Function at 0x4beda0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x48
push 0
push 0
dec ecx
jne 0x4beda8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405288
mov esi, 0x96d9d4
mov edi, dword [0x59bd28]
xor eax, eax
push ebp
push 0x4c0e29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x96d9c0
call fcn.00404dd8
push esi
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x4c0e44
call fcn.0047b71c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004052f8
cmp dword [esi], 0
jne 0x4bee1c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404e2c
xor eax, eax
mov dword [0x96d9dc], eax
jmp 0x4bee72
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004c7080
mov dword [0x96d9dc], eax
mov ebx, dword [0x96d9dc]
test ebx, ebx
jle 0x4bee72
mov dword [0x96d9d8], 1
push 1
lea eax, [ebp - 0x14]
push eax
mov cl, 1
mov edx, dword [0x96d9d8]
mov eax, dword [ebp - 4]
call fcn.004c70f8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x96d9d8]
lea eax, [eax*4 + 0x96d8f0]
call fcn.00404e2c
inc dword [0x96d9d8]
dec ebx
jne 0x4bee3f
mov eax, dword [esi]
mov edx, 0x4c0e50
call fcn.004051e4
jne 0x4bef5d
mov dl, 1
mov eax, dword [0x41ba20]
call fcn.00403f74
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x18]
mov eax, 0x96d9cc
call fcn.00404e2c
xor eax, eax
push ebp
push 0x4beee2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x96d9cc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bef1d
mov eax, dword [ebp - 8]
call fcn.004bb110
mov ebx, dword [0x96d8e0]
mov eax, dword [ebp - 8]
mov dword [0x96d8e0], eax
call fcn.004bcf6c
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd]
or ecx, 0xffffffff
xor edx, edx
call fcn.004bd000
mov dword [0x96d8e0], ebx
call fcn.004bcf6c
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0e88
call fcn.004051e4
jne 0x4bef7d
mov eax, dword [edi]
mov eax, dword [eax + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x80]
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0e98
call fcn.004051e4
jne 0x4bf08f
mov dl, 1
mov eax, dword [0x41ba20]
call fcn.00403f74
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x28]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d8f0]
mov eax, dword [0x96d9cc]
call fcn.004caa08
inc eax
jne case.default.0x4bf195
xor eax, eax
push ebp
push 0x4bf004
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x96d9cc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf03f
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d8f0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.004bb110
mov ebx, dword [0x96d8e0]
mov eax, dword [ebp - 8]
mov dword [0x96d8e0], eax
call fcn.004bcf6c
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xd]
or ecx, 0xffffffff
xor edx, edx
call fcn.004bd000
mov dword [0x96d8e0], ebx
call fcn.004bcf6c
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0eb0
call fcn.004051e4
mov eax, dword [esi]
mov edx, 0x4c0ec4
call fcn.004051e4
jne 0x4bf0c4
mov ecx, dword [0x96d8f8]
mov edx, dword [0x96d8f4]
mov eax, dword [0x96d8d0]
call fcn.004cca58
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0ed4
call fcn.004051e4
jne 0x4bf0ec
mov edx, dword [0x96d8f4]
mov eax, dword [0x96d8d0]
call fcn.004cc3b0
call fcn.004cd820
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0ee4
call fcn.004051e4
jne 0x4bf10f
mov edx, dword [0x96d8f4]
mov eax, dword [0x96d8d0]
call fcn.004cd170
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0ef4
call fcn.004051e4
jne 0x4bf132
mov edx, dword [0x96d8f4]
mov eax, dword [0x96d8d0]
call fcn.004cd198
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0f04
call fcn.004051e4
jne 0x4bf274
cmp dword [0x96d9dc], 1
jne 0x4bf174
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
call fcn.004157fc
lea eax, [ebp - 0x44]
call fcn.004c6f54
jmp case.default.0x4bf195
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, dword [0x96d8f8]
call fcn.004c8490
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
add eax, 0xffffffd0
cmp eax, 4
ja case.default.0x4bf195
jmp dword [eax*4 + 0x4bf19c]
lea ecx, [ebp - 0x60]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
call fcn.004157fc
lea eax, [ebp - 0x5c]
call fcn.004c6f54
jmp case.default.0x4bf195
push 0
lea ecx, [ebp - 0x64]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x64]
