Function at 0x4af5d8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x3c6
push 0
push 0
dec ecx
jne 0x4af5e1
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b6b39
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0x64
jl 0x4af628
mov eax, dword [0x61ac04]
cmp dword [eax], 0x32
jge 0x4af628
mov eax, dword [ebp + 8]
mov edx, 0x4b6b54
call fcn.0040515c
jmp 0x4b68ec
mov eax, dword [ebp - 4]
lea eax, [eax + eax*4]
mov edx, dword [0x61b4b4]
cmp byte [edx + eax*2], 0
jne 0x4af8ba
lea edx, [ebp - 0x908]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x908]
lea eax, [ebp - 0x904]
mov edx, 0x4b6b64
call fcn.00405414
mov eax, dword [ebp - 0x904]
call fcn.0049839c
lea eax, [ebp - 0x44]
call fcn.00405108
cmp dword [ebp + 0xc], 0
setl byte [ebp - 0xb5]
mov eax, dword [ebp + 0xc]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x98c]
push eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov ecx, 4
mov edx, 1
call fcn.004029cc
lea eax, [ebp - 0x98c]
mov edx, 0x4b6b74
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403368
jne 0x4af6ce
cmp byte [ebp - 9], 0
je 0x4af6d2
xor eax, eax
jmp 0x4af6d4
mov al, 1
mov byte [ebp - 0x91], al
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
mov eax, 0x4b6b7c
call fcn.00402c78
test eax, eax
jle 0x4af709
mov eax, dword [ebp + 8]
mov edx, 0x4b6b90
call fcn.0040515c
jmp 0x4b68ec
lea eax, [ebp - 0x98c]
push eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov ecx, 5
mov edx, 1
call fcn.004029cc
lea eax, [ebp - 0x98c]
mov edx, 0x4b6b9c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403368
jne 0x4af758
mov eax, dword [ebp + 8]
mov edx, 0x4b6bac
call fcn.0040515c
jmp 0x4b68ec
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
mov eax, 0x4b6bb4
call fcn.00402c78
test eax, eax
jle 0x4af7aa
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
push dword [eax + edx*8 + 4]
push dword [eax + edx*8]
call fcn.00491408
cmp edx, 0
jne 0x4af7a1
cmp eax, 0x14
jae 0x4af7aa
jmp 0x4af7a3
jge 0x4af7aa
mov byte [ebp - 0x91], 1
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax], 0
je 0x4af8ad
lea edx, [ebp - 0x994]
mov eax, dword [ebp - 4]
call fcn.004f4fe8
mov ecx, dword [ebp - 0x994]
lea eax, [ebp - 0x990]
mov edx, 0x4b6bcc
call fcn.00405414
mov eax, dword [ebp - 0x990]
call fcn.0049839c
lea eax, [ebp - 0x99c]
imul edx, dword [ebp - 4], 0x65
mov ecx, dword [0x61a818]
lea edx, [ecx + edx]
call fcn.0040536c
mov eax, dword [ebp - 0x99c]
lea edx, [ebp - 0x998]
call fcn.00409de4
cmp dword [ebp - 0x998], 0
jne 0x4af863
lea edx, [ebp - 0xaa0]
mov eax, dword [ebp - 4]
call fcn.004f4fe8
mov edx, dword [ebp - 0xaa0]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61a818]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
push dword [eax + edx*8 + 4]
push dword [eax + edx*8]
call fcn.00491408
cmp edx, 0
jne 0x4af88f
cmp eax, 0x14
jae 0x4af898
jmp 0x4af891
jge 0x4af898
mov byte [ebp - 0x91], 1
mov eax, 0x4b6be0
call fcn.0048cf1c
test al, al
je 0x4af8ad
mov byte [ebp - 0x91], 0
cmp byte [ebp - 0x91], 0
je 0x4af9e2
mov eax, 0x4b6bf8
call fcn.0049839c
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x637a54], 0
jne 0x4af901
push 0
push 0x100000
push 1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b83f0
call fcn.0040623c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4af901
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax*4 + 0x637a54], edx
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 4]
cmp byte [eax + edx], 0
je 0x4af947
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
mov eax, dword [ebp - 8]
lea edi, [eax + 0xc6d]
mov esi, 0x4b6c00
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [ebp - 4]
mov edx, dword [ebp - 8]
mov byte [edx + 0xc61], al
mov eax, dword [ebp + 8]
call fcn.00405108
jmp 0x4b68ec
mov eax, dword [ebp + 8]
call fcn.00405108
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
mov eax, 0x4b6bb4
call fcn.00402c78
test eax, eax
jle 0x4af984
mov eax, dword [ebp + 8]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea esi, [edx + eax*2]
mov edi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0
je 0x4b68ec
mov eax, dword [ebp - 8]
add eax, 0xc6d
mov edx, 0x4b6c00
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403368
jne 0x4b68ec
mov eax, dword [ebp - 8]
lea edi, [eax + 0xc6d]
mov esi, 0x4b6c08
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b68ec
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
mov eax, 0x4b6c0c
call fcn.00402c78
test eax, eax
jle 0x4afa59
mov eax, 0x4b6c1c
call fcn.0049839c
call fcn.004cc83c
mov eax, 0x4b6c30
call fcn.0049839c
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
mov eax, dword [ebp - 4]
call fcn.004d8c9c
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
mov eax, dword [ebp + 8]
call fcn.00405108
jmp 0x4b68ec
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
je 0x4afa8b
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
cmp byte [eax*2 + 0x638ac0], 0
jne 0x4afa8b
mov eax, dword [ebp + 8]
mov edx, 0x4b6c44
call fcn.0040515c
jmp 0x4b68ec
cmp dword [ebp + 0xc], 0
jle 0x4afaad
imul eax, dword [ebp - 4], 0xc9
mov byte [eax + 0x62dd4c], 0
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
mov byte [edx + eax], 0
call fcn.0040c8dc
fstp qword [ebp - 0x80]
wait
call fcn.0040c8dc
fstp qword [ebp - 0x78]
wait
mov dword [ebp - 0x10], 0xfffffc18
cmp byte [ebp - 0xb5], 0
jne 0x4afaf8
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
imul ecx, dword [ebp - 4], 0x651
mov ebx, dword [0x61a904]
lea esi, [edx + eax*2]
lea edi, [ebx + ecx*2]
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0xaa8]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0xaa8]
lea eax, [ebp - 0xaa4]
mov edx, 0x4b6c50
call fcn.00405414
mov eax, dword [ebp - 0xaa4]
call fcn.0049839c
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004af0a4
lea edx, [ebp - 0xab0]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0xab0]
lea eax, [ebp - 0xaac]
mov edx, 0x4b6c64
call fcn.00405414
mov eax, dword [ebp - 0xaac]
call fcn.0049839c
mov byte [ebp - 0xb6], 0
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 4]
cmp byte [eax + edx], 0
jne 0x4afba9
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61a818]
add edx, eax
mov eax, 0x4b6c00
call fcn.00402c78
test eax, eax
jle 0x4afbd7
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61a818]
add edx, eax
mov eax, 0x4b6c70
call fcn.00402c78
test eax, eax
jle 0x4afbd7
imul eax, dword [ebp - 4], 0xaa4
mov edx, dword [0x61a9e0]
cmp byte [edx + eax*8], 4
jbe 0x4afbd7
imul eax, dword [ebp - 4], 0xaa4
mov edx, dword [0x61a9e0]
cmp byte [edx + eax*8 + 0x2f], 4
jbe 0x4afbd7
mov byte [ebp - 0xb6], 1
mov eax, dword [ebp + 8]
mov edx, 0x4b6c7c
call fcn.0040515c
lea eax, [ebp - 0x50]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0xa9c]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
imul eax, dword [ebp - 4], 0xaa4
mov edx, dword [0x61a9e0]
mov byte [edx + eax*8 + 0x19f], 0
imul eax, dword [ebp - 4], 0xaa4
mov edx, dword [0x61a9e0]
mov byte [edx + eax*8 + 0x1e6], 0
imul eax, dword [ebp - 4], 0xaa4
mov edx, dword [0x61a9e0]
mov byte [edx + eax*8 + 0x22d], 0
imul eax, dword [ebp - 4], 0xaa4
mov edx, dword [0x61a9e0]
mov byte [edx + eax*8 + 0x274], 0
xor eax, eax
mov dword [ebp - 0x90], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0xb0]
call fcn.00405108
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x2d], 0
xor eax, eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 4], 0
jl 0x4b618e
cmp dword [ebp - 4], 0xc7
jg 0x4b618e
mov eax, dword [ebp - 8]
mov byte [eax + 0xc6d], 0
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 0
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4afde2
mov dword [ebp - 0xa8], 3
mov eax, 0x4b6c88
call fcn.0048cf1c
test al, al
je 0x4afd20
cmp dword [ebp - 0x18], 0
je 0x4afd19
cmp dword [ebp - 0x18], 7
jne 0x4afd20
mov dword [ebp - 0x18], 0xc8
cmp dword [ebp - 0x2c], 0
jne 0x4afe01
mov edx, dword [ebp - 0x50]
mov eax, 0x4b6c98
call fcn.0040570c
test eax, eax
jle 0x4afd8f
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 1
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x50]
call fcn.004af4f4
push 0
push 0
push 3
push 0
mov eax, dword [ebp - 0xa8]
push eax
push 0xc0000000
lea eax, [ebp - 0xab4]
mov ecx, dword [ebp - 0x54]
mov edx, 0x4b6ca8
call fcn.00405414
mov eax, dword [ebp - 0xab4]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x2c], eax
jmp 0x4afe01
push 0
push 0
push 3
push 0
mov eax, dword [ebp - 0xa8]
push eax
push 0xc0000000
mov eax, dword [ebp - 0x18]
call fcn.00524050
lea edx, [ebp - 0xabc]
call fcn.0040a2d8
mov ecx, dword [ebp - 0xabc]
lea eax, [ebp - 0xab8]
mov edx, 0x4b6cb8
call fcn.00405414
mov eax, dword [ebp - 0xab8]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x2c], eax
jmp 0x4afe01
cmp dword [ebp - 0x2c], 0
jne 0x4afe01
push 0
push 0
push 1
push 0
push 0
push 0
push 0x4b6ccc
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x2c], eax
push 0x4b6ce4
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xac0]
call fcn.0040a3c4
push dword [ebp - 0xac0]
push 0x4b6cf0
mov eax, dword [ebp + 8]
mov edx, 3
call fcn.00405488
lea eax, [ebp - 0xac4]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0xac4]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0xac4]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp byte [0x613934], 2
jae 0x4afeb3
cmp dword [ebp - 4], 1
jne 0x4afeb3
cmp dword [ebp - 0x2c], 0xffffffff
je 0x4afeb3
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebp - 0x2c], 0xffffffff
cmp dword [ebp - 0x2c], 0xffffffff
je 0x4b5d17
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b0833
mov edx, dword [ebp - 0x50]
mov eax, 0x4b6c98
call fcn.0040570c
test eax, eax
jg 0x4b1dac
mov eax, dword [ebp - 4]
cmp byte [eax + 0x638f70], 0xff
sete byte [ebp - 0x92]
lea eax, [ebp - 0xac8]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x50]
call fcn.00405628
mov eax, dword [ebp - 0xac8]
mov edx, 0x4b6cfc
call fcn.00405514
je 0x4aff23
mov byte [ebp - 0x92], 1
push 0x4b6d0c
lea edx, [ebp - 0xad0]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xad0]
push 0x4b6d28
lea edx, [ebp - 0xad4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x638f70]
call fcn.0040a2d8
push dword [ebp - 0xad4]
push 0x4b6d34
mov al, byte [ebp - 0x92]
call fcn.0048e914
mov edx, eax
lea eax, [ebp - 0xad8]
call fcn.004052f0
push dword [ebp - 0xad8]
lea eax, [ebp - 0xacc]
mov edx, 6
call fcn.00405488
mov eax, dword [ebp - 0xacc]
call fcn.0049839c
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 0xfe
mov dword [ebp - 0x9c], 1
xor eax, eax
push ebp
push 0x4b008d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x639690], 0
je 0x4b0083
mov eax, 0x4b6d44
call fcn.0049839c
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call dword [0x639690]
mov byte [ebp - 0x94], al
push 0x4b6d5c
mov al, byte [ebp - 0x94]
call fcn.0048e914
mov edx, eax
lea eax, [ebp - 0xae0]
call fcn.004052f0
push dword [ebp - 0xae0]
push 0x4b6d74
mov eax, dword [ebp - 0x9c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xae4]
call fcn.0040a3c4
push dword [ebp - 0xae4]
lea eax, [ebp - 0xadc]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0xadc]
call fcn.0049839c
cmp byte [ebp - 0x94], 0
je 0x4b0083
cmp dword [ebp - 0x9c], 0
je 0x4b0066
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
jmp 0x4b0083
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 0
call fcn.00528b50
test al, al
je 0x4b0083
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b00a1
mov eax, 0x4b6d80
call fcn.0048cf1c
test al, al
je 0x4b0135
lea edx, [ebp - 0xaec]
xor eax, eax
call fcn.0048f87c
mov eax, dword [ebp - 0xaec]
lea ecx, [ebp - 0xae8]
mov edx, 0x4b6d90
call fcn.0048cc9c
mov eax, dword [ebp - 0xae8]
push eax
push 0x4b6da4
lea edx, [ebp - 0xaf4]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xaf4]
push 0x4b6d28
lea edx, [ebp - 0xaf8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x638f70]
call fcn.0040a2d8
push dword [ebp - 0xaf8]
lea eax, [ebp - 0xaf0]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0xaf0]
or ecx, 0xffffffff
pop edx
call fcn.004980a8
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax], 0
je 0x4b020f
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax + 4], 1
jb 0x4b020f
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax + 4], 3
ja 0x4b020f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x638f70], 0
jne 0x4b020f
cmp byte [0x61393c], 0
jne 0x4b020f
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
mov eax, 0x4b6d80
call fcn.0048cf1c
test al, al
je 0x4b020f
lea edx, [ebp - 0xb00]
xor eax, eax
call fcn.0048f87c
mov eax, dword [ebp - 0xb00]
lea ecx, [ebp - 0xafc]
mov edx, 0x4b6d90
call fcn.0048cc9c
mov eax, dword [ebp - 0xafc]
push eax
lea edx, [ebp - 0xb08]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb04]
mov edx, 0x4b6dc0
call fcn.00405414
mov eax, dword [ebp - 0xb04]
or ecx, 0xffffffff
pop edx
call fcn.004980a8
push 0x4b6de0
lea edx, [ebp - 0xb10]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xb10]
push 0x4b6d28
lea edx, [ebp - 0xb14]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x638f70]
call fcn.0040a2d8
push dword [ebp - 0xb14]
lea eax, [ebp - 0xb0c]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0xb0c]
call fcn.0049839c
push 0x4b6df8
lea edx, [ebp - 0xb1c]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xb1c]
push 0x4b6df8
lea eax, [ebp - 0xb18]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0xb18]
mov edx, dword [0x613940]
call fcn.0040570c
test eax, eax
jle 0x4b02b0
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
mov edx, dword [eax + edx*4]
mov eax, 0x4b6e04
call fcn.0040570c
test eax, eax
jle 0x4b02d3
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x638f70], 1
jne 0x4b0573
mov eax, 0x4b6e1c
call fcn.0049839c
mov cl, byte [ebp - 0xb6]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004bdbe4
mov edx, dword [0x61b4c4]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
push 0x4b6e34
lea edx, [ebp - 0xb24]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xb24]
push 0x4b6d28
mov eax, dword [0x61b4c4]
mov edx, dword [ebp - 4]
movzx eax, byte [eax + edx]
lea edx, [ebp - 0xb28]
call fcn.0040a2d8
push dword [ebp - 0xb28]
lea eax, [ebp - 0xb20]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0xb20]
call fcn.0049839c
mov eax, dword [0x61b4c4]
mov edx, dword [ebp - 4]
cmp byte [eax + edx], 0
jne 0x4b0647
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 0
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
mov edx, dword [eax + edx*4]
mov eax, 0x4b6e4c
call fcn.0040570c
test eax, eax
jle 0x4b039f
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
