Function at 0x4abb68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x40
push 0
push 0
dec ecx
jne 0x4abb71
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4adbda
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x4adb12
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [ebp - 0xc], 0
jne 0x4abc87
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*8 + 0xb576]
cmp dl, 0xb
je 0x4abbd9
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 0xc
jne 0x4abbe6
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb56c], 0xffffffff
je 0x4abbf2
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [edx + 0xb3b4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb578], 0
jne 0x4abc26
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431e24
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae1d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb578], 0
jle 0x4abc7f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb576], 5
je 0x4abc7f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb576], 6
je 0x4abc7f
mov eax, dword [ebp - 4]
call fcn.004ab7f8
mov eax, dword [ebp - 4]
call fcn.004ab6d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b0]
mov edx, 0x4adbf4
call fcn.00431e24
mov eax, dword [ebp - 4]
mov byte [eax + 0xa5f6], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
xor edx, edx
call fcn.00431e24
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb578], 0
jle 0x4ad08f
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb577]
sub al, 1
jb 0x4abd01
je 0x4abd2e
jmp 0x4abd52
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fbe0]
call fcn.00403c7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb568]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xa53c]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4abda1
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fbd0]
call fcn.00403c7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb568]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4abda1
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + edx*8 + 0xb577]
mov edx, dword [ebp - 4]
mov edx, dword [edx + esi*4 + 0xa5f0]
call fcn.00403c7c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4 + 0xa640]
mov edx, dword [ebp - 4]
add eax, dword [edx + ebx*8 + 0xb568]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
call fcn.004094a8
test al, al
jne 0x4abddc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x770]
mov dl, 1
call fcn.004532dc
mov eax, dword [ebp - 4]
mov byte [eax + 0xa940], 0x16
mov eax, dword [ebp - 4]
call fcn.004ab810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
mov eax, dword [ebp - 4]
add eax, 0xa954
mov edx, dword [ebp - 0x2c]
call fcn.0040633e
mov eax, dword [0x4cf300]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa954
mov edx, 1
call fcn.00406875
call fcn.00402854
mov edx, dword [ebp - 0x30]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xa954
call fcn.004068ac
call fcn.00402854
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa954
mov ecx, 4
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xb576]
cmp eax, 0xc
ja case.0x4abe55.8
jmp dword [eax*4 + 0x4abe5c]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adc08
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 8]
call fcn.00409238
push dword [ebp - 0x164]
push 0x4adc18
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4ace3e
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adc08
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 8]
call fcn.00409238
push dword [ebp - 0x168]
push 0x4adc28
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4ace3e
lea eax, [ebp - 0x1c]
call fcn.00403be4
cmp dword [ebp - 0xc], 0
jne 0x4ace3e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4fff8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ffa8]
lea eax, [ebp - 0x16c]
call fcn.00403eb0
mov eax, dword [ebp - 0x16c]
call fcn.004096dc
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4fff8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ffa8]
lea eax, [ebp - 0x170]
call fcn.00403eb0
mov edx, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0049f9c4
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa93c], 0
je 0x4ac267
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa93c]
call fcn.004094a8
test al, al
je 0x4ac267
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x20]
call fcn.00408ee8
mov edx, dword [ebp - 0x20]
mov eax, 0x4adc38
call fcn.00404150
mov ebx, eax
test ebx, ebx
jle 0x4ace3e
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 5]
mov ecx, 0x14
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov edx, dword [ebp - 0x20]
mov eax, 0x4adc48
call fcn.00404150
test eax, eax
jne 0x4ac093
lea edx, [ebx + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa93c]
call fcn.004095f8
mov ecx, dword [ebp - 0x17c]
lea eax, [ebp - 0x178]
mov edx, 0x4adc5c
call fcn.00403eb0
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
call fcn.00428cc4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x4ac24f
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x20]
call fcn.00408ee8
