Function at 0x4b2888
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x9b
push 0
push 0
dec ecx
jne 0x4b2891
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b4c21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x950]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x954]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x958]
xor edx, edx
call fcn.00431d58
mov dword [ebp - 0x38], 0x46
xor ecx, ecx
push ebp
push 0x4b4b5d
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [ebp - 0xc], 0
jne 0x4b29e0
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*8 + 0xb812]
cmp dl, 0xb
je 0x4b292f
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 0xc
jne 0x4b293c
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb808], 0xffffffff
je 0x4b2948
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [edx + 0xb650], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb814], 0
jne 0x4b297f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
xor edx, edx
call fcn.00431e70
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.004b5574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb814], 0
jle 0x4b29d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb650]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb812], 5
je 0x4b29d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb650]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb812], 6
je 0x4b29d8
mov eax, dword [ebp - 4]
call fcn.004b24b0
mov eax, dword [ebp - 4]
call fcn.004b2384
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
mov byte [eax + 0xa722], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
xor edx, edx
call fcn.00431e70
inc dword [ebp - 0x38]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb814], 0
jle 0x4b3de9
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb813]
sub al, 1
jb 0x4b2a4a
je 0x4b2a77
jmp 0x4b2a9b
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fe7c]
call fcn.00403c8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb804]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xa668]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4b2aea
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fe6c]
call fcn.00403c8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb804]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4b2aea
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + edx*8 + 0xb813]
mov edx, dword [ebp - 4]
mov edx, dword [edx + esi*4 + 0xa71c]
call fcn.00403c8c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4 + 0xa76c]
mov edx, dword [ebp - 4]
add eax, dword [edx + ebx*8 + 0xb804]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
call fcn.004094f4
test al, al
jne 0x4b2b25
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6ec]
mov dl, 1
call fcn.00453328
mov eax, dword [ebp - 4]
mov byte [eax + 0xabdc], 0x16
mov eax, dword [ebp - 4]
call fcn.004b24d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov edx, dword [ebp - 0x2c]
call fcn.0040634e
mov eax, dword [0x4e1304]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov edx, 1
call fcn.00406885
call fcn.00402864
mov edx, dword [ebp - 0x30]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004068bc
call fcn.00402864
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov ecx, 4
call fcn.004063f0
call fcn.00402864
inc dword [ebp - 0x38]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xb812]
cmp eax, 0xd
ja case.0x4b2ba1.8
jmp dword [eax*4 + 0x4b2ba8]
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4c3c
lea edx, [ebp - 0x440]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x440]
push 0x4b4c4c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b3b93
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4c5c
lea edx, [ebp - 0x444]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x444]
push 0x4b4c6c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b3b93
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4c5c
lea edx, [ebp - 0x448]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x448]
push 0x4b4c7c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b3b93
lea eax, [ebp - 0x1c]
call fcn.00403bf4
cmp dword [ebp - 0xc], 0
jne 0x4b3b93
mov eax, dword [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb814]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50294]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x50244]
lea eax, [ebp - 0x44c]
call fcn.00403ec0
mov edx, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004a3ec8
mov eax, dword [ebp - 4]
cmp dword [eax + 0xabd8], 0
je 0x4b2fde
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabd8]
call fcn.004094f4
test al, al
je 0x4b2fde
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
lea edx, [ebp - 0x450]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x450]