mov cx, word [0x4c0f0c]
mov dl, 2
call fcn.004385f4
dec eax
jmp case.default.0x4bf195
push 0
lea ecx, [ebp - 0x68]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x68]
mov cx, word [0x4c0f0c]
mov dl, 1
call fcn.004385f4
jmp case.default.0x4bf195
push 0
lea ecx, [ebp - 0x6c]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x6c]
mov cx, word [0x4c0f0c]
xor edx, edx
call fcn.004385f4
jmp case.default.0x4bf195
push 0
lea ecx, [ebp - 0x70]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x70]
mov cx, word [0x4c0f0c]
mov dl, 3
call fcn.004385f4
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0f18
call fcn.004051e4
jne 0x4bf2a9
push 0
lea ecx, [ebp - 0x74]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x74]
mov cx, word [0x4c0f0c]
mov dl, 2
call fcn.004385f4
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0f30
call fcn.004051e4
jne 0x4bf2de
push 0
lea ecx, [ebp - 0x78]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x78]
mov cx, word [0x4c0f0c]
mov dl, 1
call fcn.004385f4
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0f48
call fcn.004051e4
jne 0x4bf313
push 0
lea ecx, [ebp - 0x7c]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x7c]
mov cx, word [0x4c0f0c]
xor edx, edx
call fcn.004385f4
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0f60
call fcn.004051e4
jne 0x4bf348
push 0
lea ecx, [ebp - 0x80]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x80]
mov cx, word [0x4c0f0c]
mov dl, 3
call fcn.004385f4
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0f78
call fcn.004051e4
jne 0x4bf36b
mov eax, dword [0x96d8f4]
call fcn.004be5e0
push eax
call sub.user32.dll_MessageBeep
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0f90
call fcn.004051e4
jne 0x4bf397
mov eax, dword [edi]
mov eax, dword [eax + 0x6c]
call fcn.004762a4
mov eax, dword [0x59bb04]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.004762a4
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0fa0
call fcn.004051e4
jne 0x4bf3b6
mov eax, dword [0x59bb04]
mov eax, dword [eax]
call fcn.0047939c
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0fb0
call fcn.004051e4
je 0x4bf3d2
mov eax, dword [esi]
mov edx, 0x4c0fc0
call fcn.004051e4
jne 0x4bf438
cmp dword [0x96d9dc], 1
jne 0x4bf405
push 5
lea ecx, [ebp - 0x84]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x84]
call fcn.00405298
push eax
call sub.kernel32.dll_WinExec
jmp case.default.0x4bf195
mov eax, dword [0x96d8f8]
call fcn.004be5e0
push eax
lea ecx, [ebp - 0x88]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x88]
call fcn.00405298
push eax
call sub.kernel32.dll_WinExec
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0fd0
call fcn.004051e4
jne 0x4bf544
lea ecx, [ebp - 0x90]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.0040a4b0
mov eax, dword [ebp - 0x8c]
call fcn.004029b4
cmp dword [0x96d9dc], 1
jne 0x4bf4de
push 5
push 0x4c0fd4
push 0x4c0fd4
lea ecx, [ebp - 0xa8]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
call fcn.004157fc
lea eax, [ebp - 0xa4]
lea edx, [ebp - 0x94]
call fcn.004b9b20
mov eax, dword [ebp - 0x94]
call fcn.00405298
push eax
push 0x4c0fd8
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.default.0x4bf195
mov eax, dword [0x96d8f8]
call fcn.004be5e0
push eax
push 0x4c0fd4
push 0x4c0fd4
lea ecx, [ebp - 0xc0]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0xc0]
lea eax, [ebp - 0xbc]
call fcn.004157fc
lea eax, [ebp - 0xbc]
lea edx, [ebp - 0xac]
call fcn.004b9b20
mov eax, dword [ebp - 0xac]
call fcn.00405298
push eax
push 0x4c0fd8
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0fe8
call fcn.004051e4
jne 0x4bf5fb
cmp dword [0x96d9dc], 1
jle case.default.0x4bf195
push 5
push 0x4c0fd4
lea ecx, [ebp - 0xd8]
xor edx, edx
mov eax, dword [0x96d8f8]
call fcn.004c8490
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
call fcn.004157fc
lea eax, [ebp - 0xd4]
lea edx, [ebp - 0xc4]
call fcn.004b9b20
mov eax, dword [ebp - 0xc4]
call fcn.00405298
push eax
lea ecx, [ebp - 0xf0]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
call fcn.004157fc
lea eax, [ebp - 0xec]
lea edx, [ebp - 0xdc]
call fcn.004b9b20
mov eax, dword [ebp - 0xdc]
call fcn.00405298
push eax
push 0x4c0fd8
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c0ff8
