Function at 0x4a06e8
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], ecx
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a1746
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x4a07a4
mov eax, dword [ebp - 8]
cmp byte [eax + 0xb0], 0
je 0x4a07a4
mov eax, dword [ebp - 8]
cmp dword [eax + 0x178], 0
je 0x4a077e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x178]
call fcn.00447b38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x178]
call fcn.00447b60
mov eax, dword [ebp - 8]
add eax, 0x178
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x4c]
call fcn.00404ebc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x423]
mov dl, 1
mov eax, dword [0x4965e0]
call fcn.004a2f24
mov edx, dword [ebp - 8]
mov dword [edx + 0x178], eax
jmp 0x4a1723
xor ecx, ecx
push ebp
push 0x4a1719
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x138], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x180], 0
mov cl, 1
mov dl, 1
mov eax, dword [0x456670]
call fcn.00456bbc
mov dword [ebp - 0x34], eax
xor ecx, ecx
push ebp
push 0x4a1708
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov byte [ebp - 0x29], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x134], edx
cmp byte [ebp - 9], 0
je 0x4a0b44
xor eax, eax
push ebp
push 0x4a0886
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 0xa0], 0
je 0x4a087c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
mov edx, dword [eax + 0x50]
mov dword [ebp - 0x40], edx
mov edx, dword [eax + 0x54]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
xor edx, edx
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
mov dl, 3
call fcn.004477cc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
call fcn.00447b38
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xa0], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0890
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486a48
dec eax
test eax, eax
jl 0x4a0a4e
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x8d], 1
jne 0x4a0a42
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0xac]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
test esi, esi
je 0x4a0a42
cmp dword [esi + 0x20], 0
je 0x4a0a42
mov dl, 1
mov eax, dword [0x4a05fc]
call fcn.00404e8c
mov ebx, eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 8]
call fcn.00406f08
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xac]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xa8]
mov dword [ebx + 0xc], eax
lea edx, [ebp - 0x64]
mov eax, esi
call fcn.00487484
mov edx, dword [ebp - 0x64]
lea eax, [ebx + 0x10]
call fcn.00406f08
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x14], eax
xor edx, edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x1c], eax
movzx eax, byte [esi + 0x30]
mov byte [ebx + 0x20], al
movzx eax, byte [esi + 0x31]
mov byte [ebx + 0x21], al
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0x24]
imul edx, dword [edx + 0xc0], 0x85
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x620]
mov edx, dword [ecx + edx + 0x27]
call fcn.00406f08
lea eax, [ebx + 0x28]
mov edx, dword [ebp - 0x24]
imul edx, dword [edx + 0xc0], 0x85
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x620]
mov edx, dword [ecx + edx + 0x2b]
call fcn.00406f08
mov eax, dword [ebp - 0x24]
imul eax, dword [eax + 0xc0], 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov eax, dword [edx + eax + 0x37]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [eax + 0xc0], 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov eax, dword [edx + eax + 0x3f]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [eax + 0xc0], 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov eax, dword [edx + eax + 0x43]
mov dword [ebx + 0x34], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0xac]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x18]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 0x34]
mov edx, ebx
call fcn.0043cfa0
inc dword [ebp - 0x18]
dec dword [ebp - 0x44]
jne 0x4a08b2
xor eax, eax
push ebp
push 0x4a0a86
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
add eax, 0x620
mov ecx, 1
mov edx, dword [0x46765c]
call fcn.00408ab8
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0a90
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
xor edx, edx
mov dword [eax + 0x61c], edx
mov eax, dword [ebp - 8]
add eax, 0xd8
mov edx, dword [eax]
mov dword [ebp - 0x50], edx
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x50]
call fcn.00404ebc
push 0x1e
push 0x64
mov ecx, 0x22
mov dl, 1
mov eax, dword [0x467390]
call fcn.004759c4
mov edx, dword [ebp - 8]
mov dword [edx + 0xd8], eax
push 0xf
call sub.user32.dll_GetSysColor
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xd8]
mov dword [edx + 0x15], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x12c], 0