lea edx, [ebp - 0x20]
call fcn.00408f00
mov edx, dword [ebp - 0x20]
mov eax, 0x4b4c8c
call fcn.00404160
mov ebx, eax
test ebx, ebx
jle 0x4b3b93
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 5]
mov ecx, 0x14
mov eax, dword [ebp - 0x20]
call fcn.0040407c
mov edx, dword [ebp - 0x20]
mov eax, 0x4b4c9c
call fcn.00404160
test eax, eax
jne 0x4b2e0a
lea edx, [ebx + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
lea edx, [ebp - 0x458]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabd8]
call fcn.00409644
mov ecx, dword [ebp - 0x458]
lea eax, [ebp - 0x454]
mov edx, 0x4b4cb0
call fcn.00403ec0
mov edx, dword [ebp - 0x454]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
call fcn.00428d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x4b2fc6
lea edx, [ebp - 0x45c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x45c]
lea edx, [ebp - 0x20]
call fcn.00408f00
mov edx, dword [ebp - 0x20]
mov eax, 0x4b4c9c
call fcn.00404160
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 0xa]
mov ecx, 0xff
mov eax, dword [ebp - 0x20]
call fcn.0040407c
mov edx, dword [ebp - 0x20]
mov eax, 0x4b4cd0
call fcn.00404160
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040407c
jmp 0x4b2e98
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
dec ecx
mov edx, 2
mov eax, dword [ebp - 0x20]
call fcn.0040407c
mov eax, dword [ebp - 0x20]
mov al, byte [eax]
cmp al, 0x5c
je 0x4b2e7c
cmp al, 0x2e
je 0x4b2e7c
cmp al, 0x20
je 0x4b2e7c
cmp al, 0x3d
je 0x4b2e7c
cmp al, 0x27
je 0x4b2e7c
cmp al, 0x22
je 0x4b2e7c
jmp 0x4b2ed3
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040407c
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x20
je 0x4b2eb7
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x27
je 0x4b2eb7
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x22
je 0x4b2eb7
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4cdc
push dword [ebp - 0x20]
lea eax, [ebp - 0x460]
mov edx, 4
call fcn.00403f34
mov eax, dword [ebp - 0x460]
call fcn.004094f4
test al, al
jne 0x4b2fc6
mov edx, ebx
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
mov edx, dword [ebp - 0x18]
add edx, 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov ecx, dword [eax]
call dword [ecx + 0xc4]
lea edx, [ebp - 0x468]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabd8]
call fcn.00409644
mov ecx, dword [ebp - 0x468]
lea eax, [ebp - 0x464]
mov edx, 0x4b4cb0
call fcn.00403ec0
mov edx, dword [ebp - 0x464]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
call fcn.00428d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc4]
jmp 0x4b3b93
mov eax, dword [ebp - 4]
add eax, 0xabd8
call fcn.00403bf4
jmp 0x4b3b93
lea eax, [ebp - 0x1c]
call fcn.00403bf4
jmp 0x4b3b93
cmp dword [ebp - 0xc], 5
jne 0x4b307c
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb828], 0
jne 0x4b306f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabe8]
call fcn.00409540
mov eax, dword [ebp - 4]
inc dword [eax + 0x51328]
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4ce8
lea edx, [ebp - 0x46c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51328]
call fcn.00409284
push dword [ebp - 0x46c]
push 0x4b4cfc
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b3b93
lea eax, [ebp - 0x1c]
call fcn.00403bf4
jmp 0x4b3b93
mov eax, dword [ebp - 4]
inc dword [eax + 0x51328]
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4d0c
lea edx, [ebp - 0x470]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51328]
call fcn.00409284
push dword [ebp - 0x470]
push 0x4b4cfc
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b3b93
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa6b1], 1
jne 0x4b31fa
cmp dword [ebp - 0xc], 0
jne 0x4b3196
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa71c]
mov edx, 0x4b4d1c
call fcn.00404160
test eax, eax
jle 0x4b3196
xor eax, eax
push ebp
push 0x4b313d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x474]
mov eax, 0x4b4d34
call fcn.00461e2c
mov edx, dword [ebp - 0x474]
mov eax, dword [ebp - 4]
add eax, 0x512f0
call fcn.00405284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3196
cmp dword [ebp - 0xc], 5
jne 0x4b31a9
lea eax, [ebp - 0x1c]
call fcn.00403bf4
jmp 0x4b3b93
mov eax, dword [ebp - 4]
inc dword [eax + 0x5132c]
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4d50
lea edx, [ebp - 0x47c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5132c]
call fcn.00409284
push dword [ebp - 0x47c]
push 0x4b4d60
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b3b93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
mov edx, 0x4b4d70
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xabec
call fcn.00403bf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b5574
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov edx, 0x4b4d7c