call fcn.004051e4
jne 0x4bf70b
cmp dword [0x96d9dc], 1
jne 0x4bf673
push 5
push 0x4c0fd4
push 0x4c0fd4
lea ecx, [ebp - 0x108]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.004157fc
lea eax, [ebp - 0x104]
lea edx, [ebp - 0xf4]
call fcn.004b9b20
mov eax, dword [ebp - 0xf4]
call fcn.00405298
push eax
push 0x4c0fd8
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.default.0x4bf195
push 1
push 0x4c0fd4
lea ecx, [ebp - 0x120]
xor edx, edx
mov eax, dword [0x96d8f8]
call fcn.004c8490
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
call fcn.004157fc
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x10c]
call fcn.004b9b20
mov eax, dword [ebp - 0x10c]
call fcn.00405298
push eax
lea ecx, [ebp - 0x138]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
call fcn.004157fc
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x124]
call fcn.004b9b20
mov eax, dword [ebp - 0x124]
call fcn.00405298
push eax
push 0x4c0fd8
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c1010
call fcn.004051e4
jne 0x4bf739
mov eax, dword [0x96d8f8]
call fcn.004be5e0
push eax
mov eax, dword [0x96d8f4]
call fcn.004be5e0
push eax
call sub.user32.dll_ShowWindow
jmp case.default.0x4bf195
mov eax, dword [esi]
cmp byte [eax], 0x24
jne 0x4bf897
lea eax, [ebp - 0x13c]
push eax
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c1024
call fcn.0047b71c
mov ecx, eax
mov edx, 1
mov eax, dword [esi]
call fcn.004be7ac
mov edx, dword [ebp - 0x13c]
mov eax, 0x96d9cc
call fcn.00404e2c
lea ecx, [ebp - 0x140]
mov edx, 0x4c1024
mov eax, dword [esi]
call fcn.004be810
mov edx, dword [ebp - 0x140]
mov eax, esi
call fcn.00404e2c
mov edx, dword [esi]
mov eax, dword [0x96d8d0]
call fcn.004cc2f8
sub al, 0x16
je 0x4bf7c9
sub al, 0x68
jne 0x4bf801
mov edx, dword [esi]
mov eax, dword [0x96d8d0]
call fcn.004cc498
mov edx, dword [0x96d9cc]
call fcn.004b255c
jmp case.default.0x4bf195
push dword [esi]
push 0x4c1024
push dword [0x96d9cc]
lea eax, [ebp - 0x148]
mov edx, 3
call fcn.00405158
mov edx, dword [ebp - 0x148]
lea ecx, [ebp - 0x144]
mov eax, dword [0x96d8d0]
call fcn.004cc7d8
jmp case.default.0x4bf195
mov edx, dword [esi]
mov eax, dword [0x96d8d8]
call fcn.004cc2f8
sub al, 0x16
je 0x4bf831
sub al, 0x68
jne 0x4bf869
mov edx, dword [esi]
mov eax, dword [0x96d8d8]
call fcn.004cc498
mov edx, dword [0x96d9cc]
call fcn.004b255c
jmp case.default.0x4bf195
push dword [esi]
push 0x4c1024
push dword [0x96d9cc]
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00405158
mov edx, dword [ebp - 0x150]
lea ecx, [ebp - 0x14c]
mov eax, dword [0x96d8d8]
call fcn.004cc7d8
jmp case.default.0x4bf195
lea eax, [ebp - 0x154]
mov ecx, 0x4c1030
mov edx, dword [esi]
call fcn.004050e4
mov ecx, dword [ebp - 0x154]
mov dl, 1
mov eax, dword [0x4088d8]
call fcn.0040d8c8
call fcn.00404770
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c1048
call fcn.004051e4
jne 0x4bf95f
lea ecx, [ebp - 0x158]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0x158]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x59cfbc]
mov eax, dword [0x96d9cc]
call fcn.004caa08
mov dword [0x96d9e0], eax
cmp dword [0x96d9e0], 0xffffffff
jne 0x4bf932
lea ecx, [ebp - 0x15c]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov edx, dword [ebp - 0x15c]
mov eax, dword [0x59cfbc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x160]
xor edx, edx
mov eax, dword [0x96d8f8]
call fcn.004c8490
mov edx, dword [ebp - 0x160]
mov eax, dword [0x59cfc0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp case.default.0x4bf195
lea ecx, [ebp - 0x164]
xor edx, edx
mov eax, dword [0x96d8f8]
call fcn.004c8490
mov ecx, dword [ebp - 0x164]
mov edx, dword [0x96d9e0]
mov eax, dword [0x59cfc0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c1058
call fcn.004051e4
jne 0x4bf994
lea ecx, [ebp - 0x168]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x168]
call fcn.004029b4
call fcn.00402978
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c1068
call fcn.004051e4
je 0x4bf9d0
mov eax, dword [esi]
mov edx, 0x4c107c
call fcn.004051e4
je 0x4bf9d0
mov eax, dword [esi]
mov edx, 0x4c1090
call fcn.004051e4
je 0x4bf9d0
mov eax, dword [esi]
mov edx, 0x4c10a4
call fcn.004051e4
jne 0x4bfa99
lea ecx, [ebp - 0x170]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.004095a4
