Function at 0x4a0a90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b36e2
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x5f8800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
movsx eax, word [edi + 0x145ab8]
movzx edx, word [edi + 0x1459ae]
movzx ecx, word [edi + 0x1459b0]
mov si, word [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
sub eax, 0
je 0x4a0d04
sub eax, 1
je 0x4a0bf1
sub eax, 1
jne 0x4a1034
mov ax, word [ebp + 8]
movsx edx, dx
cwde
mov dword [ebp + 0xc], eax
lea eax, [edx + 0x19]
cmp dword [ebp + 0xc], eax
jl 0x4a0b37
lea eax, [edx + 0x41]
cmp dword [ebp + 0xc], eax
jg 0x4a0b37
movsx eax, cx
movsx ecx, si
mov dword [ebp - 0x1c], eax
add eax, 0x12c
mov dword [ebp - 0x18], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a0b37
mov eax, dword [ebp - 0x1c]
add eax, 0x140
cmp dword [ebp - 0x18], eax
jle 0x4a10a5
lea eax, [edx + 0xb4]
cmp dword [ebp + 0xc], eax
jl 0x4a1034
lea eax, [edx + 0xe6]
cmp dword [ebp + 0xc], eax
jg 0x4a1034
movsx edx, cx
movsx eax, si
mov dword [ebp + 0xc], eax
lea eax, [edx + 0x12c]
cmp dword [ebp + 0xc], eax
jl 0x4a1034
lea eax, [edx + 0x140]
movsx edx, si
cmp edx, eax
jg 0x4a1034
mov ecx, dword [edi + 0x13c690]
mov eax, dword [edi + 0x14595c]
mov dword [ecx + 0x30], eax
mov ecx, dword [edi + 0x13c690]
mov eax, dword [edi + 0x145960]
mov dword [ecx + 0x38], eax
mov ecx, dword [edi + 0x13c690]
mov eax, dword [edi + 0x145964]
mov dword [ecx + 0x3c], eax
movsx eax, word [edi + 0x14568c]
cmp eax, 0xffffffed
je 0x4a0cb7
cmp eax, 0xffffffef
jne 0x4a0ce6
mov eax, dword [edi + 0x145530]
push 0
push 0
push 0
push dword [edi + 0x145538]
mov eax, dword [edi + eax*4 + 0x13b664]
push dword [eax + 4]
push 0
push 0xf14
push 0xfc9428b
jmp 0x4a0cdf
movsx esi, word [ebp + 8]
movsx edx, dx
mov dword [ebp - 0x18], esi
lea eax, [edx + 0x19]
cmp esi, eax
mov si, word [ebp + 0xc]
jl 0x4a0c37
lea eax, [edx + 0x41]
cmp dword [ebp - 0x18], eax
jg 0x4a0c37
movsx eax, cx
movsx ecx, si
mov dword [ebp + 0xc], eax
add eax, 0x12c
mov dword [ebp - 0x1c], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a0c37
mov eax, dword [ebp + 0xc]
add eax, 0x140
cmp dword [ebp - 0x1c], eax
jle 0x4a10a5
lea eax, [edx + 0xb4]
cmp dword [ebp - 0x18], eax
jl 0x4a0cf5
lea eax, [edx + 0xe6]
cmp dword [ebp - 0x18], eax
jg 0x4a0cf5
movsx edx, cx
movsx eax, si
mov dword [ebp + 0xc], eax
lea eax, [edx + 0x12c]
cmp dword [ebp + 0xc], eax
jl 0x4a0cf5
lea eax, [edx + 0x140]
movsx edx, si
cmp edx, eax
jg 0x4a0cf5
mov eax, dword [edi + 0x13c690]
xorps xmm0, xmm0
mov eax, dword [eax + 0x48]
movups xmmword [eax + 4], xmm0
mov dword [eax + 0x14], 0
mov byte [eax + 0x18], 0
mov eax, dword [edi + 0x13c690]
movups xmm0, xmmword [edi + 0x1459b8]
mov ecx, dword [eax + 0x48]
movups xmmword [ecx + 4], xmm0
mov eax, dword [edi + 0x1459c8]
mov dword [ecx + 0x14], eax
jmp 0x4a0bab
mov eax, dword [edi + 0x145530]
push 0
push 0
push 0
push dword [edi + 0x145538]
mov eax, dword [edi + eax*4 + 0x13b664]
push dword [eax + 4]
push 0
push 0xf14
push 0xfc9428c
mov ecx, edi
call fcn.00493690
or eax, 0xffffffff
mov word [edi + 0x145ab8], ax
jmp 0x4a21d0
movsx eax, word [edi + 0x145ab8]
add eax, 3
jmp switch.0x004a1047
mov ax, word [ebp + 8]
movsx edx, dx
cwde
mov dword [ebp + 0xc], eax
lea eax, [edx + 0x19]
cmp dword [ebp + 0xc], eax
jl 0x4a0e59
lea eax, [edx + 0x41]
cmp dword [ebp + 0xc], eax
jg 0x4a0e59
movsx eax, cx
movsx ecx, si
mov dword [ebp - 0x1c], eax
add eax, 0x12c
mov dword [ebp - 0x18], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a0e59
mov eax, dword [ebp - 0x1c]
add eax, 0x140
cmp dword [ebp - 0x18], eax
jg 0x4a0e59
movsx eax, word [edi + 0x14568c]
mov esi, 0x93
cmp eax, 0xffffffed
je 0x4a0d6f
cmp eax, 0xffffffef
jne 0x4a0d8d
