Function at 0x4f98d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x94
push 0
push 0
dec ecx
jne 0x4f98e1
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4fc083
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x22c]
call fcn.0044bf78
dec eax
test eax, eax
jl 0x4f9984
inc eax
mov dword [ebp - 0x20], eax
xor esi, esi
mov eax, dword [ebx + 0x22c]
mov edx, esi
call fcn.0044bfa8
call fcn.0044b904
test al, al
jne 0x4f997e
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [ebx + 0x22c]
mov edx, esi
call fcn.0044bfa8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0xb8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0x18]
call fcn.004089c4
mov eax, dword [ebp - 0x18]
call fcn.004044c8
cmp eax, 3
jl 0x4f997e
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.004044d0
inc esi
dec dword [ebp - 0x20]
jne 0x4f9918
mov eax, dword [ebp - 4]
call fcn.0041a928
mov edx, eax
dec edx
mov eax, dword [ebp + 8]
call fcn.0044ab68
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0044ab5c
xor eax, eax
push ebp
push 0x4fc031
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0041a928
dec eax
test eax, eax
jl 0x4fc023
inc eax
mov dword [ebp - 0x20], eax
xor esi, esi
push 0x4fc09c
lea edx, [ebp - 0xbc]
mov eax, esi
call fcn.00408af8
push dword [ebp - 0xbc]
push 0x4fc0a8
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404588
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0040480c
test eax, eax
jg 0x4fc019
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.0044ab78
mov eax, dword [0x512704]
cmp byte [eax], 5
je 0x4fc023
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004845a8
mov eax, dword [eax + 0x1c]
lea edx, [ebp - 0x14]
call fcn.004089c4
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004845a8
mov eax, dword [eax + 0xc]
lea edx, [ebp - 0xc0]
call fcn.004089c4
mov eax, dword [ebp - 0xc0]
lea edx, [ebp - 8]
call fcn.00408774
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004845a8
mov eax, dword [eax + 0x10]
lea edx, [ebp - 0xc4]
call fcn.004089c4
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc]
call fcn.00408774
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004845a8
mov eax, dword [eax + 0x14]
lea edx, [ebp - 0x10]
call fcn.004089c4
mov eax, dword [ebp - 0x14]
mov edx, 0x4fc0b4
call fcn.00404614
je 0x4f9ab3
mov eax, dword [ebp - 0x14]
mov edx, 0x4fc0c0
call fcn.00404614
jne 0x4fc019
mov eax, dword [ebp - 8]
call fcn.004e7520
mov ebx, eax
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0xc8]
push eax
lea edx, [ebp - 0xcc]
mov eax, 0x4fc0cc
call fcn.004087b0
mov eax, dword [ebp - 0xcc]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4f9b4f
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0xd0]
push eax
lea edx, [ebp - 0xd4]
mov eax, 0x4fc0e8
call fcn.004087b0
mov eax, dword [ebp - 0xd4]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fc019
push 0
push 0x4fc0fc
call sub.kernel32.dll_WinExec
push 0
push 0x4fc110
call sub.kernel32.dll_WinExec
push 0x64
call sub.kernel32.dll_Sleep_1
jmp 0x4fc019
mov eax, dword [ebp - 0x14]
mov edx, 0x4fc0b4
call fcn.00404614
jne 0x4f9c67
lea eax, [ebp - 0xd8]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404728
mov eax, dword [ebp - 0xd8]
mov edx, 0x4fc134
call fcn.00404614
jne 0x4f9b9f
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404768
lea eax, [ebp - 0xdc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004044c8
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404728
mov eax, dword [ebp - 0xdc]
mov edx, 0x4fc134
call fcn.00404614
jne 0x4f9be6
mov eax, dword [ebp - 0xc]
call fcn.004044c8
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 1
call fcn.00404768
mov eax, dword [ebp - 0xc]
call fcn.004044c8
test eax, eax
je 0x4fc019
mov eax, dword [ebp - 8]
mov edx, 0x4fc140
call fcn.00404614
jne 0x4f9c29
lea edx, [ebp - 0xe0]
mov eax, 0x4fc15c
call fcn.00408774
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xc]
call fcn.00404614
je 0x4fc019
mov eax, dword [0x512b08]
cmp dword [eax], 0
je 0x4f9c48
mov eax, dword [0x512b08]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
mov edx, dword [ebp - 0xc]
call fcn.00461c78
cmp dword [ebp - 0xc], 0
je 0x4f9c67
mov eax, dword [ebp - 0xc]
mov edx, 0x4fc134
call fcn.00404614
je 0x4f9c67
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004ea5a0
mov eax, dword [ebp - 0x14]
mov edx, 0x4fc0c0
call fcn.00404614
jne 0x4f9cb7
mov eax, dword [0x512b08]
cmp dword [eax], 0
je 0x4f9c95
mov eax, dword [0x512b08]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
mov edx, dword [ebp - 0xc]
call fcn.00461c78
cmp dword [ebp - 0xc], 0
je 0x4f9cb7
mov eax, dword [ebp - 0xc]
mov edx, 0x4fc134
call fcn.00404614
je 0x4f9cb7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004ea6a0
mov eax, 0x4fc198
mov edx, dword [ebp - 8]
call fcn.00404614
je 0x4f9cec
lea edx, [ebp - 0xe4]
mov eax, 0x4fc1b4
call fcn.00408774
mov eax, dword [ebp - 0xe4]
mov edx, dword [ebp - 0xc]
call fcn.0040480c