mov edx, dword [ebp - 0x16c]
mov eax, 0x96d9cc
call fcn.00404e2c
mov eax, dword [edi]
call fcn.0047752c
mov ebx, eax
dec ebx
test ebx, ebx
jl case.default.0x4bf195
inc ebx
mov dword [0x96d9d8], 0
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov eax, dword [eax + 8]
lea edx, [ebp - 0x174]
call fcn.004095a4
mov eax, dword [ebp - 0x174]
mov edx, dword [0x96d9cc]
call fcn.004051e4
jne 0x4bfa8b
mov eax, dword [0x96d8f8]
call fcn.004be5e0
cmp eax, 7
jne 0x4bfa74
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
call fcn.00476444
jmp case.default.0x4bf195
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
call fcn.004762a4
jmp case.default.0x4bf195
inc dword [0x96d9d8]
dec ebx
jne 0x4bfa20
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c10b8
call fcn.004051e4
je 0x4bfad5
mov eax, dword [esi]
mov edx, 0x4c10cc
call fcn.004051e4
je 0x4bfad5
mov eax, dword [esi]
mov edx, 0x4c10e0
call fcn.004051e4
je 0x4bfad5
mov eax, dword [esi]
mov edx, 0x4c10f4
call fcn.004051e4
jne 0x4bfba1
lea ecx, [ebp - 0x17c]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.004095a4
mov edx, dword [ebp - 0x178]
mov eax, 0x96d9cc
call fcn.00404e2c
mov eax, dword [edi]
call fcn.0047752c
mov ebx, eax
dec ebx
test ebx, ebx
jl case.default.0x4bf195
inc ebx
mov dword [0x96d9d8], 0
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov eax, dword [eax + 8]
lea edx, [ebp - 0x180]
call fcn.004095a4
mov eax, dword [ebp - 0x180]
mov edx, dword [0x96d9cc]
call fcn.004051e4
jne 0x4bfb93
mov eax, dword [0x96d8f8]
call fcn.004be5e0
cmp eax, 7
jne 0x4bfb79
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
call fcn.0047644c
jmp case.default.0x4bf195
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [eax]
call dword [edx + 0xec]
jmp case.default.0x4bf195
inc dword [0x96d9d8]
dec ebx
jne 0x4bfb25
jmp case.default.0x4bf195
mov eax, dword [esi]
mov edx, 0x4c1108
call fcn.004051e4
je 0x4bfbdd
mov eax, dword [esi]
mov edx, 0x4c111c
call fcn.004051e4
je 0x4bfbdd
mov eax, dword [esi]
mov edx, 0x4c1130
call fcn.004051e4
je 0x4bfbdd
mov eax, dword [esi]
mov edx, 0x4c1144
call fcn.004051e4
jne 0x4bfe37
xor eax, eax
push ebp
push 0x4bfe1e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x188]
xor edx, edx
mov eax, dword [0x96d8f4]
call fcn.004c8490
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x184]
call fcn.004095a4
mov edx, dword [ebp - 0x184]
mov eax, 0x96d9cc
call fcn.00404e2c
mov eax, dword [edi]
mov eax, dword [eax + 0x6c]
mov eax, dword [eax + 0x40]
mov dword [0x96d9e4], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x6c]
mov eax, dword [eax + 0x44]
mov dword [0x96d9e8], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x6c]
mov eax, dword [eax + 0x48]
mov dword [0x96d9ec], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x6c]
mov eax, dword [eax + 0x4c]
mov dword [0x96d9f0], eax
mov eax, dword [edi]
call fcn.0047752c
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4bfdaf
inc ebx
mov dword [0x96d9d8], 0
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov eax, dword [eax + 8]
lea edx, [ebp - 0x18c]
call fcn.004095a4
mov eax, dword [ebp - 0x18c]
mov edx, dword [0x96d9cc]
call fcn.004051e4
jne 0x4bfda2
cmp dword [0x96d9dc], 1
jle 0x4bfd55
mov eax, dword [0x96d8f8]
call fcn.004be5e0
dec eax
je 0x4bfcc3
dec eax
je 0x4bfcf5
jmp 0x4bfd55
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [0x96d9e4]
call fcn.00459134
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [0x96d9e8]
call fcn.00459158
jmp 0x4bfd55
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [0x96d9e4]
call fcn.00459134
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [0x96d9e8]
call fcn.00459158
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [0x96d9ec]
call fcn.00459180
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [0x96d9f0]
call fcn.004591a4
cmp dword [0x96d9dc], 1
jne 0x4bfd8e
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [0x96d9e4]
call fcn.00459134
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov edx, dword [0x96d9e8]
call fcn.00459158
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
call fcn.0047644c
jmp 0x4bfdaf
inc dword [0x96d9d8]
dec ebx
jne 0x4bfc6f
mov eax, dword [edi]
call fcn.0047752c
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4bfe11
