Function at 0x48b8a4
Capabilities:
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Move file
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf7
push 0
push 0
dec ecx
jne 0x48b8ac
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x453648]
call fcn.004045b4
xor eax, eax
push ebp
push 0x48dd83
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xffffff91
cmp eax, 0x68
ja case.0x48b8ee.111
mov al, byte [eax + 0x48b8f5]
jmp dword [eax*4 + 0x48b95e]
lea eax, [ebp - 0x44]
mov edx, dword [0x4c7ed8]
call fcn.00403c38
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x48ba61
mov ecx, dword [ebp - 0x44]
mov edx, 0x48dd9c
mov eax, 0x48ddac
call fcn.00454040
mov edx, 0x48dd9c
mov eax, 0x48ddf8
call fcn.00454978
jmp case.0x48b8ee.111
cmp eax, 1
jne 0x48ba8c
mov eax, 0x48ddf8
mov edx, 0x48dd9c
mov ecx, dword [ebp - 0x44]
call fcn.00454040
mov eax, 0x48ddac
mov edx, 0x48dd9c
call fcn.00454978
jmp case.0x48b8ee.111
cmp eax, 2
jne case.0x48b8ee.111
mov eax, 0x48ddac
mov edx, 0x48dd9c
call fcn.00454978
mov eax, 0x48ddf8
mov edx, 0x48dd9c
call fcn.00454978
jmp case.0x48b8ee.111
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x4c7f05]
jne case.0x48b8ee.111
cmp byte [0x4bc534], 0
jne case.0x48b8ee.111
xor eax, eax
push ebp
push 0x48bb3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4bc534], 1
cmp byte [0x4c7ef8], 0
je 0x48bb0d
mov byte [0x4c7f11], 0
mov eax, dword [ebx + 0x14]
mov dword [0x4c7fcc], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.0048b44c
jmp 0x48bb2a
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x4c7f05]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.0048b008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x48b8ee.111
mov byte [0x4bc534], 0
ret
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x4c7f90], al
mov eax, 0x4c7f17
call fcn.00403ba0
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x4c7e84], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x4c7e88], eax
jmp case.0x48b8ee.111
mov eax, dword [ebx + 0x10]
mov dword [0x4c7f7c], eax
mov eax, dword [ebx + 0x14]
mov dword [0x4c7f80], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.00444784
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48b8ee.111
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.00444784
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48b8ee.111
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.00444784
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48b8ee.111
lea eax, [ebp - 0x48]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebp - 0x48]
call fcn.00490848
jmp case.0x48b8ee.111
call fcn.0048b62c
jmp case.0x48b8ee.111
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.00458024
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.00491bc4
jmp case.0x48b8ee.111
mov eax, dword [0x4bc998]
mov byte [eax], 1
mov eax, dword [0x4bcc00]
mov dl, byte [0x48de40]
cmp dl, byte [eax]
je 0x48bc48
xor ecx, ecx
mov dl, byte [0x48de44]
xor eax, eax
call fcn.00487830
mov eax, dword [0x4bc81c]
mov byte [eax], 1
mov eax, dword [0x4bc900]
mov eax, dword [eax]
call fcn.0042e10c
jmp case.0x48b8ee.111
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.00458024
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.00491bc4
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.0048986c
jmp case.0x48b8ee.111
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.00458024
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.00491bc4
mov edx, dword [ebx + 0x10]
mov ax, 2
call fcn.0048986c
jmp case.0x48b8ee.111
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.00458024
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.00491bc4
mov eax, dword [0x4bcc50]
cmp dword [eax], 2
jne 0x48bcea
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.0048986c
jmp case.0x48b8ee.111
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.0048986c
jmp case.0x48b8ee.111
cmp byte [0x4bc480], 2
je case.0x48b8ee.111
cmp byte [0x4c7f16], 3
jne case.0x48b8ee.111
cmp byte [0x4c7ef8], 0
jne case.0x48b8ee.111
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [0x4c7ef9]
call fcn.0041249c
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x740]
mov ecx, 0x48de50
call fcn.00403e6c
mov eax, dword [ebp - 0x740]
call fcn.0048b6f8
pop ecx
push ebp
mov eax, dword [0x4c7e8c]
call fcn.0048b6f8
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x4c7ef9]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp eax, 4
jne 0x48bdf3
cmp dword [ebp - 0x15], 0x55662143
jne 0x48bdce
lea edx, [ebp - 0x2c]
mov eax, dword [0x4c7ef9]
call fcn.00453e58
push ebp
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x744]
mov ecx, dword [ebp - 0x2c]
call fcn.00403e6c
mov eax, dword [ebp - 0x744]
call fcn.0048b6f8
pop ecx
jmp 0x48bd7c
mov ebx, dword [0x4c7ef9]
mov eax, ebx
call fcn.0041248c
mov edx, eax
sub edx, 4
mov eax, ebx
call fcn.0041249c
push ebp
mov eax, 0x48de68
call fcn.0048b6f8