mov edx, dword [ebp - 0x20]
mov eax, 0x4adc48
call fcn.00404150
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 0xa]
mov ecx, 0xff
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov edx, dword [ebp - 0x20]
mov eax, 0x4adc7c
call fcn.00404150
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040406c
jmp 0x4ac121
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
dec ecx
mov edx, 2
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov eax, dword [ebp - 0x20]
mov al, byte [eax]
cmp al, 0x5c
je 0x4ac105
cmp al, 0x2e
je 0x4ac105
cmp al, 0x20
je 0x4ac105
cmp al, 0x3d
je 0x4ac105
cmp al, 0x27
je 0x4ac105
cmp al, 0x22
je 0x4ac105
jmp 0x4ac15c
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x20
je 0x4ac140
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x27
je 0x4ac140
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x22
je 0x4ac140
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
push 0x4adc88
push dword [ebp - 0x20]
lea eax, [ebp - 0x184]
mov edx, 4
call fcn.00403f24
mov eax, dword [ebp - 0x184]
call fcn.004094a8
test al, al
jne 0x4ac24f
mov edx, ebx
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
mov edx, dword [ebp - 0x18]
add edx, 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc4]
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa93c]
call fcn.004095f8
mov ecx, dword [ebp - 0x18c]
lea eax, [ebp - 0x188]
mov edx, 0x4adc5c
call fcn.00403eb0
mov edx, dword [ebp - 0x188]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
call fcn.00428cc4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc4]
jmp 0x4ace3e
mov eax, dword [ebp - 4]
add eax, 0xa93c
call fcn.00403be4
jmp 0x4ace3e
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4ace3e
cmp dword [ebp - 0xc], 5
jne 0x4ac305
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb58c], 0
jne 0x4ac2f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa94c]
call fcn.004094f4
mov eax, dword [ebp - 4]
inc dword [eax + 0x51528]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adc94
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51528]
call fcn.00409238
push dword [ebp - 0x190]
push 0x4adca8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4ace3e
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4ace3e
mov eax, dword [ebp - 4]
inc dword [eax + 0x51528]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adcb8
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51528]
call fcn.00409238
push dword [ebp - 0x194]
push 0x4adca8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4ace3e
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa585], 1
jne 0x4ac483
cmp dword [ebp - 0xc], 0
jne 0x4ac41f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5f0]
mov edx, 0x4adcc8
call fcn.00404150
test eax, eax
jle 0x4ac41f
xor eax, eax
push ebp
push 0x4ac3c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x198]
mov eax, 0x4adce0
call fcn.00461de0
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 4]
add eax, 0x51500
call fcn.00405274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac41f
cmp dword [ebp - 0xc], 5
jne 0x4ac432
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4ace3e
mov eax, dword [ebp - 4]
inc dword [eax + 0x5152c]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adcfc
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5152c]
call fcn.00409238
push dword [ebp - 0x1a0]
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
push 0x4add08
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4ace3e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4add18
call fcn.00431e24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
add eax, 0xa950
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4add24
call fcn.00431e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa586], 1
jne 0x4ac632
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5f0]
mov edx, 0x4add54
call fcn.00404150
test eax, eax
je 0x4ac54d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5f0]
mov edx, 0x4add6c
call fcn.00404150
test eax, eax
jne 0x4ac5e1
xor eax, eax
push ebp
push 0x4ac588
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1a4]
mov eax, 0x4add80
call fcn.00461de0
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 4]
add eax, 0x51510
call fcn.00405274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac5e1
mov eax, dword [ebp - 4]
inc dword [eax + 0x51530]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adcfc
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51530]
call fcn.00409238
push dword [ebp - 0x1ac]
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
push 0x4add9c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4ace3e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4add18
call fcn.00431e24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
add eax, 0xa950
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4addac
call fcn.00431e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa587], 1
jne 0x4ac717
mov eax, dword [ebp - 4]
inc dword [eax + 0x51534]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adddc