lea eax, [esi - 2]
jmp 0x4a0d86
cmp byte [edi + 0x145abb], 0
je 0x4a0d81
mov word [edi + 0x14568c], si
jmp 0x4a0d8d
mov eax, 0x92
mov word [edi + 0x14568c], ax
push 0x40
mov ecx, edi
call fcn.00415190
cmp word [edi + 0x14568c], si
jne 0x4a21d0
push 0x78
call fcn.005aa520
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4a0dd1
mov ecx, dword [edi + 0x145530]
push dword [edi + ecx*4 + 0x13b664]
mov ecx, eax
call fcn.00577730
jmp 0x4a0dd3
xor eax, eax
push 0x60
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x13c690], eax
call fcn.005aa520
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4a0e03
mov ecx, eax
call fcn.00567c60
mov ecx, eax
jmp 0x4a0e05
xor ecx, ecx
mov eax, dword [edi + 0x13c690]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 0x48], ecx
mov eax, dword [edi + 0x145530]
mov ecx, dword [edi + 0x145538]
mov eax, dword [edi + eax*4 + 0x13b664]
push dword [eax + ecx*4 + 0x984]
mov ecx, edi
push dword [edi + 0x13c690]
call fcn.0049e2f0
mov eax, dword [edi + 0x13c690]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4a21d0
mov dword [eax + 0x48], 1
jmp 0x4a21d0
cmp byte [edi + 0x1459ac], 0
je 0x4a0f3f
lea eax, [edx + 0x64]
cmp dword [ebp + 0xc], eax
jl 0x4a0f3f
lea eax, [edx + 0x91]
cmp dword [ebp + 0xc], eax
jg 0x4a0f3f
movsx eax, cx
movsx ecx, si
mov dword [ebp - 0x1c], eax
add eax, 0x12c
mov dword [ebp - 0x18], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a0f3f
mov eax, dword [ebp - 0x1c]
add eax, 0x140
cmp dword [ebp - 0x18], eax
jg 0x4a0f3f
movsx eax, word [edi + 0x14568c]
cmp eax, 0xffffffed
je 0x4a0ef2
cmp eax, 0xffffffef
jne 0x4a0f2a
mov eax, dword [edi + 0x145530]
mov ecx, edi
push 0
push 0
push 0
push dword [edi + 0x145538]
mov eax, dword [edi + eax*4 + 0x13b664]
push dword [eax + 4]
push 0
push 0
push 0xfc94292
call fcn.00493690
mov eax, 0xfffffff0
jmp 0x4a0f23
mov eax, dword [edi + 0x145530]
mov ecx, edi
push 0
push 0
push 0
push dword [edi + 0x145538]
mov eax, dword [edi + eax*4 + 0x13b664]
push dword [eax + 4]
push 0
push 0
push 0xfc94293
call fcn.00493690
mov eax, 0xffffffee
mov word [edi + 0x14568c], ax
push 0x40
mov ecx, edi
mov byte [edi + 0x14568f], 0
call fcn.00415190
jmp 0x4a21d0
cmp byte [edi + 0x145abb], 0
jne 0x4a1034
lea eax, [edx + 0xb4]
cmp dword [ebp + 0xc], eax
jl 0x4a1034
lea eax, [edx + 0xe6]
cmp dword [ebp + 0xc], eax
jg 0x4a1034
movsx edx, cx
movsx eax, si
mov dword [ebp + 0xc], eax
lea eax, [edx + 0x12c]
cmp dword [ebp + 0xc], eax
jl 0x4a1034
lea eax, [edx + 0x140]
movsx edx, si
cmp edx, eax
jg 0x4a1034
movsx eax, word [edi + 0x14568c]
cmp eax, 0xffffffed
je 0x4a0fda
cmp eax, 0xffffffef
jne 0x4a1015
mov eax, dword [edi + 0x145530]
mov ecx, edi
push 0
push 0
push 0
push dword [edi + 0x145538]
mov eax, dword [edi + eax*4 + 0x13b664]
push dword [eax + 4]
push 0
push 0xf14
push 0xfc9428b
call fcn.00493690
mov eax, 0xfffffff0
jmp 0x4a100e
mov eax, dword [edi + 0x145530]
mov ecx, edi
push 0
push 0
push 0
push dword [edi + 0x145538]
mov eax, dword [edi + eax*4 + 0x13b664]
push dword [eax + 4]
push 0
push 0xf14
push 0xfc9428c
call fcn.00493690
mov eax, 0xffffffee
mov word [edi + 0x14568c], ax
mov eax, 0xfffffffc
mov byte [edi + 0x14568f], 0
mov word [edi + 0x145ab8], ax
mov byte [edi + 0x145abb], 1
jmp 0x4a21d0
movsx eax, word [edi + 0x145ab8]
add eax, 3
cmp eax, 5
ja case.default.0x4a1047
jmp dword [eax*4 + 0x4a21f4]
mov eax, dword [ebp - 0x14]
movsx edx, ax
mov ax, word [ebp + 8]
cwde
mov dword [ebp + 8], eax
lea eax, [edx + 0x9a]
cmp dword [ebp + 8], eax
jle case.default.0x4a1047
lea eax, [edx + 0xe4]
cmp dword [ebp + 8], eax
jge case.default.0x4a1047
movsx ecx, cx
movsx edx, si
lea eax, [ecx + 0x124]
cmp edx, eax
jle case.default.0x4a1047
lea eax, [ecx + 0x138]
cmp edx, eax