pop ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x48be3a
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x74c]
mov ecx, 0x48de7c
call fcn.00403e6c
mov edx, dword [ebp - 0x74c]
lea eax, [ebp - 0x748]
call fcn.00404314
mov eax, dword [ebp - 0x748]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.00455944
jmp 0x48be5d
mov ecx, 0x48de7c
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x750]
call fcn.00403e6c
mov eax, dword [ebp - 0x750]
call fcn.00408efc
mov eax, dword [ebp - 0x24]
call fcn.00402e78
mov eax, 0x12c
call fcn.0045504c
mov eax, dword [0x4bc998]
mov byte [eax], 1
mov eax, dword [0x4bcc00]
mov dl, byte [0x48de40]
cmp dl, byte [eax]
je 0x48be95
mov dl, byte [0x48de44]
xor ecx, ecx
xor eax, eax
call fcn.00487830
mov eax, dword [0x4bc81c]
mov byte [eax], 1
mov eax, dword [0x4bc900]
mov eax, dword [eax]
call fcn.0042e10c
push 1
mov eax, dword [0x4c7e8c]
call fcn.00403fe4
push eax
call sub.kernel32.dll_WinExec
jmp case.0x48b8ee.111
lea eax, [ebp - 0x2c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebp - 0x2c]
call fcn.00403e20
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x30]
call fcn.00409464
mov eax, dword [ebp - 0x30]
call fcn.00403e20
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x34]
call fcn.00409464
mov eax, dword [ebp - 0x2c]
mov edx, 0x48de90
call fcn.00403f30
jne 0x48bf48
lea eax, [ebp - 0x30]
call fcn.0048a418
lea eax, [ebp - 0x34]
call fcn.0048a418
mov edx, 0x20
mov eax, dword [ebp - 0x34]
call fcn.00408de0
push 0
mov eax, dword [ebp - 0x34]
call fcn.00403fe4
push eax
mov eax, dword [ebp - 0x30]
call fcn.00403fe4
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x48b8ee.111
mov eax, dword [ebp - 0x2c]
mov edx, 0x48dea4
call fcn.00403f30
jne 0x48c019
mov eax, dword [ebp - 0x30]
call fcn.00403e20
cmp eax, 3
jle case.0x48b8ee.111
lea eax, [ebp - 0x30]
call fcn.0048a418
mov eax, dword [ebp - 0x30]
call fcn.00408d78
test al, al
je 0x48bf92
mov edx, 2
mov eax, dword [ebp - 0x30]
call fcn.0048a18c
jmp case.0x48b8ee.111
mov eax, dword [ebp - 0x30]
call fcn.0044ad18
test al, al
je case.0x48b8ee.111
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0x30]
call fcn.00403bf4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 1
mov byte [0x4bc52c], 1
xor eax, eax
push ebp
push 0x48bffb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.004529a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c002
mov byte [0x4bc52c], 0
ret
mov eax, dword [ebp - 0x2c]
mov edx, 0x48deb8
call fcn.00403f30
jne 0x48c063
lea eax, [ebp - 0x30]
call fcn.0048a418
lea eax, [ebp - 0x34]
call fcn.0048a418
mov edx, 0x20
mov eax, dword [ebp - 0x34]
call fcn.00408de0
push 3
mov eax, dword [ebp - 0x34]
call fcn.00403fe4
push eax
mov eax, dword [ebp - 0x30]
call fcn.00403fe4
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x48b8ee.111
lea eax, [ebp - 0x34]
call fcn.0048a418
cmp dword [ebp - 0x34], 0
jne 0x48c07c
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
call fcn.00408fc8
lea eax, [ebp - 0x2c]
call fcn.0048a418
push 1
mov eax, dword [ebp - 0x34]
call fcn.00403fe4
push eax
mov eax, dword [ebp - 0x30]
call fcn.00403fe4
push eax
mov eax, dword [ebp - 0x2c]
call fcn.00403fe4
push eax
push 0x48dec4
mov eax, dword [ebp - 0x28]
call fcn.00444784
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x48b8ee.111
cmp byte [0x4bc508], 1
jbe case.0x48b8ee.111
mov byte [0x4bc4c4], 0xff
mov ecx, dword [0x4c7fa8]
neg ecx
sar ecx, 1
jns 0x48c0dc
adc ecx, 0
mov eax, ecx
cdq
cmp edx, dword [0x4c7f78]
jne 0x48c0f1
cmp eax, dword [0x4c7f74]
jbe 0x48c109
jmp 0x48c0f3
jle 0x48c109
mov eax, dword [0x4c7fa8]
neg eax
mov eax, ecx
cdq
mov dword [0x4c7f74], eax
mov dword [0x4c7f78], edx
mov eax, dword [0x4bc850]
cmp dword [eax], 0
jle 0x48c13d
test byte [ebx + 0x17], 0x80
je 0x48c12b
mov eax, dword [ebx + 0x10]
and eax, 0xff
call fcn.00488bec
jmp case.0x48b8ee.111
mov eax, dword [ebx + 0x10]
and eax, 0xff
call fcn.00488bd4
jmp case.0x48b8ee.111
mov eax, dword [0x4bcbdc]
cmp dword [eax], 0
jle 0x48c17f
test byte [ebx + 0x17], 0x80
je 0x48c166
push 1
mov eax, dword [ebx + 0x10]
and eax, 0xff
push eax
mov eax, dword [0x4bcb60]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 1
mov eax, dword [ebx + 0x10]
and eax, 0xff
push eax
mov eax, dword [0x4bca3c]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
xor esi, esi
mov eax, dword [ebx + 0x14]
test ah, 1
je 0x48c18e
mov esi, 1
test eax, 0x80000000
je 0x48c198
or esi, 2
mov dword [ebp - 0x73c], 1
mov dx, word [ebx + 0x10]
mov word [ebp - 0x738], dx
shr eax, 8
mov word [ebp - 0x736], ax
mov dword [ebp - 0x734], esi
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x730], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x72c], eax
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x48b8ee.111
cmp byte [0x4bc508], 1
jbe case.0x48b8ee.111
mov byte [0x4bc4c4], 0xff
mov ecx, dword [0x4c7fa8]
neg ecx
sar ecx, 1
jns 0x48c20b
adc ecx, 0
mov eax, ecx
cdq