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51534]
call fcn.00409238
push dword [ebp - 0x1b0]
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
push 0x4addec
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4ace3e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4add18
call fcn.00431e24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
add eax, 0xa950
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4addfc
call fcn.00431e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa588], 1
jne 0x4ac9b6
push 0
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xa954
mov ecx, 0x1e
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb590], 0
je 0x4ac7fc
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb590], 3
jne 0x4ac813
mov ebx, 0x1e
lea eax, [ebp - 0x160]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec ebx
jne 0x4ac807
mov ebx, 0xf
lea esi, [ebp - 0x160]
lea eax, [ebp - 0x1b4]
mov dl, byte [esi]
call fcn.00403d8c
mov edx, dword [ebp - 0x1b4]
lea eax, [ebp - 0x20]
call fcn.00403e6c
inc esi
dec ebx
jne 0x4ac81e
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push dword [ebp - 0x20]
push 0x4ade34
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb590], 1
je 0x4ac889
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb590], 4
jne 0x4ac88d
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
test al, al
je 0x4ace3e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4add18
call fcn.00431e24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
add eax, 0xa950
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004ae1d8
mov ebx, 1
lea edx, [ebp - 0x1b8]
mov eax, dword [ebp - 0x1c]
call fcn.004095c0
mov edx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x4fff8]
call fcn.00403f74
je 0x4ac92e
inc ebx
cmp ebx, 0x12d
jne 0x4ac900
cmp ebx, 0x12d
jne 0x4ac9a9
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x4fff8], 0
je 0x4ac975
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x4fff8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ffa8]
lea eax, [ebp - 0x1bc]
call fcn.00403eb0
mov eax, dword [ebp - 0x1bc]
call fcn.004094a8
test al, al
jne 0x4ac9a0
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa950]
call fcn.004095c0
mov edx, dword [ebp - 0x1c0]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x4fff8]
call fcn.00403c38
jmp 0x4ac9a9
inc ebx
cmp ebx, 0x12d
jne 0x4ac93b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4add18
call fcn.00431e24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
add eax, 0xa950
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4ade44
call fcn.00431e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
push 0
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xa954
mov ecx, 0x1e
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb590], 0
je 0x4aca8b
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb590], 3
jne 0x4acaa2
mov ebx, 0x1e
lea eax, [ebp - 0x160]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec ebx
jne 0x4aca96
mov ebx, 0xf
lea esi, [ebp - 0x160]
lea eax, [ebp - 0x1c4]
mov dl, byte [esi]
call fcn.00403d8c
mov edx, dword [ebp - 0x1c4]
lea eax, [ebp - 0x20]
call fcn.00403e6c
inc esi
dec ebx
jne 0x4acaad
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb576], 5
jne 0x4acb01
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push dword [ebp - 0x20]
push 0x4ade84
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb576], 6
jne 0x4acb36
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push dword [ebp - 0x20]
push 0x4ade94
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb590], 1
je 0x4acb64
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb590], 4
jne 0x4acb68
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 4]
add eax, 0x85c
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
test al, al
je 0x4ace3e
mov ebx, 1
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x1c]
call fcn.004095c0
mov edx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x504a8]
call fcn.00403f74
jne 0x4acc99
mov eax, dword [ebp - 4]
mov esi, dword [eax + ebx*4 + 0x50958]
test esi, esi
je 0x4acc00
mov eax, dword [ebp - 4]
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x4acc00
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50958]
push eax
call sub.user32.dll_SetForegroundWindow
push 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50958]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ffa8]
call fcn.00404028
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x504a8]
call fcn.00404028
push eax
push 0x4ade9c
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4acca6
lea edx, [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c]
call fcn.004095c0
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x504a8]
call fcn.00403c38
mov eax, dword [ebp - 4]
mov dword [eax + 0x50e0c], ebx
mov eax, dword [ebp - 4]
call fcn.004c1148
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50e10], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov dl, 1
call fcn.004532dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
