0x5c
je 0x405ec9
cmp byte [esp + 0x12c], 0
jne 0x405ec9
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040ed30
add esp, 0x18
mov byte [0x4c0d5e], 0
jmp 0x406174
mov al, byte [esp + 0x124]
cmp al, 0xa4
je 0x405ee9
mov byte [esp + 0x1a], 0
cmp al, 0xa5
jne 0x405eee
mov byte [esp + 0x1a], 1
cmp al, 0xa0
je 0x405efa
cmp al, 0xa1
je 0x405efa
xor cl, cl
jmp 0x405efc
mov cl, 1
mov byte [esp + 0x1b], cl
cmp al, 0xa2
je 0x405f0c
cmp al, 0xa3
je 0x405f0c
xor dl, dl
jmp 0x405f0e
mov dl, 1
xor al, al
test byte [0x4c1e45], 0x10
mov byte [esp + 0x30], al
je 0x405f21
mov al, 0xa0
jmp 0x405f43
test byte [0x4c1e45], 0x20
je 0x405f2e
mov al, 0xa1
jmp 0x405f43
cmp byte [esp + 0x12c], 0
jne 0x405f47
test cl, cl
je 0x405f47
mov al, byte [esp + 0x124]
mov byte [esp + 0x30], al
mov cl, byte [0x4c1e45]
mov byte [esp + 0x2c], 0
test cl, 1
je 0x405f5e
mov byte [esp + 0x2c], 0xa2
jmp 0x405f83
test cl, 2
je 0x405f6a
mov byte [esp + 0x2c], 0xa3
jmp 0x405f83
cmp byte [esp + 0x12c], 0
jne 0x405f83
test dl, dl
je 0x405f83
mov cl, byte [esp + 0x124]
mov byte [esp + 0x2c], cl
mov esi, dword [esp + 0x30]
xor bl, bl
test al, al
je 0x405fa5
push 0xffc3d44d
push 0
push 0
push 0
push esi
push 1
call fcn.0040ed30
add esp, 0x18
mov bl, 1
cmp byte [esp + 0x2c], 0
je 0x405fc6
mov edx, dword [esp + 0x2c]
push 0xffc3d44d
push 0
push 0
push 0
push edx
push 1
call fcn.0040ed30
add esp, 0x18
cmp byte [esp + 0x1a], 0
je 0x405fe0
cmp byte [esp + 0x12c], 0
jne 0x405fe8
mov al, byte [esp + 0x124]
jmp 0x405fe4
mov al, byte [esp + 0x12]
test al, al
jne 0x405fff
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040ed30
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040ed30
add esp, 0x18
test bl, bl
je 0x406037
cmp byte [esp + 0x1b], 0
jne 0x406037
push 0xffc3d44d
push 0
push 0
push 0
push esi
push 0
call fcn.0040ed30
add esp, 0x18
mov byte [0x4c0d5e], 1
jmp 0x406174
cmp byte [0x4c0d5e], 0
jne 0x406080
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push 0
push 0x3fff
push ebx
push eax
mov eax, dword [esp + 0x138]
push ecx
mov cl, byte [esp + 0x138]
push edx
push edi
jmp 0x40643b
cmp byte [esp + 0x12c], 0
mov al, byte [esp + 0x124]
jne 0x4060cb
cmp al, 0xa2
je 0x4060a1
cmp al, 0xa3
je 0x4060a1
cmp al, 0xa0
je 0x4060a1
cmp al, 0xa1
jne 0x4060cb
mov eax, dword [esp + 0x124]
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040ed30
mov dl, byte [0x4c1e45]
mov al, byte [esp + 0x13c]
add esp, 0x18
test dl, 0xc
je 0x4060e2
cmp byte [esp + 0x12c], 0
je 0x4060f9
cmp al, 0xa4
je 0x4060e2
cmp al, 0xa5
jne 0x4060f9
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040ed30
add esp, 0x18
mov ecx, 0x3ffd
xor bl, bl
cmp bp, cx
jne 0x406127
test byte [0x4c1e45], 0x30
jne 0x406127
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 0
call fcn.0040ed30
add esp, 0x18
mov bl, 1
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040ed30
add esp, 0x18
test bl, bl
je 0x406174
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
call fcn.0040ed30
add esp, 0x18
jmp 0x406174
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
cmp byte [eax + 0x1e], 5
jne 0x406174
movzx edx, word [eax + 0x1c]
shl edx, 0x10
or dword [esp + 0x24], edx
cmp byte [esp + 0x19], 0
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x1c]