test eax, eax
jle 0x4fc019
lea eax, [ebp - 0x18]
call fcn.00404208
mov eax, 0x4fc198
mov edx, dword [ebp - 8]
call fcn.00404614
jne 0x4f9d0d
lea eax, [ebp - 0x18]
call fcn.00404208
jmp 0x4f9d41
lea edx, [ebp - 0xe8]
mov eax, 0x4fc1d0
call fcn.00408774
mov eax, dword [ebp - 0xe8]
mov edx, dword [ebp - 0xc]
call fcn.0040480c
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x10]
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404728
lea edx, [ebp - 0xec]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0xec]
push eax
lea edx, [ebp - 0xf0]
mov eax, 0x4fc1ec
call fcn.004087b0
mov eax, dword [ebp - 0xf0]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa079
push 0
push 1
lea eax, [ebp - 0xf4]
mov ecx, 0x4fc200
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0xf4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0xfc]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0xfc]
push 0x4fc22c
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0xf8]
push eax
push 1
lea eax, [ebp - 0x100]
mov ecx, 0x4fc258
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x100]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc278
push 1
lea eax, [ebp - 0x104]
mov ecx, 0x4fc2a8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x104]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc2c0
push 1
lea eax, [ebp - 0x108]
mov ecx, 0x4fc2d0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x108]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc2e8
push 1
lea eax, [ebp - 0x10c]
mov ecx, 0x4fc308
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0x114]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x114]
push 0x4fc328
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x110]
push eax
push 1
lea eax, [ebp - 0x118]
mov ecx, 0x4fc358
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc380
push 1
lea eax, [ebp - 0x11c]
mov ecx, 0x4fc3a0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x11c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc3c8
push 1
lea eax, [ebp - 0x120]
mov ecx, 0x4fc3dc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x120]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc410
push 1
lea eax, [ebp - 0x124]
mov ecx, 0x4fc424
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x124]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc450
push 1
lea eax, [ebp - 0x128]
mov ecx, 0x4fc460
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x128]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0x130]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x130]
push 0x4fc328
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x12c]
push eax
push 1
lea eax, [ebp - 0x134]
mov ecx, 0x4fc480
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x134]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc380
push 1
lea eax, [ebp - 0x138]
mov ecx, 0x4fc4a8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x138]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc3c8
push 1
lea eax, [ebp - 0x13c]
mov ecx, 0x4fc4d0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x13c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc504
push 1
lea eax, [ebp - 0x140]
mov ecx, 0x4fc510
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x140]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc410
push 1
lea eax, [ebp - 0x144]
mov ecx, 0x4fc540
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x144]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, 0x4fc570
call fcn.004087b0
mov eax, dword [ebp - 0x14c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa0dc
push 0x4fc584
push 1
lea eax, [ebp - 0x150]
mov ecx, 0x4fc59c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x150]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, 0x4fc5c0
call fcn.004087b0
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa195
push 0x4fc5d0
push 2
lea eax, [ebp - 0x15c]
mov ecx, 0x4fc5fc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x15c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc618
push 2
lea eax, [ebp - 0x160]
mov ecx, 0x4fc64c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x160]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc674
push 2
lea eax, [ebp - 0x164]
mov ecx, 0x4fc6a4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x164]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x168]
push eax
lea edx, [ebp - 0x16c]
mov eax, 0x4fc6c8
call fcn.004087b0
mov eax, dword [ebp - 0x16c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa221
push 0x4fc6dc
push 2
lea eax, [ebp - 0x170]
mov ecx, 0x4fc70c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x170]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc730
push 2
lea eax, [ebp - 0x174]
mov ecx, 0x4fc760
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x174]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x178]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x178]
push eax
lea edx, [ebp - 0x17c]