inc ebx
mov dword [0x96d9d8], 0
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov eax, dword [eax + 8]
lea edx, [ebp - 0x190]
call fcn.004095a4
mov eax, dword [ebp - 0x190]
mov edx, dword [0x96d9cc]
call fcn.004051e4
je 0x4bfe08
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
call fcn.00476444
inc dword [0x96d9d8]
dec ebx
jne 0x4bfdc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp case.default.0x4bf195
mov eax, dword [ebp - 4]
mov edx, 0x4c1158
call fcn.004051e4
jne 0x4bfea5
mov eax, dword [edi]
call fcn.0047752c
mov ebx, eax
sub ebx, 2
test ebx, ebx
jle case.default.0x4bf195
mov dword [0x96d9d8], 1
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov eax, dword [eax + 8]
mov edx, dword [edi]
mov edx, dword [edx + 0x6c]
mov edx, dword [edx + 8]
call fcn.004051e4
je 0x4bfe97
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc dword [0x96d9d8]
dec ebx
jne 0x4bfe64
jmp case.default.0x4bf195
mov eax, dword [ebp - 4]
mov edx, 0x4c1174
call fcn.004051e4
jne 0x4bff13
mov eax, dword [edi]
call fcn.0047752c
mov ebx, eax
sub ebx, 2
test ebx, ebx
jle case.default.0x4bf195
mov dword [0x96d9d8], 1
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov eax, dword [eax + 8]
mov edx, dword [edi]
mov edx, dword [edx + 0x6c]
mov edx, dword [edx + 8]
call fcn.004051e4
je 0x4bff05
mov eax, dword [edi]
mov edx, dword [0x96d9d8]
call fcn.00477518
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc dword [0x96d9d8]
dec ebx
jne 0x4bfed2
jmp case.default.0x4bf195
mov eax, dword [esi]
call fcn.004b92f0
mov dword [0x96d9e0], eax
cmp dword [0x96d9e0], 0xffffffff
je 0x4bff37
mov eax, dword [0x96d9e0]
call fcn.004c127c
jmp case.default.0x4bf195
lea eax, [ebp - 0x194]
mov ecx, dword [esi]
mov edx, 0x4c1190
call fcn.004050e4
mov eax, dword [ebp - 0x194]
call fcn.004b943c
mov dword [0x96d9e0], eax
cmp dword [0x96d9e0], 0xffffffff
je 0x4bff77
lea edx, [ebp - 0x198]
mov eax, dword [0x96d9e0]
call fcn.004c1944
jmp case.default.0x4bf195
mov eax, dword [esi]
call fcn.004b9588
mov dword [0x96d9e0], eax
cmp dword [0x96d9e0], 0xffffffff
je 0x4bffac
imul eax, dword [0x96d9e0], 0x22
mov edx, dword [0x96d8cc]
lea eax, [edx + eax*8]
lea edx, [ebp - 0x19c]
call fcn.004c2538
jmp case.default.0x4bf195
mov edx, 0x96d9d8
mov eax, dword [0x96d9c4]
call fcn.004c500c
mov dword [0x96d9e0], eax
cmp dword [0x96d9e0], 0xffffffff
je 0x4bfff2
lea eax, [ebp - 0x1a0]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1a0]
push eax
mov edx, 0x96d8f4
mov ecx, 0x31
mov eax, dword [0x96d9e0]
call fcn.004be904
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c119c
call fcn.0047b71c
test eax, eax
jle 0x4c0055
lea eax, [ebp - 0x1a8]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [esi]
call fcn.004be7ac
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x1a4]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x1a4]
mov eax, 0x96d9cc
call fcn.00404e2c
mov eax, dword [0x96d9cc]
call fcn.00409c00
mov ebx, eax
call ebx
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c0e98
call fcn.0047b71c
test eax, eax
jle 0x4c0201
mov dl, 1
mov eax, dword [0x41ba20]
call fcn.00403f74
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1b0]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [esi]
call fcn.004be7ac
mov eax, dword [ebp - 0x1b0]
lea ecx, [ebp - 0x1ac]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x1ac]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d8ec]
mov eax, dword [0x96d9cc]
call fcn.004caa08
inc eax
jne case.default.0x4bf195
xor eax, eax
push ebp
push 0x4c00f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x96d9cc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c0136
mov eax, dword [ebp - 8]
call fcn.004bb110
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d8ec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x96d8e8]
call fcn.00406198
inc eax
push eax
mov eax, 0x96d8e8
mov ecx, 1
mov edx, dword [0x4b8c4c]
call fcn.00406354
add esp, 4
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
mov eax, dword [0x96d8e8]
call fcn.004061a0
mov edx, dword [0x96d8e8]
lea eax, [edx + eax*4]
mov ecx, 1
mov edx, dword [0x4b8c28]
call fcn.00406354
add esp, 4
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl case.default.0x4bf195
inc ebx