inc ebx
cmp ebx, 0x12d
jne 0x4acb8d
cmp ebx, 0x12d
jne 0x4acdc4
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x504a8], 0
je 0x4accf5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x504a8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ffa8]
lea eax, [ebp - 0x1d0]
call fcn.00403eb0
mov eax, dword [ebp - 0x1d0]
call fcn.004094a8
test al, al
jne 0x4acdb7
mov eax, dword [ebp - 4]
mov dword [eax + 0x50e0c], ebx
lea edx, [ebp - 0x1d4]
mov eax, dword [ebp - 0x1c]
call fcn.004095c0
mov edx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x504a8]
call fcn.00403c38
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ffa8]
call fcn.00404028
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x504a8]
call fcn.00404028
push eax
push 0x4ade9c
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4acd83
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50e10], edx
mov eax, dword [ebp - 4]
call fcn.004c1148
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov dl, 1
call fcn.004532dc
jmp 0x4acdaa
push 0
mov ecx, 0x4adea4
mov edx, 0x4adeac
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.00450468
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x504a8]
call fcn.00403be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
inc ebx
cmp ebx, 0x12d
jne 0x4accb7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4fc0d
call fcn.00403e08
mov eax, dword [ebp - 4]
call fcn.004ab810
push 0
push 0x4aded4
push dword [ebp - 0x20]
push 0x4adf04
push 0x4adf14
push 0x4adf28
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x1d8]
call fcn.00404028
mov edx, eax
mov ecx, 0x4adea4
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.00450468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
cmp dword [ebp - 0xc], 0
jne 0x4ace5f
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xb576], 0xa
je 0x4acf4e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb590]
cmp al, 1
je 0x4ace8c
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4acf4e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb578]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*8 + 0xb576]
test dl, dl
je 0x4aceee
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 2
je 0x4aceee
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 0xa
je 0x4aceee
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 1
jne 0x4acf3b
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb58c], 0
jle 0x4acf3b
cmp dword [ebp - 0xc], 0
jne 0x4acf0d
mov edx, dword [ebp - 4]
sub esi, dword [edx + eax*8 + 0xb58c]
jmp 0x4acf3b
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*8 + 0xb578]
add edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
sub edx, dword [ecx + eax*8 + 0xb58c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb58c]
mov eax, dword [ebp - 0x30]
push eax
push esi
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004c8bfc
cmp dword [ebp - 0xc], 0
jne 0x4acf6f
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xb576], 0xa
je 0x4ad08f
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb590]
test al, al
je 0x4acf9c
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 3
jne 0x4ad08f
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb578]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb576]
test al, al
je 0x4acfdd
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
jne 0x4ad061
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb58c], 0
jle 0x4ad061
cmp dword [ebp - 0xc], 0
jne 0x4acffc
mov eax, dword [ebp - 4]
sub esi, dword [eax + ebx*8 + 0xb58c]
jmp 0x4ad061
mov eax, dword [ebp - 4]
add eax, 0xa954
call fcn.0040656c
call fcn.00402854
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*8 + 0xb578]
add edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + ebx*8 + 0xb58c]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xa954
call fcn.004068ac
call fcn.00402854
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa954
mov ecx, 4
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 4]
mov esi, dword [eax + ebx*8 + 0xb58c]
mov eax, dword [ebp - 4]
add eax, 0xa954
call fcn.0040656c
call fcn.00402854
mov dword [ebp - 0x30], eax
push esi
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004a721c
mov eax, dword [ebp - 4]
add eax, 0xa954
call fcn.004064a8
call fcn.00402854
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xb576]
cmp eax, 0xc
ja case.0x4ad0c5.0
mov al, byte [eax + 0x4ad0cc]
jmp dword [eax*4 + 0x4ad0d9]
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x504a8], 0
je 0x4ad12c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x504a8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ffa8]
lea eax, [ebp - 0x1dc]
call fcn.00403eb0
mov eax, dword [ebp - 0x1dc]
call fcn.004094a8
test al, al
jne 0x4ad1ee
mov eax, dword [ebp - 4]
mov dword [eax + 0x50e0c], ebx
lea edx, [ebp - 0x1e0]
mov eax, dword [ebp - 0x1c]
call fcn.004095c0
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x504a8]
call fcn.00403c38
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ffa8]
call fcn.00404028
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x504a8]
