Function at 0x4117e0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xc8
push ebx
mov ebx, ecx
push esi
mov esi, edx
mov dword [ebp + 0x68], ebx
push edi
cmp word [ebx], 0
mov dword [ebp + 0x50], esi
je 0x412a02
mov eax, dword [0x4e7024]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
mov dword [ebp + 0x48], eax
mov eax, dword [0x4ec468]
mov dword [ebp + 0xc], eax
mov eax, dword fs:[0x24]
mov dword [ebp + 0x24], eax
test esi, esi
jne 0x411845
push 7
push str.Blind
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x411845
add ebx, 0xe
mov byte [0x4ec704], 1
mov dword [ebp + 0x68], ebx
jmp 0x411850
mov byte [0x4ec704], 0
test esi, esi
jne 0x41186e
push 6
push str.Text
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x41186e
add ebx, 0xc
mov dword [ebp + 0x50], 2
mov dword [ebp + 0x68], ebx
mov ecx, dword [ebp + 0x48]
mov edi, dword [ebp + 0x78]
mov eax, dword [ecx + 0x5c]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x64]
mov dword [ebp + 0x14], eax
cmp edi, 1
je 0x41188e
cmp edi, 3
jne 0x411948
mov eax, dword [0x4ec664]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4118a0
push eax
call edi
push str.AHK_Keybd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4ec664], 0
mov ebx, eax
je 0x4118ca
mov dword [0x4ec664], esi
jmp 0x4118d1
test esi, esi
je 0x4118d1
push esi
call edi
cmp ebx, 0xb7
je 0x411912
cmp dword [ebp + 0x50], 0
jne 0x411905
call fcn.0040ba10
mov ebx, dword [ebp + 0x68]
test al, al
je 0x411908
mov edx, str.Click
mov ecx, ebx
call fcn.004a1f00
test eax, eax
jne 0x411915
mov edi, 1
mov dword [ebp + 0x78], edi
jmp 0x411948
mov ebx, dword [ebp + 0x68]
mov edi, 1
mov dword [ebp + 0x78], edi
jmp 0x411948
mov ebx, dword [ebp + 0x68]
cmp dword [ebp + 0x78], 3
jne 0x411925
mov edi, 2
mov dword [ebp + 0x78], edi
jmp 0x411948
mov ecx, dword [ebp + 0x48]
xor edi, edi
mov dword [ebp + 0x78], edi
cmp dword [ecx + 0x5c], edi
jge 0x41193c
cmp dword [ecx + 0x64], edi
jge 0x41193c
or eax, 0xffffffff
jmp 0x41193e
xor eax, eax
mov dword [ecx + 0x64], eax
mov dword [ecx + 0x5c], 0xffffffff
mov eax, dword [ebp + 0x7c]
xor esi, esi
mov byte [ebp + 0x61], 0
test eax, eax
je 0x4119a2
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
mov dword [ebp + 0x18], edi
test edi, edi
je 0x411a7d
cmp edi, dword [0x4eb0cc]
je 0x411a7d
mov ecx, dword [ebp + 0x7c]
call fcn.004a81e0
test al, al
jne 0x411a7d
push 1
push edi
push dword [0x4eb0cc]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov esi, edi
setne byte [ebp + 0x61]
jmp 0x411a7d
test byte [0x4ec436], 0xc0
je 0x411a3b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ec42c]
cmp eax, 0x32
jae 0x411a3b
cmp edi, 2
je 0x411a3b
cmp byte [0x4ec704], 0
jne 0x411a3b
mov eax, dword [ebp + 0x50]
cmp eax, 2
je 0x411a3b
cmp byte [0x4ec633], 0
je 0x411a3b
mov ecx, dword [ebp + 0x24]
cmp ecx, dword [0x4eb0cc]
jne 0x411a3b
test eax, eax
je 0x411acb
mov edi, ebx
test ebx, ebx