cmp edx, dword [0x4c7f78]
jne 0x48c220
cmp eax, dword [0x4c7f74]
jbe 0x48c238
jmp 0x48c222
jle 0x48c238
mov eax, dword [0x4c7fa8]
neg eax
mov eax, ecx
cdq
mov dword [0x4c7f74], eax
mov dword [0x4c7f78], edx
mov eax, dword [0x4bc850]
cmp dword [eax], 0
jle 0x48c321
mov eax, dword [ebx + 0x10]
dec eax
je 0x48c25b
dec eax
je 0x48c29d
dec eax
je 0x48c2df
jmp case.0x48b8ee.111
mov eax, 0x12
call fcn.00488bd4
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 9
call fcn.00488bd4
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 9
call fcn.00488bec
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x12
call fcn.00488bec
jmp case.0x48b8ee.111
mov eax, 0x12
call fcn.00488bd4
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.00488bd4
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.00488bec
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x12
call fcn.00488bec
jmp case.0x48b8ee.111
mov eax, 0x11
call fcn.00488bd4
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.00488bd4
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.00488bec
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x11
call fcn.00488bec
jmp case.0x48b8ee.111
mov eax, dword [0x4bcbdc]
cmp dword [eax], 0
jle 0x48c42e
mov eax, dword [ebx + 0x10]
dec eax
je 0x48c344
dec eax
je 0x48c392
dec eax
je 0x48c3e0
jmp case.0x48b8ee.111
push 1
push 0x12
mov eax, dword [0x4bca3c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 9
mov eax, dword [0x4bca3c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 9
mov eax, dword [0x4bcb60]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x12
mov eax, dword [0x4bcb60]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 1
push 0x12
mov eax, dword [0x4bca3c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bca3c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bcb60]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x12
mov eax, dword [0x4bcb60]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 1
push 0x11
mov eax, dword [0x4bca3c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bca3c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bcb60]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x11
mov eax, dword [0x4bcb60]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
mov dword [ebp - 0x73c], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x730], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x72c], eax
mov eax, dword [ebx + 0x10]
dec eax
je 0x48c467
dec eax
je 0x48c51b
dec eax
je 0x48c5cf
jmp case.0x48b8ee.111
mov word [ebp - 0x738], 0x12
xor eax, eax
mov dword [ebp - 0x734], eax
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 9
xor eax, eax
mov dword [ebp - 0x734], eax
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 9
mov dword [ebp - 0x734], 2
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 0x12
mov dword [ebp - 0x734], 2
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x48b8ee.111
mov word [ebp - 0x738], 0x12
xor eax, eax
mov dword [ebp - 0x734], eax
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 0x1b
xor eax, eax
mov dword [ebp - 0x734], eax
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 0x1b
mov dword [ebp - 0x734], 2
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 0x12
mov dword [ebp - 0x734], 2
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x48b8ee.111
mov word [ebp - 0x738], 0x11
xor eax, eax
mov dword [ebp - 0x734], eax
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 0x1b
xor eax, eax
mov dword [ebp - 0x734], eax
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 0x1b
mov dword [ebp - 0x734], 2
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x730]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x738], 0x11
mov dword [ebp - 0x734], 2
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x48b8ee.111
cmp byte [0x4bc508], 1
jbe case.0x48b8ee.111
mov byte [0x4bc4c4], 0xff
mov ecx, dword [0x4c7fa8]
neg ecx
sar ecx, 1
jns 0x48c6a6
adc ecx, 0
mov eax, ecx
cdq
cmp edx, dword [0x4c7f78]
jne 0x48c6bb
cmp eax, dword [0x4c7f74]
jbe 0x48c6d3
jmp 0x48c6bd
jle 0x48c6d3
mov eax, dword [0x4c7fa8]
neg eax
mov eax, ecx
cdq
mov dword [0x4c7f74], eax
mov dword [0x4c7f78], edx
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x4c7fd0], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x48c73c
je 0x48c797
cmp eax, 0xa4
jg 0x48c724
je 0x48c7b5
sub eax, 0x84
je 0x48c79c
sub eax, 0x1c
je 0x48c7bf
dec eax
je 0x48c7a1
dec eax
je 0x48c7a6
jmp case.0x48c74a.515
sub eax, 0xa5
je 0x48c7ba
sub eax, 2
je 0x48c7ab
dec eax
je 0x48c7b0
jmp case.0x48c74a.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x48c74a.515
jmp dword [eax*4 + 0x48c751]
or esi, 2
jmp case.0x48c74a.515
or esi, 4
jmp case.0x48c74a.515
or esi, 0x20
jmp case.0x48c74a.515
or esi, 0x40
jmp case.0x48c74a.515
or esi, 8
jmp case.0x48c74a.515
or esi, 0x10
jmp case.0x48c74a.515
or esi, 1
jmp case.0x48c74a.515
or esi, 1
jmp case.0x48c74a.515
or esi, 2