mov edx, dword [eax + edx*4]
mov eax, 0x4b6e5c
call fcn.0040570c
test eax, eax
jle 0x4b03c2
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
xor eax, eax
push ebp
push 0x4b03ff
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040c8dc
fsub dword [0x4b6e68]
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fcomp qword [eax + edx*8]
fnstsw ax
sahf
jb 0x4b03f5
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0409
mov eax, dword [ebp - 4]
cmp byte [eax + 0x638f70], 0
jne 0x4b0564
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax], 0
je 0x4b0564
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax + 4], 8
jne 0x4b0564
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
push 0x4b6e74
lea edx, [ebp - 0xb30]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xb30]
push 0x4b6d28
lea edx, [ebp - 0xb34]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x638f70]
call fcn.0040a2d8
push dword [ebp - 0xb34]
lea eax, [ebp - 0xb2c]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0xb2c]
call fcn.0049839c
mov eax, 0x4b6d80
call fcn.0048cf1c
test al, al
je 0x4b0564
lea edx, [ebp - 0xb3c]
xor eax, eax
call fcn.0048f87c
mov eax, dword [ebp - 0xb3c]
lea ecx, [ebp - 0xb38]
mov edx, 0x4b6d90
call fcn.0048cc9c
mov eax, dword [ebp - 0xb38]
push eax
push 0x4b6e8c
lea edx, [ebp - 0xb44]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xb44]
push 0x4b6ea4
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
movzx eax, byte [edx + eax + 4]
lea edx, [ebp - 0xb48]
call fcn.0040a2d8
push dword [ebp - 0xb48]
push 0x4b6eb0
lea edx, [ebp - 0xb4c]
mov eax, dword [ebp - 4]
call fcn.004f4fe8
push dword [ebp - 0xb4c]
lea eax, [ebp - 0xb40]
mov edx, 6
call fcn.00405488
mov eax, dword [ebp - 0xb40]
or ecx, 0xffffffff
pop edx
call fcn.004980a8
mov eax, 0x4b6ec0
call fcn.0049839c
jmp 0x4b0647
mov eax, 0x4b6ed8
call fcn.00492b74
test al, al
je 0x4b0647
mov eax, 0x4b6eec
call fcn.0049839c
mov cl, byte [ebp - 0xb6]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004bdbe4
mov edx, dword [0x61b4c4]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
push 0x4b6f04
lea edx, [ebp - 0xb54]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xb54]
push 0x4b6d28
mov eax, dword [0x61b4c4]
mov edx, dword [ebp - 4]
movzx eax, byte [eax + edx]
lea edx, [ebp - 0xb58]
call fcn.0040a2d8
push dword [ebp - 0xb58]
lea eax, [ebp - 0xb50]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0xb50]
call fcn.0049839c
mov eax, dword [0x61b4c4]
mov edx, dword [ebp - 4]
cmp byte [eax + edx], 2
jne 0x4b0624
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
mov eax, 0x4b6f1c
call fcn.0049839c
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
mov edx, dword [eax + edx*4]
mov eax, 0x4b6e4c
call fcn.0040570c
test eax, eax
jle 0x4b0647
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x638f70], 0
jne 0x4b0820
mov eax, dword [ebp - 4]
fld qword [eax*8 + 0x639038]
fcomp dword [0x4b6f2c]
fnstsw ax
sahf
jne 0x4b067c
call fcn.0040c8dc
mov eax, dword [ebp - 4]
fstp qword [eax*8 + 0x639038]
wait
mov eax, 0x4b6d80
call fcn.0048cf1c
test al, al
je 0x4b06e7
lea edx, [ebp - 0xb60]
xor eax, eax
call fcn.0048f87c
mov eax, dword [ebp - 0xb60]
lea ecx, [ebp - 0xb5c]
mov edx, 0x4b6d90
call fcn.0048cc9c
mov eax, dword [ebp - 0xb5c]
push eax
lea edx, [ebp - 0xb68]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0xb68]
lea eax, [ebp - 0xb64]
mov edx, 0x4b6f38
call fcn.00405414
mov eax, dword [ebp - 0xb64]
or ecx, 0xffffffff
pop edx
call fcn.004980a8
mov byte [ebp - 0x2f], 0
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 4]
cmp byte [eax + edx], 0
je 0x4b073f
imul eax, dword [ebp - 4], 0xaa4
mov edx, dword [0x61a9e0]
cmp byte [edx + eax*8], 0
je 0x4b0764
lea eax, [ebp - 0xb6c]
imul edx, dword [ebp - 4], 0xaa4
mov ecx, dword [0x61a9e0]
lea edx, [ecx + edx*8 + 0x300]
mov ecx, 0x2711
call fcn.00405378
cmp dword [ebp - 0xb6c], 0
je 0x4b0764
mov byte [ebp - 0x2f], 1
jmp 0x4b0764
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
cmp byte [edx + eax*2], 0
je 0x4b0764
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
cmp dword [eax + edx*4], 0
je 0x4b0764
mov byte [ebp - 0x2f], 1
cmp byte [ebp - 0x92], 0
je 0x4b07dc
mov eax, 0x4b6d80
call fcn.0048cf1c
test al, al
je 0x4b07d8
lea edx, [ebp - 0xb74]
xor eax, eax
call fcn.0048f87c
mov eax, dword [ebp - 0xb74]
lea ecx, [ebp - 0xb70]
mov edx, 0x4b6d90
call fcn.0048cc9c
mov eax, dword [ebp - 0xb70]
push eax
lea edx, [ebp - 0xb7c]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0xb7c]
lea eax, [ebp - 0xb78]
mov edx, 0x4b6f50
call fcn.00405414
mov eax, dword [ebp - 0xb78]
or ecx, 0xffffffff
pop edx
call fcn.004980a8
mov byte [ebp - 0x2f], 0
cmp byte [ebp - 0x2f], 0
je 0x4b0820
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0xa9c]
mov edx, dword [ebp - 0x50]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
jmp 0x4af8ba
cmp byte [ebp - 0x92], 0
je 0x4b0833
mov eax, dword [ebp - 4]
mov byte [eax + 0x638f70], 1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax*8 + 0x639038], edx
mov dword [eax*8 + 0x63903c], edx
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
call fcn.00500678
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 4]
cmp byte [eax + edx], 0
jne 0x4b09ec
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
call fcn.004053c8
cmp eax, 0x1f4
jl 0x4b09ec
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 4]
call fcn.00526b90
test al, al
je 0x4b09ec
lea eax, [ebp - 0xb84]
mov edx, 0x61394c
call fcn.0040536c
mov eax, dword [ebp - 0xb84]
lea edx, [ebp - 0xb80]
call fcn.0048d278
mov eax, dword [ebp - 0xb80]
mov edx, 0x4b6f6c
call fcn.00405514
je 0x4b09ec
mov eax, dword [ebp - 4]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x61b0f0]
cmp byte [edx + eax*8 + 0x4e], 0
je 0x4b09ec
lea eax, [ebp - 0xb88]
call fcn.0048ee6c
mov eax, dword [ebp - 0xb88]
mov edx, 0x4b6f78
call fcn.00405514
jb 0x4b09ec
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004bfbb0
test eax, eax
jne 0x4b09ec
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.005287b0
mov dword [ebp - 0x88], eax
push 0x4b6f84
lea edx, [ebp - 0xb90]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xb90]
push 0x4b6d74
push dword [ebp - 0x64]
push 0x4b6f98
lea edx, [ebp - 0xb94]
mov eax, dword [ebp - 0x88]
call fcn.0040a2d8
push dword [ebp - 0xb94]
lea eax, [ebp - 0xb8c]
mov edx, 6
call fcn.00405488
mov edx, dword [ebp - 0xb8c]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
mov eax, 0x613a48
mov cl, 0xfa
call fcn.004032c8
mov edx, 0x4b6f9c
lea eax, [ebp - 0xc98]
call fcn.004032bc
mov edx, 0x613a48
lea eax, [ebp - 0xc98]
mov cl, 0xfe
call fcn.0040328c
lea edx, [ebp - 0xc98]
lea eax, [ebp - 0xb98]
call fcn.0040536c
mov eax, dword [ebp - 0xb98]
call fcn.0049839c
cmp dword [ebp - 0x88], 1
jl 0x4b09ec
mov eax, dword [ebp - 4]
mov byte [eax + 0x639698], 1
mov eax, dword [ebp - 4]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x61b0f0]
cmp dword [edx + eax*8 + 8], 0x100
jne 0x4b0a26
mov edx, dword [ebp - 0x50]
mov eax, 0x4b6fac
call fcn.0040570c
test eax, eax
jle 0x4b0a26
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x50]
call fcn.0040515c
jmp 0x4b52b8
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b0e0d
mov eax, dword [ebp - 0x2c]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00524050
mov ecx, eax
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 4]
call fcn.004ef5cc
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jl 0x4b0c6e
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0xd10]
call fcn.004032bc
mov edx, 0x4b6fb4
lea eax, [ebp - 0xd10]
mov cl, 0x6d
call fcn.0040328c
lea edx, [ebp - 0xd10]
lea eax, [ebp - 0xca0]
call fcn.0040536c
push dword [ebp - 0xca0]
lea edx, [ebp - 0xd14]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0xd14]
push 0x4b6fc8
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0xd18]
call fcn.0040a3c4
push dword [ebp - 0xd18]
lea eax, [ebp - 0xc9c]
mov edx, 4
call fcn.00405488
mov edx, dword [ebp - 0xc9c]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
mov edx, 0x4b6fcc
lea eax, [ebp - 0xda4]
call fcn.004032bc
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0xda4]
mov cl, 0x89
call fcn.0040328c
lea edx, [ebp - 0xda4]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
call fcn.00405108
mov eax, 0x4b6fdc
call fcn.0048cf1c
test al, al
je 0x4b0c56
push 0x4b6fec
lea edx, [ebp - 0xdac]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xdac]
push 0x4b7000
mov eax, dword [ebp - 4]
call fcn.00524050
lea edx, [ebp - 0xdb0]
call fcn.0040a2d8
push dword [ebp - 0xdb0]
push 0x4b7010
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xdb4]
call fcn.0040a3c4
push dword [ebp - 0xdb4]
push 0x4b7024
lea eax, [ebp - 0xdb8]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0xdb8]
lea eax, [ebp - 0xda8]
mov edx, 8
call fcn.00405488
mov eax, dword [ebp - 0xda8]
mov dl, 1
call fcn.004e5d18
cmp dword [ebp - 0x2c], 0xffffffff
je 0x4b618e
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4b618e
cmp dword [ebp - 0x84], 0
jne 0x4b0e0d
mov eax, dword [0x61ac04]
cmp dword [eax], 0
jg 0x4b0c97
lea eax, [ebp - 0x44]
mov edx, 0x4b7034
call fcn.004051a0
jmp 0x4b1dac
imul eax, dword [ebp - 4], 0xaa4
mov edx, dword [0x61a9e0]
lea edx, [edx + eax*8]
mov eax, 0x4b7040
call fcn.00402c78
test eax, eax
jle 0x4b0cc7
lea eax, [ebp - 0x44]
mov edx, 0x4b7034
call fcn.004051a0
jmp 0x4b1dac
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
lea eax, [edx + eax]
mov edx, 0x4b7048
mov cl, 0x64
call fcn.0040328c
mov edx, 0x4b7058
lea eax, [ebp - 0xe4c]
call fcn.004032bc
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0xe4c]
mov cl, 0x92
call fcn.0040328c
lea edx, [ebp - 0xe4c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
mov edx, 0x4b7074
call fcn.0040515c
mov eax, 0x4b6fdc
call fcn.0048cf1c
test al, al
je 0x4b0dff
push 0x4b6fec
lea edx, [ebp - 0xe54]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xe54]
push 0x4b7000
mov eax, dword [ebp - 4]
call fcn.00524050
lea edx, [ebp - 0xe58]
call fcn.0040a2d8
push dword [ebp - 0xe58]
push 0x4b7010
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xe5c]
call fcn.0040a3c4
push dword [ebp - 0xe5c]
push 0x4b7090
lea eax, [ebp - 0xe60]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0xe60]
lea eax, [ebp - 0xe50]
mov edx, 8
call fcn.00405488
mov eax, dword [ebp - 0xe50]
mov dl, 1
call fcn.004e5d18
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4b618e
mov edx, dword [ebp - 0x50]
mov eax, 0x4b70a4
call fcn.0040570c
test eax, eax
jle 0x4b10a5
push dword [ebp - 0x50]
push 0x4b70b4
lea edx, [ebp - 0xe68]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xe68]
push 0x4b7000
mov eax, dword [ebp - 4]
call fcn.00524050
lea edx, [ebp - 0xe6c]
call fcn.0040a2d8
push dword [ebp - 0xe6c]
push 0x4b70c4
lea eax, [ebp - 0xe70]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0xe70]
lea eax, [ebp - 0xe64]
mov edx, 7
call fcn.00405488
mov eax, dword [ebp - 0xe64]
call fcn.0049839c
push 0
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea edx, [edx + eax*2]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0052bbcc
test eax, eax
jle 0x4b10a5
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0xee4]
call fcn.004032bc
mov edx, 0x4b70cc
lea eax, [ebp - 0xee4]
mov cl, 0x69
call fcn.0040328c
lea edx, [ebp - 0xee4]
lea eax, [ebp - 0xe78]
call fcn.0040536c
push dword [ebp - 0xe78]
lea edx, [ebp - 0xee8]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0xee8]
push 0x4b6fc8
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0xeec]
call fcn.0040a3c4
push dword [ebp - 0xeec]
lea eax, [ebp - 0xe74]
mov edx, 4
call fcn.00405488
mov edx, dword [ebp - 0xe74]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
mov edx, dword [ebp - 0x50]
mov eax, 0x4b70dc
call fcn.0040570c
test eax, eax
jne 0x4b0fda
push 0
lea eax, [ebp - 0x50]
mov ecx, 0x4b70f0
mov edx, 0x4b70a4
call fcn.0048d458
lea eax, [ebp - 0xa9c]
mov edx, dword [ebp - 0x50]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
call fcn.00405108
push dword [ebp - 0x50]
push 0x4b70b4
lea edx, [ebp - 0xef4]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0xef4]
push 0x4b7000
mov eax, dword [ebp - 4]
call fcn.00524050
lea edx, [ebp - 0xef8]
call fcn.0040a2d8
push dword [ebp - 0xef8]
push 0x4b70c4
lea eax, [ebp - 0xefc]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0xefc]
lea eax, [ebp - 0xef0]
mov edx, 7
call fcn.00405488
mov eax, dword [ebp - 0xef0]
call fcn.0049839c
cmp dword [ebp - 0x2c], 0xffffffff
je 0x4b618e
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4b618e
lea eax, [ebp - 0xec]
xor ecx, ecx
mov edx, 0x20
call fcn.0040345c
lea eax, [ebp - 0x2fc]
xor ecx, ecx
mov edx, 0x210
call fcn.0040345c
mov dword [ebp - 0xec], 0x200
mov byte [ebp - 0xe7], 1
mov byte [ebp - 0xe6], 1
mov byte [ebp - 0xe2], 0xec
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b110d
mov al, byte [ebp - 0x18]
and al, 1
shl eax, 4
or al, 0xa0
mov byte [ebp - 0xe3], al
mov al, byte [ebp - 0x18]
mov byte [ebp - 0xe0], al
jmp 0x4b1133
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abc]
mov byte [ebp - 0xe3], al
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abe]
mov byte [ebp - 0xe0], al
mov dword [ebp - 0x2fc], 0x210
lea edx, [ebp - 0xf04]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0xf04]
lea eax, [ebp - 0xf00]
mov edx, 0x4b7104
call fcn.00405414
mov eax, dword [ebp - 0xf00]
call fcn.0049839c
push 0
lea eax, [ebp - 0x28]
push eax
push 0x210
lea eax, [ebp - 0x2fc]
push eax
push 0x20
lea eax, [ebp - 0xec]
push eax
push 0x7c088
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x2f], al
cmp byte [ebp - 0x2f], 0
je 0x4b11b5
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004c0478
dec eax
jne 0x4b11b5
mov byte [ebp - 0x2f], 0
cmp byte [ebp - 0x2f], 0
je 0x4b11d3
lea eax, [ebp - 0x2ec]
mov edx, 0x1ff
call fcn.0052cd9c
test al, al
je 0x4b11d3
mov byte [ebp - 0x2f], 0
mov eax, 0x4b7120
call fcn.0048cf1c
test al, al
je 0x4b11eb
cmp dword [ebp - 4], 3
jg 0x4b11eb
mov byte [ebp - 0x2f], 0
mov eax, 0x4b7130
call fcn.0048cf1c
test al, al
je 0x4b1203
cmp dword [ebp - 4], 0xa
jg 0x4b1203
mov byte [ebp - 0x2f], 0
mov eax, 0x4b7140
call fcn.0048cf1c
test al, al
je 0x4b121e
cmp dword [ebp - 4], 0x96
jg 0x4b121e
mov byte [ebp - 0x2f], 0
mov eax, 0x4b7150
call fcn.0048cf1c
test al, al
je 0x4b1236
cmp dword [ebp - 4], 0xf
jg 0x4b1236
mov byte [ebp - 0x2f], 0
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b715c
mov cl, 0x82
call fcn.0040328c
cmp byte [ebp - 0x2f], 0
je 0x4b1276
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b7164
mov cl, 0x82
call fcn.0040328c
jmp 0x4b1292
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b7168