je 0x411a31
movzx eax, word [ebx]
test ax, ax
je 0x411a31
mov esi, eax
mov ecx, 0x4d5a10
mov edx, 0x4c
nop dword [eax]
cmp si, dx
je 0x411a33
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x411a10
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x411a02
xor edi, edi
test edi, edi
jne 0x411b7d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
test eax, eax
je 0x411a77
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push eax
call ebx
mov esi, eax
mov dword [ebp - 0x58], 0x30
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x411a77
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x411a77
push 0
push eax
call ebx
mov esi, eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x18], eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov dword [0x4ec6e0], eax
mov ecx, eax
call fcn.00415e90
mov cl, 1
mov dword [0x4ec6e4], eax
call fcn.00415950
mov bl, al
and byte [0x4ec68f], bl
cmp dword [0x4e9814], 0
je 0x411bc2
mov al, byte [0x4ea1e6]
mov cl, byte [0x4ea1e4]
mov bh, al
not al
and bh, cl
and al, cl
jmp 0x411be6
mov esi, ebx
nop dword [eax]
test esi, esi
je 0x411a3b
movzx eax, word [esi]
test ax, ax
je 0x411a3b
mov edi, eax
nop word [eax + eax]
mov ecx, 0x4d5a10
mov edx, 0x4c
nop word [eax + eax]
cmp di, dx
je 0x411b26
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x411b00
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x411af0
jmp 0x411a3b
add esi, 2
je 0x411b7d
movzx eax, word [esi]
test ax, ax
je 0x411b7d
mov edi, eax
nop word [eax + eax]
mov eax, 0x4d5a18
mov edx, 0x7b
nop word [eax + eax]
cmp di, dx
je 0x411b73
movzx ecx, word [eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x411b50
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x411b40
jmp 0x411b7d
cmp word [esi], 0x7b
jne 0x411ad0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x5b
call esi
bt ax, 0xf
jb 0x411b9d
push 0x5c
call esi
bt ax, 0xf
jae 0x411a3b
mov edx, 1
mov dword [0x4e701c], 0
mov ecx, 0x8000012f
call fcn.00401700
mov dword [0x4e701c], 1
jmp 0x411b83
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ec42c]
cmp eax, dword [0x4e8290]
jae 0x411be0
mov cl, byte [0x4ec436]
and cl, bl
jmp 0x411be2
xor cl, cl
mov bh, cl
xor al, al
not bh
mov byte [ebp + 0x6d], cl
and bh, byte [0x4ec68e]
and bh, bl
mov byte [ebp + 0x62], al
cmp byte [0x4ec704], 0
mov byte [ebp + 0x6f], bh
mov byte [0x4ec68e], bh
je 0x411c15
not bh
and bh, bl
mov al, bh
mov bh, bl
mov byte [ebp + 0x6f], bh
jmp 0x411c17
xor al, al
mov byte [ebp + 0x6c], al
mov eax, dword [ebp + 0x48]
mov byte [ebp + 0x58], bh
cmp byte [eax + 0xf3], 0
je 0x411c49
cmp byte [0x4ec704], 0
jne 0x411c49
cmp dword [ebp + 0x50], 2
je 0x411c49
mov edx, 2
mov cl, 0x14
call fcn.00415110
mov dword [ebp + 0x1c], eax
jmp 0x411c50
mov dword [ebp + 0x1c], 0
mov edx, dword [ebp + 0x78]
mov eax, 0x1f4
mov dword [0x4ec700], edx
mov ecx, 0x5dc
test edx, edx
je 0x411cc9
cmp edx, 1
cmovne eax, ecx