jmp case.0x48c74a.515
or esi, 4
jmp case.0x48c74a.515
or esi, 0x20
jmp case.0x48c74a.515
or esi, 0x40
jmp case.0x48c74a.515
or esi, 8
jmp case.0x48c74a.515
or esi, 0x10
jmp case.0x48c74a.515
or esi, 1
jmp case.0x48c74a.515
or esi, 0x800
mov eax, dword [0x4bcc38]
mov eax, dword [eax]
call fcn.0042f174
dec eax
push eax
mov eax, dword [0x4c7fd0]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x4bcc38]
mov eax, dword [eax]
call fcn.0042f168
dec eax
push eax
mov eax, dword [0x4c7fd0]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x40], eax
cmp edi, 0x10000
jge case.0x48b8ee.111
cmp dword [ebp - 0x40], 0x10000
jge case.0x48b8ee.111
mov eax, dword [ebx + 0x10]
cmp eax, 0x20a
jne 0x48c845
mov edx, dword [0x4c7fd0]
mov edx, dword [edx + 0x10]
mov dword [ebp - 0x38], edx
jmp 0x48c84a
xor edx, edx
mov dword [ebp - 0x38], edx
mov edx, dword [0x4bc850]
cmp dword [edx], 0
jle 0x48c97f
cmp eax, 0x20a
je 0x48c87a
mov eax, dword [0x4c7fd0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c7fd0]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bc7c0]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x48c8bb
je case.0x48c894.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x48b8ee.111
jmp dword [eax*4 + 0x48c89b]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x48b8ee.111
jmp dword [eax*4 + 0x48c8d0]
push 1
mov eax, dword [0x4bca58]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 2
mov eax, dword [0x4bca58]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 0x10
mov eax, dword [0x4bca58]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 0x20
mov eax, dword [0x4bca58]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 4
mov eax, dword [0x4bca58]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 8
mov eax, dword [0x4bca58]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
mov eax, dword [0x4c7fd0]
cmp dword [eax + 0x10], 0
jle 0x48c96f
push 1
mov eax, dword [0x4bc844]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 2
mov eax, dword [0x4bc844]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
mov edx, dword [0x4bcbdc]
cmp dword [edx], 0
jle 0x48ca56
cmp eax, 0x20a
je 0x48c9af
mov eax, dword [0x4c7fd0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c7fd0]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bcad0]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x48c9d2
je 0x48c9eb
sub eax, 0xa1
je 0x48c9eb
dec eax
je 0x48c9fb
sub eax, 2
je 0x48ca0b
dec eax
je 0x48ca1b
jmp case.0x48b8ee.111
sub eax, 0x202
je 0x48c9fb
sub eax, 2
je 0x48ca0b
dec eax
je 0x48ca1b
sub eax, 5
je 0x48ca2b
jmp case.0x48b8ee.111
push 1
mov eax, dword [0x4bc86c]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 1
mov eax, dword [0x4bc9d8]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 1
mov eax, dword [0x4bcb5c]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 1
mov eax, dword [0x4bc730]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
mov eax, dword [0x4c7fd0]
cmp dword [eax + 0x10], 0
jle 0x48ca46
push 1
mov eax, dword [0x4bca34]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
push 0xffffffffffffffff
mov eax, dword [0x4bca34]
mov eax, dword [eax]
call eax
jmp case.0x48b8ee.111
cmp eax, 0x200
je 0x48ca74
push 0
push 0
mov eax, dword [ebp - 0x40]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
cmp dword [ebx + 0x10], 0x20a
jne 0x48ca99
push 0
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x40]
inc eax
push eax
inc edi
push edi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x48b8ee.111
xor eax, eax
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x72c], esi
inc edi
mov dword [ebp - 0x738], edi
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x734], eax
xor eax, eax
mov dword [ebp - 0x730], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x728], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x724], eax
push 0x1c
lea eax, [ebp - 0x73c]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x48b8ee.111
lea eax, [ebp - 0x150]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x128], 0x1c0000
mov eax, dword [ebx + 0x10]
mov edx, eax
shr edx, 0x10
mov dword [ebp - 0xe4], edx
and eax, 0xffff
mov dword [ebp - 0xe0], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0xe8], eax
push 0
lea eax, [ebp - 0x150]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x48b8ee.111
cmp dword [0x4bc474], 0x41100d7
jb case.0x48b8ee.111
mov byte [0x4bc4c4], 0
mov byte [0x4bc508], 0
xor eax, eax
mov dword [0x4bc4d0], eax
mov dword [0x4c7f60], 0
mov dword [0x4c7f64], 0
mov byte [0x4bc4d4], 0
mov eax, dword [0x4bc850]
cmp dword [eax], 0
jne 0x48cb89
call fcn.00488df4
mov eax, dword [0x4bcbdc]
cmp dword [eax], 0
jne 0x48cb98
call fcn.00489074
cmp byte [0x4bc4bc], 0
jne 0x48cc45
mov byte [0x4bc4bc], 0xff
mov byte [0x4bc4c0], 0
mov dl, 1
mov eax, dword [0x417de8]
call fcn.0041e2b0
mov dword [0x4bc4c8], eax
mov eax, dword [0x4bc4c8]
call fcn.0041e81c
mov eax, dword [eax + 0xc]