call fcn.00431e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa6b2], 1
jne 0x4b33a9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa71c]
mov edx, 0x4b4dac
call fcn.00404160
test eax, eax
je 0x4b32c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa71c]
mov edx, 0x4b4dc4
call fcn.00404160
test eax, eax
jne 0x4b3358
xor eax, eax
push ebp
push 0x4b32ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x480]
mov eax, 0x4b4dd8
call fcn.00461e2c
mov edx, dword [ebp - 0x480]
mov eax, dword [ebp - 4]
add eax, 0x51300
call fcn.00405284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3358
mov eax, dword [ebp - 4]
inc dword [eax + 0x51330]
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4d50
lea edx, [ebp - 0x488]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51330]
call fcn.00409284
push dword [ebp - 0x488]
push 0x4b4df4
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b3b93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
mov edx, 0x4b4d70
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xabec
call fcn.00403bf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b5574
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov edx, 0x4b4e04
call fcn.00431e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa6b3], 1
jne 0x4b348e
mov eax, dword [ebp - 4]
inc dword [eax + 0x51334]
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4e34
lea edx, [ebp - 0x48c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51334]
call fcn.00409284
push dword [ebp - 0x48c]
push 0x4b4e44
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b3b93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
mov edx, 0x4b4d70
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xabec
call fcn.00403bf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b5574
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov edx, 0x4b4e54
call fcn.00431e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa6b4], 1
jne 0x4b36a7
push 0
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov ecx, 0x1e
call fcn.004063f0
call fcn.00402864
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 0
je 0x4b3573
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 3
jne 0x4b358a
mov ebx, 0x1e
lea eax, [ebp - 0x43c]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec ebx
jne 0x4b357e
lea eax, [ebp - 0x20]
call fcn.00403bf4
mov ebx, 0xf
lea esi, [ebp - 0x43c]
lea eax, [ebp - 0x490]
mov dl, byte [esi]
call fcn.00403d9c
mov edx, dword [ebp - 0x490]
lea eax, [ebp - 0x20]
call fcn.00403e7c
inc esi
dec ebx
jne 0x4b359d
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4cdc
push dword [ebp - 0x20]
push 0x4b4e8c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 1
je 0x4b3616
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 4
jne 0x4b361a
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
test al, al
je 0x4b3b93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
mov edx, 0x4b4d70
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xabec
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004b5574
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
mov edx, 0x4b4d70
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xabec
call fcn.00403bf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b5574
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x690]
mov edx, 0x4b4e9c
call fcn.00431e70
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
push 0
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov ecx, 0x1e
call fcn.004063f0
call fcn.00402864
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 0
je 0x4b378e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 3
jne 0x4b37a5
mov ebx, 0x1e
lea esi, [ebp - 0x43c]
mov al, byte [esi]
sub al, byte [ebp - 0x14]
dec eax
mov byte [esi], al
inc esi
dec ebx
jne 0x4b3799
mov ebx, 0xf
lea esi, [ebp - 0x43c]
lea eax, [ebp - 0x494]
mov dl, byte [esi]
call fcn.00403d9c
mov edx, dword [ebp - 0x494]
lea eax, [ebp - 0x20]
call fcn.00403e7c
inc esi
dec ebx
jne 0x4b37b0
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb812], 5
jne 0x4b3804
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
push dword [ebp - 0x20]
push 0x4b4edc
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f34
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb812], 6
jne 0x4b3839
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
push dword [ebp - 0x20]
push 0x4b4eec
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f34
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 1
je 0x4b3867
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 4
jne 0x4b386b
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 4]
add eax, 0x984
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
test al, al
je 0x4b3b93
mov ebx, 1