mov eax, 0x4fc784
call fcn.004087b0
mov eax, dword [ebp - 0x17c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa32c
push 0x4fc798
push 1
lea eax, [ebp - 0x180]
mov ecx, 0x4fc7a4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x180]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc7c0
push 1
lea eax, [ebp - 0x184]
mov ecx, 0x4fc7d0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x184]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc7c0
push 1
lea eax, [ebp - 0x188]
mov ecx, 0x4fc7f4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x188]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc818
push 1
lea eax, [ebp - 0x18c]
mov ecx, 0x4fc848
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x18c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc880
push 1
lea eax, [ebp - 0x190]
mov ecx, 0x4fc8b0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x190]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x194]
push eax
lea edx, [ebp - 0x198]
mov eax, 0x4fc8f8
call fcn.004087b0
mov eax, dword [ebp - 0x198]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa460
push 0x4fc6dc
push 2
lea eax, [ebp - 0x19c]
mov ecx, 0x4fc90c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x19c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc7c0
push 1
lea eax, [ebp - 0x1a0]
mov ecx, 0x4fc930
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1a0]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc730
push 2
lea eax, [ebp - 0x1a4]
mov ecx, 0x4fc954
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1a4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc978
push 1
lea eax, [ebp - 0x1a8]
mov ecx, 0x4fc9a8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1a8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc818
push 1
lea eax, [ebp - 0x1ac]
mov ecx, 0x4fc9cc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1ac]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc880
push 1
lea eax, [ebp - 0x1b0]
mov ecx, 0x4fca04
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1b0]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x1b4]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x1b8]
mov eax, 0x4fca4c
call fcn.004087b0
mov eax, dword [ebp - 0x1b8]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa4ec
push 0x4fca74
push 1
lea eax, [ebp - 0x1bc]
mov ecx, 0x4fcaa4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1bc]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fca74
push 1
lea eax, [ebp - 0x1c0]
mov ecx, 0x4fcad0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1c0]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x1c4]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x1c4]
push eax
lea edx, [ebp - 0x1c8]
mov eax, 0x4fcb00
call fcn.004087b0
mov eax, dword [ebp - 0x1c8]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa817
push 0x4fcb14
push 1
lea eax, [ebp - 0x1cc]
mov ecx, 0x4fcb44
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1cc]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
lea edx, [ebp - 0x1d0]
mov eax, 0x1a
call fcn.004e57b0
lea eax, [ebp - 0x1d0]
mov edx, 0x4fcb5c
call fcn.004044d0
mov eax, dword [ebp - 0x1d0]
push eax
push 1
lea eax, [ebp - 0x1d4]
mov ecx, 0x4fcb88
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1d4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc2c0
push 1
lea eax, [ebp - 0x1d8]
mov ecx, 0x4fcba8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1d8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0x1e0]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x1e0]
push 0x4fc328
lea eax, [ebp - 0x1dc]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x1dc]
push eax
push 1
lea eax, [ebp - 0x1e4]
mov ecx, 0x4fcbc0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1e4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc380
push 1
lea eax, [ebp - 0x1e8]
mov ecx, 0x4fcbe4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1e8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc3c8
push 1
lea eax, [ebp - 0x1ec]
mov ecx, 0x4fcc08
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1ec]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0x1f4]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x1f4]
push 0x4fcc38
lea eax, [ebp - 0x1f0]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x1f0]
push eax
push 1
lea eax, [ebp - 0x1f8]
mov ecx, 0x4fcc64
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1f8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcc8c
push 1
lea eax, [ebp - 0x1fc]
mov ecx, 0x4fcca4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x1fc]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc3c8
push 1
lea eax, [ebp - 0x200]
mov ecx, 0x4fcccc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x200]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcd00
push 1
lea eax, [ebp - 0x204]
mov ecx, 0x4fcd48
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x204]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcd70