jge case.default.0x4a1047
push 0x34
mov ecx, edi
call fcn.00415190
xor eax, eax
mov word [edi + 0x145ab8], ax
jmp 0x4a21d0
mov eax, dword [ebp - 0x14]
cwde
lea edx, [eax + 0x1e]
mov dword [ebp + 0xc], edx
movsx edx, word [ebp + 8]
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jle 0x4a1477
add eax, 0xf0
cmp edx, eax
jge 0x4a1477
movsx edx, cx
movsx eax, si
mov dword [ebp - 0x1c], eax
lea eax, [edx + 0x41]
cmp dword [ebp - 0x1c], eax
jl 0x4a12a5
lea eax, [edx + 0x4f]
movsx edx, si
cmp edx, eax
jg 0x4a12a5
mov eax, dword [edi + 0x13c690]
mov dword [eax + 8], 0
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x24], 1
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x2c], 0xffffffff
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x30], 0xffffffff
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x34], 0xffffffff
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x38], 0xffffffff
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [edi + 0x13c690]
call fcn.00407180
cwde
cmp eax, 4
ja case.default.0x4a1169
jmp dword [eax*4 + 0x4a220c]
cmp byte [edi + 0x1895fd], 0
mov eax, 1
mov ecx, 4
cmovne eax, ecx
movzx eax, ax
jmp 0x4a11cc
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
add eax, 2
jmp 0x4a11cc
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
jmp 0x4a11c5
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 + 2]
jmp 0x4a11cc
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
lea eax, [eax*2 + 1]
mov ecx, dword [edi + 0x13c690]
push eax
call fcn.00406fc0
mov ecx, dword [edi + 0x13c690]
call fcn.00407180
cwde
sub eax, 1
je 0x4a1211
sub eax, 1
jne 0x4a1293
mov eax, dword [edi + 0x13c690]
mov ecx, edi
mov dword [eax + 8], 1
push dword [edi + 0x13c690]
call fcn.00560990
jmp case.default.0x4a1414
mov eax, dword [edi + 0x13c690]
mov dword [eax + 8], 1
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x2c], 2
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x30], 0
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x34], 0
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x38], 0
mov eax, dword [edi + 0x13c690]
cmp dword [eax + 0x48], 0
jne 0x4a1293
push 0x60
call fcn.005aa520
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x4a1281
mov ecx, eax
call fcn.00567c60
mov ecx, eax
jmp 0x4a1283
xor ecx, ecx
mov eax, dword [edi + 0x13c690]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 0x48], ecx
push dword [edi + 0x13c690]
mov ecx, edi
call fcn.00560990
jmp case.default.0x4a1414
movsx edx, cx
movsx eax, si
mov dword [ebp - 0x1c], eax
lea eax, [edx + 0x50]
cmp dword [ebp - 0x1c], eax
jl 0x4a1350
lea eax, [edx + 0x5e]
movsx edx, si
cmp edx, eax
jg 0x4a1350
mov ecx, dword [edi + 0x13c690]
call fcn.00407160
cwde
cmp eax, 3
ja case.default.0x4a1414
jmp dword [eax*4 + 0x4a2220]
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
mov ecx, dword [edi + 0x13c690]
lea eax, [eax*2 + 1]
push eax
call fcn.00406f80
jmp case.default.0x4a1414
mov ecx, dword [edi + 0x13c690]
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
add eax, 2
push eax
call fcn.00406f80
jmp case.default.0x4a1414
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
jmp 0x4a12ef
mov ecx, dword [edi + 0x13c690]
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
inc eax
push eax
call fcn.00406f80
jmp case.default.0x4a1414
movsx edx, cx
movsx eax, si
mov dword [ebp - 0x1c], eax
lea eax, [edx + 0x5f]
cmp dword [ebp - 0x1c], eax
jl 0x4a13ec
lea eax, [edx + 0x6d]
movsx edx, si
cmp edx, eax
jg 0x4a13ec
mov ecx, dword [edi + 0x13c690]
call fcn.00407170
cwde
sub eax, 0
je 0x4a13cf
sub eax, 1
je 0x4a13ab
sub eax, 1
jne case.default.0x4a1414
cmp byte [edi + 0x1895fd], al
mov ecx, dword [edi + 0x13c690]
setne al
movzx eax, ax
push eax
call fcn.00406fa0