lea edx, [ebp - 0x498]
mov eax, dword [ebp - 0x1c]
call fcn.0040960c
mov edx, dword [ebp - 0x498]
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50294]
call fcn.00403f84
jne 0x4b39c6
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x50744], 0
je 0x4b391b
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50744]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4b391b
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50744]
push eax
call sub.user32.dll_SetForegroundWindow
push 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50744]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50244]
call fcn.00404038
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50294]
call fcn.00404038
push eax
push 0x4b4ef4
mov eax, dword [0x4e1268]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4b39d3
lea edx, [ebp - 0x49c]
mov eax, dword [ebp - 0x1c]
call fcn.0040960c
mov edx, dword [ebp - 0x49c]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50294]
call fcn.00403c48
mov eax, dword [ebp - 4]
mov dword [eax + 0x50bf8], ebx
mov eax, dword [ebp - 4]
call fcn.004cd748
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50bfc], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4f8]
mov dl, 1
call fcn.00453328
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
inc ebx
cmp ebx, 0x12d
jne 0x4b3890
cmp ebx, 0x12d
jne 0x4b3b03
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x50294], 0
je 0x4b3a22
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x50294]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x50244]
lea eax, [ebp - 0x4a0]
call fcn.00403ec0
mov eax, dword [ebp - 0x4a0]
call fcn.004094f4
test al, al
jne 0x4b3af6
mov eax, dword [ebp - 4]
mov dword [eax + 0x50bf8], ebx
lea edx, [ebp - 0x4a4]
mov eax, dword [ebp - 0x1c]
call fcn.0040960c
mov edx, dword [ebp - 0x4a4]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50294]
call fcn.00403c48
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50244]
call fcn.00404038
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50294]
call fcn.00404038
push eax
push 0x4b4ef4
mov eax, dword [0x4e1268]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4b3ab0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50bfc], edx
mov eax, dword [ebp - 4]
call fcn.004cd748
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4f8]
mov dl, 1
call fcn.00453328
jmp 0x4b3ad7
push 0
mov ecx, 0x4b4efc
mov edx, 0x4b4f04
mov eax, dword [0x4e1268]
mov eax, dword [eax]
call fcn.004504b4
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50294]
call fcn.00403bf4
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
inc ebx
cmp ebx, 0x12d
jne 0x4b39e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4fea9
call fcn.00403e18
mov eax, dword [ebp - 4]
call fcn.004b24d8
push 0
push 0x4b4f2c
push dword [ebp - 0x20]
push 0x4b4f5c
mov eax, dword [ebp - 4]
push dword [eax + 0xaa28]
push 0x4b4f6c
lea eax, [ebp - 0x4a8]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4a8]
call fcn.00404038
mov edx, eax
mov ecx, 0x4b4efc
mov eax, dword [0x4e1268]
mov eax, dword [eax]
call fcn.004504b4
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
inc dword [ebp - 0x38]
cmp dword [ebp - 0xc], 0
jne 0x4b3bb7
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xb812], 0xa
je 0x4b3ca8
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb82c]
cmp al, 1
je 0x4b3be4
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4b3ca8
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb814]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*8 + 0xb812]
test dl, dl
je 0x4b3c46
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 2
je 0x4b3c46
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 0xa
je 0x4b3c46
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 1
jne 0x4b3c93
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb828], 0
jle 0x4b3c93
cmp dword [ebp - 0xc], 0
jne 0x4b3c65
mov edx, dword [ebp - 4]
sub esi, dword [edx + eax*8 + 0xb828]
jmp 0x4b3c93
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*8 + 0xb814]
add edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
sub edx, dword [ecx + eax*8 + 0xb828]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb828]
mov eax, dword [ebp - 0x30]
push eax
push esi
push 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004d634c
cmp dword [ebp - 0xc], 0
jne 0x4b3cc9
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xb812], 0xa
je 0x4b3de9
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb82c]
test al, al
je 0x4b3cf6
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 3
jne 0x4b3de9
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb814]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb812]
test al, al
je 0x4b3d37
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