push 2
lea eax, [ebp - 0x208]
mov ecx, 0x4fcdc4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x208]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcdec
push 1
lea eax, [ebp - 0x20c]
mov ecx, 0x4fce00
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x20c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcdec
push 1
lea eax, [ebp - 0x210]
mov ecx, 0x4fce10
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x210]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fce20
push 1
lea eax, [ebp - 0x214]
mov ecx, 0x4fce34
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x214]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fce20
push 1
lea eax, [ebp - 0x218]
mov ecx, 0x4fce44
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x218]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x21c]
push eax
lea edx, [ebp - 0x220]
mov eax, 0x4fce54
call fcn.004087b0
mov eax, dword [ebp - 0x220]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fa9a0
push 0x4fce70
push 2
lea eax, [ebp - 0x224]
mov ecx, 0x4fce98
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x224]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcec0
push 1
lea eax, [ebp - 0x228]
mov ecx, 0x4fcef0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x228]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcf10
push 1
lea eax, [ebp - 0x22c]
mov ecx, 0x4fcf20
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x22c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcec0
push 1
lea eax, [ebp - 0x230]
mov ecx, 0x4fcf40
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x230]
mov ecx, 0x4fcf64
mov eax, ebx
call fcn.004f974c
push 0
push 1
lea eax, [ebp - 0x234]
mov ecx, 0x4fcf40
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x234]
mov ecx, 0x4fcf74
mov eax, ebx
call fcn.004f974c
push 0x4fcf8c
push 1
lea eax, [ebp - 0x238]
mov ecx, 0x4fcfb8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x238]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcd00
push 2
lea eax, [ebp - 0x23c]
mov ecx, 0x4fcfe4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x23c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcd70
push 2
lea eax, [ebp - 0x240]
mov ecx, 0x4fd014
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x240]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x248]
mov eax, 0x4fd044
call fcn.004087b0
mov eax, dword [ebp - 0x248]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4faa59
push 0x4fd058
push 1
lea eax, [ebp - 0x24c]
mov ecx, 0x4fd088
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x24c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd0ac
push 2
lea eax, [ebp - 0x250]
mov ecx, 0x4fd0dc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x250]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd100
push 2
lea eax, [ebp - 0x254]
mov ecx, 0x4fd144
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x254]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x258]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, 0x4fc6c8
call fcn.004087b0
mov eax, dword [ebp - 0x25c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4faae5
push 0x4fc6dc
push 2
lea eax, [ebp - 0x260]
mov ecx, 0x4fc70c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x260]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc730
push 2
lea eax, [ebp - 0x264]
mov ecx, 0x4fc760
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x264]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x268]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x268]
push eax
lea edx, [ebp - 0x26c]
mov eax, 0x4fd16c
call fcn.004087b0
mov eax, dword [ebp - 0x26c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fab8b
push 0x4fd180
push 1
lea eax, [ebp - 0x270]
mov ecx, 0x4fd1b0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x270]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 1
push 0x4fd1c8
lea edx, [ebp - 0x278]
mov eax, 0x19
call fcn.004e57b0
push dword [ebp - 0x278]
push 0x4fd1e0
lea eax, [ebp - 0x274]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x274]
call fcn.004046c8
push eax
call sub.kernel32.dll_WinExec
jmp 0x4fc019
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x27c]
push eax
lea edx, [ebp - 0x280]
mov eax, 0x4fd1f8
call fcn.004087b0
mov eax, dword [ebp - 0x280]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fac95
lea edx, [ebp - 0x284]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x284]
push eax
lea edx, [ebp - 0x288]
mov eax, 0x4fd20c
call fcn.004087b0
mov eax, dword [ebp - 0x288]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fac24
push 0x4fd21c
push 1
lea eax, [ebp - 0x28c]
mov ecx, 0x4fd24c
mov edx, dword [ebp - 0xc]
call fcn.00404514
mov edx, dword [ebp - 0x28c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fac4d
push 0x4fd25c
push 1
lea eax, [ebp - 0x290]
mov ecx, 0x4fd24c
mov edx, dword [ebp - 0xc]
call fcn.00404514
mov edx, dword [ebp - 0x290]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 1