mov cl, 0x82
call fcn.0040328c
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0xf94]
call fcn.004032bc
mov edx, 0x4b716c
lea eax, [ebp - 0xf94]
mov cl, 0x86
call fcn.0040328c
lea edx, [ebp - 0xf94]
lea eax, [ebp - 0xf0c]
call fcn.0040536c
push dword [ebp - 0xf0c]
lea edx, [ebp - 0xf98]
xor eax, eax
mov al, byte [ebp - 0x2f8]
call fcn.0040a2d8
push dword [ebp - 0xf98]
push 0x4b717c
lea edx, [ebp - 0xf9c]
xor eax, eax
mov al, byte [ebp - 0x2f7]
call fcn.0040a2d8
push dword [ebp - 0xf9c]
push 0x4b6d74
lea eax, [ebp - 0xf08]
mov edx, 5
call fcn.00405488
mov edx, dword [ebp - 0xf08]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov edx, 0x4b7184
lea eax, [ebp - 0x1028]
call fcn.004032bc
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x1028]
mov cl, 0x85
call fcn.0040328c
lea edx, [ebp - 0x1028]
lea eax, [ebp - 0xfa0]
call fcn.0040536c
mov eax, dword [ebp - 0xfa0]
call fcn.0049839c
mov eax, dword [0x61ab90]
cmp byte [eax], 0
je 0x4b1415
push 0x200
push 0x4b7190
lea edx, [ebp - 0x1034]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0x1034]
push 0x4b719c
lea eax, [ebp - 0x1030]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x1030]
push eax
lea edx, [ebp - 0x1038]
xor eax, eax
call fcn.0048f87c
mov eax, dword [ebp - 0x1038]
lea ecx, [ebp - 0x102c]
pop edx
call fcn.0048cc9c
mov eax, dword [ebp - 0x102c]
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
call fcn.0048f4ac
cmp byte [ebp - 0x2f7], 1
jne 0x4b1479
lea eax, [ebp - 0x54]
call fcn.00405108
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp byte [ebp + eax - 0x2ec], 0
je 0x4b1445
lea eax, [ebp - 0x54]
mov edx, 0x4b71ac
call fcn.004053d0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x10
jne 0x4b142b
mov eax, dword [ebp - 0x54]
call fcn.004053c8
dec eax
jg 0x4b1479
mov byte [ebp - 0x2f], 0
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b71b0
mov cl, 0x82
call fcn.0040328c
mov eax, 0x4b71c0
call fcn.0048cf1c
test al, al
je 0x4b14a4
cmp dword [ebp - 4], 1
jne 0x4b14a4
push 0
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
mov eax, 0x4b71d8
call fcn.004bc154
mov eax, 0x4b71e4
call fcn.0048cf1c
test al, al
je 0x4b14b6
mov byte [ebp - 0x2f], 0
lea eax, [ebp - 0x2ec]
mov edx, 0x200
call fcn.004ff11c
test al, al
jne 0x4b14ce
mov byte [ebp - 0x2f], 0
cmp byte [ebp - 0x2f], 0
je 0x4b1593
mov dword [ebp - 0x1c], 0x14
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0x80
jb 0x4b151e
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ed], 0x20
jne 0x4b151e
cmp dword [ebp - 0x1c], 0x20
jl 0x4b151e
mov eax, dword [ebp - 0x1c]
cmp eax, 0x27
jg 0x4b151e
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x2ec], 0x20
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x28
jne 0x4b150a
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0
je 0x4b1538
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0x1f
ja 0x4b1559
mov eax, dword [ebp - 0x1c]
cmp eax, 0x27
jg 0x4b1593
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x2ec], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x28
jne 0x4b1543
jmp 0x4b1593
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0
je 0x4b1586
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0x20
jb 0x4b1580
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0x7f
jbe 0x4b1586
mov byte [ebp - 0x2f], 0
jmp 0x4b1593
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x28
jne 0x4b14df
cmp byte [ebp - 0x2f], 0
je 0x4b15ed
mov dword [ebp - 0x1c], 0x2e
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0
je 0x4b15e4
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0x20
jb 0x4b15c7
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0x7f
jbe 0x4b15e4
mov byte [ebp - 0x2f], 0
lea eax, [ebp - 0x2f]
push eax
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
mov eax, dword [ebp - 4]
call fcn.004fedf8
jmp 0x4b15ed
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x36
jne 0x4b15a0
cmp byte [ebp - 0x2f], 0
je 0x4b165e
mov dword [ebp - 0x1c], 0x36
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0
jne 0x4b1628
mov eax, dword [ebp - 0x1c]
cmp eax, 0x5d
jg 0x4b165e
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x2ec], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x5e
jne 0x4b1612
jmp 0x4b165e
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0
je 0x4b1655
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0x20
jb 0x4b164f
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0x7f
jbe 0x4b1655
mov byte [ebp - 0x2f], 0
jmp 0x4b165e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x5e
jne 0x4b15fa
cmp byte [ebp - 0x2f], 0
je 0x4b172d
lea eax, [ebp - 0x54]
call fcn.00405108
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x14
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0
jne 0x4b168e
inc dword [ebp - 0x20]
jmp 0x4b16b1
lea eax, [ebp - 0x103c]
mov edx, dword [ebp - 0x1c]
mov dl, byte [ebp + edx - 0x2ec]
call fcn.004052f0
mov edx, dword [ebp - 0x103c]
lea eax, [ebp - 0x54]
call fcn.004053d0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x28
jne 0x4b167c
lea edx, [ebp - 0x1040]
mov eax, dword [ebp - 0x54]
call fcn.00409de4
mov eax, dword [ebp - 0x1040]
call fcn.004053c8
cmp eax, 5
jge 0x4b16ed
mov edx, dword [ebp - 0x54]
mov eax, 0x4b71f4
call fcn.0040570c
test eax, eax
jne 0x4b16ed
mov byte [ebp - 0x2f], 0
lea edx, [ebp - 0x1044]
mov eax, dword [ebp - 0x54]
call fcn.00409de4
mov eax, dword [ebp - 0x1044]
call fcn.004053c8
cmp eax, dword [ebp - 0x20]
jge 0x4b172d
lea edx, [ebp - 0x1048]
mov eax, dword [ebp - 0x54]
call fcn.00409de4
mov eax, dword [ebp - 0x1048]
call fcn.004053c8
cmp eax, 7
jge 0x4b172d
mov byte [ebp - 0x2f], 0
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x54]
call fcn.004051a0
cmp byte [ebp - 0x2f], 0
je 0x4b17d2
lea eax, [ebp - 0x54]
call fcn.00405108
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x2e
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax - 0x2ec], 0
jne 0x4b1768
inc dword [ebp - 0x20]
jmp 0x4b178b
lea eax, [ebp - 0x104c]
mov edx, dword [ebp - 0x1c]
mov dl, byte [ebp + edx - 0x2ec]
call fcn.004052f0
mov edx, dword [ebp - 0x104c]
lea eax, [ebp - 0x54]
call fcn.004053d0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x5e
jne 0x4b1756
lea edx, [ebp - 0x1050]
mov eax, dword [ebp - 0x54]
call fcn.00409de4
mov edx, dword [ebp - 0x1050]
lea eax, [ebp - 0x54]
call fcn.004051a0
mov eax, dword [ebp - 0x54]
call fcn.004053c8
cmp eax, 5
jge 0x4b17c1
mov byte [ebp - 0x2f], 0
mov eax, dword [ebp - 0x54]
call fcn.004053c8
cmp eax, dword [ebp - 0x20]
jge 0x4b17d2
mov byte [ebp - 0x2f], 0
cmp byte [ebp - 0x2f], 0
je 0x4b1881
push 0x4b7208
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [ebp - 0x54]
call fcn.004053c8
mov ecx, eax
mov edx, 9
mov eax, dword [ebp - 0x54]
call fcn.00405628
mov eax, dword [ebp - 0x105c]
lea edx, [ebp - 0x1058]
call fcn.0048f554
push dword [ebp - 0x1058]
push 0x4b7224
lea eax, [ebp - 0x1064]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 0x54]
call fcn.00405628
mov eax, dword [ebp - 0x1064]
lea edx, [ebp - 0x1060]
call fcn.0048f554
push dword [ebp - 0x1060]
push 0x4b7234
lea edx, [ebp - 0x1068]
mov eax, dword [ebp - 0x40]
call fcn.0048f554
push dword [ebp - 0x1068]
lea eax, [ebp - 0x1054]
mov edx, 6
call fcn.00405488
mov eax, dword [ebp - 0x1054]
call fcn.0049839c
jmp 0x4b18a5
push 0x200
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
mov eax, 0x4b7244
call fcn.00498430
mov eax, 0x4b7260
call fcn.0049839c
mov edx, dword [ebp - 0x54]
mov eax, 0x4b727c
call fcn.0040570c
test eax, eax
jle 0x4b18ba
mov byte [ebp - 0x2f], 0
lea eax, [ebp - 0x2ec]
mov ecx, 0x200
mov edx, 0x1ff
call fcn.004d864c
test al, al
je 0x4b1918
lea eax, [ebp - 0x106c]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 0x54]
call fcn.00405628
mov edx, dword [ebp - 0x106c]
mov eax, dword [ebp - 4]
call fcn.0052c6c8
xor eax, eax
call fcn.004d72c8
call fcn.004d86f8
test al, al
je 0x4b1914
mov dword [ebp - 0xb4], 1
mov byte [ebp - 0x2f], 0
mov edx, dword [ebp - 0x54]
mov eax, 0x4b7290
call fcn.0040570c
test eax, eax
jle 0x4b192d
mov byte [ebp - 0x2f], 0
mov edx, dword [ebp - 0x54]
mov eax, 0x4b72a0
call fcn.0040570c
test eax, eax
jle 0x4b1942
mov byte [ebp - 0x2f], 0
mov edx, dword [ebp - 0x54]
mov eax, 0x4b72b0
call fcn.0040570c
test eax, eax
jle 0x4b1957
mov byte [ebp - 0x2f], 0
mov edx, dword [ebp - 0x54]
mov eax, 0x4b72c0
call fcn.0040570c
test eax, eax
jle 0x4b196c
mov byte [ebp - 0x2f], 0
cmp dword [ebp - 4], 7
jl 0x4b1a47
lea edx, [ebp - 0x1074]
mov eax, dword [ebp - 0x40]
call fcn.0048f554
mov eax, dword [ebp - 0x1074]
lea edx, [ebp - 0x1070]
call fcn.00409b94
mov edx, dword [ebp - 0x1070]
mov eax, 0x4b72d0
call fcn.0040570c
test eax, eax
jle 0x4b1a47
push 0x4b72e8
lea edx, [ebp - 0x107c]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0x107c]
push 0x4b72fc
lea edx, [ebp - 0x1080]
mov eax, dword [ebp - 0x40]
call fcn.0048f554
push dword [ebp - 0x1080]
lea eax, [ebp - 0x1078]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0x1078]
call fcn.0049839c
mov eax, dword [ebp - 0x2c]
call fcn.00525d98
mov dword [ebp - 0x88], eax
lea edx, [ebp - 0x1088]
mov eax, dword [ebp - 0x88]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x1088]
lea eax, [ebp - 0x1084]
mov edx, 0x4b7308
call fcn.00405414
mov eax, dword [ebp - 0x1084]
call fcn.0049839c
cmp dword [ebp - 0x88], 7
jne 0x4b1a47
mov byte [ebp - 0x2f], 0
cmp byte [ebp - 0x2f], 0
jne 0x4b2d68
lea eax, [ebp - 0x1090]
imul edx, dword [ebp - 0x18], 0x65
mov ecx, dword [0x61a818]
lea edx, [ecx + edx]
call fcn.0040536c
mov eax, dword [ebp - 0x1090]
lea edx, [ebp - 0x108c]
call fcn.00409b94
mov edx, dword [ebp - 0x108c]
mov eax, 0x4b731c
call fcn.0040570c
test eax, eax
jg 0x4b1a9c
mov eax, dword [0x61a92c]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4], 0
jl 0x4b1ab1
mov eax, dword [ebp + 8]
mov edx, 0x4b6d74
call fcn.004053d0
mov eax, dword [ebp + 8]
jmp 0x4b1dac
mov eax, dword [ebp - 0x2f8]
mov dword [0x639684], eax
mov eax, dword [ebp - 0x2f4]
mov dword [0x639688], eax
mov eax, dword [ebp - 0x2f0]
mov dword [0x63968c], eax
cmp dword [ebp + 0xc], 0
jle 0x4b1ca3
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp + 0xc]
jge 0x4b1ca3
inc dword [ebp - 0x90]
lea edx, [ebp - 0x1098]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x1098]
lea eax, [ebp - 0x1094]
mov edx, 0x4b7328
call fcn.00405414
mov eax, dword [ebp - 0x1094]
call fcn.0049839c
mov eax, dword [0x61aedc]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_Sleep_1
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x110c]
call fcn.004032bc
mov edx, 0x4b7338
lea eax, [ebp - 0x110c]
mov cl, 0x6b
call fcn.0040328c
lea edx, [ebp - 0x110c]
lea eax, [ebp - 0x10a0]
call fcn.0040536c
push dword [ebp - 0x10a0]
lea edx, [ebp - 0x1110]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0x1110]
push 0x4b6fc8
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x1114]
call fcn.0040a3c4
push dword [ebp - 0x1114]
lea eax, [ebp - 0x109c]
mov edx, 4
call fcn.00405488
mov edx, dword [ebp - 0x109c]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
call fcn.0040c8dc
fstp qword [ebp - 0x78]
wait
imul eax, dword [ebp - 4], 0xc9
lea edx, [eax + 0x62dd4c]
lea eax, [ebp - 0x11e8]
call fcn.004032bc
mov edx, 0x4b7340
lea eax, [ebp - 0x11e8]
mov cl, 0xcb
call fcn.0040328c
lea edx, [ebp - 0x11e8]
lea eax, [ebp - 0x111c]
call fcn.0040536c
push dword [ebp - 0x111c]
lea edx, [ebp - 0x11ec]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0x11ec]
push 0x4b6d74
lea eax, [ebp - 0x1118]
mov edx, 3
call fcn.00405488
mov edx, dword [ebp - 0x1118]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0xc9
add eax, 0x62dd4c
mov cl, 0xc8
call fcn.004032c8
jmp 0x4b10a5
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
cmp dword [eax + edx*4], 0
je 0x4b1dac
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61a904]
imul ecx, dword [ebp - 4], 0x651
mov ebx, dword [0x61ae8c]
lea esi, [edx + eax*2]
lea edi, [ebx + ecx*2]
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea edi, [edx + eax*2 + 0xc2b]
mov esi, 0x4b7344
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov byte [edx + eax*2 + 0xc6d], 0
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea esi, [edx + eax*2]
mov edi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 4]
mov byte [eax + edx], 0
mov edx, 0x4b734c
lea eax, [ebp - 0x127c]
call fcn.004032bc
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x127c]
mov cl, 0x8e
call fcn.0040328c
lea edx, [ebp - 0x127c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
call fcn.00405108
jmp 0x4b68ec
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b2c4c
cmp byte [0x613944], 0
je 0x4b2af8
mov eax, dword [ebp - 0xb4]
push eax
push dword [ebp - 0x44]
push 0x4b6cb8
lea edx, [ebp - 0x1284]
mov eax, dword [ebp - 0x18]
call fcn.0040a2d8
push dword [ebp - 0x1284]
lea eax, [ebp - 0x1280]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x1280]
imul edx, dword [ebp - 0x18], 0xaa4
mov ecx, dword [0x61a9e0]
lea edx, [ecx + edx*8]
mov ecx, dword [ebp - 0x2c]
call fcn.00504378
test al, al
je 0x4b2af8
mov eax, dword [ebp - 0x18]
inc eax
mov edx, dword [0x61ac04]
cmp eax, dword [edx]
jl 0x4b1e54
mov eax, dword [ebp - 0x18]
inc eax
mov edx, dword [0x61ac04]
mov dword [edx], eax
mov eax, dword [0x61ac04]
mov eax, dword [eax]
mov edx, dword [0x61a92c]
cmp dword [edx + eax*4], 9
jne 0x4b1e54
mov eax, dword [0x61ac04]
inc dword [eax]
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
lea edx, [edx + eax*8]
mov eax, 0x4b6bb4
call fcn.00402c78
test eax, eax
jle 0x4b1f73
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
imul edx, dword [ebp - 0x18], 0xaa4
mov ecx, dword [0x61a9e0]
lea edx, [ecx + edx*8]
mov cl, 0x82
call fcn.004032c8
cmp byte [ebp - 9], 0
je 0x4b1eb4
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x12f8]
call fcn.004032bc
mov edx, 0x4b735c
lea eax, [ebp - 0x12f8]
mov cl, 0x6e
call fcn.0040328c
lea edx, [ebp - 0x12f8]
lea eax, [ebp - 0x1288]
call fcn.0040536c
lea eax, [ebp - 0x1288]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x12fc]
call fcn.0040a3c4
mov edx, dword [ebp - 0x12fc]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1288]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
mov eax, dword [ebp + 8]
mov edx, 0x4b7370
call fcn.0040515c
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 0
jmp 0x4b618e
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
add edx, eax
mov eax, 0x4b7380
call fcn.00402c78
test eax, eax
jle 0x4b20b2
mov eax, dword [ebp - 8]
mov byte [eax + 0xc6d], 0
mov al, byte [ebp - 0x18]
mov edx, dword [ebp - 8]
mov byte [edx + 0xc61], al
cmp byte [ebp - 9], 0
je 0x4b1fbe