mov ecx, 0x2ee0
mov dword [0x4ec6ec], eax
mov eax, 0x36b0
cmovne eax, ecx
call fcn.004bdae0
mov eax, dword [0x4e8a0c]
mov ecx, esp
mov edx, dword [ebp + 0x78]
mov byte [0x4ec6f4], bl
mov byte [0x4ec6f5], 0
mov dword [eax], ecx
mov dword [0x4ec6f8], 0x80000000
mov dword [0x4ec6fc], 0x80000000
mov dword [0x4ec6e8], 0
mov byte [0x4ec6f6], 0
mov byte [0x4ec6f7], 1
mov al, byte [0x4e9882]
mov byte [ebp + 0x4f], al
mov eax, dword [0x4e7034]
cmp eax, 8
je 0x411ce0
cmp eax, 0xa
jne 0x411d00
mov esi, dword [ebp + 0x7c]
test edx, edx
jne 0x411d03
test esi, esi
jne 0x411d03
push 1
mov byte [ebp + 0x60], 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e9882], 1
jmp 0x411d07
mov esi, dword [ebp + 0x7c]
mov byte [ebp + 0x60], 0
mov edi, dword [ebp + 0x68]
xor bl, bl
mov byte [ebp + 0x64], bl
cmp word [edi], 0
je 0x41278a
jmp 0x411d23
mov esi, dword [ebp + 0x7c]
cmp dword [0x4ec700], 0
mov byte [ebp + 0x63], 0
jne 0x411d8c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e7024]
sub eax, dword [0x4ec46c]
cmp eax, dword [ecx + 0xd8]
jbe 0x411d8c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x411d81
mov edx, 1
mov dword [0x4e701c], 0
or ecx, 0xffffffff
call fcn.00401700
mov dword [0x4e701c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ec46c], eax
mov eax, dword [ebp + 0x50]
test eax, eax
jne 0x4126b1
movzx eax, word [edi]
push eax
push 0x4d5a20
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
test eax, eax
je 0x4126ee
movzx eax, word [edi]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x411dc7.34
movzx eax, byte [eax + 0x412a2c]
jmp dword [eax*4 + 0x412a10]
test bh, 3
jne case.0x411dc7.34
or bl, 1
jmp 0x412772
test bh, 0x30
jne case.0x411dc7.34
or bl, 0x10
jmp 0x412772
test bh, 0xc
jne case.0x411dc7.34
or bl, 4
jmp 0x412772
test bh, 0xc0
jne case.0x411dc7.34
or bl, 0x40
jmp 0x412772
lea esi, [edi + 2]
push 0x7d
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
mov dword [ebp + 0x54], eax
test eax, eax
je case.0x411dc7.34
mov edi, esi
nop
movzx ecx, word [edi]
cmp ecx, 0x20
je 0x411e3d
cmp ecx, 9
jne 0x411e42
add edi, 2
jmp 0x411e30
mov esi, eax
mov dword [ebp + 0x68], edi
sub esi, edi
sar esi, 1
mov dword [ebp + 0x34], esi
jne 0x411ed8
lea esi, [eax + 2]
movzx eax, word [esi]
cmp eax, 0x7d
jne 0x411e67
mov dword [ebp + 0x54], esi
lea esi, [eax - 0x7c]
jmp 0x411ed5
cmp eax, 0x20
je 0x411e75
cmp eax, 9
jne 0x4126a9
cmp ax, 0x20
je 0x411e81
cmp ax, 9
jne 0x411e8a
movzx eax, word [esi + 2]
add esi, 2
jmp 0x411e75
push 4
push str.Down
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x411eb8
push 2
push 0x4c1e9c
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4126a9
push 0x7d
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
mov dword [ebp + 0x54], eax
test eax, eax
je case.0x411dc7.34
mov esi, eax
sub esi, edi
sar esi, 1
mov dword [ebp + 0x34], esi
push 5
push 0x4c0348
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x411f97