push 0x4fd1c8
lea edx, [ebp - 0x298]
mov eax, 0x19
call fcn.004e57b0
push dword [ebp - 0x298]
push 0x4fd28c
lea eax, [ebp - 0x294]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x294]
call fcn.004046c8
push eax
call sub.kernel32.dll_WinExec
jmp 0x4fc019
lea edx, [ebp - 0x29c]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x29c]
push eax
lea edx, [ebp - 0x2a0]
mov eax, 0x4fd2a4
call fcn.004087b0
mov eax, dword [ebp - 0x2a0]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fadba
push 0x4fd2b8
push 1
lea eax, [ebp - 0x2a4]
mov ecx, 0x4fd2e8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2a4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd308
push 1
lea eax, [ebp - 0x2a8]
mov ecx, 0x4fd338
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2a8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd358
push 1
lea eax, [ebp - 0x2ac]
mov ecx, 0x4fd388
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2ac]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd3a8
push 1
lea eax, [ebp - 0x2b0]
mov ecx, 0x4fd3d8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2b0]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 1
push 0x4fd1c8
lea edx, [ebp - 0x2b8]
mov eax, 0x19
call fcn.004e57b0
push dword [ebp - 0x2b8]
push 0x4fd3f0
lea eax, [ebp - 0x2b4]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x2b4]
call fcn.004046c8
push eax
call sub.kernel32.dll_WinExec
jmp 0x4fc019
lea edx, [ebp - 0x2bc]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x2bc]
push eax
lea edx, [ebp - 0x2c0]
mov eax, 0x4fd408
call fcn.004087b0
mov eax, dword [ebp - 0x2c0]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4faf83
lea edx, [ebp - 0x2c4]
mov eax, 0x19
call fcn.004e57b0
lea eax, [ebp - 0x2c4]
mov edx, 0x4fd418
call fcn.004044d0
mov eax, dword [ebp - 0x2c4]
push eax
push 2
lea eax, [ebp - 0x2c8]
mov ecx, 0x4fd42c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2c8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcf10
push 1
lea eax, [ebp - 0x2cc]
mov ecx, 0x4fd448
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2cc]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0x2d4]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x2d4]
push 0x4fc328
lea eax, [ebp - 0x2d0]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x2d0]
push eax
push 1
lea eax, [ebp - 0x2d8]
mov ecx, 0x4fd45c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2d8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcc8c
push 1
lea eax, [ebp - 0x2dc]
mov ecx, 0x4fd480
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2dc]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc3c8
push 1
lea eax, [ebp - 0x2e0]
mov ecx, 0x4fd4a4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2e0]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcdec
push 1
lea eax, [ebp - 0x2e4]
mov ecx, 0x4fce00
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2e4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcdec
push 1
lea eax, [ebp - 0x2e8]
mov ecx, 0x4fce10
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2e8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd4d4
push 1
xor ecx, ecx
mov edx, 0x4fd4ec
mov eax, 0x80000002
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x2ec]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x2ec]
push eax
lea edx, [ebp - 0x2f0]
mov eax, 0x4fd518
call fcn.004087b0
mov eax, dword [ebp - 0x2f0]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb14c
lea edx, [ebp - 0x2f4]
mov eax, 0x19
call fcn.004e57b0
lea eax, [ebp - 0x2f4]
mov edx, 0x4fd418
call fcn.004044d0
mov eax, dword [ebp - 0x2f4]
push eax
push 2
lea eax, [ebp - 0x2f8]
mov ecx, 0x4fd528
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2f8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcf10
push 1
lea eax, [ebp - 0x2fc]
mov ecx, 0x4fd544
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x2fc]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0x304]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x304]
push 0x4fc328
lea eax, [ebp - 0x300]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x300]
push eax
push 1
lea eax, [ebp - 0x308]
mov ecx, 0x4fd558
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x308]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcc8c
push 1
lea eax, [ebp - 0x30c]
mov ecx, 0x4fd578
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x30c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc3c8
push 1
lea eax, [ebp - 0x310]
mov ecx, 0x4fd598
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x310]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcdec
push 1
lea eax, [ebp - 0x314]
mov ecx, 0x4fce00
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x314]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcdec
push 1
lea eax, [ebp - 0x318]
mov ecx, 0x4fce10
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x318]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd4d4