mov edx, dword [0x4bcbb8]
mov edx, dword [edx]
call fcn.00418ecc
mov eax, dword [0x4bc4c8]
call fcn.0041e81c
mov eax, dword [eax + 0xc]
mov edx, 0x24
call fcn.00418e8c
mov eax, dword [0x4bc4c8]
call fcn.0041e81c
mov eax, dword [eax + 0xc]
mov dl, byte [0x48decc]
call fcn.00418f70
mov dl, 1
mov eax, dword [0x417de8]
call fcn.0041e2b0
mov dword [0x4c7f6c], eax
mov dl, 1
mov eax, dword [0x417de8]
call fcn.0041e2b0
mov dword [0x4c7f70], eax
mov dword [0x4c7f74], 0
mov dword [0x4c7f78], 0
jmp 0x48cc83
mov eax, dword [0x4c7fa8]
neg eax
sar eax, 1
jns 0x48cc53
adc eax, 0
cdq
cmp edx, dword [0x4c7f78]
jne 0x48cc66
cmp eax, dword [0x4c7f74]
jbe 0x48cc83
jmp 0x48cc68
jle 0x48cc83
mov eax, dword [0x4c7fa8]
neg eax
sar eax, 1
jns 0x48cc76
adc eax, 0
cdq
mov dword [0x4c7f74], eax
mov dword [0x4c7f78], edx
cmp byte [ebx + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x4c7f5d], al
cmp byte [0x4c7f5d], 0
je 0x48ccea
mov dword [0x4c7fa4], 0xffffffff
mov dl, 6
mov eax, dword [0x4bc4c8]
call fcn.0041f6dc
mov eax, dword [ebx + 0x10]
mov dword [0x4bc4f4], eax
mov eax, dword [ebx + 0x14]
mov dword [0x4bc4f8], eax
mov eax, dword [ebx + 0x18]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bc500], eax
mov eax, dword [ebx + 0x18]
shr eax, 8
and eax, 0xf
mov dword [0x4bc504], eax
mov al, byte [ebx + 0x18]
and al, 0xff
mov byte [0x4c7f68], al
jmp 0x48cd37
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bc500], eax
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x4bc504], eax
mov al, byte [ebx + 0x14]
and al, 0xff
mov byte [0x4c7f68], al
cmp byte [0x4c7f68], 3
jbe 0x48cd2b
mov dl, byte [0x4c7f68]
mov eax, dword [0x4bc4c8]
call fcn.0041f6dc
jmp 0x48cd37
mov dl, 6
mov eax, dword [0x4bc4c8]
call fcn.0041f6dc
cmp dword [0x4bc4cc], 0
jne case.0x48b8ee.111
mov dl, 1
mov eax, dword [0x40f08c]
call fcn.00402e48
mov dword [0x4bc4cc], eax
jmp case.0x48b8ee.111
cmp byte [0x4bc4bc], 0
je case.0x48b8ee.111
mov byte [0x4bc4bc], 0
mov eax, 0x4bc4c8
call fcn.0040c880
mov eax, dword [0x4c7f6c]
call fcn.00402e78
mov eax, dword [0x4c7f70]
call fcn.00402e78
call fcn.00488e90
call fcn.00489110
mov eax, dword [0x4bc4cc]
call fcn.00412820
jmp case.0x48b8ee.111
cmp byte [0x4bc4bc], 0
je case.0x48b8ee.111
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bc500], eax
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x4bc504], eax
mov al, byte [ebx + 0x14]
and al, 0xff
mov byte [0x4c7f68], al
cmp byte [0x4c7f5d], 0
jne 0x48cdea
cmp byte [0x4c7f68], 3
ja 0x48cdfb
mov dl, 6
mov eax, dword [0x4bc4c8]
call fcn.0041f6dc
jmp case.0x48b8ee.111
mov dl, byte [0x4c7f68]
mov eax, dword [0x4bc4c8]
call fcn.0041f6dc
jmp case.0x48b8ee.111
cmp dword [ebx + 0x10], 0
je 0x48ce41
lea eax, [ebp - 0x754]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov ecx, dword [ebp - 0x754]
mov dl, byte [0x48ded0]
mov al, 1
call fcn.00487830
jmp case.0x48b8ee.111
mov dl, byte [0x48de44]
xor ecx, ecx
xor eax, eax
call fcn.00487830
jmp case.0x48b8ee.111
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x4bc900]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.00436f78
jmp case.0x48b8ee.111
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.00444784
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48b8ee.111
lea eax, [ebp - 0x75c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebp - 0x75c]
lea edx, [ebp - 0x758]
call fcn.00408754
mov edx, dword [ebp - 0x758]
mov eax, 0x4c7fd4
call fcn.00403bf4
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.00444784
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48b8ee.111
lea eax, [ebp - 0x50]
call fcn.00403ba0
cmp byte [ebx + 0xc], 0x9f
jne 0x48cf06
cmp dword [ebx + 4], 0x20
jle 0x48cf06
lea eax, [ebp - 0x50]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x48cf2a
cmp eax, 0xffffffff
je 0x48cf2a
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.00444784
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x50], 0
je case.0x48b8ee.111
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x50]
call fcn.00403c38
jmp 0x48bf5b
lea edx, [ebp - 0x4c]
lea eax, [ebx + 0x20]
call fcn.00409464
lea eax, [ebp - 0x4c]
call fcn.00403ff0
push eax
call fcn.00425458
pop edx
call fcn.00425100
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x48b8ee.111
lea edx, [ebp - 0x60]
lea eax, [ebx + 0x20]
call fcn.00409464
mov eax, dword [ebx + 0x10]
cmp eax, 0xaf
jne 0x48cfd8
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x28]
call fcn.00493f20
jmp case.0x48b8ee.111
cmp eax, 0xae
jne 0x48d029
mov edx, dword [ebp - 0x60]
mov eax, 0x48dedc
call fcn.0040410c
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jle case.0x48b8ee.111
lea eax, [ebp - 0x760]
push eax
mov ecx, dword [ebp - 0x3c]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x60]
call fcn.00404028
mov eax, dword [ebp - 0x760]
or edx, 0xffffffff
call fcn.00408bbc
call fcn.00494024
jmp case.0x48b8ee.111
cmp eax, 0xb4
jne 0x48d046