jne 0x4b3dbb
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb828], 0
jle 0x4b3dbb
cmp dword [ebp - 0xc], 0
jne 0x4b3d56
mov eax, dword [ebp - 4]
sub esi, dword [eax + ebx*8 + 0xb828]
jmp 0x4b3dbb
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.0040657c
call fcn.00402864
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*8 + 0xb814]
add edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + ebx*8 + 0xb828]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004068bc
call fcn.00402864
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov ecx, 4
call fcn.004063f0
call fcn.00402864
mov eax, dword [ebp - 4]
mov esi, dword [eax + ebx*8 + 0xb828]
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.0040657c
call fcn.00402864
mov dword [ebp - 0x30], eax
push esi
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004ad97c
xor eax, eax
push ebp
push 0x4b3e2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb814], 0
jle 0x4b3e20
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3e34
inc dword [ebp - 0x38]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xb812]
cmp eax, 0xd
ja case.0x4b3e5b.0
mov al, byte [eax + 0x4b3e62]
jmp dword [eax*4 + 0x4b3e70]
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x50294], 0
je 0x4b3ec3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x50294]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x50244]
lea eax, [ebp - 0x4ac]
call fcn.00403ec0
mov eax, dword [ebp - 0x4ac]
call fcn.004094f4
test al, al
jne 0x4b3f85
mov eax, dword [ebp - 4]
mov dword [eax + 0x50bf8], ebx
lea edx, [ebp - 0x4b0]
mov eax, dword [ebp - 0x1c]
call fcn.0040960c
mov edx, dword [ebp - 0x4b0]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50294]
call fcn.00403c48
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50244]
call fcn.00404038
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50294]
call fcn.00404038
push eax
push 0x4b4ef4
mov eax, dword [0x4e1268]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4b3f51
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50bfc], edx
mov eax, dword [ebp - 4]
call fcn.004cd748
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4f8]
mov dl, 1
call fcn.00453328
jmp 0x4b3f78
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50294]
call fcn.00403bf4
push 0
mov ecx, 0x4b4efc
mov edx, 0x4b4f04
mov eax, dword [0x4e1268]
mov eax, dword [eax]
call fcn.004504b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
inc ebx
cmp ebx, 0x12d
jne 0x4b3e85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
cmp dword [ebp - 0xc], 0
jne 0x4b412a
cmp dword [ebp - 0x1c], 0
jne 0x4b3fce
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa714]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4b3fe5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb808], 0xffffffff
jne 0x4b3ffa
mov eax, dword [ebp - 4]
call fcn.004b7874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
mov edx, 0x4b4f7c
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f0]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb825], 0xa
jae 0x4b4068
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
xor edx, edx
call fcn.00442438
jmp 0x4b4078
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
mov dl, 1
call fcn.00442438
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004cc8f0
mov eax, dword [ebp - 4]
call fcn.004b24d8
xor eax, eax
push ebp
push 0x4b40b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b40be
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc8]
xor eax, eax
push ebp
push 0x4b410c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
call fcn.0045c380
test eax, eax
jne 0x4b4102
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x63c]
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4116
mov eax, dword [ebp - 4]
mov byte [eax + 0x5027c], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0xa5ec], 0
cmp dword [ebp - 0xc], 1
jne 0x4b416c
cmp dword [ebp - 0x1c], 0
jne 0x4b4155
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa714]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4b416c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0xc], 5
jne 0x4b41ae
cmp dword [ebp - 0x1c], 0
jne 0x4b4197
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa714]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4b41ae
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0x1c], 0
jne 0x4b41c7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa714]
call fcn.00402f6c
jmp 0x4b4b50
mov eax, dword [ebp - 0x1c]
call fcn.00409540
jmp 0x4b4b50
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb812]
cmp al, 0xb
je 0x4b4201
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xc
jne 0x4b4394
xor eax, eax
mov dword [ebp - 0x3c], eax
push 0x4b4f88