jmp case.default.0x4a1414
xor ecx, ecx
mov eax, 2
cmp byte [edi + 0x1895fd], cl
cmovne eax, ecx
mov ecx, dword [edi + 0x13c690]
movzx eax, ax
push eax
call fcn.00406fa0
jmp case.default.0x4a1414
mov ecx, dword [edi + 0x13c690]
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
inc eax
push eax
call fcn.00406fa0
jmp case.default.0x4a1414
movsx ecx, cx
movsx edx, si
lea eax, [ecx + 0x6e]
cmp edx, eax
jl 0x4a1477
lea eax, [ecx + 0x7c]
cmp edx, eax
jg 0x4a1477
mov ecx, dword [edi + 0x13c690]
movsx eax, byte [ecx + 0x21]
inc eax
cmp eax, 3
ja case.default.0x4a1414
jmp dword [eax*4 + 0x4a2230]
mov al, byte [edi + 0x1895fd]
neg al
sbb al, al
and al, 2
mov byte [ecx + 0x21], al
jmp case.default.0x4a1414
cmp byte [edi + 0x1895fd], 0
sete al
lea eax, [eax*2 - 1]
mov byte [ecx + 0x21], al
jmp case.default.0x4a1414
cmp byte [edi + 0x1895fd], 0
setne al
dec al
and al, 2
mov byte [ecx + 0x21], al
jmp case.default.0x4a1414
cmp byte [edi + 0x1895fd], 0
setne al
lea eax, [eax*2 - 1]
mov byte [ecx + 0x21], al
jmp case.default.0x4a1414
mov ecx, dword [edi + 0x13c690]
call fcn.00407180
cwde
sub eax, 1
je 0x4a170a
sub eax, 1
je 0x4a1642
sub eax, 1
jne case.default.0x4a1047
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0xc]
jle case.default.0x4a1047
mov edx, dword [ebp - 0x14]
movsx eax, dx
add eax, 0xf0
cmp ecx, eax
jge case.default.0x4a1047
mov edx, dword [ebp - 0x10]
movsx ecx, dx
movsx eax, si
mov dword [ebp + 8], eax
lea eax, [ecx + 0x7d]
cmp dword [ebp + 8], eax
jl 0x4a1509
lea eax, [ecx + 0x8b]
movsx ecx, si
cmp ecx, eax
jg 0x4a1509
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfc94262
mov ecx, edi
call fcn.00493690
mov eax, 0xfffffffe
mov word [edi + 0x145ab8], ax
jmp 0x4a21d0
movsx ecx, dx
movsx eax, si
mov dword [ebp + 8], eax
lea eax, [ecx + 0x8c]
cmp dword [ebp + 8], eax
jl 0x4a15b3
lea eax, [ecx + 0x9a]
movsx ecx, si
cmp ecx, eax
jg 0x4a15b3
cmp byte [edi + 0x1895fb], 0
mov eax, 0xa
mov edx, dword [edi + 0x13c690]
mov ecx, 1
cmovne ecx, eax
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
imul ecx, eax
add dword [edx + 0x2c], ecx
mov ecx, dword [edi + 0x13c690]
mov eax, dword [ecx + 0x2c]
cmp eax, 0x2ee
jle 0x4a1580
mov dword [ecx + 0x2c], 0x2ee
jmp case.default.0x4a1414
test eax, eax
jne 0x4a159e
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
mov dword [ecx + 0x2c], eax
jmp case.default.0x4a1414
cmp eax, 1
jge case.default.0x4a1414
mov dword [ecx + 0x2c], 0xffffffff
jmp case.default.0x4a1414
movsx ecx, dx
movsx edx, si
lea eax, [ecx + 0x9b]
cmp edx, eax
jl case.default.0x4a1047
lea eax, [ecx + 0xa9]
cmp edx, eax
jg case.default.0x4a1047
cmp byte [edi + 0x1895fb], 0
mov eax, 0xa
mov edx, dword [edi + 0x13c690]
mov ecx, 1
cmovne ecx, eax
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
imul ecx, eax
add dword [edx + 0x30], ecx
mov ecx, dword [edi + 0x13c690]
mov eax, dword [ecx + 0x30]
cmp eax, 0x2ee
jle 0x4a1623
mov dword [ecx + 0x30], 0x2ee
jmp case.default.0x4a1414
cmp dword [ecx + 0x2c], 0
je 0x4a1584
cmp eax, 1
jge case.default.0x4a1414
mov dword [ecx + 0x30], 0xffffffff
jmp case.default.0x4a1414
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0xc]
jle case.default.0x4a1047
mov edx, dword [ebp - 0x14]
movsx eax, dx
add eax, 0xf0
cmp ecx, eax
jge case.default.0x4a1047
mov edx, dword [ebp - 0x10]
movsx ecx, dx
movsx edx, si
lea eax, [ecx + 0x7d]
cmp edx, eax
jl case.default.0x4a1047
lea eax, [ecx + 0x8b]
cmp edx, eax
jg case.default.0x4a1047
cmp byte [edi + 0x1895fb], 0
je 0x4a16a7
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
mov ecx, 0xfffffff6
sar eax, 0xf
and eax, 0x5a
sub ecx, eax
lea edx, [eax + 0xa]
jmp 0x4a16af
mov edx, 1
or ecx, 0xffffffff
cmp byte [edi + 0x1895fd], 0
