Function at 0x4dcea8
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x50], edx
mov esi, eax
lea eax, [ebp - 8]
mov edx, dword [0x4d6478]
call fcn.00403e48
xor eax, eax
push ebp
push 0x4de327
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004d66ac
mov ebx, eax
mov eax, esi
cmp eax, 0x284
jg 0x4dd108
je 0x4dd777
cmp eax, 0x118
jg 0x4dd012
je 0x4dd594
cmp eax, 0xcb
jg 0x4dcf9d
je 0x4dd504
cmp eax, 0x7d
jg 0x4dcf5e
je 0x4dd3bc
cmp eax, 0x78
jg 0x4dcf49
je 0x4dd373
sub eax, 0x64
je 0x4dd323
sub eax, 5
je 0x4dd369
jmp case.0x4dd2ac.1402
sub eax, 0x7a
je 0x4dd37d
dec eax
je 0x4dd3a8
jmp case.0x4dd2ac.1402
cmp eax, 0xb4
jg 0x4dcf84
je 0x4dd4b4
sub eax, 0x8c
je case.0x4dd2ac.1427
sub eax, 0x14
je case.0x4dd2ac.1427
jmp case.0x4dd2ac.1402
sub eax, 0xc8
je 0x4dd4d2
sub eax, 2
je case.0x4dd2ac.1422
jmp case.0x4dd2ac.1402
cmp eax, 0xe9
jg 0x4dcfe7
je 0x4dd562
cmp eax, 0xe1
jg 0x4dcfd0
je case.0x4dd2ac.1422
sub eax, 0xcd
je 0x4dd522
sub eax, 0xf
je 0x4dd540
jmp case.0x4dd2ac.1402
sub eax, 0xe6
je 0x4dd54a
dec eax
je 0x4dd556
jmp case.0x4dd2ac.1402
sub eax, 0xeb
je 0x4dd56c
sub eax, 5
je 0x4dd576
sub eax, 0x14
je 0x4dd580
sub eax, 5
je 0x4dd58a
jmp case.0x4dd2ac.1402
cmp eax, 0x15e
jg 0x4dd097
je 0x4dd6bc
cmp eax, 0x154
jg 0x4dd06e
je 0x4dd638
cmp eax, 0x131
jg 0x4dd055
je case.0x4dd2ac.1424
add eax, 0xfffffede
sub eax, 2
jb 0x4dd5aa
sub eax, 8
je 0x4dd5eb
jmp case.0x4dd2ac.1402
sub eax, 0x140
je 0x4dd5ff
sub eax, 5
je case.0x4dd2ac.1424
jmp case.0x4dd2ac.1402
sub eax, 0x157
je 0x4dd661
sub eax, 2
je 0x4dd684
dec eax
je 0x4dd696
sub eax, 3
je 0x4dd6aa
jmp case.0x4dd2ac.1402
cmp eax, 0x26c
jg 0x4dd0e3
je 0x4dd723
cmp eax, 0x163
jg 0x4dd0c8
je 0x4dd6f6
sub eax, 0x15f
je 0x4dd6d0
dec eax
je 0x4dd6e2
jmp case.0x4dd2ac.1402
sub eax, 0x168
je 0x4dd708
sub eax, 0xf0
je 0x4dd717
jmp case.0x4dd2ac.1402
sub eax, 0x280
je 0x4dd72f
dec eax
je 0x4dd740
dec eax
je 0x4dd74f
dec eax
je 0x4dd759
jmp case.0x4dd2ac.1402
cmp eax, 0x370
jg 0x4dd21a
je 0x4ddc57
cmp eax, 0x339
jg 0x4dd1a5
je 0x4dd967
cmp eax, 0x32d
jg 0x4dd179
je 0x4dd8ec
cmp eax, 0x294
jg 0x4dd15d
je 0x4dd860
add eax, 0xfffffd7b
sub eax, 2
jb 0x4dd786
je 0x4dd7ad
jmp case.0x4dd2ac.1402
add eax, 0xfffffd44
sub eax, 7
jb 0x4dd8c0
sub eax, 0x5d
je 0x4dd8ce
jmp case.0x4dd2ac.1402
sub eax, 0x32e
je 0x4dd8f6
add eax, 0xfffffffe
sub eax, 2
jb 0x4dd921
dec eax
je 0x4dd92d
sub eax, 3
je 0x4dd95b
jmp case.0x4dd2ac.1402
cmp eax, 0x35c
jg 0x4dd1f1
je 0x4ddb88
cmp eax, 0x348
jg 0x4dd1d8
je 0x4ddaab
sub eax, 0x33c
je 0x4dda5f
sub eax, 3
je 0x4dda9f
jmp case.0x4dd2ac.1402
sub eax, 0x34d
je 0x4ddae3
sub eax, 5
je 0x4ddb7c
jmp case.0x4dd2ac.1402
sub eax, 0x35f
je 0x4ddb9a
dec eax
je 0x4ddba6
sub eax, 6
je 0x4ddbb2
sub eax, 5
je 0x4ddc23
jmp case.0x4dd2ac.1402
cmp eax, 0x578
jg 0x4dd29e
je 0x4de142
cmp eax, 0x51f
jg 0x4dd276
je 0x4dde1f
cmp eax, 0x4b0
jg 0x4dd25d