mov eax, dword [ebp + 0x54]
xor ecx, ecx
mov word [eax], cx
lea ecx, [edi + 0xa]
nop dword [eax]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x411f0d
cmp eax, 9
jne 0x411f12
add ecx, 2
jmp 0x411f00
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x6e]
push eax
lea eax, [ebp + 0x2c]
push eax
lea edx, [ebp + 0x28]
call fcn.00413840
mov eax, dword [ebp + 0x54]
add esp, 0x14
mov ecx, 0x7d
push dword [ebp + 0x20]
mov word [eax], cx
mov eax, dword [ebp + 0x30]
cmp eax, 1
jge 0x411f6c
mov eax, dword [ebp + 0x48]
lea edx, [ebp + 0x2c]
lea ecx, [ebp + 0x28]
movzx eax, byte [eax + 0xef]
push eax
lea eax, [ebp + 4]
push eax
call fcn.00414490
mov edi, dword [ebp + 0x54]
add esp, 0xc
jmp 0x412770
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x7c]
xor edx, edx
push dword [ebp + 0x28]
push ecx
mov cl, byte [ebp + 0x6e]
push 0
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x64]
call fcn.00412ab0
mov edi, dword [ebp + 0x54]
add esp, 0x24
jmp 0x412770
push 3
push 0x4d5a30
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x411fbb
mov edi, dword [ebp + 0x54]
mov dword [ebp + 0x50], 1
jmp 0x412770
push 4
push 0x4d5980
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x411ffd
lea ecx, [edi + 8]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x411fe0
cmp eax, 9
jne 0x411fe5
add ecx, 2
jmp 0x411fd3
cmp ecx, dword [ebp + 0x54]
jne 0x4126a9
mov edi, dword [ebp + 0x54]
mov dword [ebp + 0x50], 2
jmp 0x412770
mov eax, dword [ebp + 0x54]
xor ecx, ecx
mov edi, 1
mov dword [ebp + 0x5c], 2
mov dword [ebp + 0x40], edi
mov dword [ebp + 0x30], edi
mov word [eax], cx
mov ecx, dword [ebp + 0x68]
mov ebx, ecx
mov dword [ebp + 0x38], esi
movzx eax, word [ecx]
test ax, ax
je 0x412226
mov esi, eax
nop dword [eax]
mov edx, 0x4d5394
mov ecx, 0x20
nop word [eax + eax]
cmp si, cx
je 0x412082
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
test ax, ax
jne 0x412040
movzx eax, word [ebx + 2]
add ebx, 2
mov esi, eax
test ax, ax
jne 0x412030
push dword [0x4ec6e0]
mov ecx, dword [ebp + 0x68]
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
lea edx, [ebp + 0x6e]
call fcn.004164a0
add esp, 0xc
jmp 0x412159
movzx edi, word [ebx]
lea esi, [ebx + 2]
xor eax, eax
mov word [ebx], ax
mov eax, ebx
sub eax, dword [ebp + 0x68]
sar eax, 1
mov dword [ebp + 0x38], eax
movzx eax, word [esi]
cmp eax, 0x20
je 0x4120a4
cmp eax, 9
jne 0x4120a9
add esi, 2
jmp 0x412097
mov eax, dword [ebp + 0x54]
sub eax, esi
sar eax, 1
je 0x412133
push 4
push str.Down
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x41210a
push 4
add esi, 8
mov dword [ebp + 0x5c], eax
push str.Temp
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4120eb
mov dword [ebp + 0x44], eax
jmp 0x412133
xor eax, eax
cmp word [esi], 0x52
sete al
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
add esp, 4
neg eax
sbb esi, esi
neg esi
inc esi
mov dword [ebp + 0x44], esi