mov eax, dword [edi + 0x13c690]
cmovne edx, ecx
add dword [eax + 8], edx
mov eax, dword [edi + 0x13c690]
mov ecx, dword [eax + 8]
cmp ecx, 0x77359400
jle 0x4a16ec
mov dword [eax + 8], 0x77359400
mov ecx, edi
push dword [edi + 0x13c690]
call fcn.00560990
jmp case.default.0x4a1414
cmp ecx, 1
jge 0x4a16f8
mov dword [eax + 8], 1
push dword [edi + 0x13c690]
mov ecx, edi
call fcn.00560990
jmp case.default.0x4a1414
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0xc]
jle 0x4a186c
mov edx, dword [ebp - 0x14]
movsx eax, dx
add eax, 0xf0
cmp ecx, eax
jge 0x4a186c
mov edx, dword [ebp - 0x10]
movsx eax, dx
movsx ecx, si
mov dword [ebp - 0x1c], eax
add eax, 0x7d
mov dword [ebp - 0x18], ecx
cmp ecx, eax
mov ecx, dword [ebp + 8]
jl 0x4a186c
mov eax, dword [ebp - 0x1c]
add eax, 0x8b
cmp dword [ebp - 0x18], eax
jg 0x4a186c
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x2c], 0xffffffff
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x30], 0xffffffff
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x34], 0xffffffff
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x38], 0xffffffff
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [edi + 0x13c690]
mov eax, dword [ecx + 8]
add eax, 6
cmp eax, 5
ja case.default.0x4a17a9
jmp dword [eax*4 + 0x4a2240]
mov eax, 0xfffffffe
lea edx, [eax + 3]
jmp 0x4a181c
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
lea eax, [eax*2 - 3]
jmp 0x4a1826
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
lea eax, [eax*2 - 4]
jmp 0x4a1826
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
lea eax, [eax*2 - 5]
jmp 0x4a1826
xor eax, eax
cmp byte [edi + 0x1895fd], al
setne al
lea eax, [eax*2 - 6]
jmp 0x4a1826
mov eax, 1
lea edx, [eax - 6]
jmp 0x4a181c
or eax, 0xffffffff
mov edx, 0xfffffffa
cmp byte [edi + 0x1895fd], 0
cmovne eax, edx
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x13c690]
cmp dword [eax + 8], 0
jl case.default.0x4a1414
mov dword [eax + 0x2c], 2
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x30], 0
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x34], 0
mov eax, dword [edi + 0x13c690]
mov dword [eax + 0x38], 0
jmp case.default.0x4a1414
mov eax, dword [edi + 0x13c690]
mov dword [ebp - 0x18], 5
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
test eax, eax
js 0x4a1909
mov edx, dword [ebp - 0x14]
movsx eax, dx
add eax, 0x4b
cmp ecx, eax
jl 0x4a1902
movsx eax, dx
mov edx, dword [ebp - 0x10]
add eax, 0xaf
cmp ecx, eax
jge 0x4a1902
movsx eax, dx
movsx ecx, si
mov dword [ebp - 0x18], eax
add eax, 0x9b
mov dword [ebp - 0x20], ecx
cmp ecx, eax
mov ecx, dword [ebp + 8]
jl 0x4a1902
mov eax, dword [ebp - 0x18]
add eax, 0xe5
cmp dword [ebp - 0x20], eax
jg 0x4a1902
push 0x40
lea esi, [edi + 0x1459b8]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [edi + 0x13c690]
add esp, 0xc
mov eax, dword [eax + 0x48]
movups xmm0, xmmword [eax + 4]
movups xmmword [esi], xmm0
mov eax, dword [eax + 0x14]
mov dword [esi + 0x10], eax
mov eax, 1
mov word [edi + 0x145ab8], ax
jmp 0x4a21d0
mov dword [ebp - 0x18], 0xb
mov eax, dword [ebp + 0xc]
cmp ecx, eax
jle 0x4a1a27
mov edx, dword [ebp - 0x14]
movsx eax, dx
mov edx, dword [ebp - 0x10]
add eax, 0xf0
cmp ecx, eax
jge 0x4a1a24
mov ecx, dword [ebp - 0x18]
shl ecx, 4
sub ecx, dword [ebp - 0x18]
movsx eax, dx
add ecx, eax
movsx eax, si
mov dword [ebp - 0x20], eax
lea eax, [ecx + 0x41]
cmp dword [ebp - 0x20], eax
jl 0x4a1a21
lea eax, [ecx + 0x4f]
movsx ecx, si
cmp ecx, eax
jg 0x4a1a21
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov cl, byte [edi + 0x1895fb]
test ax, ax
mov edx, dword [edi + 0x13c690]
mov byte [ebp + 0xb], cl
mov cl, byte [edi + 0x1895fd]
mov byte [ebp + 0xf], cl
mov ecx, 1
lea eax, [ecx + 9]
js 0x4a19d3
cmp byte [ebp + 0xb], 0