je 0x4a0b16
mov eax, dword [ebp - 8]
add eax, 0x12c
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x58]
call fcn.00404ebc
mov eax, dword [ebp - 8]
cmp dword [eax + 0x130], 0
je 0x4a0b44
mov eax, dword [ebp - 8]
add eax, 0x130
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x60]
call fcn.00404ebc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xd8]
mov dl, 1
mov eax, dword [0x4831b4]
call fcn.00486930
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x12c], ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xe0]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xdc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xe0], 0x20
setne al
push eax
mov ecx, dword [0x4bf8b0]
movzx ecx, byte [ecx]
mov eax, ebx
mov edx, 0x4a1760
call fcn.00486ce8
mov edx, dword [0x4bf8dc]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
call fcn.00486b68
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xd8]
mov dl, 1
mov eax, dword [0x4831b4]
call fcn.00486930
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x130], ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xe0]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xdc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xe0], 0x20
setne al
push eax
mov ecx, dword [0x4bf8b0]
movzx ecx, byte [ecx]
mov edx, dword [0x4bf69c]
mov edx, dword [edx]
mov eax, ebx
call fcn.00486c50
mov edx, dword [0x4bf8dc]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486b68
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
cmp byte [eax + 0x1c], 0
jne 0x4a0c55
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
cmp byte [eax + 0x1c], 0
jne 0x4a0c55
mov eax, dword [0x4bf470]
cmp byte [eax + 0x85], 0
je 0x4a0c91
mov eax, dword [0x4bf438]
mov dword [eax], 0xfffffffe
mov eax, dword [0x4bf75c]
mov dword [eax], 0x20
mov eax, dword [0x4bf8a0]
mov dword [eax], 5
mov eax, dword [0x4bf540]
mov dword [eax], 0x20
mov eax, dword [0x4bf56c]
mov dword [eax], 0x20
jmp 0x4a0d12
mov eax, dword [0x4bf8b0]
cmp byte [eax], 0
je 0x4a0cdd
mov eax, dword [0x4bf438]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4bf75c]
mov dword [eax], 0x1c
mov eax, dword [0x4bf8a0]
mov dword [eax], 3
mov eax, dword [0x4bf540]
mov dword [eax], 0x14
mov eax, dword [0x4bf56c]
mov dword [eax], 0x18
mov eax, dword [0x4bf874]
mov dword [eax], 0x1e
jmp 0x4a0d12
mov eax, dword [0x4bf438]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4bf75c]
mov dword [eax], 0x18
mov eax, dword [0x4bf8a0]
mov dword [eax], 1
mov eax, dword [0x4bf540]
mov dword [eax], 0x14
mov eax, dword [0x4bf56c]
mov dword [eax], 0x18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00471448
xor edx, edx
call fcn.0046a8d0
mov eax, dword [0x4bf8b0]
cmp byte [eax], 0
je 0x4a0d4a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00471448
mov edx, dword [0x4bf470]
mov edx, dword [edx + 0x80]
call fcn.0046a8d0
mov dword [0x4bf398], 0xffffffff
mov dword [0x4bf39c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4a1284
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
call fcn.00486a48
cmp eax, dword [ebp - 0x10]
jle 0x4a0d9f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
mov edx, dword [ebp - 0x10]
call fcn.00486a50
mov ebx, dword [eax + 0x1c]
jmp 0x4a0da2
or ebx, 0xffffffff
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486a48
cmp eax, dword [ebp - 0x14]
jle 0x4a0dcb
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x14]
call fcn.00486a50
mov eax, dword [eax + 0x1c]
jmp 0x4a0dce
or eax, 0xffffffff
cmp eax, ebx
jg 0x4a0dd5
inc eax
jne 0x4a0dfb
inc ebx
je 0x4a0dfb
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
mov edx, dword [ebp - 0x10]
call fcn.00486a50
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov edx, eax
neg eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x10]
jmp 0x4a0e18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x14]
call fcn.00486a50
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp byte [ebp - 0x29], 0
jne 0x4a0e93
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x20], 0
je 0x4a0e6e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.00408904
test eax, eax
jle 0x4a0e93
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.0040890c
imul eax, eax, 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov eax, dword [edx + eax + 0x13]
mov edx, dword [ebp - 8]
add dword [edx + 0x134], eax
jmp 0x4a0e93
mov byte [ebp - 0x29], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x134]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
add eax, dword [edx + 0x628]
add eax, 5
mov edx, dword [ebp - 8]
mov dword [edx + 0x134], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, 0x4a1784
call fcn.00407b28
jne 0x4a0edb
mov eax, dword [0x4bf8b0]
cmp byte [eax], 0
je 0x4a0edb