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x12f8]
call fcn.004032bc
mov edx, 0x4b735c
lea eax, [ebp - 0x12f8]
mov cl, 0x6e
call fcn.0040328c
lea edx, [ebp - 0x12f8]
lea eax, [ebp - 0x1300]
call fcn.0040536c
lea eax, [ebp - 0x1300]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x1304]
call fcn.0040a3c4
mov edx, dword [ebp - 0x1304]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1300]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
mov eax, dword [ebp + 8]
call fcn.00405108
mov eax, dword [ebp - 8]
add eax, 0xc6d
mov edx, 0x4b6c00
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403368
je 0x4b618e
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 0
jmp 0x4b618e
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
cmp dword [edx + eax*8 + 0x174], 0
jl 0x4b28ff
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
mov eax, dword [edx + eax*8 + 0x174]
cmp eax, 0xa
ja case.default.0x4b20ea
jmp dword [eax*4 + 0x4b20f1]
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
mov dword [edx + eax], 0x41544103
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4]
mov ecx, 8
mov edx, 0x99
call fcn.00405628
mov eax, dword [ebp - 0x48]
call fcn.004053c8
test eax, eax
jle 0x4b24ed
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x88], 1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x88]
cmp byte [eax + edx - 1], 0
je 0x4b2203
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b7388
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
push ebp
push 0x4b21f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x48]
test byte [eax], 8
je 0x4b21c6
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea eax, [edx + eax]
mov edx, 0x4b7390
mov cl, 0x64
call fcn.0040328c
jmp 0x4b21e7
mov eax, dword [ebp - 0x48]
test byte [eax], 4
je 0x4b21e7
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea eax, [edx + eax]
mov edx, 0x4b7398
mov cl, 0x64
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b24ed
inc dword [ebp - 0x88]
dec dword [ebp - 0xbc]
jne 0x4b216c
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b739c
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b73b4
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b73cc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b73dc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b73f0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
cmp byte [edx + eax*8 + 0xe0], 0x53
jne 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
add edx, eax
lea eax, [ebp - 0x1370]
call fcn.004032bc
mov edx, 0x4b7404
lea eax, [ebp - 0x1370]
mov cl, 0x66
call fcn.0040328c
lea edx, [ebp - 0x1370]
lea eax, [ebp - 0x1308]
call fcn.0040536c
lea eax, [ebp - 0x1308]
push eax
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
movzx eax, byte [edx + eax*8 + 0xdf]
lea edx, [ebp - 0x1374]
call fcn.0040a2d8
mov edx, dword [ebp - 0x1374]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1308]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 0x18], 0x65
mov ecx, dword [0x61a818]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b7408
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b7420
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
call fcn.0052cc7c
test al, al
je 0x4b23c2
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea eax, [edx + eax]
mov edx, 0x4b7434
mov cl, 0x64
call fcn.0040328c
mov eax, dword [ebp - 0x18]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp word [edx + eax + 0xd], 0x51
jb 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
add edx, eax
lea eax, [ebp - 0x1370]
call fcn.004032bc
mov edx, 0x4b7438
lea eax, [ebp - 0x1370]
mov cl, 0x66
call fcn.0040328c
lea edx, [ebp - 0x1370]
lea eax, [ebp - 0x13dc]
call fcn.004032bc
lea eax, [ebp - 0x13e0]
mov edx, dword [ebp - 0x18]
mov ecx, edx
shl edx, 4
add edx, ecx
mov ecx, dword [0x61add4]
movzx edx, word [ecx + edx + 0xd]
sub edx, 0x10
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x13e0]
lea eax, [ebp - 0x13dc]
mov cl, 0x67
call fcn.0040328c
lea edx, [ebp - 0x13dc]
lea eax, [ebp - 0x144c]
call fcn.004032bc
mov edx, 0x4b743c
lea eax, [ebp - 0x144c]
mov cl, 0x68
call fcn.0040328c
lea edx, [ebp - 0x144c]
imul eax, dword [ebp - 0x18], 0x65
mov ecx, dword [0x61a818]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b7440
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b7458
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax]
mov esi, 0x4b7470
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b24ed
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
mov word [edx + eax], 0x3f01
mov eax, dword [ebp - 8]
mov byte [eax + 0xc6d], 0
mov al, byte [ebp - 0x18]
mov edx, dword [ebp - 8]
mov byte [edx + 0xc61], al
lea eax, [ebp - 0x48]
mov edx, 0x4b731c
call fcn.004051a0
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
cmp dword [edx + eax*8 + 0x174], 0xa
jne 0x4b2534
lea eax, [ebp - 0x48]
mov edx, 0x4b7484
call fcn.004051a0
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
lea edx, [edx + eax*8]
mov eax, 0x4b748c
call fcn.00402c78
dec eax
jne 0x4b2577
lea eax, [ebp - 0x48]
mov edx, 0x4b749c
call fcn.004053d0
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea eax, [edx + eax]
mov edx, 0x4b74a4
mov cl, 0x64
call fcn.0040328c
lea eax, [ebp - 0x4c]
call fcn.00405108
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
cmp dword [edx + eax*8 + 0x174], 0
jne 0x4b25c3
lea eax, [ebp - 0x48]
mov edx, 0x4b74b0
call fcn.004051a0
mov eax, dword [ebp - 4]
lea eax, [eax + eax*2]
mov edx, dword [0x61a7f4]
cmp byte [edx + eax + 1], 0xc8
jne 0x4b25c3
lea eax, [ebp - 0x48]
mov edx, 0x4b74c0
call fcn.004051a0
imul eax, dword [ebp - 0x18], 0xaa4
mov edx, dword [0x61a9e0]
cmp dword [edx + eax*8 + 0x174], 9
jne 0x4b25e7
lea eax, [ebp - 0x4c]
mov edx, 0x4b74d4
call fcn.004051a0
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
mov eax, 0x4b74dc
call fcn.00402c78
test eax, eax
jle 0x4b2678
push dword [ebp - 0x4c]
push 0x4b6d74
lea eax, [ebp - 0x98c]
push eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
mov eax, 0x4b74dc
call fcn.00402c78
mov edx, eax
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
movzx ecx, byte [ecx + eax]
imul eax, dword [ebp - 4], 0x83
mov ebx, dword [0x61af88]
lea eax, [ebx + eax]
call fcn.004029cc
lea edx, [ebp - 0x98c]
lea eax, [ebp - 0x1450]
call fcn.0040536c
push dword [ebp - 0x1450]
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x61b0f0]
cmp byte [edx + eax*8 + 0x42], 0
jne 0x4b269e
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov edx, 0x4b74e8
call fcn.00405414
push 0x4b74f8
push dword [ebp - 0x48]
push 0x4b7508
push dword [ebp - 0x4c]
lea eax, [ebp - 0x1454]
mov edx, 4
call fcn.00405488
mov edx, dword [ebp - 0x1454]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp byte [ebp - 9], 0
je 0x4b2708
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x14c4]
call fcn.004032bc
mov edx, 0x4b7510
lea eax, [ebp - 0x14c4]
mov cl, 0x65
call fcn.0040328c
lea edx, [ebp - 0x14c4]
lea eax, [ebp - 0x145c]
call fcn.0040536c
push dword [ebp - 0x145c]
push dword [ebp - 0x48]
push 0x4b7508
push dword [ebp - 0x4c]
push 0x4b6fc8
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x14c8]
call fcn.0040a3c4
push dword [ebp - 0x14c8]
lea eax, [ebp - 0x1458]
mov edx, 6
call fcn.00405488
mov edx, dword [ebp - 0x1458]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
mov eax, dword [ebp + 8]
call fcn.00405108
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 0
mov eax, dword [0x61a92c]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 4], 9
jne 0x4b618e
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61a818]
lea edi, [edx + eax + 0x65]
mov esi, 0x4b7514
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
imul eax, dword [ebp - 0x18], 0x83
mov edx, dword [0x61af88]
lea edi, [edx + eax + 0x83]
mov esi, 0x4b752c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 9], 0
je 0x4b2856
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 0x18]
fstp qword [eax + edx*8 + 8]
wait
imul eax, dword [ebp - 0x18], 0x65
mov edx, dword [0x61ad48]
lea edx, [edx + eax + 0x65]
lea eax, [ebp - 0x1540]
call fcn.004032bc
mov edx, 0x4b7540
lea eax, [ebp - 0x1540]
mov cl, 0x72
call fcn.0040328c
lea edx, [ebp - 0x1540]
lea eax, [ebp - 0x14cc]
call fcn.0040536c
lea eax, [ebp - 0x14cc]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x1544]
call fcn.0040a3c4
mov edx, dword [ebp - 0x1544]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x14cc]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 0x18], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax + 0x65]
mov cl, 0x64
call fcn.004032c8
jmp 0x4b618e
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 1
mov eax, dword [ebp - 8]
lea edi, [eax + 0xc6d]
mov esi, 0x4b6c00
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [ebp - 0x18]
mov edx, dword [ebp - 8]
mov byte [edx + 0xc61], al
imul eax, dword [ebp - 0x18], 0x651
mov edx, dword [0x61ae8c]
lea edx, [edx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
mov eax, dword [ebp + 8]
call fcn.00405108
mov edx, 0x4b7550
lea eax, [ebp - 0x127c]
call fcn.004032bc
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x127c]
mov cl, 0x8e
call fcn.0040328c
lea edx, [ebp - 0x127c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov edx, dword [ebp - 0x50]
mov eax, 0x4b6c98
call fcn.0040570c
test eax, eax
jle 0x4b2a3b
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x15d4]
call fcn.004032bc
mov edx, 0x4b7560
lea eax, [ebp - 0x15d4]
mov cl, 0x88
call fcn.0040328c
lea edx, [ebp - 0x15d4]
lea eax, [ebp - 0x1548]
call fcn.0040536c
lea eax, [ebp - 0x1548]
push eax
lea edx, [ebp - 0x15d8]
mov eax, dword [ebp - 0x50]
call fcn.004af4f4
mov edx, dword [ebp - 0x15d8]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1548]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp byte [ebp - 9], 0
je 0x4b2a52
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x1648]
call fcn.004032bc
mov edx, 0x4b7568
lea eax, [ebp - 0x1648]
mov cl, 0x6a
call fcn.0040328c
lea edx, [ebp - 0x1648]
lea eax, [ebp - 0x15dc]
call fcn.0040536c
lea eax, [ebp - 0x15dc]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x164c]
call fcn.0040a3c4
mov edx, dword [ebp - 0x164c]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x15dc]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
jmp 0x4b2c4c
cmp byte [0x613944], 0
jne 0x4b2b2c
xor eax, eax
push ebp
push 0x4b2b22
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b2b2c
mov eax, dword [ebp - 0x18]
inc eax
mov edx, dword [0x61ac04]
cmp eax, dword [edx]
jl 0x4b2b46
mov eax, dword [ebp - 0x18]
inc eax
mov edx, dword [0x61ac04]
mov dword [edx], eax
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 1
mov eax, dword [ebp - 8]
lea edi, [eax + 0xc6d]
mov esi, 0x4b6c00
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [ebp - 0x18]
mov edx, dword [ebp - 8]
mov byte [edx + 0xc61], al
mov eax, dword [ebp + 8]
call fcn.00405108
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea edi, [edx + eax]
mov esi, 0x4b7570
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 9], 0
je 0x4b2bab
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x16c0]
call fcn.004032bc
mov edx, 0x4b758c
lea eax, [ebp - 0x16c0]
mov cl, 0x6f
call fcn.0040328c
lea edx, [ebp - 0x16c0]
lea eax, [ebp - 0x1650]
call fcn.0040536c
lea eax, [ebp - 0x1650]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x16c4]
call fcn.0040a3c4
mov edx, dword [ebp - 0x16c4]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1650]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
je 0x4b2c5f
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
cmp dword [eax + edx*4], 0
je 0x4b618e
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61a904]
imul ecx, dword [ebp - 4], 0x651
mov ebx, dword [0x61ae8c]
lea esi, [edx + eax*2]
lea edi, [ebx + ecx*2]
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea edi, [edx + eax*2 + 0xc2b]
mov esi, 0x4b7344
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov byte [edx + eax*2 + 0xc6d], 0
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea esi, [edx + eax*2]
mov edi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 4]
mov byte [eax + edx], 0
mov edx, 0x4b7598
lea eax, [ebp - 0x127c]
call fcn.004032bc
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x127c]
mov cl, 0x8e
call fcn.0040328c
lea edx, [ebp - 0x127c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
call fcn.00405108
jmp 0x4b68ec
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b2d9c
cmp byte [ebp - 0x2f], 0
je 0x4b2d9c
mov eax, dword [ebp - 0x18]
inc eax
mov edx, dword [0x61ac04]
cmp eax, dword [edx]
jl 0x4b2d9c
mov eax, dword [0x61ac04]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
inc eax
mov edx, dword [0x61ac04]
mov dword [edx], eax
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
je 0x4b2dcb
lea eax, [ebp - 0x2ec]
mov edx, 0x200
call fcn.004ff11c
test al, al
jne 0x4b2dbe
mov byte [ebp - 0x2f], 0
test byte [ebp - 0x2ec], 0x80
je 0x4b2dcb
mov byte [ebp - 0x2f], 0
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x110c]
call fcn.004032bc
mov edx, 0x4b75a8
lea eax, [ebp - 0x110c]
mov cl, 0x6b
call fcn.0040328c
lea edx, [ebp - 0x110c]
lea eax, [ebp - 0x16c8]
call fcn.0040536c
lea eax, [ebp - 0x16c8]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x16cc]
call fcn.0040a3c4
mov edx, dword [ebp - 0x16cc]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x16c8]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
call fcn.0040c8dc
fstp qword [ebp - 0x78]
wait
mov eax, dword [ebp + 8]
mov edx, 0x4b75b8
call fcn.0040515c
lea eax, [ebp - 0x16d0]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x16d0]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x16d0]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp byte [ebp - 0x2f], 0
jne 0x4b31c2
push 0x4b75c4
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x16d4]
call fcn.0040a3c4
push dword [ebp - 0x16d4]
push 0x4b75d8
mov eax, dword [ebp + 8]
mov edx, 3
call fcn.00405488
lea eax, [ebp - 0x16d8]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x16d8]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x16d8]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
lea eax, [ebp - 0xec]
xor ecx, ecx
mov edx, 0x20
call fcn.0040345c
lea eax, [ebp - 0x2fc]
xor ecx, ecx
mov edx, 0x210
call fcn.0040345c
mov dword [ebp - 0xec], 0x200
mov byte [ebp - 0xe7], 1
mov byte [ebp - 0xe6], 1
mov byte [ebp - 0xe2], 0xa1
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b2fe1
mov al, byte [ebp - 0x18]
and al, 1
shl eax, 4
or al, 0xa0
mov byte [ebp - 0xe3], al
mov al, byte [ebp - 0x18]
mov byte [ebp - 0xe0], al
jmp 0x4b3007