jmp 0x412133
push 0x4c1e9c
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x412126
mov dword [ebp + 0x5c], 1
jmp 0x412133
mov ecx, esi
call fcn.004112f0
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x30], eax
push dword [0x4ec6e0]
mov ecx, dword [ebp + 0x68]
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
lea edx, [ebp + 0x6e]
call fcn.004164a0
add esp, 0xc
test ebx, ebx
je 0x412156
mov word [ebx], di
mov edi, dword [ebp + 0x40]
mov ebx, dword [ebp + 0x54]
mov eax, 0x7d
mov word [ebx], ax
cmp edi, 1
jl 0x4126a6
mov bh, byte [ebp + 0x6e]
mov esi, dword [ebp + 0x3c]
test bh, bh
jne 0x4125e9
test si, si
jne 0x4125e9
mov ebx, dword [ebp + 0x68]
movzx eax, byte [ebx]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
add esp, 4
test eax, eax
mov eax, dword [ebp + 0x38]
je 0x4122d7
cmp eax, 1
jbe 0x4122da
cmp dword [0x4ec700], 0
je 0x41226c
mov ecx, ebx
call fcn.004112f0
mov ecx, dword [0x4ec6e8]
mov esi, eax
cmp ecx, dword [0x4ec6ec]
jne 0x4121d9
call fcn.00414b50
test eax, eax
je 0x4126a6
cmp dword [0x4ec700], 1
jne 0x412244
mov eax, dword [0x4ec6e8]
xor edx, edx
or byte [0x4ec6f5], 1
mov bh, byte [ebp + 0x6f]
mov edi, dword [ebp + 0x54]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [0x4ea34c]
inc dword [0x4ec6e8]
mov dword [eax + ecx*4], 1
mov dword [eax + ecx*4 + 4], edx
mov dword [eax + ecx*4 + 8], edx
mov dword [eax + ecx*4 + 0x10], esi
mov dword [eax + ecx*4 + 0xc], edx
jmp 0x412770
push dword [0x4ec6e0]
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x3c]
push eax
lea edx, [ebp + 0x6e]
call fcn.004164a0
add esp, 0xc
jmp 0x412159
mov eax, dword [0x4e8a0c]
mov bh, byte [ebp + 0x6f]
mov edi, dword [ebp + 0x54]
mov ecx, dword [eax]
mov eax, dword [0x4ec6e8]
inc dword [0x4ec6e8]
mov dword [ecx + eax*8], 0
mov dword [ecx + eax*8 + 4], esi
jmp 0x412770
mov eax, dword [ebp + 0x24]
mov dword [0x4e701c], 0
cmp dword [0x4eb0cc], eax
je 0x4122af
mov ecx, ebx
call fcn.004112f0
test eax, eax
js 0x4122af
mov ecx, ebx
call fcn.004112f0
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov bh, byte [ebp + 0x6f]
mov edi, dword [ebp + 0x54]
mov dword [0x4e701c], 1
jmp 0x412770
mov ecx, ebx
call fcn.004112f0
mov edx, 1
mov ecx, eax
call fcn.00401700
mov bh, byte [ebp + 0x6f]
mov edi, dword [ebp + 0x54]
mov dword [0x4e701c], 1
jmp 0x412770
cmp eax, 1
jne 0x412343
cmp dword [ebp + 0x5c], 1
je 0x4126a6
mov ecx, dword [ebp + 0x7c]
test ecx, ecx
je 0x412321
test edi, edi
jle 0x4126a6
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
nop dword [eax + eax]
movzx eax, word [ebx]
push 0
push eax
push 0x102
push ecx
call esi
mov ecx, dword [ebp + 0x7c]
sub edi, 1
jne 0x412300
mov bh, byte [ebp + 0x6f]
mov edi, dword [ebp + 0x54]
jmp 0x412770
mov al, byte [ebp + 0x64]
mov edx, edi
or al, byte [ebp + 0x6f]
mov cx, word [ebx]
movzx eax, al
push eax
call fcn.00412c60
mov bh, byte [ebp + 0x6f]
add esp, 4
