Function at 0x4d2cdc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x4d2ce4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d3ac4
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040ac7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
fstp qword [eax + 0x50]
wait
lea eax, [ebp - 0x10]
call fcn.004042b0
mov eax, dword [ebp - 4]
mov byte [eax + 0x410], 0x46
call sub.kernel32.dll_GetTickCount
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
push ebp
push 0x4d2e57
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x46
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3adc
mov edx, 0x4d3ae8
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x60]
push edx
mov ecx, 0x4d3afc
mov edx, 0x4d3b14
call fcn.0049e5c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x74]
cmp byte [eax + 0x10], 0
jne 0x4d2e4d
cmp byte [eax + 0x11], 0
jne 0x4d2dcf
push 0x46
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b24
mov edx, 0x4d3b30
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x68]
push edx
mov ecx, 0x4d3b40
mov edx, 0x4d3b14
call fcn.0049e5c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x74]
cmp byte [eax + 0x12], 0
jne 0x4d2e17
push 0x46
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b54
mov edx, 0x4d3b60
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x6c]
push edx
mov ecx, 0x4d3b7c
mov edx, 0x4d3b14
call fcn.0049e5c0
push 0x46
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b90
mov edx, 0x4d3b9c
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x64]
push edx
mov ecx, 0x4d3bac
mov edx, 0x4d3b14
call fcn.0049e5c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d2ec2
push 0x46
mov eax, dword [0x4dd4d8]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x188]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3c2c
call fcn.004d04fc
xor edx, edx
push ebp
push 0x4d39e4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x74]
cmp byte [eax + 0x10], 0
jne 0x4d345d
cmp byte [eax + 0x11], 0
jne 0x4d2fcc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
mov edx, 0x4d3c38
call fcn.00443fc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
call fcn.004444d4
push 0x50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b90
mov edx, 0x4d3c60
call fcn.004d04fc
push 0x2bf20
push 0x50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x68]
mov ecx, 0x4d3c74
mov eax, dword [ebp - 4]
call fcn.004d1098
call fcn.0049d968
test al, al
je 0x4d2f96
push 0x50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3c2c
mov edx, 0x4d3c84
call fcn.004d04fc
jmp 0x4d2fbd
lea eax, [ebp - 0x10]
mov edx, 0x4d3c98
call fcn.00404348
push 0x50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b54
mov edx, 0x4d3c98
call fcn.004d04fc
mov edx, 0x3c
mov eax, dword [ebp - 4]
call fcn.004d2cbc
jmp 0x4d2fe6
push 0x50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3bdc
mov edx, 0x4d3cac
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x74]
cmp byte [eax + 0x12], 0
jne 0x4d30b2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
mov edx, 0x4d3cc0
call fcn.00443fc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
call fcn.004444d4
push 0x5a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b90
mov edx, 0x4d3cf4
call fcn.004d04fc
push 0x2bf20
push 0x5a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x6c]
mov ecx, 0x4d3d14
mov eax, dword [ebp - 4]
call fcn.004d1098
call fcn.0049da84
test al, al
je 0x4d307c
push 0x5a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3c2c
mov edx, 0x4d3d30
call fcn.004d04fc
jmp 0x4d30a3
lea eax, [ebp - 0x10]
mov edx, 0x4d3d50
call fcn.00404348
push 0x5a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b54
mov edx, 0x4d3d50
call fcn.004d04fc
mov edx, 0x78
mov eax, dword [ebp - 4]
call fcn.004d2cbc
jmp 0x4d30cc
push 0x5a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3bdc
mov edx, 0x4d3d70
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
mov edx, 0x4d3d90
call fcn.00443fc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
call fcn.004444d4
push 0x64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b90
mov edx, 0x4d3dd0
call fcn.004d04fc
push 0x4d3de4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
push dword [eax + 0x20]
push 0x4d3e04
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404630
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x20]
call fcn.004095fc
test al, al
je 0x4d3172
xor eax, eax
push ebp
push 0x4d3168
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x20]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3172
push 0xffffffffffffffff
push 0x64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x64]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d1098