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abc]
mov byte [ebp - 0xe3], al
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abe]
mov byte [ebp - 0xe0], al
mov dword [ebp - 0x2fc], 0x210
mov eax, 0x4b75e8
call fcn.0049839c
push 0
lea eax, [ebp - 0x28]
push eax
push 0x210
lea eax, [ebp - 0x2fc]
push eax
push 0x20
lea eax, [ebp - 0xec]
push eax
push 0x7c088
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x2f], al
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
je 0x4b307c
lea eax, [ebp - 0x2ec]
mov edx, 0x200
call fcn.004ff11c
test al, al
jne 0x4b306f
mov byte [ebp - 0x2f], 0
test byte [ebp - 0x2ec], 0x80
je 0x4b307c
mov byte [ebp - 0x2f], 0
lea ecx, [ebp - 0x16e0]
xor edx, edx
mov al, byte [ebp - 0x2f]
call fcn.0040a6b8
mov ecx, dword [ebp - 0x16e0]
lea eax, [ebp - 0x16dc]
mov edx, 0x4b7600
call fcn.00405414
mov eax, dword [ebp - 0x16dc]
call fcn.0049839c
mov eax, dword [ebp + 8]
mov edx, 0x4b7618
call fcn.0040515c
lea eax, [ebp - 0x16e4]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x16e4]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x16e4]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x110c]
call fcn.004032bc
mov edx, 0x4b761c
lea eax, [ebp - 0x110c]
mov cl, 0x6b
call fcn.0040328c
lea edx, [ebp - 0x110c]
lea eax, [ebp - 0x16e8]
call fcn.0040536c
lea eax, [ebp - 0x16e8]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x16ec]
call fcn.0040a3c4
mov edx, dword [ebp - 0x16ec]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x16e8]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
call fcn.0040c8dc
fstp qword [ebp - 0x78]
wait
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
je 0x4b3204
cmp byte [ebp - 0x2f], 0
jne 0x4b31e0
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4b618e
mov eax, dword [ebp - 0x18]
inc eax
mov edx, dword [0x61ac04]
cmp eax, dword [edx]
jl 0x4b3204
mov eax, dword [0x61ac04]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
inc eax
mov edx, dword [0x61ac04]
mov dword [edx], eax
cmp byte [ebp - 0x2f], 0
je 0x4b3e08
mov eax, dword [ebp + 8]
mov edx, 0x4b762c
call fcn.0040515c
lea eax, [ebp - 0x16f0]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x16f0]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x16f0]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
lea eax, [ebp - 0x58]
call fcn.00405108
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x16f4]
mov edx, dword [ebp - 0x1c]
mov dl, byte [ebp + edx - 0x2ec]
call fcn.004052f0
mov edx, dword [ebp - 0x16f4]
lea eax, [ebp - 0x58]
call fcn.004053d0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x200
jne 0x4b3286
lea eax, [ebp - 0x58]
xor edx, edx
call fcn.005240e8
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4], 0
jne 0x4b32e2
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4]
mov edx, dword [ebp - 0x58]
call fcn.0040515c
jmp 0x4b3320
lea eax, [ebp - 0x16f8]
push eax
mov ecx, 1
mov edx, 0x37
mov eax, dword [ebp - 0x58]
call fcn.00405628
mov eax, dword [ebp - 0x16f8]
mov edx, 0x4b763c
call fcn.00405514
je 0x4b3320
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4]
mov edx, dword [ebp - 0x58]
call fcn.0040515c
lea edx, [ebp - 0x16fc]
mov eax, dword [ebp - 0x58]
call fcn.00409de4
cmp dword [ebp - 0x16fc], 0
je 0x4b3351
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x61b0f0]
lea edx, [edx + eax*8]
mov al, byte [ebp - 0x18]
call fcn.004ff16c
mov eax, dword [ebp - 0x18]
call fcn.00528e84
test al, al
je 0x4b33a0
push 0x4b7648
lea edx, [ebp - 0x1704]
mov eax, dword [ebp - 0x18]
call fcn.0040a2d8
push dword [ebp - 0x1704]
push 0x4b7664
lea eax, [ebp - 0x1700]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x1700]
call fcn.0049839c
mov eax, dword [ebp - 0x2c]
call fcn.004faf50
test al, al
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4]
call fcn.00526d20
lea edx, [ebp - 0x170c]
call fcn.0048dfc0
mov ecx, dword [ebp - 0x170c]
lea eax, [ebp - 0x1708]
mov edx, 0x4b7678
call fcn.00405414
mov eax, dword [ebp - 0x1708]
call fcn.0049839c
mov eax, dword [0x61ac04]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x4b3e08
inc eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
je 0x4b3df9
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x1c]
cmp byte [eax + edx], 0
jne 0x4b3df9
lea edx, [ebp - 0x1710]
mov eax, dword [ebp - 0x1c]
call fcn.004fff48
mov eax, dword [ebp - 0x1710]
push eax
lea edx, [ebp - 0x1714]
mov eax, dword [ebp - 0x18]
call fcn.004fff48
mov edx, dword [ebp - 0x1714]
pop eax
call fcn.00405514
jne 0x4b3df9
lea edx, [ebp - 0x1718]
mov eax, dword [ebp - 0x1c]
call fcn.005001c8
mov eax, dword [ebp - 0x1718]
push eax
lea edx, [ebp - 0x171c]
mov eax, dword [ebp - 0x18]
call fcn.005001c8
mov edx, dword [ebp - 0x171c]
pop eax
call fcn.00405514
jne 0x4b3df9
lea eax, [ebp - 0x1720]
push eax
lea edx, [ebp - 0x1724]
mov eax, dword [ebp - 0x1c]
call fcn.005003f4
mov eax, dword [ebp - 0x1724]
mov ecx, 4
mov edx, 1
call fcn.00405628
mov eax, dword [ebp - 0x1720]
push eax
lea eax, [ebp - 0x1728]
push eax
lea edx, [ebp - 0x172c]
mov eax, dword [ebp - 0x18]
call fcn.005003f4
mov eax, dword [ebp - 0x172c]
mov ecx, 4
mov edx, 1
call fcn.00405628
mov edx, dword [ebp - 0x1728]
pop eax
call fcn.00405514
jne 0x4b3df9
mov eax, dword [ebp - 0x1c]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax], 0
je 0x4b39a6
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4]
call fcn.00405108
mov eax, dword [ebp - 4]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x61b0f0]
lea eax, [edx + eax*8]
xor ecx, ecx
mov edx, 0x60
call fcn.0040345c
cmp dword [ebp - 0x10], 0
jl 0x4b3547
mov eax, dword [0x61ac04]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea edx, [edx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
push 0x4b769c
mov eax, dword [ebp + 8]
push dword [eax]
push 0x4b76ac
lea edx, [ebp - 0x1730]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1730]
push 0x4b76d0
mov eax, dword [ebp - 0x1c]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
movzx eax, byte [edx + eax + 1]
lea edx, [ebp - 0x1734]
call fcn.0040a2d8
push dword [ebp - 0x1734]
push 0x4b76dc
mov eax, dword [ebp - 0x1c]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
movzx eax, word [edx + eax + 2]
lea edx, [ebp - 0x1738]
call fcn.0040a2d8
push dword [ebp - 0x1738]
mov eax, dword [ebp + 8]
mov edx, 8
call fcn.00405488
lea eax, [ebp - 0xa9c]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, 0x4b6fdc
call fcn.0048cf1c
test al, al
je 0x4b36c5
push 0x4b76e8
lea edx, [ebp - 0x1740]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0x1740]
push 0x4b7000
mov eax, dword [ebp - 4]
call fcn.00524050
lea edx, [ebp - 0x1744]
call fcn.0040a2d8
push dword [ebp - 0x1744]
push 0x4b7010
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1748]
call fcn.0040a3c4
push dword [ebp - 0x1748]
push 0x4b7024
lea eax, [ebp - 0x174c]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0x174c]
lea eax, [ebp - 0x173c]
mov edx, 8
call fcn.00405488
mov eax, dword [ebp - 0x173c]
mov dl, 1
call fcn.004e5d18
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x4b6fdc
call fcn.0048cf1c
test al, al
je 0x4b372c
push 0x4b7700
lea edx, [ebp - 0x1754]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1754]
push 0x4b7724
lea edx, [ebp - 0x1758]
mov eax, dword [ebp - 0x18]
dec eax
call fcn.0040a2d8
push dword [ebp - 0x1758]
lea eax, [ebp - 0x1750]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0x1750]
mov dl, 1
call fcn.004e5d18
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
dec edx
sub edx, eax
jl 0x4b618e
inc edx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax], 0
je 0x4b3992
mov eax, dword [ebp - 0x24]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax + 4], 1
jb 0x4b3992
mov eax, dword [ebp - 0x24]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax + 4], 3
ja 0x4b3992
mov eax, 0x4b6fdc
call fcn.0048cf1c
test al, al
je 0x4b3849
push 0x4b7730
lea edx, [ebp - 0x1760]
mov eax, dword [ebp - 0x24]
call fcn.0040a2d8
push dword [ebp - 0x1760]
push 0x4b7750
mov eax, dword [ebp - 0x24]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
movzx eax, byte [edx + eax + 1]
lea edx, [ebp - 0x1764]
call fcn.0040a2d8
push dword [ebp - 0x1764]
push 0x4b7724
lea eax, [ebp - 0x1768]
imul edx, dword [ebp - 0x24], 0x65
mov ecx, dword [0x61a818]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0x1768]
push 0x4b775c
mov eax, dword [ebp - 4]
call fcn.00524050
lea edx, [ebp - 0x176c]
call fcn.0040a2d8
push dword [ebp - 0x176c]
lea eax, [ebp - 0x175c]
mov edx, 8
call fcn.00405488
mov eax, dword [ebp - 0x175c]
mov dl, 1
call fcn.004e5d18
mov eax, dword [ebp - 4]
call fcn.00524050
mov edx, dword [ebp - 0x24]
mov ecx, edx
shl edx, 4
add edx, ecx
mov ecx, dword [0x61add4]
mov byte [ecx + edx + 1], al
push 0x4b776c
mov eax, dword [ebp - 0x24]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
movzx eax, byte [edx + eax + 1]
lea edx, [ebp - 0x1774]
call fcn.0040a2d8
push dword [ebp - 0x1774]
push 0x4b76dc
mov eax, dword [ebp - 0x24]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
movzx eax, word [edx + eax + 2]
lea edx, [ebp - 0x1778]
call fcn.0040a2d8
push dword [ebp - 0x1778]
push 0x4b7784
mov eax, dword [ebp - 0x24]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
movzx eax, byte [edx + eax + 4]
lea edx, [ebp - 0x177c]
call fcn.0040a2d8
push dword [ebp - 0x177c]
push 0x4b7790
lea eax, [ebp - 0x1770]
mov edx, 7
call fcn.00405488
mov edx, dword [ebp - 0x1770]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 0x24], 0x65
mov ecx, dword [0x61a818]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
mov eax, 0x4b6fdc
call fcn.0048cf1c
test al, al
je 0x4b3992
push 0x4b779c
lea edx, [ebp - 0x1784]
mov eax, dword [ebp - 0x24]
call fcn.0040a2d8
push dword [ebp - 0x1784]
push 0x4b7750
lea eax, [ebp - 0x1788]
imul edx, dword [ebp - 0x24], 0x65
mov ecx, dword [0x61a818]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0x1788]
lea eax, [ebp - 0x1780]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0x1780]
mov dl, 1
call fcn.004e5d18
inc dword [ebp - 0x24]
dec dword [ebp - 0xc0]
jne 0x4b3745
jmp 0x4b618e
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x1c]
mov eax, dword [eax + edx*4]
cmp byte [eax + 3], 1
je 0x4b3a6b
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x1c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x62dd48]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x4b3a6b
xor eax, eax
push ebp
push 0x4b3a4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xca2
call fcn.00402828
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
imul eax, dword [ebp - 0x1c], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 0xa4]
mov ecx, 0xca2
call fcn.00402a8c
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x1c]
mov edx, dword [eax + edx*4]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [0x62dd48]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3a6b
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4]
cmp byte [eax + 3], 1
je 0x4b3b30
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
mov edx, dword [eax + edx*4]
mov eax, dword [0x62dd48]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x4b3b30
xor eax, eax
push ebp
push 0x4b3b11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xca2
call fcn.00402828
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
imul eax, dword [ebp - 0x18], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 0xa4]
mov ecx, 0xca2
call fcn.00402a8c
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
mov edx, dword [eax + edx*4]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [0x62dd48]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3b30
lea ecx, [ebp - 0x5c]
or edx, 0xffffffff
mov eax, dword [ebp - 0x1c]
call fcn.005260b0
lea ecx, [ebp - 0x60]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.005260b0
mov eax, dword [ebp - 0x5c]
call fcn.004053c8
test eax, eax
jle 0x4b3b64
mov eax, dword [ebp - 0x60]
call fcn.004053c8
test eax, eax
jg 0x4b3b68
xor eax, eax
jmp 0x4b3b6a
mov al, 1
mov byte [ebp - 0x95], al
cmp byte [ebp - 0x95], 0
je 0x4b3d40
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x1c]
lea eax, [eax + edx*4]
mov edx, dword [ebp - 0x5c]
call fcn.0040515c
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4]
mov edx, dword [ebp - 0x60]
call fcn.0040515c
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x61b0f0]
lea edx, [edx + eax*8]
mov al, byte [ebp - 0x1c]
call fcn.004ff16c
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x61b0f0]
lea edx, [edx + eax*8]
mov al, byte [ebp - 0x18]
call fcn.004ff16c
imul eax, dword [ebp - 0x1c], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x1818]
call fcn.004032bc
mov edx, 0x4b77b8
lea eax, [ebp - 0x1818]
mov cl, 0x8b
call fcn.0040328c
lea edx, [ebp - 0x1818]
lea eax, [ebp - 0x178c]
call fcn.0040536c
lea eax, [ebp - 0x178c]
push eax
lea edx, [ebp - 0x181c]
mov eax, dword [ebp - 0x18]
call fcn.0040a2d8
mov edx, dword [ebp - 0x181c]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x178c]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 0x1c], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
call fcn.00405108
lea edx, [ebp - 0x1824]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x1824]
lea eax, [ebp - 0x1820]
mov edx, 0x4b77cc
call fcn.00405414
mov edx, dword [ebp - 0x1820]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 0x18], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp byte [ebp - 9], 0
je 0x4b3cde
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 0x1c]
fstp qword [eax + edx*8]
wait
lea eax, [ebp - 0x1828]
push eax
imul eax, dword [ebp - 0x1c], 0x651
mov edx, dword [0x61ae8c]
lea edx, [edx + eax*2]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
call fcn.005262c4
lea eax, [ebp - 0x182c]
push eax
imul eax, dword [ebp - 0x18], 0x651
mov edx, dword [0x61ae8c]
lea edx, [edx + eax*2]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.005262c4
imul eax, dword [ebp - 0x18], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea esi, [edx + eax*2]
mov edi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x95], 0
jne 0x4b3dd4
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 0x18]
mov byte [eax + edx], 1
mov eax, dword [ebp - 8]
lea edi, [eax + 0xc6d]
mov esi, 0x4b6c00
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [ebp - 0x18]
mov edx, dword [ebp - 8]
mov byte [edx + 0xc61], al
mov eax, dword [ebp + 8]
call fcn.00405108
lea edx, [ebp - 0x1834]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x1834]
lea eax, [ebp - 0x1830]
mov edx, 0x4b77e4
call fcn.00405414
mov edx, dword [ebp - 0x1830]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp byte [ebp - 9], 0
je 0x4b3deb