mov edi, dword [ebp + 0x54]
jmp 0x412770
cmp dword [ebp + 0x7c], 0
mov ecx, ebx
mov esi, dword [ebp + 0x34]
mov edx, esi
sete al
movzx eax, al
push eax
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00416570
mov bl, al
add esp, 0xc
mov byte [ebp + 0x6e], bl
test bl, bl
je 0x41245e
cmp dword [ebp + 0x7c], 0
mov esi, dword [ebp + 0x5c]
jne 0x41238b
test esi, esi
jne 0x412384
mov byte [ebp + 0x63], bl
jmp 0x41238b
mov cl, bl
call fcn.00411510
cmp dword [0x4ec700], 0
je 0x41239b
mov al, byte [0x4ec6f4]
jmp 0x4123a2
xor cl, cl
call fcn.00415950
mov ecx, dword [ebp + 0x7c]
mov dl, al
mov bh, byte [ebp + 0x58]
push 0xffc3d44d
push 0
push 0
push ecx
mov cl, bh
mov byte [ebp + 0x6f], bh
call fcn.00415220
add esp, 0x10
test edi, edi
jle 0x4126a9
nop dword [eax]
push 0xffc3d44d
push 1
push dword [ebp + 0x7c]
mov dl, bl
mov ecx, esi
push 0
call fcn.004130d0
add esp, 0x10
cmp dword [0x4ec700], 0
jne 0x41244d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e7024]
sub eax, dword [0x4ec46c]
cmp eax, dword [ecx + 0xd8]
jbe 0x41244d
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x412442
mov edx, 1
mov dword [0x4e701c], 0
or ecx, 0xffffffff
call fcn.00401700
mov dword [0x4e701c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ec46c], eax
sub edi, 1
jne 0x4123d0
mov edi, dword [ebp + 0x54]
jmp 0x412770
cmp esi, 4
jbe 0x4124d6
mov ebx, dword [ebp + 0x68]
push 4
push str.ASC
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
mov edi, dword [ebp + 0x7c]
add esp, 0xc
test eax, eax
jne 0x4124e1
test edi, edi
jne 0x4124e1
lea ecx, [ebx + 6]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x412492
cmp eax, 9
jne 0x412497
add ecx, 2
jmp 0x412485
call fcn.00412d70
cmp dword [0x4ec700], 2
mov eax, dword [0x4e7024]
jne 0x4124c0
mov ecx, dword [eax + 0x60]
call fcn.00414e00
mov bh, byte [ebp + 0x58]
mov edi, dword [ebp + 0x54]
mov byte [ebp + 0x6f], bh
jmp 0x412770
mov ecx, dword [eax + 0x5c]
call fcn.00414e00
mov bh, byte [ebp + 0x58]
mov edi, dword [ebp + 0x54]
mov byte [ebp + 0x6f], bh
jmp 0x412770
cmp esi, 2
jbe 0x4124c8
mov ebx, dword [ebp + 0x68]
mov edi, dword [ebp + 0x7c]
push 2
push 0x4d5a50
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4124c8
push 0x10
push eax
lea eax, [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
mov edx, eax
add esp, 0xc
cmp edx, 0x10000
jb 0x41253b
sub edx, 0x10000
mov ecx, edx
mov eax, edx
shr ecx, 0xa
and eax, 0x3ff
and ecx, 0x3ff
sub ecx, 0x2800
sub eax, 0x2400
movzx ecx, cx
movzx esi, ax
jmp 0x412540
movzx ecx, dx
xor esi, esi
mov bh, byte [ebp + 0x58]
mov byte [ebp + 0x6f], bh
test edi, edi
je 0x412575
push 0
movzx eax, cx
push eax
push 0x102
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
call edi
test si, si
je 0x4125bb
push 0
movzx eax, si
push eax
push 0x102
push dword [ebp + 0x7c]
call edi
jmp 0x4125bb
cmp dword [0x4ec700], 2
je 0x41259a
mov bl, byte [ebp + 0x64]
or bl, bh
mov dl, bl