je 0x4ddcb4
sub eax, 0x37a
je 0x4ddc63
add eax, 0xffffff92
sub eax, 0x64
jb 0x4ddc87
jmp case.0x4dd2ac.1402
sub eax, 0x4ec
je 0x4ddcc3
sub eax, 0xa
je 0x4dde10
jmp case.0x4dd2ac.1402
sub eax, 0x520
je 0x4ddedf
dec eax
je 0x4ddf40
dec eax
je 0x4ddfa9
dec eax
sub eax, 2
jb 0x4de060
jmp case.0x4dd2ac.1402
add eax, 0xfffffa87
cmp eax, 0x1b
ja case.0x4dd2ac.1402
jmp dword [eax*4 + 0x4dd2b3]
mov eax, dword [0x672428]
test byte [eax + 0xb], 2
je 0x4dd338
call fcn.004da774
jmp case.0x4dd2ac.1402
push 0
call fcn.005397ec
mov ecx, dword [0x672428]
mov ecx, dword [ecx + 0xc0]
xor edx, edx
call fcn.00537ff4
test al, al
je case.0x4dd2ac.1402
mov eax, 0x7d0
call fcn.0049dbf8
jmp case.0x4dd2ac.1402
call fcn.004da774
jmp case.0x4dd2ac.1402
call fcn.004da7c0
jmp case.0x4dd2ac.1402
mov eax, dword [0x672218]
mov eax, dword [eax]
call fcn.0062afc8
push 5
push 0
push 0
mov eax, dword [0x672218]
mov eax, dword [eax]
push eax
push 0x4de338
push 0
call sub.shell32.dll_ShellExecuteW
jmp case.0x4dd2ac.1402
mov eax, dword [0x672428]
add eax, 0x208
call fcn.00464234
jmp case.0x4dd2ac.1402
call fcn.004da8cc
jmp case.0x4dd2ac.1402
cmp esi, 0xa0
je 0x4dd3e9
cmp esi, 0x593
je 0x4dd3e9
mov eax, dword [ebx + 0x16c]
call fcn.00642e74
test al, al
je case.0x4dd2ac.1402
cmp esi, 0x8c
jne 0x4dd40d
call fcn.005397ec
xor ecx, ecx
mov edx, ebx
call fcn.00538888
mov eax, 0x7f8
call fcn.0049dbf8
mov bl, 1
jmp 0x4dd42f
cmp esi, 0xa0
jne 0x4dd420
xor eax, eax
call fcn.004da96c
mov ebx, eax
jmp 0x4dd42f
call fcn.005397ec
mov eax, dword [eax + 0x10]
call fcn.004da96c
mov ebx, eax
test bl, bl
je case.0x4dd2ac.1402
mov eax, dword [0x672880]
cmp dword [eax], 0
je case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0xc]
cmp dword [eax + 0x18], 0
jne case.0x4dd2ac.1402
lea edx, [ebp - 0x20]
mov eax, dword [0x672880]
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.0065d088
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0065cf64
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov eax, 0x4de344
call fcn.0065d968
mov eax, dword [ebp - 0x18]
mov cx, word [0x4de380]
mov dl, 3
call fcn.0062941c
cmp ax, 6
jne case.0x4dd2ac.1402
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x523
call fcn.004ed070
jmp case.0x4dd2ac.1402
mov eax, ebx
call fcn.0059aa2c
test al, al
jne case.0x4dd2ac.1402
mov eax, 0x80c
call fcn.0049dbf8
jmp case.0x4dd2ac.1402
mov cl, 1
mov edx, dword [ebx + 0x158]
mov eax, ebx
call fcn.0059afb4
test al, al
jne case.0x4dd2ac.1402
mov eax, 0x80c
call fcn.0049dbf8
jmp case.0x4dd2ac.1402
mov eax, esi
call fcn.004dab1c
jmp case.0x4dd2ac.1402
mov eax, ebx
call fcn.0059b904
test al, al
jne case.0x4dd2ac.1402
mov eax, 0x80c
call fcn.0049dbf8
jmp case.0x4dd2ac.1402
mov eax, ebx
call fcn.0059bcec
test al, al
jne case.0x4dd2ac.1402
mov eax, 0x80c
call fcn.0049dbf8
jmp case.0x4dd2ac.1402
call fcn.004daa54
jmp case.0x4dd2ac.1402