push 1
xor ecx, ecx
mov edx, 0x4fd4ec
mov eax, 0x80000002
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x31c]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x31c]
push eax
lea edx, [ebp - 0x320]
mov eax, 0x4fd5c4
call fcn.004087b0
mov eax, dword [ebp - 0x320]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb1d8
push 0x4fc618
push 2
lea eax, [ebp - 0x324]
mov ecx, 0x4fd5d8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x324]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc674
push 2
lea eax, [ebp - 0x328]
mov ecx, 0x4fd5fc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x328]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x32c]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x32c]
push eax
lea edx, [ebp - 0x330]
mov eax, 0x4fd620
call fcn.004087b0
mov eax, dword [ebp - 0x330]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb2c3
push 0x4fc220
lea edx, [ebp - 0x338]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x338]
push 0x4fd630
lea eax, [ebp - 0x334]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x334]
push eax
push 1
lea eax, [ebp - 0x33c]
mov ecx, 0x4fd65c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x33c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fcc8c
push 1
lea eax, [ebp - 0x340]
mov ecx, 0x4fd67c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x340]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc3c8
push 1
lea eax, [ebp - 0x344]
mov ecx, 0x4fd69c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x344]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x348]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x348]
push eax
lea edx, [ebp - 0x34c]
mov eax, 0x4fd6c8
call fcn.004087b0
mov eax, dword [ebp - 0x34c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb326
push 0x4fd6d8
push 1
lea eax, [ebp - 0x350]
mov ecx, 0x4fd708
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x350]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x354]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x354]
push eax
lea edx, [ebp - 0x358]
mov eax, 0x4fd71c
call fcn.004087b0
mov eax, dword [ebp - 0x358]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb3cc
push 0x4fd3a8
push 1
lea eax, [ebp - 0x35c]
mov ecx, 0x4fd72c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x35c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 1
push 0x4fd1c8
lea edx, [ebp - 0x364]
mov eax, 0x19
call fcn.004e57b0
push dword [ebp - 0x364]
push 0x4fd3f0
lea eax, [ebp - 0x360]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x360]
call fcn.004046c8
push eax
call sub.kernel32.dll_WinExec
jmp 0x4fc019
lea edx, [ebp - 0x368]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x368]
push eax
lea edx, [ebp - 0x36c]
mov eax, 0x4fd740
call fcn.004087b0
mov eax, dword [ebp - 0x36c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb51a
mov edi, dword [ebp - 0xb0]
cmp edi, 5
jne 0x4fb462
push 0x4fd778
push 2
lea eax, [ebp - 0x370]
mov ecx, 0x4fd740
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x370]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd7ac
push 2
lea eax, [ebp - 0x374]
mov ecx, 0x4fd7dc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x374]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
cmp edi, 6
jne 0x4fc019
push 0x4fd820
push 1
lea eax, [ebp - 0x378]
mov ecx, 0x4fd740
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x378]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fd840
push 2
lea eax, [ebp - 0x37c]
mov ecx, 0x4fd740
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x37c]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fd884
push 2
lea eax, [ebp - 0x380]
mov ecx, 0x4fd740
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x380]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fd8d0
push 2
lea eax, [ebp - 0x384]
mov ecx, 0x4fd7dc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x384]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x388]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x388]
push eax
lea edx, [ebp - 0x38c]
mov eax, 0x4fd900
call fcn.004087b0
mov eax, dword [ebp - 0x38c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb672
mov edi, dword [ebp - 0xb0]
cmp edi, 5
jne 0x4fb5e3
push 0x4fd938
push 1
lea eax, [ebp - 0x390]
mov ecx, 0x4fd900
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x390]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fd954
push 1
lea eax, [ebp - 0x394]
mov ecx, 0x4fd900
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x394]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fd970
push 2
lea eax, [ebp - 0x398]
mov ecx, 0x4fd9a0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x398]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
cmp edi, 6
jne 0x4fc019
push 0x4fd938
push 1
lea eax, [ebp - 0x39c]
mov ecx, 0x4fd900
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x39c]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fd9e4
push 2
lea eax, [ebp - 0x3a0]