call fcn.00411590
test si, si
je 0x4125bb
mov dl, bl
mov ecx, esi
call fcn.00411590
jmp 0x4125bb
mov eax, 0x30
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xa]
push 0xa
push eax
push edx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.00412d70
cmp dword [0x4ec700], 2
mov eax, dword [0x4e7024]
jne 0x4125d9
mov ecx, dword [eax + 0x60]
call fcn.00414e00
mov edi, dword [ebp + 0x54]
jmp 0x412770
mov ecx, dword [eax + 0x5c]
call fcn.00414e00
mov edi, dword [ebp + 0x54]
jmp 0x412770
push 0
mov edx, esi
mov cl, bh
call fcn.00415b60
mov bl, al
add esp, 4
mov eax, dword [ebp + 0x5c]
mov byte [ebp + 0x10], bl
test bl, bl
je 0x41267f
cmp dword [ebp + 0x7c], 0
jne 0x41267f
test eax, eax
jne 0x412637
mov ecx, dword [ebp + 0x44]
mov byte [ebp + 0x63], bh
cmp ecx, 1
jne 0x412625
mov cl, byte [ebp + 0x6f]
or byte [0x4ec68e], bl
or cl, bl
jmp 0x412679
cmp ecx, 2
jne 0x412630
or byte [0x4ec68f], bl
mov cl, byte [ebp + 0x6f]
or cl, bl
jmp 0x412679
cmp eax, 1
jne 0x41267f
mov cl, bh
call fcn.00411510
mov al, byte [ebp + 0x6c]
not bl
and byte [0x4ec68f], bl
mov cl, bl
and cl, byte [0x4ec68e]
and al, bl
mov byte [0x4ec68e], cl
mov byte [ebp + 0x6c], al
cmp bh, 0xa5
jne 0x412674
cmp dword [0x4ec6e4], 3
jne 0x412674
and al, 0xfe
mov byte [ebp + 0x6c], al
or cl, al
mov eax, dword [ebp + 0x5c]
mov byte [ebp + 0x58], cl
mov byte [ebp + 0x6f], cl
mov ecx, dword [ebp + 0x7c]
mov edx, esi
push 0
push SysReAllocString
push SysReAllocString
push ecx
push dword [ebp + 0x10]
mov cl, bh
push eax
push edi
push dword [ebp + 0x58]
push dword [ebp + 0x64]
call fcn.00412ab0
add esp, 0x24
mov bh, byte [ebp + 0x6f]
mov edi, dword [ebp + 0x54]
jmp 0x412770
cmp eax, 2
jne 0x4126f1
movzx eax, word [edi]
add eax, 0xfffffff8
cmp eax, 5
ja case.0x4126c1.11
jmp dword [eax*4 + 0x412a8c]
cmp word [edi + 2], 0xa
lea eax, [edi + 2]
cmove edi, eax
mov al, 0xd
mov byte [ebp + 0x6e], al
jmp 0x41271b
mov al, 8
mov byte [ebp + 0x6e], al
jmp 0x41271b
mov al, 9
mov byte [ebp + 0x6e], al
jmp 0x41271b
mov byte [ebp + 0x6e], 0
jmp 0x412745
mov eax, dword [ebp + 0x50]
or bl, bh
je 0x4126fd
test eax, eax
jne 0x4126fd
mov al, 1
jmp 0x4126ff
xor al, al
mov cx, word [edi]
lea edx, [ebp + 0x64]
push eax
push dword [0x4ec6e0]
call fcn.004163c0
add esp, 8
mov byte [ebp + 0x6e], al
test al, al
je 0x412742
push 0
push SysReAllocString
push SysReAllocString
push esi
push 0
push 2
push 1
push dword [ebp + 0x58]
xor edx, edx
mov cl, al
push dword [ebp + 0x64]
call fcn.00412ab0
add esp, 0x24
jmp 0x412770
mov bl, byte [ebp + 0x64]
movzx ecx, word [edi]
test esi, esi
je 0x41275d
push 0
push ecx
push 0x102
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x412770
or bl, bh
mov edx, 1
movzx eax, bl
push eax
call fcn.00412c60
add esp, 4
xor bl, bl
mov byte [ebp + 0x64], bl
mov al, byte [ebp + 0x63]
add edi, 2
mov byte [0x4ec68d], al
cmp word [edi], 0
jne 0x411d20
cmp dword [0x4ec700], 0
je 0x412835