mov eax, dword [ebp - 0x24]
mov byte [eax + 0xb8], 1
mov eax, dword [0x4bf470]
mov eax, dword [eax + 0x2c]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0xcc], eax
mov eax, dword [0x4bf470]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0xd0], eax
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x7a], 0
je 0x4a0eee
mov eax, dword [ebp - 8]
mov byte [eax + 0x180], 1
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0049e1dc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0xc0], edx
imul ebx, dword [ebp - 0x1c], 0x85
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov eax, dword [eax + ebx + 0x13]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov dword [edx + ebx + 0x47], eax
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x8d], 1
jne 0x4a1194
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov edx, 0x4a17a0
mov esi, dword [eax]
call dword [esi + 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a0f7f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
movzx edx, byte [0x4a17b4]
mov byte [eax + ebx + 2], dl
jmp 0x4a0fb5
cmp dword [ebp - 0x18], 1
jne 0x4a0f9e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
movzx edx, byte [0x4a17b8]
mov byte [eax + ebx + 2], dl
jmp 0x4a0fb5
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
movzx edx, byte [0x4a17bc]
mov byte [eax + ebx + 2], dl
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x68]
mov edx, 0x4a17cc
call fcn.004079f0
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov edx, 0x4a17a0
mov esi, dword [eax]
call dword [esi + 0xc]
dec eax
jne 0x4a1007
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
movzx eax, byte [eax + ebx + 2]
or al, byte [0x4a17dc]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov byte [edx + ebx + 2], al
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
lea eax, [eax + ebx + 0x2b]
call fcn.00406b28
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4a1194
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0
xor edx, edx
push ebp
push 0x4a117e
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.0043d164
mov ebx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, dword [ebx + 4]
call fcn.00407b28
je 0x4a1072
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1188
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x90]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebx + 8]
jg 0x4a1092
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1188
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
lea edx, [ebp - 0x6c]
mov eax, esi
call fcn.00487484
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebx + 0x10]
call fcn.00407b28
je 0x4a10c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1188
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x2c], eax
movzx eax, byte [ebx + 0x20]
mov byte [esi + 0x30], al
movzx eax, byte [ebx + 0x21]
mov byte [esi + 0x31], al
xor eax, eax
mov dword [ebx + 0x14], eax
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x24]
call fcn.00486180
mov edx, dword [ebx + 0xc]
mov eax, dword [ebp - 0x24]
call fcn.00486188
imul esi, dword [ebp - 0x1c], 0x85
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
lea eax, [eax + esi + 0x27]
mov edx, dword [ebx + 0x24]
call fcn.00406f08
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
lea eax, [eax + esi + 0x2b]
mov edx, dword [ebx + 0x28]
call fcn.00406f08
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [ebx + 0x2c]
mov dword [eax + esi + 0x37], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [ebx + 0x30]
mov dword [eax + esi + 0x3f], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [ebx + 0x34]
mov dword [eax + esi + 0x43], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1188
inc dword [ebp - 0x18]
dec dword [ebp - 0x44]
jne 0x4a1036
imul ebx, dword [ebp - 0x1c], 0x85
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [ebp - 0x28]
mov dword [eax + ebx + 0x4b], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, 0x4a17ec
call fcn.00407b28
jne 0x4a11f4
mov eax, dword [0x4bf8b0]
cmp byte [eax], 0
je 0x4a11e3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [0x4bf470]
mov edx, dword [edx + 0x24]
add dword [eax + ebx + 0x13], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x14c], edx
jmp 0x4a127a
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, 0x4a1784
call fcn.00407b28
jne 0x4a1260
mov eax, dword [0x4bf8b0]
cmp byte [eax], 0
je 0x4a1229
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [0x4bf470]
mov edx, dword [edx + 0x34]
add dword [eax + ebx + 0x13], edx
mov eax, dword [ebp - 0x1c]
mov dword [0x4bf398], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
cmp dword [eax + ebx + 0x27], 0
jne 0x4a127a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
lea eax, [eax + ebx + 0x27]