mov ecx, 0x4fd900
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3a0]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fda10
push 2
lea eax, [ebp - 0x3a4]
mov ecx, 0x4fd9a0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3a4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x3a8]
push eax
lea edx, [ebp - 0x3ac]
mov eax, 0x4fda40
call fcn.004087b0
mov eax, dword [ebp - 0x3ac]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb7ca
mov edi, dword [ebp - 0xb0]
cmp edi, 5
jne 0x4fb73b
push 0x4fda78
push 1
lea eax, [ebp - 0x3b0]
mov ecx, 0x4fda40
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3b0]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fda94
push 1
lea eax, [ebp - 0x3b4]
mov ecx, 0x4fda40
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3b4]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fdab0
push 2
lea eax, [ebp - 0x3b8]
mov ecx, 0x4fdae0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3b8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
cmp edi, 6
jne 0x4fc019
push 0x4fda78
push 1
lea eax, [ebp - 0x3bc]
mov ecx, 0x4fda40
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3bc]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fdb24
push 2
lea eax, [ebp - 0x3c0]
mov ecx, 0x4fda40
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3c0]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fdb50
push 2
lea eax, [ebp - 0x3c4]
mov ecx, 0x4fdae0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3c4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x3c8]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x3c8]
push eax
lea edx, [ebp - 0x3cc]
mov eax, 0x4fdb80
call fcn.004087b0
mov eax, dword [ebp - 0x3cc]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb859
push 0x4fdbb8
push 1
lea eax, [ebp - 0x3d0]
mov ecx, 0x4fdb80
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3d0]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fdbd4
push 2
lea eax, [ebp - 0x3d4]
mov ecx, 0x4fdc04
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3d4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x3d8]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x3d8]
push eax
lea edx, [ebp - 0x3dc]
mov eax, 0x4fdc48
call fcn.004087b0
mov eax, dword [ebp - 0x3dc]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fb9b1
mov edi, dword [ebp - 0xb0]
cmp edi, 5
jne 0x4fb922
push 0x4fdc80
push 1
lea eax, [ebp - 0x3e0]
mov ecx, 0x4fdc48
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3e0]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fdc9c
push 1
lea eax, [ebp - 0x3e4]
mov ecx, 0x4fdc48
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3e4]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fdab0
push 2
lea eax, [ebp - 0x3e8]
mov ecx, 0x4fdcb8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3e8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
cmp edi, 6
jne 0x4fc019
push 0x4fdc80
push 1
lea eax, [ebp - 0x3ec]
mov ecx, 0x4fdc48
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3ec]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fdcfc
push 2
lea eax, [ebp - 0x3f0]
mov ecx, 0x4fdc48
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3f0]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fdd28
push 2
lea eax, [ebp - 0x3f4]
mov ecx, 0x4fdcb8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x3f4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x3f8]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x3f8]
push eax
lea edx, [ebp - 0x3fc]
mov eax, 0x4fdd58
call fcn.004087b0
mov eax, dword [ebp - 0x3fc]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fbb09
mov edi, dword [ebp - 0xb0]
cmp edi, 5
jne 0x4fba7a
push 0x4fdd90
push 1
lea eax, [ebp - 0x400]
mov ecx, 0x4fdd58
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x400]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fddb0
push 1
lea eax, [ebp - 0x404]
mov ecx, 0x4fdd58
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x404]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fddd0
push 2
lea eax, [ebp - 0x408]
mov ecx, 0x4fddec
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x408]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
cmp edi, 6
jne 0x4fc019
push 0x4fde30
push 1
lea eax, [ebp - 0x40c]
mov ecx, 0x4fdd58
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x40c]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fde4c
push 2
lea eax, [ebp - 0x410]
mov ecx, 0x4fdd58
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x410]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fde7c
push 2
lea eax, [ebp - 0x414]
mov ecx, 0x4fddec
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x414]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x418]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x418]
push eax
lea edx, [ebp - 0x41c]
mov eax, 0x4fdeac
call fcn.004087b0
mov eax, dword [ebp - 0x41c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fbbc8
push 0x4fdee4