call fcn.00404028
push eax
push 0x4ade9c
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4ad1ba
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50e10], edx
mov eax, dword [ebp - 4]
call fcn.004c1148
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov dl, 1
call fcn.004532dc
jmp 0x4ad1e1
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x504a8]
call fcn.00403be4
push 0
mov ecx, 0x4adea4
mov edx, 0x4adeac
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.00450468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
inc ebx
cmp ebx, 0x12d
jne 0x4ad0ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
cmp dword [ebp - 0xc], 0
jne 0x4ad3c4
cmp dword [ebp - 0x1c], 0
jne 0x4ad237
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa5e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4ad24e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb56c], 0xffffffff
jne 0x4ad29a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4ffb4], 1
jne 0x4ad271
mov eax, dword [ebp - 4]
call fcn.004af60c
jmp 0x4ad29a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
call fcn.00428b50
mov eax, dword [ebp - 4]
call fcn.004af4e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adf38
call fcn.00431e24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb589], 0xa
jae 0x4ad2fa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
xor edx, edx
call fcn.004423ec
jmp 0x4ad30a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
mov dl, 1
call fcn.004423ec
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004c0078
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x778]
mov dl, 1
call fcn.004532dc
xor eax, eax
push ebp
push 0x4ad34e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad358
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc8]
xor eax, eax
push ebp
push 0x4ad3a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x67c]
call fcn.0045c334
test eax, eax
jne 0x4ad39c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad3b0
mov eax, dword [ebp - 4]
mov byte [eax + 0x4ffe0], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4c4], 0
cmp dword [ebp - 0xc], 1
jne 0x4ad406
cmp dword [ebp - 0x1c], 0
jne 0x4ad3ef
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa5e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4ad406
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0xc], 5
jne 0x4ad448
cmp dword [ebp - 0x1c], 0
jne 0x4ad431
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa5e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4ad448
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0x1c], 0
jne 0x4ad461
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5e8]
call fcn.00402f5c
jmp 0x4adb08
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
jmp 0x4adb08
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb576]
cmp al, 0xb
je 0x4ad49b
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xc
jne 0x4ad632
push 0x4adf44
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
lea edx, [ebp - 0x1e4]
mov eax, dword [ebp - 8]
call fcn.00409238
push dword [ebp - 0x1e4]
push 0x4ae058
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403f24
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb576], 0xb
jne 0x4ad4e9
lea eax, [ebp - 0x20]
mov edx, 0x4ae064
call fcn.00403e6c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb576], 0xc
jne 0x4ad50d
lea eax, [ebp - 0x20]
mov edx, 0x4ae070
call fcn.00403e6c
push dword [ebp - 0x20]
push 0x4ae07c
push 0x4ae08c
push 0x4ae098
push 0x4ae08c
push 0x4ae0a8
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00403f24
mov eax, dword [ebp - 4]
inc dword [eax + 0x51528]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adc94
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
lea edx, [ebp - 0x1e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51528]
call fcn.00409238
push dword [ebp - 0x1e8]
push 0x4ae0b8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x20]
call fcn.00403e64
test eax, eax
jle 0x4ad5a7
mov ebx, 1
lea esi, [ebp - 0x160]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4ad599
mov eax, dword [ebp - 4]
add eax, 0xb11c
mov edx, dword [ebp - 0x1c]
call fcn.0040633e
mov eax, dword [0x4cf300]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xb11c
mov edx, 1
call fcn.0040688c
call fcn.00402854
mov eax, dword [ebp - 4]
add eax, 0xb11c
call fcn.004065b0
call fcn.00402854
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xb11c
call fcn.004068ac
call fcn.00402854
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xb11c
call fcn.00406444
call fcn.00402854
mov eax, dword [ebp - 4]
add eax, 0xb11c
call fcn.004064a8
call fcn.00402854
mov edx, dword [ebp - 0x1c]
mov eax, 0x4ae0b8
call fcn.00404150
test eax, eax
jle 0x4ad72b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4ffb2], 2
je 0x4ad66e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb591], 1
jne 0x4ad72b
lea eax, [ebp - 0x20]
mov edx, 0x4ae0c8
call fcn.00403c7c
mov eax, dword [ebp - 0x20]
call fcn.00403e64
test eax, eax
jle 0x4ad6a0
mov ebx, 1
lea esi, [ebp - 0x160]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4ad692