lea edx, [ebp - 0x4b4]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x4b4]
push 0x4b509c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403f34
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb812], 0xb
jne 0x4b424b
lea eax, [ebp - 0x20]
mov edx, 0x4b50a8
call fcn.00403e7c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb812], 0xc
jne 0x4b426f
lea eax, [ebp - 0x20]
mov edx, 0x4b50b4
call fcn.00403e7c
push dword [ebp - 0x20]
push 0x4b50c0
push 0x4b50d0
push 0x4b50dc
push 0x4b50d0
push 0x4b50ec
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00403f34
mov eax, dword [ebp - 4]
inc dword [eax + 0x51328]
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4ce8
lea edx, [ebp - 0x4b8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51328]
call fcn.00409284
push dword [ebp - 0x4b8]
push 0x4b50fc
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x20]
call fcn.00403e74
test eax, eax
jle 0x4b4309
mov ebx, 1
lea esi, [ebp - 0x43c]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4b42fb
mov eax, dword [ebp - 4]
add eax, 0xb3b8
mov edx, dword [ebp - 0x1c]
call fcn.0040634e
mov eax, dword [0x4e1304]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xb3b8
mov edx, 1
call fcn.0040689c
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004068bc
call fcn.00402864
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004064b8
call fcn.00402864
lea eax, [ebp - 0x20]
call fcn.00403bf4
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + 0x500fa]
cmp ebx, 1
jl 0x4b43b4
cmp ebx, 0xc8
jle 0x4b43b9
mov ebx, 0x19
mov eax, dword [ebp - 4]
cmp byte [eax + 0x500f9], 0
jne 0x4b465e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
cmp byte [eax + 0x1f6], 1
jne 0x4b465e
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b50fc
call fcn.00404160
test eax, eax
jle 0x4b465e
push 0x4b510c
lea edx, [ebp - 0x4bc]
mov eax, ebx
call fcn.00409284
push dword [ebp - 0x4bc]
push 0x4b5188
push 0x4b50d0
push 0x4b5194
push 0x4b50d0
push 0x4b51a0
push 0x4b50d0
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403f34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
cmp byte [eax + 0x1f6], 1
jne 0x4b44af
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b50fc
call fcn.00404160
test eax, eax
jle 0x4b44af
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5024e], 2
je 0x4b447d
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82d], 1
jne 0x4b44af
push dword [ebp - 0x20]
push 0x4b51b8
push 0x4b50d0
push 0x4b51dc
mov eax, dword [ebp - 4]
push dword [eax + 0x96c]
push 0x4b51e8
push 0x4b50d0
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00403f34
push dword [ebp - 0x20]
push 0x4b51f8
push 0x4b50d0
push 0x4b5218
push 0x4b50d0
push 0x4b523c
push 0x4b50d0
push 0x4b5248
push 0x4b50d0
push 0x4b5268
push 0x4b50d0
push 0x4b5274
push 0x4b50d0
push 0x4b52a4
push 0x4b50d0
push 0x4b52d0
push 0x4b50d0
push 0x4b5308
push 0x4b50d0
push 0x4b532c
push 0x4b50d0
push 0x4b5338
push 0x4b50d0
push 0x4b535c
push 0x4b50d0
lea eax, [ebp - 0x20]
mov edx, 0x19
call fcn.00403f34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
cmp byte [eax + 0x1f6], 1
jne 0x4b45a1
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b50fc
call fcn.00404160
test eax, eax
jle 0x4b45a1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5024e], 2
je 0x4b457d
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82d], 1
jne 0x4b45a1
push dword [ebp - 0x20]
push 0x4b5384
push 0x4b50d0
push 0x4b53d0
push 0x4b50d0
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00403f34
lea eax, [ebp - 0x20]
mov edx, 0x4b5418
call fcn.00403e7c
mov eax, dword [ebp - 0x20]
call fcn.00403e74
test eax, eax
jle 0x4b45d3
mov ebx, 1
lea esi, [ebp - 0x43c]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4b45c5
mov eax, dword [ebp - 4]
add eax, 0xb3b8
mov edx, dword [ebp - 0x1c]
call fcn.0040634e
mov eax, dword [0x4e1304]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xb3b8
mov edx, 1
call fcn.00406885
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004068bc
call fcn.00402864
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004064b8
call fcn.00402864
cmp dword [ebp - 0x20], 0
jne 0x4b47b2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
cmp byte [eax + 0x1f6], 1
jne 0x4b47b2
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b50fc
call fcn.00404160
test eax, eax
jle 0x4b47b2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5024e], 2
je 0x4b46ba
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82d], 1
jne 0x4b47b2
push 0x4b542c
mov eax, dword [ebp - 4]
push dword [eax + 0x96c]
push 0x4b5484
push 0x4b50d0
push 0x4b5494
push 0x4b50d0
push 0x4b54b8
push 0x4b50d0
push 0x4b5504
push 0x4b50d0
push 0x4b554c
lea eax, [ebp - 0x20]
mov edx, 0xb
call fcn.00403f34
mov eax, dword [ebp - 0x20]