mov eax, ebx
call fcn.004a46f0
jmp case.0x4dd2ac.1402
mov eax, ebx
call fcn.004c27a8
jmp case.0x4dd2ac.1402
call fcn.004c7004
jmp case.0x4dd2ac.1402
call fcn.004dac68
jmp case.0x4dd2ac.1402
call fcn.004dae9c
jmp case.0x4dd2ac.1402
call fcn.004daf1c
jmp case.0x4dd2ac.1402
call fcn.004db0ec
jmp case.0x4dd2ac.1402
mov eax, 0x820
call fcn.0049dbf8
mov eax, ebx
call fcn.004357e0
jmp case.0x4dd2ac.1402
cmp byte [ebx + 0x145], 0
jne 0x4dd5cc
cmp dword [ebx + 0x814], 0
je 0x4dd5cc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x1c20
call fcn.004ed070
mov dl, byte [ebx + 0x145]
xor dl, 1
mov eax, ebx
call fcn.0056292c
mov eax, 0x834
call fcn.0049dbf8
jmp case.0x4dd2ac.1402
mov eax, 0x848
call fcn.0049dbf8
call fcn.004db1dc
jmp case.0x4dd2ac.1402
mov eax, 0x848
call fcn.0049dbf8
call fcn.005397ec
mov eax, dword [eax + 0xc]
push eax
call fcn.005397ec
pop edx
call fcn.005393c0
jmp case.0x4dd2ac.1402
mov eax, 0x848
call fcn.0049dbf8
mov eax, esi
call fcn.004dad18
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x60]
call fcn.006221a8
test al, al
je case.0x4dd2ac.1402
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
or dword [eax + 0x2c], 0x40
call fcn.00501d7c
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x60]
xor edx, edx
call fcn.00622168
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
or dword [eax + 0x2c], 0x40
call fcn.00501d7c
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x64]
call fcn.006221a8
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x64]
xor edx, edx
call fcn.00622168
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x68]
call fcn.006221a8
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x68]
xor edx, edx
call fcn.00622168
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x58]
call fcn.006221a8
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x58]
xor edx, edx
call fcn.00622168
jmp case.0x4dd2ac.1402
call fcn.00535954
mov eax, dword [eax + 0x38]
call fcn.00656eec
jmp case.0x4dd2ac.1402
call fcn.00501d74
call fcn.00501cd0
jmp case.0x4dd2ac.1402
mov eax, ebx
call fcn.005c97c4
jmp case.0x4dd2ac.1402
xor eax, eax
call fcn.00459ffc
jmp case.0x4dd2ac.1402
mov eax, dword [0x672260]
mov al, byte [eax]
call fcn.004ad02c
jmp case.0x4dd2ac.1402
mov eax, dword [0x4b217c]
call fcn.0062c3f4
jmp case.0x4dd2ac.1402
call fcn.00452dec
jmp case.0x4dd2ac.1402
mov eax, dword [0x672428]
add eax, 0xc0
call fcn.004a9424
call fcn.00501d74
call fcn.0050111c
jmp case.0x4dd2ac.1402
mov eax, dword [0x4c7b94]
call fcn.0062c3f4
jmp case.0x4dd2ac.1402
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4569dc]
call fcn.00457db0
mov edx, dword [0x672814]
mov dword [edx], eax
mov eax, dword [0x672814]
mov eax, dword [eax]
call fcn.00642f7c
jmp case.0x4dd2ac.1402
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d3a28]
call fcn.0062c3b4
mov ebx, eax
mov edx, 0x38e28
mov eax, ebx
call fcn.0062c418
mov eax, ebx
call fcn.00642fd0
cmp eax, 6
jne 0x4dd854
call fcn.006271d0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x6725b8]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [0x6725b8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea ecx, [ebp - 0x1c]
mov edx, 0x4de38c
mov al, 9
call fcn.006260e8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x3c]
call fcn.0065c920
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x38]
mov eax, 0x4de39c
mov ecx, 2
call fcn.0065d7d4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
call fcn.0065c958
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x6726d4]
call fcn.004038bc
call fcn.00501d74
call fcn.00501cd0
mov eax, ebx
call fcn.004028c0
jmp case.0x4dd2ac.1402
mov eax, dword [0x6728c4]
cmp byte [eax], 0
je 0x4dd8b1
mov eax, dword [0x672648]
cmp byte [eax], 0
je 0x4dd8b1
call fcn.0062705c
test al, al
jne 0x4dd8b1
mov eax, 0x4de3ac
mov cx, word [0x4de380]
mov dl, 3
call fcn.0062941c
cmp ax, 6
jne case.0x4dd2ac.1402
mov eax, dword [0x67227c]
mov byte [eax], 1
call fcn.00501d74
call fcn.00501cd0
jmp case.0x4dd2ac.1402
mov eax, dword [0x4c9738]
call fcn.0062c3f4
jmp case.0x4dd2ac.1402
push ebp
mov eax, esi
call fcn.004db27c
pop ecx
jmp case.0x4dd2ac.1402
mov dl, 1
mov eax, ebx
call fcn.005e6c34
push 0
call fcn.0052ddf4
xor ecx, ecx
mov edx, ebx
call fcn.0052a83c
jmp case.0x4dd2ac.1402
call fcn.004db684
jmp case.0x4dd2ac.1402
call fcn.0052ddf4
mov esi, eax
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x824]
mov edx, dword [eax]
call dword [edx + 0x34]
mov eax, esi
call fcn.005276dc
mov eax, ebx
call fcn.005e6b20
jmp case.0x4dd2ac.1402
mov eax, esi
call fcn.004db6ac
jmp case.0x4dd2ac.1402
call fcn.0052ddf4
lea ebx, [eax + 0x18]
mov esi, dword [ebx + 0x44]
mov eax, esi
call fcn.0065b4c0
mov edx, eax
lea ecx, [ebp - 0x1c]
mov eax, dword [ebx + 0x3c]
call fcn.0065c844
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0046b9f4
jmp case.0x4dd2ac.1402
push ebp
call fcn.004db818
pop ecx
jmp case.0x4dd2ac.1402
mov eax, dword [0x672428]
test byte [eax + 0xb5], 0x80
je 0x4dd9b9
mov eax, dword [0x672428]
test byte [eax + 0x17d], 0x10
je 0x4dd9b9
mov eax, 0x4de48c
mov cl, 0x28
mov dl, 3
call fcn.00629794
cmp ax, 6
jne 0x4de2e6
mov eax, dword [0x672428]
and dword [eax + 0x17c], 0xffffefff
mov eax, dword [0x672428]
or dword [eax + 0x17c], 0x2000
mov eax, dword [0x672428]
test byte [eax + 0xb5], 0x80
je 0x4dd9d7
mov eax, dword [0x672428]
and word [eax + 0xb5], 0xff7f
jmp 0x4dd9e5
mov eax, dword [0x672428]
or word [eax + 0xb5], 0x80
call fcn.0052ddf4
call fcn.005276dc
call fcn.005397ec
call fcn.00538f9c
mov eax, dword [0x672428]
test byte [eax + 0xb5], 0x80
je 0x4dda55
mov eax, dword [0x672428]
test byte [eax + 0x17d], 0x10
jne 0x4dda55
mov eax, dword [0x672428]
test byte [eax + 0x17d], 0x20
je 0x4dda55
mov eax, 0x4de560
mov cl, 0x29
mov dl, 3
call fcn.00629794
cmp ax, 6
jne 0x4dda55
mov eax, dword [0x672428]
or dword [eax + 0x17c], 0x1000
mov eax, dword [0x672428]
and dword [eax + 0x17c], 0xffffdfff
call fcn.00501d7c
jmp case.0x4dd2ac.1402
mov eax, dword [0x672428]
test byte [eax + 0xb6], 1
je 0x4dda7d
mov eax, dword [0x672428]
and word [eax + 0xb5], 0xfeff
jmp 0x4dda8b
mov eax, dword [0x672428]
or word [eax + 0xb5], 0x100
call fcn.005397ec
call fcn.00538f9c
call fcn.00501d7c
jmp case.0x4dd2ac.1402
mov al, 5
call fcn.004ad02c
jmp case.0x4dd2ac.1402
call fcn.0052ddf4
lea edx, [eax + 0x18]
mov eax, edx
mov esi, dword [eax]
push esi
mov ecx, dword [eax + 4]
add ecx, dword [edx + 0x10]
push ecx
mov dl, byte [0x4de380]
push edx
mov ecx, dword [eax + 4]
mov edx, esi
mov eax, ebx
call fcn.005c5e64
mov eax, dword [ebp + 8]
push eax
xor eax, eax
call fcn.004da4a0
pop ecx
jmp case.0x4dd2ac.1402
call fcn.00501d74
cmp byte [eax + 0x288], 0
jne case.0x4dd2ac.1402
mov eax, dword [0x6725d8]
mov eax, dword [eax]
cmp byte [eax + 0x24], 0
je 0x4ddb50
push 0x12
call sub.user32.dll_GetKeyState
movsx ebx, ax
mov esi, ebx
and esi, 0x80
test esi, esi
je 0x4ddb25
push 0
push 2
push 0
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x12
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_keybd_event
test esi, esi
je 0x4ddb50
push 0
push 0
push 0
push 0x12
call sub.user32.dll_keybd_event
call fcn.00501d74
mov byte [eax + 0x288], 1
call fcn.00452ec0
call fcn.00452f88
call fcn.00452ec0
mov edx, 0x66c278
xor ecx, ecx
call fcn.00452f58
jmp case.0x4dd2ac.1402
mov eax, ebx
call fcn.005e6684
jmp case.0x4dd2ac.1402
xor edx, edx
mov eax, dword [ebx + 0x39c]
call fcn.0046b9f4
jmp case.0x4dd2ac.1402
push ebp
call fcn.004db8c4
pop ecx
jmp case.0x4dd2ac.1402
push ebp
call fcn.004dbc44
pop ecx
jmp case.0x4dd2ac.1402
mov eax, dword [ebx + 0x1e8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x1ec]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x1f0]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x39c]
cmp eax, 0x80000000
jne 0x4ddbed
mov ecx, dword [ebx + 0x254]
mov edx, dword [ebx + 0x250]
mov eax, ebx
call fcn.005c86c0
lea edx, [ebp - 0x14]
xchg edx, eax
call fcn.004781e4
sub al, 1
jb 0x4ddc03
dec al
je 0x4ddc14
jmp case.0x4dd2ac.1402
lea ecx, [ebp - 0x14]
mov dl, 0x31
mov eax, ebx
call fcn.005cfcdc
jmp case.0x4dd2ac.1402
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.005d6a30
jmp case.0x4dd2ac.1402
mov eax, dword [ebx + 0x1e8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x1ec]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x1f0]
mov dword [ebp - 0xc], eax
mov al, byte [ebp - 0x14]
xor al, 1
mov byte [ebp - 0x14], al
lea ecx, [ebp - 0x14]
mov dl, 0x31
mov eax, ebx
call fcn.005cfcdc
jmp case.0x4dd2ac.1402
push ebp
call fcn.004dbfa8
pop ecx
jmp case.0x4dd2ac.1402
call fcn.00466078
mov eax, dword [0x6720e8]
mov eax, dword [eax]
mov dl, 1
call fcn.0062c590
mov eax, dword [0x6720e8]
mov eax, dword [eax]
call fcn.0064a384
jmp case.0x4dd2ac.1402
push 0
call fcn.005397ec
mov ecx, esi
sub ecx, 0x3e8
xor edx, edx
call fcn.00537ff4
test al, al
je case.0x4dd2ac.1402
mov eax, 0x7d0
call fcn.0049dbf8
jmp case.0x4dd2ac.1402
mov eax, dword [0x4746d4]
call fcn.0062c3f4
jmp case.0x4dd2ac.1402
mov eax, dword [0x672880]
cmp dword [eax], 0
je 0x4ddda7
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x672880]
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.0065d088
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0065cf64
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x3c]
call fcn.0065c920
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
lea edx, [ebp - 0x50]
mov eax, dword [ebx + 0x158]
call fcn.0065c920
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
lea edx, [ebp - 0x4c]
mov eax, 0x4de5dc
mov ecx, 1
call fcn.0065d7d4
mov eax, dword [ebp - 0x18]
mov cx, word [0x4de690]
mov dl, 3
call fcn.0062941c
sub ax, 6
je 0x4ddd52
dec ax
je 0x4ddd67
jmp 0x4de2e6
lea eax, [ebp - 8]
mov edx, dword [0x672880]
mov edx, dword [edx]
mov edx, dword [edx + 4]
call fcn.004038bc
jmp 0x4dddb5
cmp byte [ebx + 0x454], 0
je 0x4ddd7f
mov eax, 0x4de694
call fcn.00629668
jmp 0x4de2e6
cmp byte [ebx + 0x41e], 0
je 0x4ddd97
mov eax, 0x4de6c4
call fcn.00629668
jmp 0x4de2e6
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x158]
call fcn.004038bc
jmp 0x4dddb5
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x158]
call fcn.004038bc
call fcn.004c60e4
mov ebx, eax
cmp dword [ebx + 0x24], 1
jne 0x4dddd7
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x30f98
call fcn.004ee2e4
jmp 0x4dde04
call fcn.004c5c40
test al, al
je 0x4dde04
lea eax, [ebp - 4]
mov edx, dword [0x672428]
mov edx, dword [edx + 0x1e]
call fcn.004038bc
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x30f98
call fcn.004ee2e4
mov eax, ebx
call fcn.004028c0
jmp case.0x4dd2ac.1402
mov eax, dword [0x4c5e6c]
call fcn.0062c3f4
jmp case.0x4dd2ac.1402
lea edx, [ebp - 0x1c]
mov eax, 0x4de740
call fcn.0065ca3c
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
add eax, 0x3c
mov edx, dword [0x672714]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + 8]
pop ecx
call fcn.00403b24
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
mov byte [eax + 0x5a], 2
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
mov edx, dword [eax]
call dword [edx + 0x28]
test al, al
je case.0x4dd2ac.1402
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x523
call fcn.004ed070
mov eax, dword [0x672880]
cmp dword [eax], 0
jne case.0x4dd2ac.1402
mov dl, 1
mov eax, dword [0x535c90]
call fcn.00402898
mov edx, dword [0x672880]
mov dword [edx], eax
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
lea edx, [ebp - 0x1c]
call fcn.006371a0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x672880]
mov eax, dword [eax]
add eax, 4
call fcn.004038bc
call fcn.00501d74
call fcn.004feebc
jmp case.0x4dd2ac.1402
call fcn.00501d74
mov eax, dword [eax + 0x1ac]
add eax, 0x3c
call fcn.00403880
call fcn.00501d74
mov eax, dword [eax + 0x1ac]
mov byte [eax + 0x5a], 1
call fcn.00501d74
mov eax, dword [eax + 0x1ac]
mov edx, dword [eax]
call dword [edx + 0x28]
test al, al
je case.0x4dd2ac.1402
call fcn.00501d74
mov eax, dword [eax + 0x1ac]
lea edx, [ebp - 0x1c]
call fcn.006371a0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005397ec
pop edx
call fcn.00536890
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x18]
dec edi
test edi, edi
jl 0x4ddf8e
inc edi
xor ebx, ebx
call fcn.005397ec
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov esi, dword [eax + ebx*4]
mov eax, esi
call fcn.005661b0
test al, al
je 0x4ddf8a
cmp byte [esi + 0x454], 0
jne 0x4ddf8a
mov eax, esi
call fcn.0059aa2c
test al, al
je 0x4ddf8a
call fcn.00501d7c
jmp 0x4de2e6
inc ebx
dec edi
jne 0x4ddf53
mov eax, dword [0x672880]
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x672880]
mov eax, dword [eax]
call fcn.00535e34
jmp case.0x4dd2ac.1402
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
add eax, 0x3c
mov edx, dword [0x672880]
mov edx, dword [edx]
mov edx, dword [edx + 4]
call fcn.004038bc
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
mov byte [eax + 0x5a], 2
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
mov edx, dword [eax]
call dword [edx + 0x28]
test al, al
je case.0x4dd2ac.1402
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
lea edx, [ebp - 0x1c]
call fcn.006371a0
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x672880]
mov edx, dword [edx]
mov edx, dword [edx + 4]
call fcn.0065ce24
test al, al
jne case.0x4dd2ac.1402
call fcn.00501d74
mov eax, dword [eax + 0x1b0]
lea edx, [ebp - 0x1c]
call fcn.006371a0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x672880]
mov eax, dword [eax]
add eax, 4
call fcn.004038bc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x521
call fcn.004ed070
call fcn.00501d74
call fcn.004feebc
jmp case.0x4dd2ac.1402
lea edx, [ebp - 0x20]
mov eax, dword [0x672880]
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.0065d088
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0065cf64
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov eax, 0x4de754
call fcn.0065d968
mov eax, dword [ebp - 0x18]
mov cx, word [0x4de690]
mov dl, 3
call fcn.0062941c
sub ax, 2
je 0x4de2e6
sub ax, 4
jne 0x4de0d9
call fcn.004daa54
test al, al
je 0x4de2e6
mov eax, dword [0x672880]
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x672880]
mov eax, dword [eax]
call fcn.00535e34
test al, al
je 0x4de2e6
mov eax, dword [0x672880]
mov eax, dword [eax]
call fcn.004028c0
mov eax, dword [0x672880]
xor edx, edx
mov dword [eax], edx
cmp esi, 0x523
jne 0x4de133
call fcn.005397ec
mov esi, eax
mov eax, dword [esi + 0xc]
mov ebx, dword [eax + 0x18]
dec ebx
cmp ebx, 0
jl 0x4de133
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + ebx*4]
cmp byte [eax + 0x454], 0
jne 0x4de12d
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x1c]
mov edx, dword [eax + ebx*4]
mov cl, 1
mov eax, esi
call fcn.00538888
dec ebx
cmp ebx, 0xffffffff
jne 0x4de109
call fcn.00501d74
call fcn.004feebc
jmp case.0x4dd2ac.1402
xor eax, eax
mov dword [ebx + 0x8bc], eax
mov dword [ebx + 0x8c0], eax
xor eax, eax
mov dword [ebx + 0x8c4], eax
xor eax, eax
mov dword [ebx + 0x8c8], eax
call fcn.005397ec
mov eax, dword [eax + 0x88]
mov edx, dword [ebx + 0x158]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ebx, eax
cmp ebx, 0xffffffff
je case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x88]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
call fcn.00401fac
call fcn.005397ec
mov eax, dword [eax + 0x88]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
dec ebx
cmp ebx, 0
jl 0x4de1f2
call fcn.005397ec
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + ebx*4]
xor edx, edx
mov dword [eax + 0x8bc], edx
mov dword [eax + 0x8c0], edx
xor edx, edx
mov dword [eax + 0x8c4], edx
xor edx, edx
mov dword [eax + 0x8c8], edx
dec ebx
cmp ebx, 0xffffffff
jne 0x4de1c0
call fcn.00535954
call fcn.00534808
test al, al
je 0x4de22b
call fcn.00535954
call fcn.005341b0
mov eax, dword [eax + 8]
xor edx, edx
mov dword [eax + 0x8bc], edx
mov dword [eax + 0x8c0], edx
xor edx, edx
mov dword [eax + 0x8c4], edx
xor edx, edx
mov dword [eax + 0x8c8], edx
call fcn.005397ec
mov eax, dword [eax + 0x88]
mov ebx, dword [eax + 0x24]
dec ebx
cmp ebx, 0
jl 0x4de25c
call fcn.005397ec
mov eax, dword [eax + 0x88]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
call fcn.00401fac
dec ebx
cmp ebx, 0xffffffff
jne 0x4de23f
call fcn.005397ec
mov eax, dword [eax + 0x88]
mov edx, dword [eax]
call dword [edx + 0x34]
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0xc]
push eax
call fcn.005397ec
mov eax, dword [eax + 0x10]
pop edx
call fcn.00656bec
call fcn.00501d74
mov byte [eax + 0x27f], 1
jmp case.0x4dd2ac.1402
call fcn.005397ec
mov eax, dword [eax + 0x10]
call fcn.00656bcc
call fcn.00501d74
mov byte [eax + 0x27f], 1
jmp case.0x4dd2ac.1402
mov eax, 0x848
call fcn.0049dbf8
call fcn.005397ec
mov eax, dword [eax + 0x10]
push eax
call fcn.005397ec
pop edx
call fcn.005393c0
jmp case.0x4dd2ac.1402
call fcn.004dc420
jmp case.0x4dd2ac.1402
call fcn.004dc68c
jmp case.0x4dd2ac.1402
call fcn.004dcbec
call fcn.00501d7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de32e
lea eax, [ebp - 0x50]
call fcn.00403274
lea eax, [ebp - 0x3c]
call fcn.00403274
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x18]
call fcn.00403274
lea eax, [ebp - 8]
mov edx, dword [0x4d6478]
call fcn.00403f10
ret