cmovne ecx, eax
xor eax, eax
cmp byte [ebp + 0xf], al
sete al
lea eax, [eax*2 - 1]
imul ecx, eax
add dword [edx + 0x24], ecx
mov eax, dword [edi + 0x13c690]
mov ecx, dword [eax + 0x24]
cmp ecx, 0x77359400
jle 0x4a19be
mov dword [eax + 0x24], 0x77359400
jmp case.default.0x4a1414
cmp ecx, 1
jge case.default.0x4a1414
mov dword [eax + 0x24], 1
jmp case.default.0x4a1414
cmp byte [ebp + 0xb], 0
cmovne ecx, eax
xor eax, eax
cmp byte [ebp + 0xf], al
sete al
lea eax, [eax*2 - 1]
imul ecx, eax
add dword [edx + 0x28], ecx
mov eax, dword [edi + 0x13c690]
mov ecx, dword [eax + 0x28]
cmp ecx, 0x77359400
jle 0x4a1a0c
mov dword [eax + 0x28], 0x77359400
jmp case.default.0x4a1414
cmp ecx, 1
jge case.default.0x4a1414
mov dword [eax + 0x28], 0xffffffff
jmp case.default.0x4a1414
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x24], 0
jl case.default.0x4a1047
cmp ecx, eax
jle case.default.0x4a1047
mov edx, dword [ebp - 0x14]
movsx eax, dx
mov edx, dword [ebp - 0x10]
add eax, 0xf0
cmp ecx, eax
jge case.default.0x4a1047
mov ecx, dword [ebp - 0x18]
shl ecx, 4
sub ecx, dword [ebp - 0x18]
movsx eax, dx
add ecx, eax
movsx eax, si
mov dword [ebp + 8], eax
lea eax, [ecx + 0x50]
cmp dword [ebp + 8], eax
jl 0x4a1bb5
lea eax, [ecx + 0x5e]
movsx ecx, si
cmp ecx, eax
jg 0x4a1bb5
mov edx, dword [edi + 0x13c690]
mov ecx, dword [edx + 0x2c]
mov eax, ecx
sar eax, 4
and eax, 0xf
cmp eax, 3
ja case.default.0x4a1acb
jmp dword [eax*4 + 0x4a2258]
and ecx, 0xff0f
cmp byte [edi + 0x1895fd], 0
je 0x4a1aee
or ecx, 0x30
mov dword [edx + 0x2c], ecx
mov edx, dword [edi + 0x13c690]
mov ecx, dword [edx + 0x2c]
mov eax, ecx
and eax, 0xf
dec eax
cmp eax, 3
ja case.default.0x4a1acb
jmp dword [eax*4 + 0x4a2268]
and ecx, 0xfff0
or ecx, 4
jmp 0x4a1b71
and ecx, 0xfff0
or ecx, 3
jmp 0x4a1b71
or ecx, 0x10
jmp 0x4a1b71
and ecx, 0xff0f
mov eax, ecx
or eax, 0x20
cmp byte [edi + 0x1895fd], 0
cmove ecx, eax
jmp 0x4a1b71
cmp byte [edi + 0x1895fd], 0
mov eax, 0x10
mov esi, 0x30
cmove eax, esi
and ecx, 0xff0f
or eax, ecx
mov dword [edx + 0x2c], eax
jmp case.default.0x4a1acb
and ecx, 0xff0f
cmp byte [edi + 0x1895fd], 0
je 0x4a1b3f
or ecx, 0x20
jmp 0x4a1b71
mov dword [edx + 0x2c], ecx
mov edx, dword [edi + 0x13c690]
mov ecx, dword [edx + 0x2c]
mov eax, ecx
and eax, 0xf
dec eax
cmp eax, 3
ja case.default.0x4a1acb
jmp dword [eax*4 + 0x4a2278]
and ecx, 0xfff0
or ecx, 2
jmp 0x4a1b71
and ecx, 0xfff0
or ecx, 1
mov dword [edx + 0x2c], ecx
mov ecx, dword [edi + 0x13c690]
mov eax, dword [ecx + 0x2c]
sar eax, 4
and eax, 0xf
sub eax, 1
je 0x4a1b92
sub eax, 1
je 0x4a1b92
or eax, 0xffffffff
jmp 0x4a1b97
mov eax, 1
mov edx, 0x34
mov dword [edx + ecx], eax
mov eax, dword [edi + 0x13c690]
mov ecx, dword [eax + 0x48]
mov ax, word [eax + 0x2c]
mov word [ecx + 0x4c], ax
jmp case.default.0x4a1414
mov ecx, dword [ebp - 0x18]
shl ecx, 4
sub ecx, dword [ebp - 0x18]
movsx eax, dx
add ecx, eax
movsx eax, si
mov dword [ebp + 8], eax
lea eax, [ecx + 0x5f]
cmp dword [ebp + 8], eax
jl 0x4a1ce9
lea eax, [ecx + 0x6d]
movsx ecx, si
cmp ecx, eax
jg 0x4a1ce9
mov ecx, dword [edi + 0x13c690]
mov ecx, dword [ecx + 0x48]
call fcn.00567d50
mov edx, dword [edi + 0x13c690]
test al, al
je 0x4a1c6d
cmp byte [edx + 0x44], 0
mov al, byte [edi + 0x1895fb]
mov byte [ebp + 0xb], al
je 0x4a1c48
test al, al
je 0x4a1c2b
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
mov edx, 0xffffff9c
sar eax, 0xf
and eax, 0x26ac
sub edx, eax
lea ecx, [eax + 0x64]
jmp 0x4a1c33
mov ecx, 1
or edx, 0xffffffff
cmp byte [edi + 0x1895fd], 0
mov eax, dword [edi + 0x13c690]
cmovne ecx, edx
add dword [eax + 0x34], ecx
jmp 0x4a1cab
xor ecx, ecx
mov eax, 1
cmp byte [edi + 0x1895fd], cl
mov esi, 0xa
sete cl
cmp byte [ebp + 0xb], 0
cmovne eax, esi
lea ecx, [ecx*2 - 1]
jmp 0x4a1ca5