call fcn.00403e74
test eax, eax
jle 0x4b4727
mov ebx, 1
lea esi, [ebp - 0x43c]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4b4719
mov eax, dword [ebp - 4]
add eax, 0xb3b8
mov edx, dword [ebp - 0x1c]
call fcn.0040634e
mov eax, dword [0x4e1304]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xb3b8
mov edx, 1
call fcn.00406885
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004068bc
call fcn.00402864
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xb3b8
call fcn.004064b8
call fcn.00402864
cmp dword [ebp - 0xc], 5
jne 0x4b489f
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb812]
cmp al, 2
je 0x4b47fa
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
je 0x4b47fa
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xa
jne 0x4b489f
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb828], 0
jne 0x4b4840
mov eax, dword [ebp - 4]
add eax, 0xabe8
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov eax, dword [ebp - 4]
mov byte [eax + 0xa6dd], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
mov edx, 0x4b555c
call fcn.00471f60
jmp 0x4b4892
cmp dword [ebp - 0x1c], 0
jne 0x4b4873
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa714]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa714]
call fcn.00402f6c
jmp 0x4b4892
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x1c]
call fcn.00409540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xabc4]
cmp ebx, dword [ebp - 8]
je 0x4b499d
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4c5c
lea edx, [ebp - 0x4c4]
mov eax, ebx
call fcn.00409284
push dword [ebp - 0x4c4]
push 0x4b4c6c
lea eax, [ebp - 0x4c0]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4c0]
call fcn.00409540
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4c5c
lea edx, [ebp - 0x4cc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabc4]
call fcn.00409284
push dword [ebp - 0x4cc]
push 0x4b4c7c
lea eax, [ebp - 0x4c8]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4c8]
call fcn.00409540
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4b4c3c
lea edx, [ebp - 0x4d4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabc4]
call fcn.00409284
push dword [ebp - 0x4d4]
push 0x4b4c4c
lea eax, [ebp - 0x4d0]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4d0]
call fcn.00409540
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xabc4], edx
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp dword [ecx + edx*8 + 0xb808], 0xffffffff
jne 0x4b4a82
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb812]
cmp al, 0xb
je 0x4b49f1
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xc
jne 0x4b4a82
mov eax, dword [ebp - 4]
mov byte [eax + 0xa721], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6bc]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 4]
add eax, 0xabc8
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov eax, dword [0x4e12ac]
cmp dword [eax], 0
jne 0x4b4a3d
mov ecx, dword [0x4e12ac]
mov eax, dword [0x4e1268]
mov eax, dword [eax]
mov edx, dword [0x49f38c]
call fcn.004502dc
mov eax, dword [0x4e12ac]
mov eax, dword [eax]
call fcn.0044d228
lea eax, [ebp - 0x4d8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xabc8]
call fcn.004043fc
mov edx, dword [ebp - 0x4d8]
mov eax, dword [0x4e12ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00471f60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x614]
mov edx, 0x4b4d70
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x66c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7f4]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xabec
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004b5574
mov eax, dword [ebp - 4]
mov byte [eax + 0xa5ec], 0
jmp 0x4b4b50
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4fea9
call fcn.00403e18
mov eax, dword [ebp - 4]
call fcn.004b24d8
push 0
push 0x4b4f2c
push dword [ebp - 0x20]
push 0x4b4f5c
mov eax, dword [ebp - 4]
push dword [eax + 0xaa28]
push 0x4b4f6c
lea eax, [ebp - 0x4dc]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4dc]
call fcn.00404038
mov edx, eax
mov ecx, 0x4b4efc
mov eax, dword [0x4e1268]
mov eax, dword [eax]
call fcn.004504b4
inc dword [ebp - 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4b91
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4c2b
lea eax, [ebp - 0x4dc]
call fcn.00403bf4
lea eax, [ebp - 0x4d8]
call fcn.004042b8
lea eax, [ebp - 0x4d4]
mov edx, 0x14
call fcn.00403c18
lea eax, [ebp - 0x484]
mov edx, dword [0x4011b0]
mov ecx, 2
call fcn.00404670
lea eax, [ebp - 0x47c]
call fcn.00403bf4
lea eax, [ebp - 0x478]
mov edx, dword [0x4011b0]
mov ecx, 2
call fcn.00404670
lea eax, [ebp - 0x470]
mov edx, 0xd
call fcn.00403c18
lea eax, [ebp - 0x2c]
call fcn.00403bf4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403c18
ret