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x60]
mov edx, dword [0x4c7f9c]
call fcn.00403e6c
jmp 0x48bf5b
cmp eax, 0xb5
jne case.0x48b8ee.111
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x60]
mov edx, dword [0x4c7f9c]
call fcn.00403e6c
jmp 0x48bf5b
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.00444784
push eax
call sub.user32.dll_SendMessageA
jmp case.0x48b8ee.111
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x48b8ee.111
push 0
lea eax, [ebp - 0x180]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x160]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0x180]
mov edx, dword [ebp - 0x158]
sub edx, dword [ebp - 0x160]
cmp eax, edx
jle case.0x48b8ee.111
mov edx, dword [ebp - 0x158]
sub edx, dword [ebp - 0x160]
sub eax, edx
sar eax, 1
jns 0x48d0eb
adc eax, 0
add eax, dword [ebp - 0x180]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x154]
sub edx, dword [ebp - 0x15c]
sub eax, edx
sar eax, 1
jns 0x48d118
adc eax, 0
add eax, dword [ebp - 0x17c]
mov dword [ebp - 0x16c], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x16c]
push eax
mov eax, dword [ebp - 0x170]
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x48b8ee.111
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov ebx, eax
mov edx, 0x48dee8
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x48df08
mov eax, dword [0x4bcb2c]
push dword [eax]
push 0x48df18
lea eax, [ebp - 0x764]
mov edx, 3
call fcn.00403ee0
mov edx, dword [ebp - 0x764]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x48df08
mov eax, dword [0x4bcb2c]
push dword [eax]
push 0x48df28
lea eax, [ebp - 0x768]
mov edx, 3
call fcn.00403ee0
mov edx, dword [ebp - 0x768]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x48df08
mov eax, dword [0x4bcb2c]
push dword [eax]
push 0x48df38
lea eax, [ebp - 0x76c]
mov edx, 3
call fcn.00403ee0
mov edx, dword [ebp - 0x76c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x7c]
mov ecx, 0x48df48
call fcn.00403e6c
lea eax, [ebp - 0x770]
mov edx, dword [ebp - 0x7c]
call fcn.00404314
mov eax, dword [ebp - 0x770]
push eax
push ebx
call fcn.00455944
push 0x48df5c
push dword [ebp - 0x7c]
push 0x48df5c
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00403ee0
mov eax, ebx
call fcn.00402e78
push 0
push 0
push 0
mov eax, dword [ebp - 0x7c]
call fcn.00403fe4
push eax
push 0x48dec4
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4bc81c]
mov byte [eax], 1
mov eax, dword [0x4bc900]
mov eax, dword [eax]
call fcn.0042e10c
jmp case.0x48b8ee.111
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov ebx, eax
mov edx, 0x48dee8
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x48df08
lea eax, [ebp - 0x778]
mov dl, byte [0x4c7ed4]
call fcn.00403d48
push dword [ebp - 0x778]
push 0x48df68
lea eax, [ebp - 0x774]
mov edx, 3
call fcn.00403ee0
mov edx, dword [ebp - 0x774]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x48df08
push dword [0x4c7e78]
push 0x48df7c
lea eax, [ebp - 0x77c]
mov edx, 3
call fcn.00403ee0
mov edx, dword [ebp - 0x77c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x48df08
push dword [0x4c7e78]
push 0x48df94
lea eax, [ebp - 0x780]
mov edx, 3
call fcn.00403ee0
mov edx, dword [ebp - 0x780]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x48df08
mov eax, dword [0x4bcb2c]
push dword [eax]
push 0x48df38
lea eax, [ebp - 0x784]
mov edx, 3
call fcn.00403ee0
mov edx, dword [ebp - 0x784]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x7c]
mov ecx, 0x48df48
call fcn.00403e6c
lea eax, [ebp - 0x788]
mov edx, dword [ebp - 0x7c]
call fcn.00404314
mov eax, dword [ebp - 0x788]
push eax
push ebx
call fcn.00455944
push 0x48df5c
push dword [ebp - 0x7c]
push 0x48df5c
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00403ee0
mov eax, ebx
call fcn.00402e78
push 0
push 0
push 0
mov eax, dword [ebp - 0x7c]
call fcn.00403fe4
push eax
push 0x48dec4
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x48b8ee.111
lea eax, [ebp - 0x78c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov ecx, dword [ebp - 0x78c]
mov edx, 0x48dfac
mov eax, 0x48dfc0
call fcn.00454040
jmp case.0x48b8ee.111
lea eax, [ebp - 0x94]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
lea eax, [ebp - 0x94]
call fcn.0048a418
mov eax, dword [ebp - 0x94]
call fcn.0044ad18
test al, al
je 0x48d5fa
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0x94]
call fcn.00403bf4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 0
mov dl, 1
mov eax, dword [0x45366c]
call fcn.00402e48
mov dword [0x4c7fd8], eax
mov edx, 0x20
mov eax, dword [0x4c7fd8]
mov ecx, dword [eax]
call dword [ecx]
mov edx, 0x20
mov eax, dword [0x4c7fd8]
call fcn.0041249c
mov byte [0x4bc52c], 2
xor eax, eax
push ebp
push 0x48d5f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.004529a4
mov eax, dword [0x4c7fd8]
call fcn.004124a8
cmp eax, 0x20
jle 0x48d5b6
mov eax, dword [0x4c7fd8]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xe8
mov byte [ebx + 0xe], 0