mov ecx, dword [edx + 0x48]
call fcn.00567f50
mov edx, dword [edi + 0x13c690]
test al, al
je 0x4a1cdd
cmp byte [edi + 0x1895fb], 0
mov eax, 0xa
mov ecx, 1
cmovne ecx, eax
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
imul ecx, eax
add dword [edx + 0x34], ecx
mov eax, dword [edi + 0x13c690]
mov ecx, dword [eax + 0x34]
cmp ecx, 0x77359400
jle 0x4a1cc8
mov dword [eax + 0x34], 0x77359400
jmp case.default.0x4a1414
cmp ecx, 1
jge case.default.0x4a1414
mov dword [eax + 0x34], 1
jmp case.default.0x4a1414
mov dword [edx + 0x34], 0xffffffff
jmp case.default.0x4a1414
mov ecx, dword [ebp - 0x18]
shl ecx, 4
sub ecx, dword [ebp - 0x18]
movsx eax, dx
add ecx, eax
movsx edx, si
lea eax, [ecx + 0x6e]
cmp edx, eax
jl case.default.0x4a1047
lea eax, [ecx + 0x7c]
cmp edx, eax
jg case.default.0x4a1047
mov ecx, dword [edi + 0x13c690]
mov eax, dword [ecx + 0x30]
mov dword [edi + 0x14595c], eax
mov eax, dword [ecx + 0x38]
mov dword [edi + 0x145960], eax
mov eax, dword [ecx + 0x3c]
mov dword [edi + 0x145964], eax
mov eax, 2
mov word [edi + 0x145ab8], ax
jmp case.default.0x4a1414
xor eax, eax
xor edx, edx
mov dword [ebp + 0xc], eax
cmp dword [edi + 0x194b10], eax
jle case.default.0x4a1047
lea ecx, [edi + 0x1873a8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0
je 0x4a1dd1
movsx eax, word [edi + 0x1459b6]
inc edx
mov dword [ebp - 0x24], eax
cmp edx, eax
jle 0x4a1dce
mov eax, dword [edi + 0x145958]
add eax, dword [ebp - 0x24]
cmp edx, eax
jg 0x4a1dce
mov eax, dword [ebp - 0x14]
movsx ecx, word [ebp + 8]
cwde
add eax, 0x19
mov dword [ebp - 0x24], ecx
cmp ecx, eax
jle 0x4a1dca
mov ecx, dword [ebp - 0x14]
movsx eax, cx
mov ecx, dword [ebp - 0x10]
add eax, 0xf0
cmp dword [ebp - 0x24], eax
jge 0x4a1dca
movsx eax, cx
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
add eax, 0x50
movsx ecx, si
mov dword [ebp - 0x20], ecx
cmp ecx, eax
jl 0x4a1dca
mov eax, dword [ebp - 0x24]
add eax, 0x5f
cmp ecx, eax
jl 0x4a1df4
add dword [ebp - 0x1c], 0xf
mov eax, dword [ebp + 0xc]
add dword [ebp - 0x18], 4
inc eax
mov dword [ebp + 0xc], eax
cmp eax, dword [edi + 0x194b10]
jl 0x4a1d61
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x40
lea esi, [edi + 0x1459b8]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov eax, dword [edi + eax*4 + 0x1873a8]
movups xmm0, xmmword [eax + 4]
movups xmmword [esi], xmm0
mov eax, dword [eax + 0x14]
mov dword [esi + 0x10], eax
jmp case.default.0x4a1414
mov edx, dword [edi + 0x14595c]
mov eax, edx
sar eax, 0x14
and eax, 0xf
mov dword [ebp - 0x1c], eax
mov eax, edx
sar eax, 0x10
and eax, 0xf
mov dword [ebp - 0x24], eax
mov eax, edx
sar eax, 0xc
and eax, 0xf
mov dword [ebp - 0x20], eax
mov eax, edx
sar eax, 8
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, edx
shr eax, 0x1c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
movsx ecx, ax
mov dword [ebp + 0xc], ecx
movsx ecx, word [ebp + 8]
mov eax, dword [ebp + 0xc]
add eax, 0x1e
mov dword [ebp + 8], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jle case.default.0x4a1047
mov eax, dword [ebp + 0xc]
add eax, 0xf0
cmp dword [ebp + 8], eax
jge case.default.0x4a1047
movsx eax, cx
movsx ecx, si
mov dword [ebp + 8], eax
add eax, 0x41
mov dword [ebp + 0xc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a1f06
mov eax, dword [ebp + 8]
add eax, 0x4f
cmp dword [ebp + 0xc], eax
jg 0x4a1f06
mov cl, byte [edi + 0x1895fd]
xor eax, eax
test cl, cl
mov byte [ebp + 0xb], cl
mov ecx, dword [ebp - 0x1c]
sete al
lea eax, [eax*2 - 1]
add ecx, eax
cmp ecx, 4
jne 0x4a1ee2
xor ecx, ecx
cmp byte [ebp + 0xb], cl
sete cl
lea ecx, [ecx*2 + 3]
jmp 0x4a1eea
xor eax, eax
cmp ecx, 0xc
cmova ecx, eax
and edx, 0xff0fffff
shl ecx, 0x14
or edx, ecx
and edx, 0xfff0ffff
mov dword [edi + 0x14595c], edx