push 1
lea eax, [ebp - 0x420]
mov ecx, 0x4fdeac
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x420]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fdf18
push 1
lea eax, [ebp - 0x424]
mov ecx, 0x4fdeac
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x424]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fdf4c
push 2
lea eax, [ebp - 0x428]
mov ecx, 0x4fdf78
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x428]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x42c]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x42c]
push eax
lea edx, [ebp - 0x430]
mov eax, 0x4fdfbc
call fcn.004087b0
mov eax, dword [ebp - 0x430]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fbee4
mov edi, dword [ebp - 0xb0]
cmp edi, 5
jne 0x4fbd15
push 0x4fdff4
push 2
lea eax, [ebp - 0x434]
mov ecx, 0x4fdfbc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x434]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fe010
push 2
lea eax, [ebp - 0x438]
mov ecx, 0x4fdfbc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x438]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0x4fe02c
push 2
lea eax, [ebp - 0x43c]
mov ecx, 0x4fe048
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x43c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fe08c
push 1
lea eax, [ebp - 0x440]
mov ecx, 0x4fe0a4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x440]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0x448]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x448]
push 0x4fe0e0
lea eax, [ebp - 0x444]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x444]
push eax
push 2
lea eax, [ebp - 0x44c]
mov ecx, 0x4fe108
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x44c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
cmp edi, 6
jne 0x4fc019
push 0x4fe158
lea edx, [ebp - 0x454]
mov eax, 0x19
call fcn.004e57b0
push dword [ebp - 0x454]
push 0x4fe164
lea eax, [ebp - 0x450]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x450]
push eax
push 1
lea eax, [ebp - 0x458]
mov ecx, 0x4fdfbc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x458]
mov ecx, 0x4fd874
mov eax, ebx
call fcn.004f974c
push 0x4fe158
lea edx, [ebp - 0x460]
mov eax, 0x19
call fcn.004e57b0
push dword [ebp - 0x460]
push 0x4fe180
lea eax, [ebp - 0x45c]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x45c]
push eax
push 1
lea eax, [ebp - 0x464]
mov ecx, 0x4fdfbc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x464]
mov ecx, 0x4fd8b8
mov eax, ebx
call fcn.004f974c
push 0
lea edx, [ebp - 0x46c]
mov eax, 0x19
call fcn.004e57b0
push dword [ebp - 0x46c]
push 0x4fe19c
lea eax, [ebp - 0x468]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x468]
push eax
push 1
lea eax, [ebp - 0x470]
mov ecx, 0x4fe048
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x470]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fe08c
push 1
lea eax, [ebp - 0x474]
mov ecx, 0x4fe0a4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x474]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fe1b8
push 1
lea eax, [ebp - 0x478]
mov ecx, 0x4fe1d0
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x478]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fc220
lea edx, [ebp - 0x480]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x480]
push 0x4fe0e0
lea eax, [ebp - 0x47c]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x47c]
push eax
push 1
lea eax, [ebp - 0x484]
mov ecx, 0x4fe108
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x484]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
jmp 0x4fc019
lea edx, [ebp - 0x488]
mov eax, dword [ebp - 0xc]
call fcn.004087b0
mov eax, dword [ebp - 0x488]
push eax
lea edx, [ebp - 0x48c]
mov eax, 0x4fe218
call fcn.004087b0
mov eax, dword [ebp - 0x48c]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4fc019
push 0x4fc220
lea edx, [ebp - 0x494]
mov eax, 0x1a
call fcn.004e57b0
push dword [ebp - 0x494]
push 0x4fe0e0
lea eax, [ebp - 0x490]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x490]
push eax
push 1
lea eax, [ebp - 0x498]
mov ecx, 0x4fe250
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x498]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fe294
push 1
lea eax, [ebp - 0x49c]
mov ecx, 0x4fe2bc
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x49c]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0
push 1
lea eax, [ebp - 0x4a0]
mov ecx, 0x4fe2f8
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x4a0]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fe33c
push 1
lea eax, [ebp - 0x4a4]
mov ecx, 0x4fe36c
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x4a4]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
push 0x4fe3ac
push 1
lea eax, [ebp - 0x4a8]
mov ecx, 0x4fe3d4
mov edx, dword [ebp - 0x18]
call fcn.00404514
mov edx, dword [ebp - 0x4a8]
xor ecx, ecx
mov eax, ebx
call fcn.004f974c
inc esi
dec dword [ebp - 0x20]
jne 0x4f99c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc038
ret