mov eax, dword [0x4c7fd8]
call fcn.004124a8
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.0048fc90
mov eax, dword [ebx + 4]
mov dword [ebp - 0xa8], eax
cmp byte [0x4c7fb0], 0
je 0x48d5aa
lea ebx, [ebp - 0x720]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf2
mov byte [ebx + 0xe], 0
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
xor edx, edx
mov eax, dword [0x4c7fd8]
call fcn.0041249c
xor eax, eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebx + 0x14], eax
inc dword [ebp - 0xa4]
mov eax, dword [0x4c7fd8]
call fcn.0041248c
mov edx, dword [ebp - 0xa8]
sub edx, eax
cmp edx, 0x500
jle 0x48d548
mov esi, 0x500
jmp 0x48d55a
mov eax, dword [0x4c7fd8]
call fcn.0041248c
mov esi, dword [ebp - 0xa8]
sub esi, eax
lea edx, [ebx + 0x20]
mov ecx, esi
mov eax, dword [0x4c7fd8]
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [0x4c7fd8]
call fcn.0041248c
mov edx, dword [ebp - 0xa8]
sub edx, eax
mov dword [ebx + 0x18], edx
add esi, 0x20
mov dword [ebx + 4], esi
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0048ab9c
test al, al
je 0x48d5d4
mov eax, dword [0x4bca8c]
mov eax, dword [eax]
call fcn.004311a8
cmp dword [ebx + 0x18], 0
jne 0x48d518
jmp 0x48d5d4
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0048ab9c
jmp 0x48d5d4
push 0
push 0
mov eax, dword [ebp - 0x94]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.0048b008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x48b8ee.111
mov byte [0x4bc52c], 0
mov eax, dword [0x4c7fd8]
call fcn.00402e78
ret
push 0
push 0
mov eax, dword [ebp - 0x94]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.0048b008
jmp case.0x48b8ee.111
lea eax, [ebp - 0x2c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
lea eax, [ebp - 0x2c]
call fcn.0048a418
push 0
lea eax, [ebp - 0x2c]
call fcn.00403ff0
push eax
call sub.kernel32.dll_CreateDirectoryA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x89], al
push 0
push 0
lea eax, [ebp - 0x790]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebp - 0x790]
push eax
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x89]
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.0048b008
jmp case.0x48b8ee.111
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x794]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov edx, dword [ebp - 0x794]
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x94]
xor edx, edx
mov eax, dword [ebp - 0x90]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x94]
call fcn.0048a418
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x48d7c7
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x3c], 1
lea ecx, [ebp - 0x798]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x90]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x798]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x94]
call fcn.00403e6c
mov eax, dword [ebp - 0x2c]
call fcn.00408d78
test al, al
je 0x48d746
mov edx, 2
mov eax, dword [ebp - 0x2c]
call fcn.0048a18c
jmp 0x48d7b8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0x2c]
call fcn.00403bf4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 1
mov byte [0x4bc52c], 3
xor eax, eax
push ebp
push 0x48d79f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.004529a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d7a6
mov byte [0x4bc52c], 0
ret
inc dword [ebp - 0x3c]
dec dword [ebp - 0xb4]
jne 0x48d703
lea ecx, [ebp - 0x94]
xor edx, edx
mov eax, dword [ebp - 0x90]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x90]
call fcn.00402e78
jmp 0x48d3ff
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x79c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov edx, dword [ebp - 0x79c]
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x94]
xor edx, edx
mov eax, dword [ebp - 0x90]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x2c]
mov edx, 1
mov eax, dword [ebp - 0x90]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x30]
mov edx, 2
mov eax, dword [ebp - 0x90]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x94]
call fcn.0048a418
lea eax, [ebp - 0x7a0]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x94]
call fcn.00403e6c
mov eax, dword [ebp - 0x7a0]
call fcn.00403fe4
push eax
lea eax, [ebp - 0x7a4]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x94]
call fcn.00403e6c
mov eax, dword [ebp - 0x7a4]
call fcn.00403fe4
push eax
call sub.kernel32.dll_MoveFileA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x89], al
mov eax, dword [ebp - 0x90]
call fcn.00402e78
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x89]
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.0048b008
jmp case.0x48b8ee.111
mov eax, 0x4c7fdc
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, 0x4c7fdc
call fcn.0048a418
mov eax, dword [0x4c7fdc]
cmp byte [eax + 1], 0x3a
jne 0x48d923
mov eax, dword [0x4c7fdc]
mov al, byte [eax]
call fcn.004029e8
mov byte [0x4c7fe0], al
jmp case.0x48b8ee.111
mov byte [0x4c7fe0], 0