jmp case.default.0x4a1414
movsx eax, cx
movsx ecx, si
mov dword [ebp + 8], eax
add eax, 0x50
mov dword [ebp + 0xc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a1f86
mov eax, dword [ebp + 8]
add eax, 0x5e
cmp dword [ebp + 0xc], eax
jg 0x4a1f86
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 0xb
ja case.default.0x4a1414
movzx eax, byte [eax + 0x4a2290]
jmp dword [eax*4 + 0x4a2288]
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
add ecx, eax
cmp ecx, 0xf
jbe 0x4a1f65
mov ecx, 1
jmp 0x4a1f70
cmp ecx, 1
mov eax, 0xf
cmovb ecx, eax
and edx, 0xfff0ffff
shl ecx, 0x10
or edx, ecx
mov dword [edi + 0x14595c], edx
jmp case.default.0x4a1414
movsx eax, cx
movsx ecx, si
mov dword [ebp + 8], eax
add eax, 0x6e
mov dword [ebp + 0xc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a1fe1
mov eax, dword [ebp + 8]
add eax, 0x7c
cmp dword [ebp + 0xc], eax
jg 0x4a1fe1
mov ecx, dword [ebp - 0x20]
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
add ecx, eax
xor eax, eax
cmp ecx, 0xc
cmovbe eax, ecx
and edx, 0xffff0fff
shl eax, 0xc
or eax, edx
and eax, 0xfffff0ff
mov dword [edi + 0x14595c], eax
jmp case.default.0x4a1414
movsx eax, cx
movsx ecx, si
mov dword [ebp + 8], eax
add eax, 0x7d
mov dword [ebp + 0xc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a2048
mov eax, dword [ebp + 8]
add eax, 0x8b
cmp dword [ebp + 0xc], eax
jg 0x4a2048
mov ecx, dword [ebp - 0x18]
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
add ecx, eax
cmp ecx, 0xf
jbe 0x4a2027
mov ecx, 1
jmp 0x4a2032
cmp ecx, 1
mov eax, 0xf
cmovb ecx, eax
and edx, 0xfffff0ff
shl ecx, 8
or edx, ecx
mov dword [edi + 0x14595c], edx
jmp case.default.0x4a1414
movsx eax, cx
movsx ecx, si
mov dword [ebp + 8], eax
add eax, 0x9b
mov dword [ebp + 0xc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a2098
mov eax, dword [ebp + 8]
add eax, 0xa9
cmp dword [ebp + 0xc], eax
jg 0x4a2098
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
and edx, 0xfffffff
lea eax, [eax*2 - 1]
add eax, dword [ebp - 0x28]
shl eax, 0x1c
or eax, edx
mov dword [edi + 0x14595c], eax
jmp case.default.0x4a1414
movsx eax, cx
movsx ecx, si
mov dword [ebp + 8], eax
add eax, 0xb9
mov dword [ebp + 0xc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
jl 0x4a20d8
mov eax, dword [ebp + 8]
add eax, 0xc7
cmp dword [ebp + 0xc], eax
jg 0x4a20d8
mov ecx, edx
mov eax, edx
and ecx, 0xfffffffe
or eax, 1
test dl, 1
cmovne eax, ecx
mov dword [edi + 0x14595c], eax
jmp case.default.0x4a1414
movsx edx, cx
movsx eax, si
mov dword [ebp + 8], eax
lea eax, [edx + 0xd7]
cmp dword [ebp + 8], eax
jl 0x4a2157
lea eax, [edx + 0xe5]
movsx edx, si
cmp edx, eax
jg 0x4a2157
cmp byte [edi + 0x1895fb], 0
mov eax, 0xa
mov ecx, 1
cmovne ecx, eax
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
imul ecx, eax
add ecx, dword [edi + 0x145960]
mov dword [edi + 0x145960], ecx
cmp ecx, 0x64
jle 0x4a2142
mov dword [edi + 0x145960], 0x64
jmp case.default.0x4a1414
cmp ecx, 0xffffff9c
jge case.default.0x4a1414
mov dword [edi + 0x145960], 0xffffff9c
jmp case.default.0x4a1414
movsx ecx, cx
movsx edx, si
lea eax, [ecx + 0xf5]
cmp edx, eax
jl case.default.0x4a1047
lea eax, [ecx + 0x103]
cmp edx, eax
jg case.default.0x4a1047
cmp byte [edi + 0x1895fb], 0
mov eax, 0xa
mov ecx, 1
cmovne ecx, eax
xor eax, eax
cmp byte [edi + 0x1895fd], al
sete al
lea eax, [eax*2 - 1]
imul ecx, eax
add ecx, dword [edi + 0x145964]
mov dword [edi + 0x145964], ecx
cmp ecx, 0xff
jle 0x4a21ba
mov dword [edi + 0x145964], 0xff
jmp case.default.0x4a1414
cmp ecx, 0xffffffff
jge case.default.0x4a1414
mov dword [edi + 0x145964], 0xffffffff
mov byte [edi + 0x145abb], 0
push 0
push 5
push 0xe
push 0x45
mov ecx, edi
call fcn.0045cfc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8