call fcn.0049d854
test al, al
jne 0x4d344e
push 0x65
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b24
mov edx, 0x4d3e10
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x70]
push edx
mov ecx, 0x4d3e28
mov edx, 0x4d3b14
call fcn.0049e5c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x20]
call fcn.004095fc
test al, al
je 0x4d3382
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x20]
mov eax, dword [0x49b0dc]
call fcn.0049b56c
test al, al
je 0x4d3300
xor eax, eax
push ebp
push 0x4d3230
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x24]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d323a
xor eax, eax
push ebp
push 0x4d3274
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3e0]
mov eax, dword [ebx + 0x24]
call fcn.00404770
push eax
mov eax, dword [ebx + 0x20]
call fcn.00404770
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d327e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x24]
mov eax, dword [0x49b0dc]
call fcn.0049b648
push dword [ebp - 0x18]
push 0x4d3e3c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x24]
mov edx, 0x14
mov eax, dword [0x49b0dc]
call fcn.0049b7ac
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404630
xor eax, eax
push ebp
push 0x4d32f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x24]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d334d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x20]
mov eax, dword [0x49b0dc]
call fcn.0049b648
push dword [ebp - 0x18]
push 0x4d3e3c
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x20]
mov edx, 0x14
mov eax, dword [0x49b0dc]
call fcn.0049b7ac
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404630
xor eax, eax
push ebp
push 0x4d3376
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x20]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d338f
lea eax, [ebp - 0x18]
mov edx, 0x4d3e50
call fcn.00404578
mov edx, dword [ebp - 0x18]
mov eax, dword [0x49b0dc]
call fcn.0049c5cc
mov ebx, eax
test ebx, ebx
jle 0x4d3434
push 0x65
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.00409010
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x4d3e6c
call fcn.004045bc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3adc
call fcn.004d04fc
push 0xffffffffffffffff
push 0x64
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.00409010
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x70]
mov eax, dword [ebp - 4]
call fcn.004d1098
push 0x65
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3e8c
mov edx, 0x4d3e98
call fcn.004d04fc
push 0xffffffffffffffff
push 0x64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x64]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d1098
jmp 0x4d344e
push 0x65
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3ec0
mov edx, 0x4d3ecc
call fcn.004d04fc
mov edx, 0x2d0
mov eax, dword [ebp - 4]
call fcn.004d2cbc
jmp 0x4d3477
push 0x64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3bdc
mov edx, 0x4d3ee0
call fcn.004d04fc
call fcn.0049d854
test al, al
je 0x4d37f6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x74]
cmp byte [eax + 0x10], 0
jne 0x4d34b0
push 0x64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3c2c
mov edx, 0x4d3ef4
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
mov edx, 0x4d3f08
call fcn.00443fc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
call fcn.004444d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
call fcn.0049e41c
push 0x6e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3bdc
mov edx, 0x4d3f2c
call fcn.004d04fc
push 0x4d3f44
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3e0]
push dword [ebx + 0x14]
push 0x4d3f64
push dword [ebx + 0x18]
push 0x4d3e04
lea eax, [ebp - 8]
mov edx, 5
call fcn.00404630
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x18]
call fcn.004095fc
test al, al
je 0x4d356c
xor eax, eax
push ebp
push 0x4d3562
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x18]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d356c
push 0xffffffffffffffff
push 0x6e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x60]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d1098
mov edx, 0x30c
mov eax, dword [ebp - 4]
call fcn.004d2cbc
lea edx, [ebp - 0xc]
mov eax, dword [0x49b0dc]
call fcn.0049c2b8
xor ebx, ebx
cmp dword [ebp - 0xc], 0
je 0x4d35b8
mov eax, dword [ebp - 0xc]
mov edx, 0x4d3f78
call fcn.004046bc
jne 0x4d35d5
inc ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x49b0dc]
call fcn.0049c2b8
push 0x1f4
call sub.kernel32.dll_Sleep_1
cmp ebx, 9
jl 0x4d35a3
cmp dword [ebp - 0xc], 0
je 0x4d35ee
mov eax, dword [ebp - 0xc]
mov edx, 0x4d3f78
call fcn.004046bc
jne 0x4d37ae