mov dword [ebp - 0xc], 0
mov eax, dword [0x96d8e8]
call fcn.004061a0
mov edx, dword [0x96d8e8]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0xc]
lea eax, [eax + edx*4]
push eax
lea ecx, [ebp - 0x1b8]
mov edx, dword [0x96d9d8]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x1b8]
pop eax
call fcn.00404e2c
inc dword [ebp - 0xc]
dec ebx
jne 0x4c01bc
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c0e50
call fcn.0047b71c
test eax, eax
jle 0x4c0396
mov dl, 1
mov eax, dword [0x41ba20]
call fcn.00403f74
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c0]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [esi]
call fcn.004be7ac
mov eax, dword [ebp - 0x1c0]
lea ecx, [ebp - 0x1bc]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x1bc]
mov eax, 0x96d9cc
call fcn.00404e2c
xor eax, eax
push ebp
push 0x4c028a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x96d9cc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c02cb
mov eax, dword [ebp - 8]
call fcn.004bb110
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d8ec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x96d8e8]
call fcn.00406198
inc eax
push eax
mov eax, 0x96d8e8
mov ecx, 1
mov edx, dword [0x4b8c4c]
call fcn.00406354
add esp, 4
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
mov eax, dword [0x96d8e8]
call fcn.004061a0
mov edx, dword [0x96d8e8]
lea eax, [edx + eax*4]
mov ecx, 1
mov edx, dword [0x4b8c28]
call fcn.00406354
add esp, 4
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl case.default.0x4bf195
inc ebx
mov dword [ebp - 0xc], 0
mov eax, dword [0x96d8e8]
call fcn.004061a0
mov edx, dword [0x96d8e8]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0xc]
lea eax, [eax + edx*4]
push eax
lea ecx, [ebp - 0x1c8]
mov edx, dword [0x96d9d8]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x1c8]
pop eax
call fcn.00404e2c
inc dword [ebp - 0xc]
dec ebx
jne 0x4c0351
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c0fc0
call fcn.0047b71c
test eax, eax
jle 0x4c03e3
mov eax, esi
mov ecx, 4
mov edx, 1
call fcn.0047bcb0
push 5
lea ecx, [ebp - 0x1cc]
xor edx, edx
mov eax, dword [esi]
call fcn.004c8490
mov eax, dword [ebp - 0x1cc]
call fcn.00405298
push eax
call sub.kernel32.dll_WinExec
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c11ac
call fcn.0047b71c
test eax, eax
jle 0x4c0523
mov eax, esi
mov ecx, 6
mov edx, 1
call fcn.0047bcb0
mov dl, 0x2c
mov eax, dword [esi]
call fcn.004c7548
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle case.default.0x4bf195
mov edi, 1
push 0
lea eax, [ebp - 0x1d0]
push eax
mov cl, 0x2c
mov edx, edi
mov eax, dword [esi]
call fcn.004c7268
mov edx, dword [ebp - 0x1d0]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004c8690
test eax, eax
je 0x4c04ed
lea ecx, [ebp - 0x1d4]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be810
mov edx, dword [ebp - 0x1d4]
mov eax, 0x96d9d0
call fcn.00404e2c
lea ecx, [ebp - 0x1dc]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be890
mov eax, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x1d8]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x1d8]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c0516
mov ecx, dword [0x96d9cc]
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc5b8
jmp 0x4c0516
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c0516
mov ecx, 0x4c11c8
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d8d0]
call fcn.004cc5b8
inc edi
dec ebx
jne 0x4c0429
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c11d8
call fcn.0047b71c
test eax, eax
jle 0x4c0663
mov eax, esi
mov ecx, 6
mov edx, 1
call fcn.0047bcb0
mov dl, 0x2c
mov eax, dword [esi]
call fcn.004c7548
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle case.default.0x4bf195
mov edi, 1
push 0
lea eax, [ebp - 0x1e0]
push eax
mov cl, 0x2c
mov edx, edi
mov eax, dword [esi]
call fcn.004c7268
mov edx, dword [ebp - 0x1e0]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004c8690
test eax, eax
je 0x4c062d
lea ecx, [ebp - 0x1e4]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be810
mov edx, dword [ebp - 0x1e4]
mov eax, 0x96d9d0
call fcn.00404e2c
lea ecx, [ebp - 0x1ec]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be890