mov edx, 0x4a1804
call fcn.00406f08
jmp 0x4a127a
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, 0x4a1814
call fcn.00407b28
jne 0x4a127a
mov eax, dword [ebp - 0x1c]
mov dword [0x4bf39c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a128e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
call fcn.00486a48
cmp eax, dword [ebp - 0x10]
jg 0x4a0d68
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486a48
cmp eax, dword [ebp - 0x14]
jg 0x4a0d68
cmp dword [0x4bf39c], 0xffffffff
je 0x4a140e
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x4a12df
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
jmp 0x4a13a9
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00470aac
mov edx, eax
imul eax, dword [0x4bf39c], 0x85
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x620]
add edx, dword [ecx + eax + 0x17]
add edx, 2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470ac4
mov eax, dword [0x4bf8b0]
cmp byte [eax], 0
je 0x4a133e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470aac
mov edx, eax
mov eax, dword [0x4bf470]
add edx, dword [eax + 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470ac4
mov eax, dword [0x4bf8b0]
cmp byte [eax], 0
je 0x4a136d
mov edx, dword [0x4bf8a0]
mov edx, dword [edx]
mov eax, dword [0x4bf438]
add edx, dword [eax]
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x190]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b10
jmp 0x4a1381
mov edx, dword [0x4bf8a0]
mov edx, dword [edx]
inc edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b10
imul eax, dword [0x4bf39c], 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov edx, dword [edx + eax + 0x13]
sub edx, 4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b60
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
je 0x4a140e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.0047487c
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b88
sub eax, 2
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b44
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470af8
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470aac
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.0046e99c
push eax
call sub.user32.dll_MoveWindow
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00475384
mov eax, dword [ebp - 8]
cmp byte [eax + 0x16c], 0
je 0x4a1552
mov eax, dword [ebp - 8]
mov byte [eax + 0x16c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486a48
dec eax
test eax, eax
jl 0x4a1552
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
mov eax, dword [eax + 8]
mov dl, 1
call fcn.00456c2c
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x170]
jne 0x4a1546
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
cmp dword [eax + 0x3c], 0
je 0x4a1552
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
mov ecx, dword [eax + 0x4c]
mov edx, dword [0x4bf628]
mov edx, dword [edx]
lea eax, [ebp - 0x70]
call fcn.004079f0
mov eax, dword [ebp - 0x70]
mov dl, 1
call fcn.0041ca24
test al, al
jne 0x4a1552
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
mov ecx, dword [eax + 0x4c]
mov edx, dword [0x4bf628]
mov edx, dword [edx]
lea eax, [ebp - 0x74]
call fcn.004079f0
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
lea edx, [ebp - 0x78]
call fcn.004860cc
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
lea edx, [ebp - 0x7c]
call fcn.004860e4
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 8]
pop ecx
call fcn.0049eac8
jmp 0x4a1552
inc dword [ebp - 0x18]
dec dword [ebp - 0x44]
jne 0x4a144a
mov dl, 1
mov eax, dword [0x4357f4]
call fcn.00440ac0
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x4a1649
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486a48
dec eax
test eax, eax
jl 0x4a1616
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
cmp dword [eax + 0x3c], 0
je 0x4a160a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
cmp dword [eax + 0xbc], 0
jle 0x4a160a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
mov eax, dword [eax + 0xbc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486a50
mov ecx, dword [eax + 0x4c]
mov edx, dword [0x4bf628]
mov edx, dword [edx]
lea eax, [ebp - 0x80]
call fcn.004079f0
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x30]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x3c]
inc dword [ebp - 0x18]
dec dword [ebp - 0x44]
jne 0x4a1591
mov eax, dword [ebp - 8]
cmp dword [eax + 0x174], 0
je 0x4a1633
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x174]
mov edx, dword [ebp - 0x30]
call fcn.0048cbec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1650
mov eax, dword [ebp - 0x30]
call fcn.00404ebc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a174d
lea eax, [ebp - 0x80]
mov edx, 8
call fcn.00406b88
lea eax, [ebp - 4]
call fcn.00406b28
ret