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 0x18]
fstp qword [eax + edx*8]
wait
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4b618e
inc dword [ebp - 0x1c]
dec dword [ebp - 0xbc]
jne 0x4b33fa
lea edx, [ebp - 0x1838]
mov eax, dword [ebp - 0x40]
call fcn.0048f554
mov edx, dword [ebp - 0x1838]
lea eax, [ebp - 0x40]
call fcn.004051a0
lea eax, [ebp - 0x183c]
mov ecx, dword [ebp - 0x40]
mov edx, 0x4b7800
call fcn.00405414
mov eax, dword [ebp - 0x183c]
call fcn.0049839c
cmp dword [ebp - 4], 1
jne 0x4b3ea1
lea edx, [ebp - 0x1840]
mov eax, dword [ebp - 0x40]
call fcn.00409b94
mov edx, dword [ebp - 0x1840]
mov eax, 0x4b7814
call fcn.0040570c
test eax, eax
jle 0x4b3ea1
mov eax, 0x4b7828
call fcn.0048cf1c
test al, al
jne 0x4b3ea1
mov eax, 0x4b7838
call fcn.0049839c
mov eax, dword [ebp - 4]
mov dword [0x613938], eax
lea eax, [ebp - 0x2ec]
xor ecx, ecx
mov edx, 0x200
call fcn.0040345c
jmp 0x4b52b8
lea edx, [ebp - 0x1844]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov eax, dword [ebp - 0x1844]
mov edx, dword [0x639678]
call fcn.0040570c
test eax, eax
jle 0x4b3f57
mov eax, dword [ebp + 8]
call fcn.00405108
cmp byte [ebp - 9], 0
je 0x4b3ee7
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea edi, [edx + eax*2]
mov esi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea edi, [edx + eax]
mov esi, 0x4b7848
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
push ebp
push 0x4b3f48
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b618e
mov eax, dword [ebp - 4]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x61b0f0]
cmp byte [edx + eax*8 + 0x42], 0
jne 0x4b40e8
lea edx, [ebp - 0x1848]
mov eax, dword [ebp - 4]
call fcn.004fff48
mov eax, dword [ebp - 0x1848]
call fcn.00525e38
test al, al
jne 0x4b40e8
push 0
push 0x100000
push 1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b83f0
call fcn.0040623c
cmp edx, 0
jne 0x4b3fbe
cmp eax, 0x36b0
ja 0x4b40e8
jmp 0x4b3fc4
jg 0x4b40e8
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 4]
call fcn.004fff48
lea eax, [ebp - 0x184c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x54]
call fcn.00405628
mov eax, dword [ebp - 0x184c]
mov edx, 0x4b786c
call fcn.00405514
je 0x4b40e8
lea eax, [ebp - 0x1850]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0x54]
call fcn.00405628
mov eax, dword [ebp - 0x1850]
mov edx, 0x4b7878
call fcn.00405514
je 0x4b40e8
lea eax, [ebp - 0x1854]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0x54]
call fcn.00405628
mov eax, dword [ebp - 0x1854]
mov edx, 0x4b7884
call fcn.00405514
je 0x4b40e8
mov eax, dword [ebp + 8]
call fcn.00405108
cmp byte [ebp - 9], 0
je 0x4b407b
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea edi, [edx + eax*2]
mov esi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea edi, [edx + eax]
mov esi, 0x4b7888
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push ebp
push 0x4b40d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b618e
lea edx, [ebp - 0x1858]
mov eax, dword [ebp - 4]
call fcn.004fff48
mov eax, dword [ebp - 0x1858]
call fcn.0052c634
test al, al
je 0x4b4198
mov eax, dword [ebp + 8]
call fcn.00405108
cmp byte [ebp - 9], 0
je 0x4b4128
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea edi, [edx + eax*2]
mov esi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea edi, [edx + eax]
mov esi, 0x4b78a8
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
push ebp
push 0x4b4189
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b618e
lea eax, [ebp - 0xec]
xor ecx, ecx
mov edx, 0x20
call fcn.0040345c
lea eax, [ebp - 0x2fc]
xor ecx, ecx
mov edx, 0x210
call fcn.0040345c
xor eax, eax
mov dword [ebp - 0xec], eax
mov byte [ebp - 0xe8], 0xd8
mov byte [ebp - 0xe7], 1
mov byte [ebp - 0xe6], 1
mov byte [ebp - 0xe5], 0x4f
mov byte [ebp - 0xe4], 0xc2
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b420c
mov al, byte [ebp - 0x18]
and al, 1
shl eax, 4
or al, 0xa0
mov byte [ebp - 0xe3], al
mov al, byte [ebp - 0x18]
mov byte [ebp - 0xe0], al
jmp 0x4b4232
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abc]
mov byte [ebp - 0xe3], al
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abe]
mov byte [ebp - 0xe0], al
mov byte [ebp - 0xe2], 0xb0
mov dword [ebp - 0x2fc], 0x210
mov eax, dword [0x613938]
cmp eax, dword [ebp - 4]
jg 0x4b433e
push 0x4b78cc
lea edx, [ebp - 0x1860]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0x1860]
push 0x4b78e4
lea edx, [ebp - 0x1864]
mov eax, dword [0x613938]
call fcn.0040a2d8
push dword [ebp - 0x1864]
lea eax, [ebp - 0x185c]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0x185c]
call fcn.0049839c
mov eax, 0x4b78f0
call fcn.0048cf1c
test al, al
jne 0x4b42cf
mov eax, 0x4b7904
call fcn.0049839c
lea eax, [ebp - 0x2ec]
xor ecx, ecx
mov edx, 0x200
call fcn.0040345c
jmp 0x4b52b8
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
lea edx, [ebp - 0x186c]
mov eax, dword [0x613938]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x186c]
lea eax, [ebp - 0x1868]
mov edx, 0x4b7920
call fcn.00405414
mov edx, dword [ebp - 0x1868]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
call fcn.00405108
jmp 0x4b618e
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
call fcn.00526d20
test al, al
jne 0x4b44ca
mov eax, 0x4b7938
call fcn.0049839c
push 0
lea eax, [ebp - 0x28]
push eax
push 0x10
lea eax, [ebp - 0x2fc]
push eax
push 0x20
lea eax, [ebp - 0xec]
push eax
push 0x7c084
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
jne 0x4b4453
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1874]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x1874]
lea eax, [ebp - 0x1870]
mov edx, 0x4b7950
call fcn.00405414
mov eax, dword [ebp - 0x1870]
call fcn.0049839c
push 0x4b796c
lea edx, [ebp - 0x1878]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1878]
push 0x4b6cf0
mov eax, dword [ebp + 8]
mov edx, 3
call fcn.00405488
lea eax, [ebp - 0x187c]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x187c]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x187c]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
jmp 0x4b44ed
mov eax, 0x4b797c
call fcn.0049839c
mov eax, dword [ebp + 8]
mov edx, 0x4b7990
call fcn.0040515c
lea eax, [ebp - 0x1880]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x1880]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x1880]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
jmp 0x4b44ed
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
lea eax, [edx + eax]
mov edx, 0x4b7994
mov cl, 0x64
call fcn.0040328c
mov eax, 0x4b79a0
call fcn.0049839c
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x1540]
call fcn.004032bc
mov edx, 0x4b79b4
lea eax, [ebp - 0x1540]
mov cl, 0x72
call fcn.0040328c
lea edx, [ebp - 0x1540]
lea eax, [ebp - 0x1884]
call fcn.0040536c
lea eax, [ebp - 0x1884]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x1888]
call fcn.0040a3c4
mov edx, dword [ebp - 0x1888]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1884]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
call fcn.0040c8dc
fstp qword [ebp - 0x78]
wait
lea eax, [ebp - 0xec]
xor ecx, ecx
mov edx, 0x20
call fcn.0040345c
lea eax, [ebp - 0x2fc]
xor ecx, ecx
mov edx, 0x210
call fcn.0040345c
mov dword [ebp - 0xec], 0x200
mov byte [ebp - 0xe8], 0xd1
mov byte [ebp - 0xe7], 1
mov byte [ebp - 0xe6], 1
mov byte [ebp - 0xe5], 0x4f
mov byte [ebp - 0xe4], 0xc2
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b460d
mov al, byte [ebp - 0x18]
and al, 1
shl eax, 4
or al, 0xa0
mov byte [ebp - 0xe3], al
mov al, byte [ebp - 0x18]
mov byte [ebp - 0xe0], al
jmp 0x4b4633
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abc]
mov byte [ebp - 0xe3], al
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abe]
mov byte [ebp - 0xe0], al
mov byte [ebp - 0xe2], 0xb0
mov dword [ebp - 0x2fc], 0x210
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6389f4], 0
jne 0x4b486e
mov eax, 0x4b79cc
call fcn.0049839c
call fcn.0040c8dc
fstp qword [ebp - 0x70]
wait
push 0
lea eax, [ebp - 0x28]
push eax
push 0x210
lea eax, [ebp - 0x2fc]
push eax
push 0x20
lea eax, [ebp - 0xec]
push eax
push 0x7c088
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4b4757
mov eax, 0x4b79e4
call fcn.0049839c
mov byte [ebp - 0x2d], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 8]
lea eax, [edx + eax*2]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
mov al, byte [ebp + eax - 0x2e9]
mov edx, dword [ebp - 0xc4]
mov byte [edx + 6], al
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1e
jne 0x4b46af
mov eax, dword [ebp + 8]
mov edx, 0x4b79f8
call fcn.0040515c
lea eax, [ebp - 0x188c]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x188c]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x188c]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
jmp 0x4b486e
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1894]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x1894]
lea eax, [ebp - 0x1890]
mov edx, 0x4b7a04
call fcn.00405414
mov eax, dword [ebp - 0x1890]
call fcn.0049839c
push 0x4b7a20
lea edx, [ebp - 0x1898]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1898]
push 0x4b7a30
mov eax, dword [ebp + 8]
mov edx, 3
call fcn.00405488
lea eax, [ebp - 0x189c]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x189c]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x189c]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp dword [ebp - 0x1c], 0x45d
jne 0x4b486e
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
call fcn.00491408
cmp edx, 0
jne 0x4b4843
cmp eax, 0x1e
jbe 0x4b486e
jmp 0x4b4845
jle 0x4b486e
mov eax, 0x4b7a3c
call fcn.0049839c
mov eax, dword [ebp - 4]
mov dword [0x613938], eax
lea eax, [ebp - 0x2ec]
xor ecx, ecx
mov edx, 0x200
call fcn.0040345c
jmp 0x4b52b8
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
mov dword [ebp - 0x14], eax
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x1918]
call fcn.004032bc
mov edx, 0x4b7a50
lea eax, [ebp - 0x1918]
mov cl, 0x76
call fcn.0040328c
lea edx, [ebp - 0x1918]
lea eax, [ebp - 0x18a0]
call fcn.0040536c
lea eax, [ebp - 0x18a0]
push eax
lea edx, [ebp - 0x191c]
mov eax, dword [ebp - 0x14]
call fcn.0040a2d8
mov edx, dword [ebp - 0x191c]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x18a0]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
call fcn.0040c8dc
fstp qword [ebp - 0x78]
wait
xor eax, eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xec]
xor ecx, ecx
mov edx, 0x20
call fcn.0040345c
lea eax, [ebp - 0x2fc]
xor ecx, ecx
mov edx, 0x210
call fcn.0040345c
mov dword [ebp - 0xec], 0x200
mov byte [ebp - 0xe8], 0xd0
mov byte [ebp - 0xe7], 1
mov byte [ebp - 0xe6], 1
mov byte [ebp - 0xe5], 0x4f
mov byte [ebp - 0xe4], 0xc2
mov eax, dword [0x61b4ac]
cmp dword [eax], 2
jne 0x4b499a
mov al, byte [ebp - 0x18]
and al, 1
shl eax, 4
or al, 0xa0
mov byte [ebp - 0xe3], al
mov al, byte [ebp - 0x18]
mov byte [ebp - 0xe0], al
jmp 0x4b49c0
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abc]
mov byte [ebp - 0xe3], al
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov al, byte [eax*2 + 0x638abe]
mov byte [ebp - 0xe0], al
mov byte [ebp - 0xe2], 0xb0
mov dword [ebp - 0x2fc], 0x210
call fcn.0040c8dc
fstp qword [ebp - 0x70]
wait
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x19ac]
call fcn.004032bc
mov edx, 0x4b7a64
lea eax, [ebp - 0x19ac]
mov cl, 0x84
call fcn.0040328c
lea edx, [ebp - 0x19ac]
lea eax, [ebp - 0x1924]
call fcn.0040536c
push dword [ebp - 0x1924]
lea edx, [ebp - 0x19b0]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0x19b0]
push 0x4b6d74
lea eax, [ebp - 0x1920]
mov edx, 3
call fcn.00405488
mov edx, dword [ebp - 0x1920]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
lea edx, [ebp - 0x19b8]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x19b8]
lea eax, [ebp - 0x19b4]
mov edx, 0x4b7a70
call fcn.00405414
mov eax, dword [ebp - 0x19b4]
call fcn.0049839c
push 0
lea eax, [ebp - 0x28]
push eax
push 0x210
lea eax, [ebp - 0x2fc]
push eax
push 0x20
lea eax, [ebp - 0xec]
push eax
push 0x7c088
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x93], al
cmp dword [ebp - 4], 1
jne 0x4b4b1c
mov eax, 0x4b7a8c
call fcn.0048cf1c
test al, al
je 0x4b4b1c
lea eax, [ebp - 0x2ec]
xor ecx, ecx
mov edx, 0x200
call fcn.0040345c
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
mov eax, dword [ebp - 4]
call fcn.004bd074
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp byte [ebp - 0x93], 0
jne 0x4b4bd4
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x19c0]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x19c0]
lea eax, [ebp - 0x19bc]
mov edx, 0x4b7aa0
call fcn.00405414
mov eax, dword [ebp - 0x19bc]
call fcn.0049839c
cmp dword [ebp - 0x1c], 0x45d
jne 0x4b4bd4
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
call fcn.00491408
cmp edx, 0
jne 0x4b4b91
cmp eax, 0x1e
jbe 0x4b4bd4
jmp 0x4b4b93
jle 0x4b4bd4
mov eax, dword [ebp - 4]
mov dword [0x613938], eax
mov dword [ebp - 0x90], 0x63
lea edx, [ebp - 0x19c8]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x19c8]
lea eax, [ebp - 0x19c4]
mov edx, 0x4b7ab4
call fcn.00405414
mov eax, dword [ebp - 0x19c4]
call fcn.0049839c
mov eax, 0x4b7ac8
call fcn.0048cf1c
test al, al
je 0x4b4cb4
push 0x4b7adc
lea edx, [ebp - 0x19d0]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0x19d0]
push 0x4b7aec
lea edx, [ebp - 0x19d4]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0x19d4]
lea eax, [ebp - 0x19cc]
mov edx, 4
call fcn.00405488
mov eax, dword [ebp - 0x19cc]
push eax
lea edx, [ebp - 0x19d8]
xor eax, eax
call fcn.0048f87c
mov eax, dword [ebp - 0x19d8]
lea ecx, [ebp - 0xac]
pop edx
call fcn.0048cc9c
cmp byte [ebp - 0x93], 0
jne 0x4b4c89
push dword [ebp - 0xac]
push 0x4b7af8
lea edx, [ebp - 0x19dc]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x19dc]
lea eax, [ebp - 0xac]
mov edx, 3
call fcn.00405488
lea eax, [ebp - 0xac]
mov edx, 0x4b7b04
call fcn.004053d0
push 0x200
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
mov eax, dword [ebp - 0xac]
call fcn.0048f4ac
cmp byte [ebp - 0x93], 0
je 0x4b4cde
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b7b0c
mov cl, 0x82
call fcn.0040328c
jmp 0x4b4d7d
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x1a6c]
call fcn.004032bc
mov edx, 0x4b7b14
lea eax, [ebp - 0x1a6c]
mov cl, 0x87
call fcn.0040328c
lea edx, [ebp - 0x1a6c]
lea eax, [ebp - 0x19e4]
call fcn.0040536c
push dword [ebp - 0x19e4]
lea edx, [ebp - 0x1a70]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1a70]
push 0x4b7a30
lea eax, [ebp - 0x19e0]
mov edx, 3
call fcn.00405488
mov edx, dword [ebp - 0x19e0]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp byte [ebp - 0x93], 0
je 0x4b503c
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