lea eax, [ebp - 0x10]
mov edx, 0x4d3f88
call fcn.00404348
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
add eax, 0x4c
mov edx, 0x4d3fb4
call fcn.00404304
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3e0]
mov ecx, dword [ebx + 0x14]
lea eax, [ebp - 0x14]
mov edx, 0x4d4024
call fcn.004045bc
mov eax, dword [ebx + 0x18]
call fcn.004095fc
test al, al
je 0x4d3774
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x18]
mov eax, dword [0x49b0dc]
call fcn.0049b56c
test al, al
je 0x4d373b
xor eax, eax
push ebp
push 0x4d3681
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x1c]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d368b
xor eax, eax
push ebp
push 0x4d36c5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3e0]
mov eax, dword [ebx + 0x1c]
call fcn.00404770
push eax
mov eax, dword [ebx + 0x18]
call fcn.00404770
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d36cf
push dword [ebp - 0x14]
push 0x4d3e3c
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x1c]
mov edx, 0x14
mov eax, dword [0x49b0dc]
call fcn.0049b7ac
push dword [ebp - 0x30]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404630
xor eax, eax
push ebp
push 0x4d372f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x1c]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3781
push dword [ebp - 0x14]
push 0x4d3e3c
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x18]
mov edx, 0x14
mov eax, dword [0x49b0dc]
call fcn.0049b7ac
push dword [ebp - 0x34]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404630
jmp 0x4d3781
lea eax, [ebp - 0x14]
mov edx, 0x4d3e50
call fcn.00404578
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov dword [eax + 0x40], 2
push 0x6e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b90
mov edx, dword [ebp - 0x14]
call fcn.004cfacc
jmp 0x4d39da
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
xor edx, edx
mov dword [eax + 0x40], edx
lea eax, [ebp - 0x10]
mov edx, 0x4d4044
call fcn.00404348
push 0x6e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3c2c
mov edx, 0x4d4044
call fcn.004d04fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
call fcn.0049e7a0
jmp 0x4d39da
lea eax, [ebp - 0x10]
mov edx, 0x4d405c
call fcn.00404348
lea eax, [ebp - 0x18]
mov edx, 0x4d405c
call fcn.00404348
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x20]
call fcn.004095fc
test al, al
je 0x4d398f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x20]
mov eax, dword [0x49b0dc]
call fcn.0049b56c
test al, al
je 0x4d3940
xor eax, eax
push ebp
push 0x4d3870
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x24]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d387a
xor eax, eax
push ebp
push 0x4d38b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3e0]
mov eax, dword [ebx + 0x24]
call fcn.00404770
push eax
mov eax, dword [ebx + 0x20]
call fcn.00404770
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d38be
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x24]
mov eax, dword [0x49b0dc]
call fcn.0049b648
push dword [ebp - 0x18]
push 0x4d3e3c
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x24]
mov edx, 0x14
mov eax, dword [0x49b0dc]
call fcn.0049b7ac
push dword [ebp - 0x38]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404630
xor eax, eax
push ebp
push 0x4d3934
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x24]
call fcn.00409718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d399c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax + 0x20]
mov eax, dword [0x49b0dc]
call fcn.0049b648
push dword [ebp - 0x18]
push 0x4d3e3c
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x20]
mov edx, 0x14
mov eax, dword [0x49b0dc]
call fcn.0049b7ac
push dword [ebp - 0x3c]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404630
jmp 0x4d399c
lea eax, [ebp - 0x18]
mov edx, 0x4d3e50
call fcn.00404578
push 0x64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov ecx, 0x4d3b54
mov edx, dword [ebp - 0x18]
call fcn.004cfacc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
add eax, 0x4c
mov edx, 0x4d4070
call fcn.00404304
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov dword [eax + 0x40], 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3a5a
mov eax, dword [ebp - 4]
mov byte [eax + 0x3d8], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x410], 0x78
push 0x78
lea edx, [ebp - 0x144]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x40]
call fcn.00409010
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, dword [ebp - 0x10]
call fcn.004d04fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3acb
lea eax, [ebp - 0x144]
call fcn.004042b0
lea eax, [ebp - 0x40]
mov edx, 0xf
call fcn.004042d4
ret