mov eax, dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1e8]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x1e8]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d8]
call fcn.004cc240
test al, al
jne 0x4c0656
mov ecx, dword [0x96d9cc]
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d8]
call fcn.004cc5b8
jmp 0x4c0656
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d8]
call fcn.004cc240
test al, al
jne 0x4c0656
mov ecx, 0x4c11e8
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d8d8]
call fcn.004cc5b8
inc edi
dec ebx
jne 0x4c0569
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c11f4
call fcn.0047b71c
test eax, eax
jle 0x4c07a3
mov eax, esi
mov ecx, 3
mov edx, 1
call fcn.0047bcb0
mov dl, 0x2c
mov eax, dword [esi]
call fcn.004c7548
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle case.default.0x4bf195
mov edi, 1
push 0
lea eax, [ebp - 0x1f0]
push eax
mov cl, 0x2c
mov edx, edi
mov eax, dword [esi]
call fcn.004c7268
mov edx, dword [ebp - 0x1f0]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004c8690
test eax, eax
je 0x4c076d
lea ecx, [ebp - 0x1f4]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be810
mov edx, dword [ebp - 0x1f4]
mov eax, 0x96d9d0
call fcn.00404e2c
lea ecx, [ebp - 0x1fc]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be890
mov eax, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x1f8]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x1f8]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c0796
mov ecx, dword [0x96d9cc]
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc5b8
jmp 0x4c0796
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c0796
mov ecx, 0x4c11c8
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d8d0]
call fcn.004cc5b8
inc edi
dec ebx
jne 0x4c06a9
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c1200
call fcn.0047b71c
dec eax
jne 0x4c08fa
mov eax, esi
mov ecx, 5
mov edx, 1
call fcn.0047bcb0
mov dl, 0x2c
mov eax, dword [esi]
call fcn.004c7548
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle case.default.0x4bf195
mov edi, 1
push 0
lea eax, [ebp - 0x200]
push eax
mov cl, 0x2c
mov edx, edi
mov eax, dword [esi]
call fcn.004c7268
mov edx, dword [ebp - 0x200]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004c8690
test eax, eax
je 0x4c08b6
lea ecx, [ebp - 0x204]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be810
mov edx, dword [ebp - 0x204]
mov eax, 0x96d9d0
call fcn.00404e2c
lea ecx, [ebp - 0x20c]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be890
mov eax, dword [ebp - 0x20c]
lea ecx, [ebp - 0x208]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x208]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c08ed
mov edx, dword [0x96d9d0]
mov eax, dword [0x59cfbc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x96d9cc]
mov eax, dword [0x59cfc0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4c08ed
push 0x4c1210
push dword [0x96d9cc]
push 0x4c1228
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.00405158
mov ecx, dword [ebp - 0x210]
mov dl, 1
mov eax, dword [0x4088d8]
call fcn.0040d8c8
call fcn.00404770
inc edi
dec ebx
jne 0x4c07e8
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c1244
call fcn.0047b71c
dec eax
jne 0x4c0a37
mov eax, esi
mov ecx, 3
mov edx, 1
call fcn.0047bcb0
mov dl, 0x2c
mov eax, dword [esi]
call fcn.004c7548
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle case.default.0x4bf195
mov edi, 1
push 0
lea eax, [ebp - 0x214]
push eax
mov cl, 0x2c
mov edx, edi
mov eax, dword [esi]
call fcn.004c7268
mov edx, dword [ebp - 0x214]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004c8690
test eax, eax
je 0x4c0a01
lea ecx, [ebp - 0x218]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be810
mov edx, dword [ebp - 0x218]
mov eax, 0x96d9d0
call fcn.00404e2c
lea ecx, [ebp - 0x220]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be890
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.004be704
mov edx, dword [ebp - 0x21c]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c0a2a
mov ecx, dword [0x96d9cc]
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc5b8
jmp 0x4c0a2a
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c0a2a
mov ecx, 0x4c1250
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d8d0]
call fcn.004cc5b8
inc edi
dec ebx
jne 0x4c093f
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [esi]
mov eax, 0x4c125c
call fcn.0047b71c
dec eax
jne 0x4c0b74
mov eax, esi
mov ecx, 5
mov edx, 1
call fcn.0047bcb0
mov dl, 0x2c
mov eax, dword [esi]
call fcn.004c7548
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle case.default.0x4bf195
mov edi, 1
push 0
lea eax, [ebp - 0x224]
push eax
mov cl, 0x2c
mov edx, edi
mov eax, dword [esi]
call fcn.004c7268
mov edx, dword [ebp - 0x224]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004c8690
test eax, eax
je 0x4c0b3e
lea ecx, [ebp - 0x228]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be810
mov edx, dword [ebp - 0x228]
mov eax, 0x96d9d0
call fcn.00404e2c
lea ecx, [ebp - 0x230]
mov edx, 0x4c11bc
mov eax, dword [0x96d9cc]
call fcn.004be890
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x22c]
call fcn.004be704
mov edx, dword [ebp - 0x22c]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c0b67
mov ecx, dword [0x96d9cc]
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc5b8
jmp 0x4c0b67
mov edx, dword [0x96d9d0]
mov eax, dword [0x96d8d0]
call fcn.004cc240
test al, al
jne 0x4c0b67
mov ecx, 0x4c1250
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d8d0]
call fcn.004cc5b8
inc edi
dec ebx
jne 0x4c0a7c
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x4c11bc
call fcn.0047b71c
test eax, eax
je 0x4c0c2e
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, 0x4c11bc
call fcn.0047b71c
mov dword [0x96d9e0], eax
push 0x96d9cc
mov ecx, dword [0x96d9e0]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004052f8
mov edx, 0x96d9cc
mov eax, dword [0x96d9cc]
call fcn.004b37ac
mov dword [0x96d9f4], eax
cmp dword [0x96d9f4], 0
je 0x4c0c2e
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [0x96d9e0]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004be7ac
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x234]
xor edx, edx
call fcn.004c8490
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 4]
call fcn.00404e70
lea ecx, [ebp - 4]
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d9f4]
call fcn.004b2050
jmp case.default.0x4bf195
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x4c1024
call fcn.0047b71c
dec eax
jle 0x4c0cd9
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x4c0e44
call fcn.0047b71c
test eax, eax
jne 0x4c0cd9
lea ecx, [ebp - 0x23c]
mov edx, 0x4c1024
mov eax, dword [ebp - 4]
call fcn.004be810
mov edx, dword [ebp - 0x23c]
mov eax, esi
call fcn.00404e2c
mov edx, 0x96d9cc
mov eax, dword [ebp - 4]
call fcn.004b37ac
mov dword [0x96d9f4], eax
lea eax, [ebp - 0x240]
push eax
mov ecx, 0x7fffffff
mov edx, dword [ebp - 4]
mov eax, 0x4c1024
call fcn.0047b85c
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004be7ac
mov edx, dword [ebp - 0x240]
mov eax, 0x96d9cc
call fcn.00404e2c
mov edx, dword [0x96d9cc]
mov eax, dword [0x96d9f4]
call fcn.004b255c
jmp case.default.0x4bf195
mov eax, dword [ebp - 4]
call fcn.00405098
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x3a
je case.default.0x4bf195
lea eax, [ebp - 0x244]
mov ecx, dword [esi]
mov edx, 0x4c126c
call fcn.004050e4
mov ecx, dword [ebp - 0x244]
mov dl, 1
mov eax, dword [0x4088d8]
call fcn.0040d8c8
call fcn.00404770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0e33
lea eax, [ebp - 0x244]
mov edx, 0x44
call fcn.00404dfc
lea eax, [ebp - 0x134]
call fcn.004111d4
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.00404dfc
lea eax, [ebp - 0x11c]
call fcn.004111d4
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00404dfc
lea eax, [ebp - 0x104]
call fcn.004111d4
lea eax, [ebp - 0xf4]
mov edx, 2
call fcn.00404dfc
lea eax, [ebp - 0xec]
call fcn.004111d4
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.00404dfc
lea eax, [ebp - 0xd4]
call fcn.004111d4
lea eax, [ebp - 0xc4]
mov edx, 2
call fcn.00404dfc
lea eax, [ebp - 0xbc]
call fcn.004111d4
lea eax, [ebp - 0xac]
mov edx, 2
call fcn.00404dfc
lea eax, [ebp - 0xa4]
call fcn.004111d4
lea eax, [ebp - 0x94]
mov edx, 0xd
call fcn.00404dfc
lea eax, [ebp - 0x60]
call fcn.00404dd8
lea eax, [ebp - 0x5c]
call fcn.004111d4
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00404dfc
lea eax, [ebp - 0x44]
call fcn.004111d4
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00404dfc
lea eax, [ebp - 4]
call fcn.00404dd8
ret