mov eax, dword [ebp - 4]
add eax, 0xb11c
mov edx, dword [ebp - 0x1c]
call fcn.0040633e
mov eax, dword [0x4cf300]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xb11c
mov edx, 1
call fcn.00406875
call fcn.00402854
mov eax, dword [ebp - 4]
add eax, 0xb11c
call fcn.004065b0
call fcn.00402854
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xb11c
call fcn.004068ac
call fcn.00402854
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xb11c
call fcn.00406444
call fcn.00402854
mov eax, dword [ebp - 4]
add eax, 0xb11c
call fcn.004064a8
call fcn.00402854
cmp dword [ebp - 0xc], 5
jne 0x4ad818
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb576]
cmp al, 2
je 0x4ad773
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
je 0x4ad773
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xa
jne 0x4ad818
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb58c], 0
jne 0x4ad7b9
mov eax, dword [ebp - 4]
add eax, 0xa94c
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [ebp - 4]
mov byte [eax + 0xa5b1], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x548]
mov edx, 0x4ae194
call fcn.00471f14
jmp 0x4ad80b
cmp dword [ebp - 0x1c], 0
jne 0x4ad7ec
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa5e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5e8]
call fcn.00402f5c
jmp 0x4ad80b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xa928]
cmp ebx, dword [ebp - 8]
je 0x4ad8c5
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adc08
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
lea edx, [ebp - 0x1f0]
mov eax, ebx
call fcn.00409238
push dword [ebp - 0x1f0]
push 0x4adc18
lea eax, [ebp - 0x1ec]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x1ec]
call fcn.004094f4
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffa8]
push 0x4adc08
mov eax, dword [ebp - 4]
push dword [eax + 0x4fff8]
lea edx, [ebp - 0x1f8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa928]
call fcn.00409238
push dword [ebp - 0x1f8]
push 0x4adc28
lea eax, [ebp - 0x1f4]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x1f4]
call fcn.004094f4
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xa928], edx
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp dword [ecx + edx*8 + 0xb56c], 0xffffffff
jne 0x4ad9aa
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb576]
cmp al, 0xb
je 0x4ad919
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xc
jne 0x4ad9aa
mov eax, dword [ebp - 4]
mov byte [eax + 0xa5f5], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x740]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 4]
add eax, 0xa92c
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [0x4cf2a8]
cmp dword [eax], 0
jne 0x4ad965
mov ecx, dword [0x4cf2a8]
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov edx, dword [0x49c2f0]
call fcn.00450290
mov eax, dword [0x4cf2a8]
mov eax, dword [eax]
call fcn.0044d1dc
lea eax, [ebp - 0x1fc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa92c]
call fcn.004043ec
mov edx, dword [ebp - 0x1fc]
mov eax, dword [0x4cf2a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00471f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4add18
call fcn.00431e24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
add eax, 0xa950
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb576], 4
jne 0x4ada85
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x4fff8], 0
je 0x4ada51
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x4fff8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ffa8]
lea eax, [ebp - 0x200]
call fcn.00403eb0
mov eax, dword [ebp - 0x200]
call fcn.004094a8
test al, al
jne 0x4ada7c
lea edx, [ebp - 0x204]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa950]
call fcn.004095c0
mov edx, dword [ebp - 0x204]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x4fff8]
call fcn.00403c38
jmp 0x4ada85
inc ebx
cmp ebx, 0x12d
jne 0x4ada17
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004ae1d8
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4c4], 0
jmp 0x4adb08
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4fc0d
call fcn.00403e08
mov eax, dword [ebp - 4]
call fcn.004ab810
push 0
push 0x4aded4
push dword [ebp - 0x20]
push 0x4adf04
push 0x4adf14
push 0x4adf28
lea eax, [ebp - 0x208]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x208]
call fcn.00404028
mov edx, eax
mov ecx, 0x4adea4
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.00450468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adb45
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adbe4
lea eax, [ebp - 0x208]
mov edx, 3
call fcn.00403c08
lea eax, [ebp - 0x1fc]
call fcn.004042a8
lea eax, [ebp - 0x1f8]
mov edx, 0x14
call fcn.00403c08
lea eax, [ebp - 0x1a8]
mov edx, dword [0x4011a0]
mov ecx, 2
call fcn.00404660
lea eax, [ebp - 0x1a0]
call fcn.00403be4
lea eax, [ebp - 0x19c]
mov edx, dword [0x4011a0]
mov ecx, 2
call fcn.00404660
lea eax, [ebp - 0x194]
mov edx, 0xd
call fcn.00403c08
lea eax, [ebp - 0x2c]
call fcn.00403be4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403c08
ret