mov eax, 0x68
mov word [ebp + 4], ax
je 0x4061e6
test bl, bl
je 0x406344
cmp byte [edi + 8], 0
je 0x4061e6
mov edi, dword [esp + 0x128]
mov esi, dword [esp + 0x124]
push 0xffc3d44e
push 0
push 0
push edi
push esi
push 1
call fcn.0040ed30
push 0xffc3d44d
push 0
push 0
push edi
push esi
push 2
call fcn.0040ed30
mov ecx, dword [esp + 0x54]
push 0
push SysReAllocString
push ecx
push ebp
push edi
jmp 0x4050ee
test bl, bl
je 0x406344
cmp byte [edi + 4], 0
je 0x406253
cmp byte [edi + 0x10], 0
mov edx, dword [esp + 0x24]
je 0x406223
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
mov bl, byte [esp + 0x12c]
push 0
push SysReAllocString
push edx
push ebp
push eax
push ecx
jmp 0x404968
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
push 1
push edx
mov edx, dword [esp + 0x11c]
push ebp
push ebx
push eax
mov eax, dword [esp + 0x13c]
push ecx
mov cl, byte [esp + 0x13c]
push edx
jmp 0x40643b
cmp byte [esp + 0x13], 0
jne 0x406267
mov eax, dword [esp + 0x34]
test byte [eax], 1
je 0x4063d4
mov esi, dword [esp + 0x114]
cmp esi, dword [0x4c1f7c]
jne 0x4062a3
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
push 0
push ecx
mov cl, byte [esp + 0x12c]
push ebp
push ebx
push edx
push eax
mov eax, dword [esp + 0x140]
push esi
jmp 0x40643b
mov eax, dword [edi]
test eax, eax
je 0x4062b2
cmp dword [eax], 7
je 0x4062b2
mov al, 1
jmp 0x4062b4
xor al, al
cmp byte [edi + 0x10], 0
je 0x406315
cmp byte [esp + 0x2b], 0
jne 0x406315
test al, al
jne 0x406319
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
push 0xffc3d44d
push 0
push 0
push ecx
push edx
push 0
call fcn.0040ed30
add esp, 0x18
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push 0
push eax
mov eax, dword [esp + 0x130]
push ebp
push ebx
push ecx
mov cl, byte [esp + 0x138]
push edx
push esi
jmp 0x40643b
test al, al
je 0x4062e8
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
mov bl, byte [esp + 0x12c]
push 0
push SysReAllocString
push eax
push ebp
push ecx
push edx
mov ecx, esi
jmp 0x40496f
mov eax, dword [0x4c0d60]
mov byte [edi + 0xf], 1
test eax, eax
je 0x40635b
cmp byte [eax + 4], 0
je 0x40635b
mov byte [eax + 0x11], 2
cmp byte [esp + 0x13], 0
je 0x406375
mov eax, dword [esp + 0x34]
or byte [eax], 8
mov eax, dword [esp + 0x24]
push 0
push eax
jmp 0x40563e
mov eax, dword [esp + 0x124]
cmp al, 0xa4
je 0x406384
cmp al, 0xa5
jne 0x4063d4
mov cl, byte [0x4c1e45]
test cl, 0xc0
je 0x4063b8
test cl, 0x33
jne 0x4063b8
movzx ecx, byte [0x4be385]
push 0xffc3d44d
push 0
push 0
push 0
push ecx
push 2
call fcn.0040ed30
mov eax, dword [esp + 0x13c]
add esp, 0x18
mov edx, dword [esp + 0x128]
push 0xffc3d44d
push 0
push 0
push edx
push eax
push 1
call fcn.0040ed30
add esp, 0x18
test bl, bl
jne 0x4063dc
mov byte [edi + 0x10], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
mov bl, byte [esp + 0x12c]
push 0
push SysReAllocString
push eax
push ebp
push ecx
push edx
jmp 0x404968
mov eax, dword [esp + 0x12c]
push 0
push 0x3fff
test al, al
sete cl
push edi
mov byte [esi + 0xf], 0
mov byte [esi + 0xc], cl
push eax
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
push edx
push eax
push ebx
mov cl, byte [esp + 0x140]
mov eax, ebp
mov edx, dword [esp + 0x13c]
call fcn.00406680
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret