Function at 0x47f94c
Capabilities:
Accept command line arguments
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x57
push 0
push 0
dec ecx
jne 0x47f954
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48098f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x5be9a4
call fcn.00403c9c
xor eax, eax
push ebp
push 0x48090f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47fa87
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x280]
push eax
call sub.kernel32.dll_GetLocalTime
lea edx, [ebp - 0x284]
mov eax, 1
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
push eax
movzx eax, word [ebp - 0x280]
mov cl, 0x30
mov edx, 4
call fcn.0041aa08
push dword [ebp - 0x288]
push 0x4809a8
lea eax, [ebp - 0x28c]
push eax
movzx eax, word [ebp - 0x27e]
mov cl, 0x30
mov edx, 2
call fcn.0041aa08
push dword [ebp - 0x28c]
push 0x4809a8
lea eax, [ebp - 0x290]
push eax
movzx eax, word [ebp - 0x27a]
mov cl, 0x30
mov edx, 2
call fcn.0041aa08
push dword [ebp - 0x290]
push 0x4809b4
lea eax, [ebp - 0x294]
push eax
movzx eax, word [ebp - 0x278]
mov cl, 0x30
mov edx, 2
call fcn.0041aa08
push dword [ebp - 0x294]
push 0x4809c0
lea eax, [ebp - 0x298]
push eax
movzx eax, word [ebp - 0x276]
mov cl, 0x30
mov edx, 2
call fcn.0041aa08
push dword [ebp - 0x298]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 0xb
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fa91
xor eax, eax
push ebp
push 0x47fae7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 2
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
call fcn.00478b04
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47faf1
xor eax, eax
push ebp
push 0x47fb47
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0048165c
cmp dword [ebp - 0xc], 0
je 0x47fb3d
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 3
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0xc]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fb51
xor eax, eax
push ebp
push 0x47fbc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x12d]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 4
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
lea edx, [ebp - 0x12d]
mov ecx, 0x105
call fcn.00403ec8
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fbd3
xor eax, eax
push ebp
push 0x47fc29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 5
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
call fcn.0048196c
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fc33
xor eax, eax
push ebp
push 0x47fc89
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00481a18
cmp dword [ebp - 0xc], 0
je 0x47fc7f
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 6
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0xc]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fc93
xor eax, eax
push ebp
push 0x47fce9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00481a64
cmp dword [ebp - 0xc], 0
je 0x47fcdf
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 7
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0xc]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fcf3
xor eax, eax
push ebp
push 0x47fd49
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00481acc
cmp dword [ebp - 0xc], 0
je 0x47fd3f
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 8
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0xc]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fd53
xor eax, eax
push ebp
push 0x47fe0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00481ba4
cmp dword [ebp - 0xc], 0
je 0x47fe01
call fcn.00481c20
mov ebx, eax
cmp ebx, 1
jne 0x47fdb1
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 9
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0xc]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
jmp 0x47fe01
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0xa
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
push eax
mov cl, 0x30
mov edx, 1
mov eax, ebx
call fcn.0041a918
push dword [ebp - 0x288]
push 0x4809d8
push dword [ebp - 0xc]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 6
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fe15
xor eax, eax
push ebp
push 0x47fe6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0xb
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
call fcn.00481d08
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fe75
xor eax, eax
push ebp
push 0x47fedf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2b8]
call fcn.0041b6ac
cmp byte [ebp - 0x2a8], 0
je 0x47fed5
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0xc
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
call fcn.00481dd8
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fee9
xor eax, eax
push ebp
push 0x47ffd1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4809dc
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x4809ec
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x12d]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0xd
call fcn.0047f41c
push dword [ebp - 0x284]
push ebp
lea edx, [ebp - 0x288]
mov al, byte [ebp - 0x12d]
call fcn.0047f250
pop ecx
push dword [ebp - 0x288]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00403fd8
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004789dc
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
call fcn.00419f58
mov ebx, eax
mov al, byte [ebp - 0x12d]
call fcn.00419f58
cmp bl, al
je 0x47ffb7
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4809b4
push ebp
lea edx, [ebp - 0x284]
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
call fcn.0047f250
pop ecx
push dword [ebp - 0x284]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00403fd8
mov eax, dword [ebp - 8]
mov edx, 0x4809cc
call fcn.00403f20
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ffdb
xor eax, eax
push ebp
push 0x480031
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0xe
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
call fcn.00481e8c
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48003b
xor eax, eax
push ebp
push 0x48009e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0xf
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0041aa98
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4800a8
xor eax, eax
push ebp
push 0x4800fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x1b
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
call fcn.0048308c
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x480108
xor eax, eax
push ebp
push 0x480275
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5b6bb0], 0
je 0x48026b
call fcn.004028e4
test eax, eax
jle 0x48026b
mov dl, 1
mov eax, dword [0x40f694]
call fcn.00402f88
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4801cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_GetCommandLineA_1
mov ecx, eax
mov edx, 0x480a00
mov eax, 0x480a20
call fcn.00410bb4
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4801c5
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x288]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x288]
mov ecx, 4
mov edx, 2
call fcn.0040411c
mov eax, dword [ebp - 0x284]
mov edx, 0x480a48
call fcn.00404028
jne 0x4801bf
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x44]
dec ebx
cmp ebx, 0xffffffff
jne 0x480177
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4801d9
lea eax, [ebp - 0x28]
call fcn.00403c9c
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x480222
inc esi
xor ebx, ebx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x284]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x284]
push 0x4809b4
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403fd8
inc ebx
dec esi
jne 0x4801f3
mov eax, dword [ebp - 0x24]
call fcn.00402fb8
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x10
call fcn.0047f41c
push dword [ebp - 0x284]
lea edx, [ebp - 0x288]
mov eax, dword [ebp - 0x28]
call fcn.00408c14
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48027f
xor eax, eax
push ebp
push 0x4802e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x11
call fcn.0047f41c
push dword [ebp - 0x284]
lea edx, [ebp - 0x28c]
xor eax, eax
call fcn.004789dc
mov eax, dword [ebp - 0x28c]
lea edx, [ebp - 0x288]
call fcn.00478a14
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4802f2
xor eax, eax
push ebp
push 0x48035b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x12
call fcn.0047f41c
push dword [ebp - 0x284]
lea edx, [ebp - 0x28c]
xor eax, eax
call fcn.004789dc
mov eax, dword [ebp - 0x28c]
lea edx, [ebp - 0x288]
call fcn.004781c4
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x480365
xor eax, eax
push ebp
push 0x480419
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x12d]
push eax
mov eax, dword [0x5bbdf4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea edx, [ebp - 0x284]
xor eax, eax
call fcn.004789dc
mov eax, dword [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
lea edx, [ebp - 0x12d]
mov ecx, 0x105
call fcn.00403ec8
mov eax, dword [ebp - 0x288]
pop edx
call fcn.00419fe8
test al, al
jne 0x48040f
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x13
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
lea edx, [ebp - 0x12d]
mov ecx, 0x105
call fcn.00403ec8
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x480423
xor eax, eax
push ebp
push 0x4806c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x12d]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4806bc
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
push ebp
push 0x4805dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x25c]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x25c]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea edx, [ebp - 0x284]
xor eax, eax
call fcn.004789dc
mov eax, dword [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
lea edx, [ebp - 0x12d]
mov ecx, 0x105
call fcn.00403ec8
mov eax, dword [ebp - 0x288]
pop edx
call fcn.00419fe8
test al, al
je 0x4804e6
lea edx, [ebp - 0x284]
mov eax, 0x14
call fcn.0047f41c
mov edx, dword [ebp - 0x284]
mov eax, dword [ebp - 8]
call fcn.00403f20
mov eax, dword [ebp - 8]
jmp 0x480507
lea edx, [ebp - 0x284]
mov eax, 0x15
call fcn.0047f41c
mov edx, dword [ebp - 0x284]
mov eax, dword [ebp - 8]
call fcn.00403f20
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
push dword [eax]
lea eax, [ebp - 0x284]
push eax
movzx eax, word [ebp - 0x280]
mov cl, 0x30
mov edx, 4
call fcn.0041aa08
push dword [ebp - 0x284]
push 0x4809a8
lea eax, [ebp - 0x288]
push eax
movzx eax, word [ebp - 0x27e]
mov cl, 0x30
mov edx, 2
call fcn.0041aa08
push dword [ebp - 0x288]
push 0x4809a8
lea eax, [ebp - 0x28c]
push eax
movzx eax, word [ebp - 0x27a]
mov cl, 0x30
mov edx, 2
call fcn.0041aa08
push dword [ebp - 0x28c]
push 0x4809b4
lea eax, [ebp - 0x290]
push eax
movzx eax, word [ebp - 0x278]
mov cl, 0x30
mov edx, 2
call fcn.0041aa08
push dword [ebp - 0x290]
push 0x4809c0
lea eax, [ebp - 0x294]
push eax
movzx eax, word [ebp - 0x276]
mov cl, 0x30
mov edx, 2
call fcn.0041aa08
push dword [ebp - 0x294]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 0xb
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4805e6
cmp dword [0x5b6be0], 0
je 0x4805f9
mov eax, dword [0x5b6be0]
cmp dword [eax], 0
jne 0x480676
lea eax, [ebp - 0x284]
lea edx, [ebp - 0x12d]
mov ecx, 0x105
call fcn.00403ec8
mov eax, dword [ebp - 0x284]
call fcn.0041baac
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x48062a
cmp dword [ebp - 0x20], 0
je 0x4806bc
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x16
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x288]
call fcn.0041bb98
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
jmp 0x4806bc
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x16
call fcn.0047f41c
push dword [ebp - 0x284]
lea eax, [ebp - 0x288]
mov edx, dword [0x5b6be0]
mov edx, dword [edx]
call fcn.00403e50
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4806d0
xor eax, eax
push ebp
push 0x480789
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x480a50
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
test ebx, ebx
je 0x48077f
push 0x104
lea eax, [ebp - 0x12d]
push eax
push ebx
call sub.kernel32.dll_GetModuleFileNameA_2
test eax, eax
jbe 0x48077f
lea eax, [ebp - 0x284]
lea edx, [ebp - 0x12d]
mov ecx, 0x105
call fcn.00403ec8
mov eax, dword [ebp - 0x284]
call fcn.0041baac
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x480739
cmp dword [ebp - 0x20], 0
je 0x48077f
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x17
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x288]
call fcn.0041bb98
push dword [ebp - 0x288]
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x480793
xor eax, eax
push ebp
push 0x4807dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x18
call fcn.0047f41c
push dword [ebp - 0x284]
push 0x480a64
push 0x4809cc
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4807e7
xor eax, eax
push ebp
push 0x4808fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
jne 0x4808c4
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0047b6c4
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0047b7d0
mov eax, dword [ebp - 8]
push dword [eax]
lea edx, [ebp - 0x284]
mov eax, 0x1a
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00403fd8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00404028
je 0x4808f1
push 1
mov eax, 0x480a6c
mov ecx, 0x7fffffff
mov edx, dword [ebp - 0xc]
call fcn.0041a430
mov edx, eax
add edx, 2
lea eax, [ebp - 0xc]
mov ecx, 0x7fffffff
call fcn.0040415c
mov eax, 0x5be9a4
mov edx, dword [ebp - 0xc]
call fcn.00403cf0
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4809cc
lea edx, [ebp - 0x284]
mov eax, 0x19
call fcn.0047f41c
push dword [ebp - 0x284]
push dword [ebp - 0xc]
push 0x480a94
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00403fd8
jmp 0x4808f1
mov eax, dword [ebp - 8]
push dword [eax]
push 0x480aa0
lea eax, [ebp - 0x284]
mov edx, 0x5b69a0
call fcn.00403ebc
push dword [ebp - 0x284]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x480905
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48094b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480996
lea eax, [ebp - 0x2b8]
mov edx, dword [0x41b5cc]
call fcn.00404594
lea eax, [ebp - 0x298]
mov edx, 6
call fcn.00403cc0
lea eax, [ebp - 0x28]
call fcn.00403c9c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403cc0
ret