jmp case.0x48b8ee.111
mov al, byte [ebx + 0x10]
mov byte [0x4c7fec], al
mov eax, dword [ebx + 0x14]
mov dword [0x4c7fe8], eax
lea eax, [ebx + 0x20]
mov ebx, eax
mov eax, dword [ebx + 4]
mov dword [0x4c7ff4], eax
mov eax, dword [ebx + 8]
mov dword [0x4c7ff8], eax
mov eax, dword [ebx]
mov dword [0x4c7ff0], eax
mov eax, dword [ebx + 0xc]
mov dword [0x4c7ffc], eax
cmp byte [0x4c7fe0], 0x41
jb 0x48d99d
mov al, byte [0x4c7fe0]
sub al, 0x41
inc eax
call fcn.00409148
sub eax, dword [0x4c7ff4]
sbb edx, dword [0x4c7ff8]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
jmp 0x48d9b1
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0x9c], 0x7fff
cmp dword [ebp - 0x9c], 0
jne 0x48d9c5
cmp dword [ebp - 0xa0], 0
jae 0x48d9e8
jmp 0x48d9c7
jge 0x48d9e8
push 0
push 1
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.0048b008
jmp case.0x48b8ee.111
mov al, byte [0x4c7fec]
sub al, 2
jb 0x48d9f8
je 0x48da0e
jmp case.0x48b8ee.111
mov dl, 1
mov eax, dword [0x45366c]
call fcn.00402e48
mov dword [0x4bc538], eax
jmp case.0x48b8ee.111
lea eax, [ebp - 0x7a8]
lea edx, [ebx + 0x10]
mov ecx, 0x401
call fcn.00403dd0
mov ecx, dword [ebp - 0x7a8]
mov eax, 0x4c7fe4
mov edx, dword [0x4c7fdc]
call fcn.00403e6c
lea eax, [ebp - 0x7ac]
mov edx, dword [0x4c7fe4]
call fcn.00404314
mov eax, dword [ebp - 0x7ac]
mov dx, 0xffff
call fcn.00453f94
mov dword [0x4bc538], eax
cmp dword [0x4bc538], 0
jne 0x48da9b
push 0
push 0
lea eax, [ebp - 0x7b0]
lea edx, [ebx + 0x10]
mov ecx, 0x401
call fcn.00403dd0
mov eax, dword [ebp - 0x7b0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.0048b008
jmp case.0x48b8ee.111
push dword [0x4c7ff8]
push dword [0x4c7ff4]
mov eax, dword [0x4bc538]
call fcn.0044b254
push 0
push 0
mov eax, dword [0x4bc538]
call fcn.0044b1f4
jmp case.0x48b8ee.111
call fcn.0048b65c
jmp case.0x48b8ee.111
mov edx, 0x48e004
mov eax, 0x48e01c
call fcn.00454978
jmp case.0x48b8ee.111
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x2c]
mov ecx, 0x48e05c
call fcn.00403e6c
mov eax, dword [ebp - 0x2c]
call fcn.00408d78
test al, al
jne 0x48db51
lea eax, [ebp - 0x7b4]
mov edx, dword [ebp - 0x2c]
call fcn.00404314
mov eax, dword [ebp - 0x7b4]
mov dx, 0xffff
call fcn.00453f94
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x48db51
mov eax, dword [0x4bc53c]
call fcn.00403e20
push eax
mov eax, 0x4bc53c
call fcn.00403ff0
mov edx, eax
mov eax, dword [ebp - 0x20]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x20]
call fcn.00402e78
push 1
push 0x48de40
push 0x48de40
lea eax, [ebp - 0x2c]
call fcn.00403ff0
push eax
push 0x48dec4
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x48b8ee.111
mov eax, dword [0x4bcba8]
cmp dword [eax], 0
jne case.0x48b8ee.111
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4883a0]
call fcn.0041569c
mov edx, dword [0x4bcba8]
mov dword [edx], eax
jmp case.0x48b8ee.111
mov eax, dword [0x4c6d3c]
mov eax, dword [eax + 0x300]
cmp byte [eax + 0x8c], 0
je case.0x48b8ee.111
lea edx, [ebp - 0x7b8]
lea eax, [ebx + 0x20]
call fcn.00409464
mov edx, dword [ebp - 0x7b8]
mov eax, dword [0x4c6d3c]
mov eax, dword [eax + 0x300]
call fcn.004584b0
jmp case.0x48b8ee.111
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x4bc50c], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x4bc510], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x4bc514], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x4bc518], eax
jmp case.0x48b8ee.111
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd4
mov eax, dword [ebp - 0x28]
call fcn.0048b008
jmp case.0x48b8ee.111
mov eax, dword [ebx + 0x14]
mov dword [0x4c7fb4], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebx + 0x10]
cdq
call fcn.004065ac
call fcn.004065ac
mov dword [0x4bc51c], eax
mov dword [0x4bc520], edx
cmp dword [0x4bc520], 0
jne 0x48dc72
cmp dword [0x4bc51c], 0
jbe case.0x48b8ee.111
jmp 0x48dc74
jle case.0x48b8ee.111
mov eax, dword [0x4bc45c]
mov edx, dword [0x4bc460]
add eax, dword [0x4bc51c]
adc edx, dword [0x4bc520]
mov dword [0x4bc51c], eax
mov dword [0x4bc520], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dd8d
lea eax, [ebp - 0x7b8]
call fcn.00403ba0
lea eax, [ebp - 0x7b4]
call fcn.004041d0
lea eax, [ebp - 0x7b0]
call fcn.00403ba0
lea eax, [ebp - 0x7ac]
call fcn.004041d0
lea eax, [ebp - 0x7a8]
mov edx, 8
call fcn.00403bc4
lea eax, [ebp - 0x788]
call fcn.004041d0
lea eax, [ebp - 0x784]
mov edx, 5
call fcn.00403bc4
lea eax, [ebp - 0x770]
call fcn.004041d0
lea eax, [ebp - 0x76c]
mov edx, 9
call fcn.00403bc4
lea eax, [ebp - 0x748]
call fcn.004041d0
lea eax, [ebp - 0x744]
mov edx, 2
call fcn.00403bc4
lea eax, [ebp - 0x94]
call fcn.00403ba0
lea eax, [ebp - 0x7c]
call fcn.00403ba0
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00403bc4
lea eax, [ebp - 0x60]
call fcn.00403ba0
lea eax, [ebp - 0x58]
mov edx, 6
call fcn.00403bc4
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403bc4
lea eax, [ebp - 0x19]
mov edx, dword [0x453648]
call fcn.00404680
ret