mov eax, dword [ebp - 4]
call fcn.005207c4
mov byte [ebp - 0x2f], al
cmp byte [ebp - 0x2f], 0
je 0x4b4db5
mov eax, 0x4b7b24
call fcn.0049839c
jmp 0x4b503c
mov eax, 0x4b7b40
call fcn.0049839c
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b7b54
mov cl, 0x82
call fcn.0040328c
lea eax, [ebp - 0x2ec]
xor ecx, ecx
mov edx, 0x200
call fcn.0040345c
push 0
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea edx, [edx + eax*2]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0052bbcc
test eax, eax
jle 0x4b52b8
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0xee4]
call fcn.004032bc
mov edx, 0x4b70cc
lea eax, [ebp - 0xee4]
mov cl, 0x69
call fcn.0040328c
lea edx, [ebp - 0xee4]
lea eax, [ebp - 0x1a78]
call fcn.0040536c
push dword [ebp - 0x1a78]
lea edx, [ebp - 0x1a7c]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0x1a7c]
push 0x4b6fc8
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x1a80]
call fcn.0040a3c4
push dword [ebp - 0x1a80]
lea eax, [ebp - 0x1a74]
mov edx, 4
call fcn.00405488
mov edx, dword [ebp - 0x1a74]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
mov eax, dword [ebp - 0x50]
call fcn.004053c8
cmp eax, 0xa
jge 0x4b4f4c
mov edx, 0x4b7b5c
lea eax, [ebp - 0x1b18]
call fcn.004032bc
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x1b18]
mov cl, 0x94
call fcn.0040328c
lea edx, [ebp - 0x1b18]
lea eax, [ebp - 0x50]
call fcn.0040536c
mov edx, dword [ebp - 0x50]
mov eax, 0x4b70dc
call fcn.0040570c
test eax, eax
jne 0x4b4f71
push 0
lea eax, [ebp - 0x50]
mov ecx, 0x4b70f0
mov edx, 0x4b70a4
call fcn.0048d458
lea eax, [ebp - 0xa9c]
mov edx, dword [ebp - 0x50]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
call fcn.00405108
push dword [ebp - 0x50]
push 0x4b70b4
lea edx, [ebp - 0x1b20]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0x1b20]
push 0x4b7000
mov eax, dword [ebp - 4]
call fcn.00524050
lea edx, [ebp - 0x1b24]
call fcn.0040a2d8
push dword [ebp - 0x1b24]
push 0x4b70c4
lea eax, [ebp - 0x1b28]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0x1b28]
lea eax, [ebp - 0x1b1c]
mov edx, 7
call fcn.00405488
mov eax, dword [ebp - 0x1b1c]
call fcn.0049839c
cmp dword [ebp - 0x2c], 0xffffffff
je 0x4b618e
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4b618e
cmp byte [ebp - 0x93], 0
jne 0x4b5677
cmp dword [ebp + 0xc], 0
jle 0x4b5217
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp + 0xc]
jge 0x4b5217
inc dword [ebp - 0x90]
mov eax, dword [0x61aedc]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_Sleep_1
lea edx, [ebp - 0x1b30]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x1b30]
lea eax, [ebp - 0x1b2c]
mov edx, 0x4b7b78
call fcn.00405414
mov eax, dword [ebp - 0x1b2c]
call fcn.0049839c
imul eax, dword [ebp - 4], 0xc9
lea edx, [eax + 0x62dd4c]
lea eax, [ebp - 0x11e8]
call fcn.004032bc
mov edx, 0x4b7b84
lea eax, [ebp - 0x11e8]
mov cl, 0xcb
call fcn.0040328c
lea edx, [ebp - 0x11e8]
lea eax, [ebp - 0x1b38]
call fcn.0040536c
push dword [ebp - 0x1b38]
lea edx, [ebp - 0x1b3c]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0x1b3c]
push 0x4b6d74
lea eax, [ebp - 0x1b34]
mov edx, 3
call fcn.00405488
mov edx, dword [ebp - 0x1b34]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0xc9
add eax, 0x62dd4c
mov cl, 0xc8
call fcn.004032c8
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x1bbc]
call fcn.004032bc
mov edx, 0x4b7b88
lea eax, [ebp - 0x1bbc]
mov cl, 0x77
call fcn.0040328c
lea edx, [ebp - 0x1bbc]
lea eax, [ebp - 0x1b44]
call fcn.0040536c
push dword [ebp - 0x1b44]
lea edx, [ebp - 0x1bc0]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0x1bc0]
push 0x4b6fc8
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x1bc4]
call fcn.0040a3c4
push dword [ebp - 0x1bc4]
lea eax, [ebp - 0x1b40]
mov edx, 4
call fcn.00405488
mov edx, dword [ebp - 0x1b40]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
call fcn.0040c8dc
fstp qword [ebp - 0x78]
wait
jmp 0x4b4924
push 0x4b7ba4
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1bc8]
call fcn.0040a3c4
push dword [ebp - 0x1bc8]
push 0x4b6cf0
mov eax, dword [ebp + 8]
mov edx, 3
call fcn.00405488
lea eax, [ebp - 0x1bcc]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
lea eax, [ebp - 0x1bcc]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x1bcc]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
lea eax, [ebp - 0x2ec]
xor ecx, ecx
mov edx, 0x200
call fcn.0040345c
mov eax, 0x4b7bb4
call fcn.0049839c
push 0
lea eax, [ebp - 0x28]
push eax
push 0x204
lea eax, [ebp - 0x500]
push eax
push 0
push 0
push 0x2d1100
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4b53d9
mov eax, 0x4b7bcc
call fcn.0049839c
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b7bd8
mov cl, 0x82
call fcn.0040328c
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov al, byte [ebp + eax - 0x4fc]
mov edx, dword [ebp - 0x1c]
mov byte [ebp + edx - 0x2ec], al
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x200
jne 0x4b5319
lea eax, [ebp - 0xb0]
mov edx, 0x4b7be8
call fcn.004051a0
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov eax, 0x4b6fac
call fcn.0040570c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4b538b
lea eax, [ebp - 0x1bd0]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, 0x32
mov edx, dword [ebp - 0x1c]
call fcn.00405628
mov edx, dword [ebp - 0x1bd0]
lea eax, [ebp - 0xb0]
call fcn.004053d0
mov eax, dword [ebp + 8]
call fcn.00405108
cmp dword [ebp - 4], 1
jne 0x4b5677
mov eax, 0x4b7a8c
call fcn.0048cf1c
test al, al
je 0x4b5677
lea eax, [ebp - 0x2ec]
xor ecx, ecx
mov edx, 0x200
call fcn.0040345c
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
mov eax, dword [ebp - 4]
call fcn.004bd074
jmp 0x4b5677
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1c], eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0xda4]
call fcn.004032bc
mov edx, 0x4b7bf0
lea eax, [ebp - 0xda4]
mov cl, 0x89
call fcn.0040328c
lea edx, [ebp - 0xda4]
lea eax, [ebp - 0x1bd8]
call fcn.0040536c
push dword [ebp - 0x1bd8]
lea edx, [ebp - 0x1bdc]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1bdc]
push 0x4b7c00
lea eax, [ebp - 0x1bd4]
mov edx, 3
call fcn.00405488
mov edx, dword [ebp - 0x1bd4]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
push 0x4b7c0c
lea edx, [ebp - 0x1be4]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1be4]
push 0x4b7c00
lea eax, [ebp - 0x1be0]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x1be0]
call fcn.0049839c
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
push 0x4b7c20
lea edx, [ebp - 0x1be8]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1be8]
push 0x4b6cf0
mov eax, dword [ebp + 8]
mov edx, 3
call fcn.00405488
mov edx, 0x4b7c2c
lea eax, [ebp - 0x1c7c]
call fcn.004032bc
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0x1c7c]
mov cl, 0x8d
call fcn.0040328c
lea edx, [ebp - 0x1c7c]
lea eax, [ebp - 0x1bec]
call fcn.0040536c
lea eax, [ebp - 0x1bec]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call fcn.004053d0
mov edx, dword [ebp - 0x1bec]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x1cfc]
call fcn.004032bc
mov edx, 0x4b7c38
lea eax, [ebp - 0x1cfc]
mov cl, 0x79
call fcn.0040328c
lea edx, [ebp - 0x1cfc]
lea eax, [ebp - 0x1c80]
call fcn.0040536c
lea eax, [ebp - 0x1c80]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x1d00]
call fcn.0040a3c4
mov edx, dword [ebp - 0x1d00]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1c80]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea edi, [edx + eax*2 + 0xc2b]
mov esi, 0x4b7344
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov byte [edx + eax*2 + 0xc6d], 0
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea esi, [edx + eax*2]
mov edi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x61a9d8]
mov edx, dword [ebp - 4]
mov byte [eax + edx], 0
mov eax, dword [ebp + 8]
call fcn.00405108
jmp 0x4b618e
imul eax, dword [ebp - 4], 0x65
mov edx, dword [0x61ad48]
add edx, eax
lea eax, [ebp - 0x1540]
call fcn.004032bc
mov edx, 0x4b7c50
lea eax, [ebp - 0x1540]
mov cl, 0x72
call fcn.0040328c
lea edx, [ebp - 0x1540]
lea eax, [ebp - 0x1d04]
call fcn.0040536c
lea eax, [ebp - 0x1d04]
push eax
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00491438
push edx
push eax
lea eax, [ebp - 0x1d08]
call fcn.0040a3c4
mov edx, dword [ebp - 0x1d08]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1d04]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x65
mov ecx, dword [0x61ad48]
lea eax, [ecx + eax]
mov cl, 0x64
call fcn.004032c8
cmp byte [ebp - 0x2d], 0
jne 0x4b5731
cmp dword [ebp - 0x14], 0xbb8
jle 0x4b5731
mov eax, dword [ebp - 4]
mov byte [eax + 0x6389f4], 1
lea edx, [ebp - 0x2ec]
mov ecx, 0x1ff
mov eax, dword [ebp - 4]
call fcn.005207c4
test al, al
je 0x4b5bac
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b7c60
mov cl, 0x82
call fcn.0040328c
mov dword [ebp - 0x1c], 0x16a
imul eax, dword [ebp - 4], 0x4b
mov edx, dword [0x61b460]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov cl, byte [ebp + ecx - 0x2ec]
mov byte [eax + edx - 0x16a], cl
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x200
jne 0x4b576f
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 4]
call fcn.00500678
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0x54]
call fcn.00500774
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 8]
lea eax, [edx + eax*2]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
mov al, byte [ebp + eax - 0x2e7]
mov edx, dword [ebp - 0xc8]
mov byte [edx + 4], al
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
mov al, byte [ebp + eax - 0x2ea]
mov edx, dword [ebp - 0xc8]
mov byte [edx + 1], al
mov eax, dword [ebp - 0xc8]
cmp byte [eax + 1], 1
jne 0x4b5860
lea edx, [ebp - 0x1d0c]
mov eax, dword [ebp - 0x54]
call fcn.00409b94
mov edx, dword [ebp - 0x1d0c]
mov eax, 0x4b7c70
call fcn.0040570c
test eax, eax
jle 0x4b5860
mov eax, dword [ebp - 0xc8]
cmp byte [eax + 4], 0
jne 0x4b5860
mov eax, dword [ebp - 0xc8]
mov al, byte [eax + 6]
mov edx, dword [ebp - 0xc8]
cmp al, byte [edx + 4]
jbe 0x4b5860
mov eax, dword [ebp - 0xc8]
mov al, byte [eax + 6]
inc eax
mov edx, dword [ebp - 0xc8]
mov byte [edx + 4], al
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
movzx eax, byte [ebp + eax - 0x2e9]
mov edx, dword [ebp - 0x1c]
shl edx, 2
lea edx, [edx + edx*2]
movzx edx, byte [ebp + edx - 0x2e8]
shl edx, 8
add ax, dx
mov edx, dword [ebp - 0xc8]
mov word [edx + 2], ax
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
mov al, byte [ebp + eax - 0x2e6]
mov edx, dword [ebp - 0xc8]
mov byte [edx + 5], al
lea ecx, [ebp - 0x2e]
mov eax, dword [ebp - 0xc8]
xor edx, edx
mov dl, byte [eax + 1]
mov eax, dword [ebp - 0x58]
call fcn.004ffd44
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov eax, dword [0x61aab4]
mov eax, dword [eax]
cdq
add dword [ebp - 0x38], eax
adc dword [ebp - 0x34], edx
push 0
push 0x1000000
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
movzx eax, byte [ebp + eax - 0x2e2]
xor edx, edx
call fcn.004061f4
push edx
push eax
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
movzx eax, byte [ebp + eax - 0x2e5]
xor edx, edx
add eax, dword [ebp - 0x38]
adc edx, dword [ebp - 0x34]
push edx
push eax
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
movzx eax, byte [ebp + eax - 0x2e4]
shl eax, 8
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
movzx eax, byte [ebp + eax - 0x2e3]
shl eax, 0x10
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
push 0
push pe_nt_image_headers32
push 0
push 0x1000000
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
movzx eax, byte [ebp + eax - 0x2e1]
xor edx, edx
call fcn.004061f4
call fcn.004061f4
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
push 0
push 0x10000
push 0
push 0x1000000
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
movzx eax, byte [ebp + eax - 0x2e0]
xor edx, edx
call fcn.004061f4
call fcn.004061f4
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
jne 0x4b59df
cmp dword [ebp - 0x38], 0
jae 0x4b59ef
jmp 0x4b59e1
jge 0x4b59ef
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
call fcn.004062b8
mov edx, dword [ebp - 0xc8]
mov byte [edx + 7], al
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 8
shr edx, 8
call fcn.004062b8
mov edx, dword [ebp - 0xc8]
mov byte [edx + 8], al
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 0x10
shr edx, 0x10
call fcn.004062b8
mov edx, dword [ebp - 0xc8]
mov byte [edx + 9], al
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 0x18
shr edx, 0x18
call fcn.004062b8
mov edx, dword [ebp - 0xc8]
mov byte [edx + 0xa], al
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 0x34]
xor edx, edx
call fcn.004062b8
mov edx, dword [ebp - 0xc8]
mov byte [edx + 0xb], al
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 0x34]
shr eax, 8
xor edx, edx
call fcn.004062b8
mov edx, dword [ebp - 0xc8]
mov byte [edx + 0xc], al
mov eax, dword [ebp - 0xc8]
mov cl, byte [eax + 4]
mov eax, dword [ebp - 0xc8]
mov dl, byte [eax + 6]
mov eax, dword [ebp - 0xc8]
mov al, byte [eax + 1]
call fcn.00526ce0
mov edx, dword [ebp - 0xc8]
mov byte [edx], al
mov eax, dword [ebp - 0xc8]
mov byte [eax + 0x40], 0
mov eax, dword [ebp - 0xc8]
cmp byte [eax + 6], 0
jne 0x4b5afd
mov eax, dword [ebp - 0xc8]
lea edi, [eax + 0xd]
mov esi, 0x4b7c78
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x4b5b90
mov eax, dword [ebp - 0xc8]
cmp byte [eax + 6], 0xff
jne 0x4b5b22
mov eax, dword [ebp - 0xc8]
lea edi, [eax + 0xd]
mov esi, 0x4b7c8c
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4b5b90
mov eax, dword [ebp - 0xc8]
mov al, byte [eax + 4]
mov edx, dword [ebp - 0xc8]
cmp al, byte [edx + 6]
jbe 0x4b5b49
mov eax, dword [ebp - 0xc8]
lea edi, [eax + 0xd]
mov esi, 0x4b7ca4
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b5b90
mov eax, dword [ebp - 0xc8]
mov byte [eax + 0x40], 1
mov eax, dword [ebp - 0xc8]
test byte [eax + 2], 1
jne 0x4b5b79
mov eax, dword [ebp - 0xc8]
lea edi, [eax + 0xd]
mov esi, 0x4b7ca8
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b5b90
mov eax, dword [ebp - 0xc8]
lea edi, [eax + 0xd]
mov esi, 0x4b7cc8
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1e
jne 0x4b57b7
mov edx, dword [ebp - 8]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.00529b60
jmp 0x4b5c22
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov edx, 0x4b7cf4
mov cl, 0x82
call fcn.0040328c
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea esi, [edx + eax*2]
mov edi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push dword [ebp - 0xb0]
push 0x4b6d74
lea eax, [ebp - 0x1d10]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0x1d10]
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp + 8]
call fcn.00405108
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
mov eax, 0x4b7cfc
call fcn.00402c78
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4b5ca2
push dword [ebp - 0xb0]
push 0x4b6d74
lea eax, [ebp - 0x98c]
push eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov ecx, 0xe
mov edx, dword [ebp - 0x1c]
call fcn.004029cc
lea edx, [ebp - 0x98c]
lea eax, [ebp - 0x1d14]
call fcn.0040536c
push dword [ebp - 0x1d14]
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.00405488
lea eax, [ebp - 0x1d18]
mov ecx, dword [ebp - 0xb0]
mov edx, 0x4b6cfc
call fcn.00405414
mov edx, dword [ebp - 0x1d18]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
mov ecx, dword [ebp - 8]
lea edi, [edx + eax*2]
mov esi, ecx
mov ecx, 0x328
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4b618e
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1c], eax
mov eax, 0x4b6c88
call fcn.0048cf1c
test al, al
je 0x4b5d3a
cmp dword [ebp - 4], 0
jne 0x4b5d3a
mov dword [ebp - 0x1c], 5
mov eax, 0x4b6c88
call fcn.0048cf1c
test al, al
je 0x4b5d59
cmp dword [ebp - 4], 7
jne 0x4b5d59
mov eax, dword [0x61ac04]
mov dword [eax], 8
cmp byte [0x613934], 2
jae 0x4b5d6f
cmp dword [ebp - 4], 1
jne 0x4b5d6f
mov dword [ebp - 0x1c], 0x20
cmp dword [ebp - 0x1c], 0x20
jne 0x4b60fd
mov eax, dword [ebp - 4]
mov edx, eax
shl eax, 4
add eax, edx
mov edx, dword [0x61add4]
cmp byte [edx + eax], 0
jne 0x4b0a26
xor eax, eax
mov al, byte [0x613934]
cmp eax, dword [ebp - 0x90]
jle 0x4b5e83
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call fcn.00491438
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x90]
mov eax, dword [0x61aedc]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_Sleep_1
lea eax, [ebp - 0x1d20]
imul edx, dword [ebp - 4], 0xc9
add edx, 0x62dd4c
call fcn.0040536c
push dword [ebp - 0x1d20]
lea edx, [ebp - 0x1d24]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1d24]
push 0x4b7d08
lea edx, [ebp - 0x1d28]
mov eax, dword [ebp - 0x90]
call fcn.0040a2d8
push dword [ebp - 0x1d28]
push 0x4b7d14
lea edx, [ebp - 0x1d2c]
mov eax, dword [ebp - 0x20]
call fcn.0040a2d8
push dword [ebp - 0x1d2c]
push 0x4b6d74
lea eax, [ebp - 0x1d1c]
mov edx, 7
call fcn.00405488
mov edx, dword [ebp - 0x1d1c]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0xc9
add eax, 0x62dd4c
mov cl, 0xc8
call fcn.004032c8
jmp 0x4afcba
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
cmp dword [eax + edx*4], 0
jne 0x4b6034
cmp dword [ebp - 0x1c], 0x20
jne 0x4b6034
mov eax, dword [ebp - 4]
call fcn.00527ba4
test al, al
jne 0x4b6034
push 0
push 0
push 3
push 0
mov eax, dword [ebp - 0xa8]
push eax
push 0
mov eax, dword [ebp - 0x18]
call fcn.00524050
lea edx, [ebp - 0x1d34]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x1d34]
lea eax, [ebp - 0x1d30]
mov edx, 0x4b6cb8
call fcn.00405414
mov eax, dword [ebp - 0x1d30]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1d3c]
call fcn.0040a3c4
mov ecx, dword [ebp - 0x1d3c]
lea eax, [ebp - 0x1d38]
mov edx, 0x4b7d20
call fcn.00405414
mov eax, dword [ebp - 0x1d38]
call fcn.0049839c
cmp dword [ebp - 0x2c], 0xffffffff
je 0x4b6034
lea eax, [ebp - 0x9f]
push eax
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x9e]
lea edx, [ebp - 0x9d]
mov eax, dword [ebp - 0x2c]
call fcn.00525490
mov byte [ebp - 0x94], al
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebp - 0x2c], 0xffffffff
cmp byte [ebp - 0x94], 0
je 0x4b602a
push 0x4b7d38
lea edx, [ebp - 0x1d44]
xor eax, eax
mov al, byte [ebp - 0x9d]
call fcn.0040a2d8
push dword [ebp - 0x1d44]
push 0x4b6d74
lea edx, [ebp - 0x1d48]
xor eax, eax
mov al, byte [ebp - 0x9e]
call fcn.0040a2d8
push dword [ebp - 0x1d48]
push 0x4b6d74
lea edx, [ebp - 0x1d4c]
xor eax, eax
mov al, byte [ebp - 0x9f]
call fcn.0040a2d8
push dword [ebp - 0x1d4c]
push 0x4b6d74
lea edx, [ebp - 0x1d50]
xor eax, eax
mov al, byte [ebp - 0xa0]
call fcn.0040a2d8
push dword [ebp - 0x1d50]
lea eax, [ebp - 0x1d40]
mov edx, 8
call fcn.00405488
mov eax, dword [ebp - 0x1d40]
call fcn.0049839c
xor eax, eax
mov al, byte [ebp - 0x9d]
add eax, 0xf4240
mov dword [ebp - 0xb4], eax
jmp 0x4b1dac
mov eax, 0x4b7d50
call fcn.0049839c
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
cmp dword [eax + edx*4], 0
jne 0x4b609a
mov dword [ebp - 0x20], 1
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
lea eax, [eax + edx*4]
mov edx, 0x4b763c
call fcn.004053d0
mov eax, dword [0x61ad04]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x201
jne 0x4b6049
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0xca2
call fcn.0040345c
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea edi, [edx + eax]
mov esi, 0x4b7d60
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x637a54], 0
jne 0x4af8ba
push 0
push 0x100000
push 1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b83f0
call fcn.0040623c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4af8ba
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax*4 + 0x637a54], edx
jmp 0x4af8ba
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0xf94]
call fcn.004032bc
mov edx, 0x4b7d68
lea eax, [ebp - 0xf94]
mov cl, 0x86
call fcn.0040328c
lea edx, [ebp - 0xf94]
lea eax, [ebp - 0x1d54]
call fcn.0040536c
lea eax, [ebp - 0x1d54]
push eax
lea edx, [ebp - 0x1d58]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
mov edx, dword [ebp - 0x1d58]
pop eax
call fcn.004053d0
mov edx, dword [ebp - 0x1d54]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
cmp dword [ebp - 4], 1
jne 0x4b6265
mov eax, 0x4b7d78
call fcn.0048cf1c
test al, al
jne 0x4b61b3
cmp byte [0x613948], 0
je 0x4b6265
mov edx, dword [ebp - 4]
mov eax, 0x4b71d8
call fcn.004bc3d8
lea eax, [ebp - 0x58]
mov edx, dword [0x61ad04]
mov edx, dword [edx + 4]
call fcn.004051a0
lea eax, [ebp - 0x58]
xor edx, edx
call fcn.005240e8
mov edx, dword [ebp - 0x58]
mov eax, 0x4b7d8c
call fcn.0040570c
test eax, eax
jg 0x4b61fd
mov edx, dword [ebp - 0x58]
mov eax, 0x4b7da0
call fcn.0040570c
test eax, eax
jle 0x4b620d
mov eax, dword [0x61ad04]
add eax, 4
mov edx, dword [ebp - 0x58]
call fcn.0040515c
mov edx, dword [ebp - 0x58]
mov eax, 0x4b7db8
call fcn.0040570c
test eax, eax
jle 0x4b622e
mov eax, dword [0x61ad04]
add eax, 4
mov edx, dword [ebp - 0x58]
call fcn.0040515c
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea edx, [edx + eax*2]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.00529b60
imul eax, dword [ebp - 4], 0x651
mov edx, dword [0x61ae8c]
lea eax, [edx + eax*2]
mov edx, dword [ebp - 8]
mov ecx, 0xca2
call fcn.00402a8c
lea edx, [ebp - 0x1d5c]
mov eax, dword [ebp - 4]
call fcn.004fff48
mov eax, dword [ebp - 0x1d5c]
lea edx, [ebp - 0x58]
call fcn.00409b94
cmp dword [ebp - 4], 1
jne 0x4b62a2
mov eax, 0x4b7dc8
call fcn.0048cf1c
test al, al
je 0x4b62a2
lea eax, [ebp - 0x58]
mov edx, 0x4b7dd8
call fcn.004051a0
mov edx, dword [ebp - 0x58]
mov eax, 0x4b7df4
call fcn.0040570c
test eax, eax
jle 0x4b6347
mov edx, dword [ebp - 0x58]
mov eax, 0x4b7e04
call fcn.0040570c
test eax, eax
jle 0x4b6347
mov eax, dword [ebp - 4]
call fcn.004be3bc
test eax, eax
jle 0x4b6347
mov edx, 0x4b6b9c
lea eax, [ebp - 0x1a6c]
call fcn.004032bc
lea eax, [ebp - 0x98c]
push eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov ecx, 0xfa
mov edx, 6
call fcn.004029cc
lea edx, [ebp - 0x98c]
lea eax, [ebp - 0x1a6c]
mov cl, 0x87
call fcn.0040328c
lea edx, [ebp - 0x1a6c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
mov edx, 0x4b6bac
call fcn.0040515c
cmp dword [ebp - 4], 1
jne 0x4b6368
mov eax, 0x4b7e14
call fcn.0048cf1c
test al, al
je 0x4b6368
lea eax, [ebp - 0x58]
mov edx, 0x4b7e24
call fcn.004051a0
mov byte [ebp - 0x30], 0
lea edx, [ebp - 0x1d60]
mov eax, dword [ebp - 0x58]
call fcn.00409b94
mov edx, dword [ebp - 0x1d60]
mov eax, 0x4b7484
call fcn.0040570c
test eax, eax
jle 0x4b63b4
mov edx, dword [ebp - 0x58]
mov eax, 0x4b7e44
call fcn.0040570c
test eax, eax
jg 0x4b63b0
mov edx, dword [ebp - 0x58]
mov eax, 0x4b7e54
call fcn.0040570c
test eax, eax
jle 0x4b63b4
mov byte [ebp - 0x30], 1
mov edx, dword [ebp - 0x58]
mov eax, 0x4b7e64
call fcn.0040570c
test eax, eax
jle 0x4b63c9
mov byte [ebp - 0x30], 1
lea eax, [ebp - 0x1d64]
push eax
mov eax, dword [0x61ad04]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
mov ecx, 4
mov edx, 0x101
call fcn.00405628
mov eax, dword [ebp - 0x1d64]
mov edx, 0x4b7e74
call fcn.00405514
jne 0x4b6400
mov byte [ebp - 0x30], 1
cmp byte [ebp - 0x30], 0
je 0x4b6485
mov eax, dword [ebp - 4]
call fcn.004bf2bc
test eax, eax
jle 0x4b6485
mov edx, 0x4b6b9c
lea eax, [ebp - 0x1a6c]
call fcn.004032bc
lea eax, [ebp - 0x98c]
push eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov ecx, 0xfa
mov edx, 6
call fcn.004029cc
lea edx, [ebp - 0x98c]
lea eax, [ebp - 0x1a6c]
mov cl, 0x87
call fcn.0040328c
lea edx, [ebp - 0x1a6c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
mov eax, dword [ebp + 8]
mov edx, 0x4b6bac
call fcn.0040515c
xor eax, eax
push ebp
push 0x4b654f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call fcn.00498580
push edx
push eax
lea eax, [ebp - 0x58]
call fcn.0040a3c4
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0xf94]
call fcn.004032bc
mov edx, 0x4b7e7c
lea eax, [ebp - 0xf94]
mov cl, 0x86
call fcn.0040328c
lea edx, [ebp - 0xf94]
lea eax, [ebp - 0x1d6c]
call fcn.0040536c
push dword [ebp - 0x1d6c]
push dword [ebp - 0x58]
push 0x4b7e8c
lea eax, [ebp - 0x1d68]
mov edx, 3
call fcn.00405488
mov edx, dword [ebp - 0x1d68]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6620
mov eax, 0x4b7eb8
call fcn.0049839c
lea eax, [ebp - 0x98c]
push eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov ecx, 4
mov edx, 1
call fcn.004029cc
lea eax, [ebp - 0x98c]
mov edx, 0x4b6b74
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403368
je 0x4b66a8
lea eax, [ebp - 0x1e10]
push eax
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
lea eax, [edx + eax]
mov ecx, 4
mov edx, 1
call fcn.004029cc
lea eax, [ebp - 0x1e10]
mov edx, 0x4b7ec0
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403368
jne 0x4b67bf
call fcn.0040c8dc
fstp qword [ebp - 0x80]
wait
push 0
push 0x100000
push 0
push 0
push 1
mov eax, dword [ebp - 4]
add eax, eax
lea ecx, [eax*8 + 0x637d7c]
mov eax, dword [ebp - 4]
add eax, eax
lea edx, [eax*8 + 0x637d74]
mov eax, dword [ebp - 4]
call fcn.004b8ba0
call fcn.0040623c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4b66f9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax*4 + 0x637a54], edx
call fcn.0040c8dc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call fcn.00498580
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1388
jl 0x4b67bf
imul eax, dword [ebp - 4], 0x83
mov edx, dword [0x61af88]
add edx, eax
lea eax, [ebp - 0xda4]
call fcn.004032bc
mov edx, 0x4b7ec8
lea eax, [ebp - 0xda4]
mov cl, 0x89
call fcn.0040328c
lea edx, [ebp - 0xda4]
lea eax, [ebp - 0x1e18]
call fcn.0040536c
push dword [ebp - 0x1e18]
lea edx, [ebp - 0x1e1c]
mov eax, dword [ebp - 0x20]
call fcn.0040a2d8
push dword [ebp - 0x1e1c]
push 0x4b7e8c
lea eax, [ebp - 0x1e14]
mov edx, 3
call fcn.00405488
mov edx, dword [ebp - 0x1e14]
lea eax, [ebp - 0xa9c]
mov ecx, 0xff
call fcn.004053a4
lea edx, [ebp - 0xa9c]
imul eax, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea eax, [ecx + eax]
mov cl, 0x82
call fcn.004032c8
xor eax, eax
push ebp
push 0x4b6856
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b7ed8
lea edx, [ebp - 0x1e24]
mov eax, dword [ebp - 0x1c]
call fcn.0040a2d8
push dword [ebp - 0x1e24]
push 0x4b7ef0
mov eax, dword [ebp - 4]
add eax, eax
push dword [eax*8 + 0x637d78]
push dword [eax*8 + 0x637d74]
lea eax, [ebp - 0x1e28]
call fcn.0040a3c4
push dword [ebp - 0x1e28]
push 0x4b7f04
lea edx, [ebp - 0x1e2c]
mov eax, dword [ebp - 4]
add eax, eax
mov eax, dword [eax*8 + 0x637d7c]
call fcn.0040a2d8
push dword [ebp - 0x1e2c]
lea eax, [ebp - 0x1e20]
mov edx, 6
call fcn.00405488
mov eax, dword [ebp - 0x1e20]
call fcn.0049839c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6860
cmp byte [ebp - 9], 0
je 0x4b6888
call fcn.0040c8dc
mov eax, dword [0x61a8e0]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
call fcn.0040c8dc
mov eax, dword [0x61a980]
mov edx, dword [ebp - 4]
fstp qword [eax + edx*8]
wait
push 0x4b7f14
lea edx, [ebp - 0x1e34]
mov eax, dword [ebp - 4]
call fcn.0040a2d8
push dword [ebp - 0x1e34]
push 0x4b7f24
mov eax, dword [ebp + 8]
push dword [eax]
push 0x4b7f34
lea eax, [ebp - 0x1e38]
imul edx, dword [ebp - 4], 0x83
mov ecx, dword [0x61af88]
lea edx, [ecx + edx]
call fcn.0040536c
push dword [ebp - 0x1e38]
lea eax, [ebp - 0x1e30]
mov edx, 6
call fcn.00405488
mov eax, dword [ebp - 0x1e30]
call fcn.0049839c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6b43
lea eax, [ebp - 0x1e38]
mov edx, 0xa
call fcn.0040512c
lea eax, [ebp - 0x1d8c]
call fcn.00405108
lea eax, [ebp - 0x1d74]
mov edx, 0x1e
call fcn.0040512c
lea eax, [ebp - 0x1c80]
call fcn.00405108
lea eax, [ebp - 0x1bec]
mov edx, 0xc
call fcn.0040512c
lea eax, [ebp - 0x1b44]
mov edx, 0xb
call fcn.0040512c
lea eax, [ebp - 0x1a80]
mov edx, 5
call fcn.0040512c
lea eax, [ebp - 0x19e4]
mov edx, 0xe
call fcn.0040512c
lea eax, [ebp - 0x1924]
mov edx, 3
call fcn.0040512c
lea eax, [ebp - 0x18a0]
mov edx, 0xd
call fcn.0040512c
lea eax, [ebp - 0x186c]
mov edx, 0x15
call fcn.0040512c
lea eax, [ebp - 0x178c]
mov edx, 0x33
call fcn.0040512c
lea eax, [ebp - 0x1650]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0x15dc]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0x1548]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0x14cc]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0x145c]
mov edx, 4
call fcn.0040512c
lea eax, [ebp - 0x1374]
call fcn.00405108
lea eax, [ebp - 0x1308]
mov edx, 4
call fcn.0040512c
lea eax, [ebp - 0x1288]
mov edx, 3
call fcn.0040512c
lea eax, [ebp - 0x11ec]
call fcn.00405108
lea eax, [ebp - 0x111c]
mov edx, 4
call fcn.0040512c
lea eax, [ebp - 0x10a0]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0x1094]
call fcn.00405108
lea eax, [ebp - 0x1098]
call fcn.00405108
lea eax, [ebp - 0x1090]
mov edx, 0x1a
call fcn.0040512c
lea eax, [ebp - 0xfa0]
mov edx, 3
call fcn.0040512c
lea eax, [ebp - 0xf0c]
mov edx, 0xa
call fcn.0040512c
lea eax, [ebp - 0xe78]
mov edx, 0xb
call fcn.0040512c
lea eax, [ebp - 0xdb8]
mov edx, 5
call fcn.0040512c
lea eax, [ebp - 0xd18]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0xca0]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0xb98]
mov edx, 0x28
call fcn.0040512c
lea eax, [ebp - 0xaf8]
mov edx, 0x17
call fcn.0040512c
lea eax, [ebp - 0x99c]
mov edx, 4
call fcn.0040512c
lea eax, [ebp - 0x908]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0xb0]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 0x64]
mov edx, 0xb
call fcn.0040512c
ret