or esi, 0xffffffff
cmp byte [0x4ec6f6], 0
mov dword [ebp + 0x44], esi
jne 0x4127f4
cmp dword [0x4ec6e8], 0
jbe 0x4127f4
cmp byte [0x4ec704], 0
je 0x4127bc
xor bl, bl
jmp 0x4127c4
mov bl, byte [ebp + 0x62]
not bl
and bl, byte [ebp + 0x6d]
or bl, byte [0x4ec68f]
mov dl, byte [0x4ec6f4]
or bl, bh
push 0xffc3d44d
push 1
push 1
push 0
mov cl, bl
call fcn.00415220
add esp, 0x10
lea ecx, [ebp + 0x44]
mov dl, bl
call fcn.00414c00
mov esi, dword [ebp + 0x44]
cmp dword [0x4ec700], 1
mov eax, 0x5dc
mov ecx, 0x1f4
cmove eax, ecx
cmp dword [0x4ec6ec], eax
jbe 0x41281f
push dword [0x4ea34c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, esi
mov dword [0x4ec700], 0
call fcn.00414e00
jmp 0x4128c1
cmp dword [0x4e9814], 0
je 0x412849
mov cl, byte [0x4ea1e4]
mov dl, byte [ebp + 0x6d]
jmp 0x412872
cmp dword [0x4e8290], 0
jl 0x41286d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4ec42c]
cmp eax, dword [0x4e8290]
jb 0x41286d
mov dl, byte [ebp + 0x6d]
xor cl, cl
jmp 0x412872
mov dl, byte [ebp + 0x6d]
mov cl, dl
or cl, byte [0x4ec68f]
cmp byte [0x4ec704], 0
je 0x412893
mov al, cl
xor al, dl
mov bl, al
and al, cl
and bl, dl
not bl
and bl, bh
or bl, al
jmp 0x41289c
mov bl, byte [ebp + 0x62]
not bl
and bl, cl
or bl, bh
push 0xffc3d44d
push 1
push 1
push dword [ebp + 0x7c]
xor cl, cl
call fcn.00415950
or al, byte [0x4ea1d7]
mov cl, bl
mov dl, al
call fcn.00415220
add esp, 0x10
cmp dword [0x4e9814], 0
je 0x4128e4
mov cl, byte [0x4ea1e5]
mov al, cl
xor al, byte [0x4ea1e6]
and al, cl
not al
and cl, al
mov byte [0x4ea1e5], cl
cmp dword [ebp + 0x1c], 1
jne 0x4128f6
mov edx, 1
mov cl, 0x14
call fcn.00415110
cmp byte [ebp + 0x61], 0
je 0x41290d
push 0
push dword [ebp + 0x18]
push dword [0x4eb0cc]
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp + 0x60], 0
je 0x412928
cmp byte [ebp + 0x4f], 0
jne 0x412928
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e9882], 0
mov eax, dword [ebp + 0x78]
test eax, eax
jne 0x4129b6
mov eax, dword [ebp + 0xc]
cmp dword [0x4ec468], eax
je 0x4129f3
cmp dword [0x4e701c], 0
je 0x4129f3
cmp dword [0x4e96bc], 0
jne 0x4129f3
mov ecx, dword [0x4e7024]
cmp byte [ecx + 0xec], 0
jne 0x4129a7
cmp byte [ecx + 0xee], 0
jne 0x41299e
cmp dword [ecx + 0xe0], 0xffffffff
jle 0x41299e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4e7024]
sub eax, dword [ecx + 0xdc]
cmp eax, dword [ecx + 0xe0]
jb 0x41299e
mov byte [ecx + 0xec], 1
cmp byte [ecx + 0xec], 0
je 0x4129f3
mov edx, 1
or ecx, 0xffffffff
call fcn.00401700
jmp 0x4129f3
cmp eax, 1
jne 0x4129f3
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4eb0cc]
jne 0x4129f3
mov edx, 1
mov dword [0x4e701c], 0
or ecx, 0xffffffff
call fcn.00401700
mov dword [0x4e701c], 1
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x5c], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x64], ecx
lea esp, [ebp - 0x64]
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x70]
pop ebp
ret