Function at 0x4a30ac
Capabilities:
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Delete file
Get number of processors
Move file
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x101
push 0
push 0
dec ecx
jne 0x4a30b4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x455094]
call fcn.004045f0
xor eax, eax
push ebp
push 0x4a6855
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
add eax, 0xffffff91
cmp eax, 0x64
ja case.0x4a30f4.112
jmp dword [eax*4 + 0x4a30fb]
cmp byte [0x4bc440], 0
je 0x4a32bc
test ebx, ebx
jne 0x4a32bc
push 0x4a6870
mov eax, dword [0x4bc994]
push dword [eax]
push 0x4a687c
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00403f04
jmp 0x4a32da
push 0x4a6870
mov eax, dword [0x4bc994]
push dword [eax]
push 0x4a688c
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00403f04
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
test ebx, ebx
jne 0x4a330a
mov ecx, dword [ebp - 0x44]
mov edx, 0x4a689c
mov eax, 0x4a68b0
call fcn.00455c80
mov edx, 0x4a689c
mov eax, 0x4a68fc
call fcn.004569fc
jmp case.0x4a30f4.112
cmp ebx, 1
jne 0x4a3335
mov eax, 0x4a68fc
mov edx, 0x4a689c
mov ecx, dword [ebp - 0x44]
call fcn.00455c80
mov eax, 0x4a68b0
mov edx, 0x4a689c
call fcn.004569fc
jmp case.0x4a30f4.112
cmp ebx, 2
jne case.0x4a30f4.112
mov eax, 0x4a68b0
mov edx, 0x4a689c
call fcn.004569fc
mov eax, 0x4a68fc
mov edx, 0x4a689c
call fcn.004569fc
jmp case.0x4a30f4.112
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x10]
mov eax, dword [0x4c9391]
cmp edx, eax
jne case.0x4a30f4.112
cmp byte [0x4bc648], 0
jne case.0x4a30f4.112
xor edx, edx
push ebp
push 0x4a33eb
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [0x4bc648], 1
cmp byte [0x4c9384], 0
je 0x4a33bd
mov byte [0x4c939d], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x4c94d8], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004a2828
jmp 0x4a33d6
push 0
push 0
push 0
push 0
push 0
mov ecx, eax
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4a30f4.112
mov byte [0x4bc648], 0
ret
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
jne 0x4a3418
push 0x22b8
mov eax, dword [0x4bcaa8]
mov eax, dword [eax]
mov ecx, 0x4a694c
mov edx, 0x634
call fcn.00492648
jmp 0x4a3437
push 0x501
mov ecx, dword [0x4bcccc]
mov ecx, dword [ecx]
mov edx, dword [0x4bc950]
mov eax, dword [0x4bc928]
mov eax, dword [eax]
call fcn.00491f6c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 8
mov byte [0x4c9488], al
mov eax, 0x4c93a3
call fcn.00403bc4
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0x10
mov dword [0x4c9294], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0xffff
mov dword [0x4c9298], eax
jmp case.0x4a30f4.112
mov eax, dword [0x4bcaa8]
mov eax, dword [eax]
call fcn.004927cc
mov edx, dword [0x4bc950]
mov eax, dword [0x4bc928]
mov eax, dword [eax]
call fcn.00492068
cmp dword [0x4c930c], 0
je case.0x4a30f4.112
mov eax, 0x4c930c
call fcn.00403bc4
mov al, byte [0x4c9308]
call fcn.00488778
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x4c9408], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x4c940c], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.004455d0
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4a30f4.112
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.004455d0
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4a30f4.112
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.004455d0
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4a30f4.112
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov eax, dword [ebp - 0x48]
call fcn.004aa970
jmp case.0x4a30f4.112
call fcn.004a2c18
jmp case.0x4a30f4.112
mov eax, dword [0x4bc838]
cmp byte [eax], 1
jne case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
call fcn.004a2d70
jmp case.0x4a30f4.112
mov eax, dword [0x4bc838]
cmp byte [eax], 1
jne case.0x4a30f4.112
call fcn.004a2e84
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.0045c31c
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004acb60
jmp case.0x4a30f4.112
mov eax, dword [0x4bca9c]
mov byte [eax], 1
mov eax, dword [0x4bcdf4]
mov dx, word [0x4a6958]
cmp dx, word [eax]
je 0x4a35cd
xor ecx, ecx
mov dx, word [0x4a695c]
xor eax, eax
call fcn.00491870
cmp dword [0x4c8138], 0x187604
jg case.0x4a30f4.112
mov eax, dword [0x4bc888]
mov byte [eax], 1
mov eax, dword [0x4bccdc]
mov eax, dword [eax]
call fcn.0042ee04
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.0045c31c
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004acb60
mov eax, dword [0x4bc3e0]
mov edx, dword [0x4bc3e4]
add eax, 0x2710
adc edx, 0
mov dword [0x4bc4a8], eax
mov dword [0x4bc4ac], edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor eax, eax
call fcn.0049e8bc
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.0045c31c
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004acb60
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 2
call fcn.0049e8bc
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.0045c31c
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004acb60
mov eax, dword [0x4bce5c]
cmp dword [eax], 2
jne 0x4a36a8
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 8
call fcn.0049e8bc
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 1
call fcn.0049e8bc
jmp case.0x4a30f4.112
cmp byte [0x4bc438], 2
je case.0x4a30f4.112
cmp byte [0x4c93a2], 3
jne case.0x4a30f4.112
cmp byte [0x4c9384], 0
jne case.0x4a30f4.112
mov dl, 1
mov eax, dword [0x40f308]
call fcn.00402e6c
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [0x4c9385]
call fcn.004130f8
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
mov edx, dword [0x4bcce8]
mov edx, dword [edx]
lea eax, [ebp - 0x734]
mov ecx, 0x4a6968
call fcn.00403e90
mov eax, dword [ebp - 0x734]
call fcn.004a2f00
pop ecx
push ebp
mov eax, dword [0x4c92b8]
call fcn.004a2f00
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x4c9385]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp eax, 4
jne 0x4a37c0
cmp dword [ebp - 0x15], 0x55662143
jne 0x4a378f
lea edx, [ebp - 0x30]
mov eax, dword [0x4c9385]
call fcn.00455a1c
push ebp
mov edx, dword [0x4bcce8]
mov edx, dword [edx]
lea eax, [ebp - 0x738]
mov ecx, dword [ebp - 0x30]
call fcn.00403e90
mov eax, dword [ebp - 0x738]
call fcn.004a2f00
pop ecx
jmp 0x4a373d
mov ebx, dword [0x4c9385]
mov eax, ebx
call fcn.004130e8
mov edx, eax
sub edx, 4
mov eax, ebx
call fcn.004130f8
push ebp
mov eax, dword [0x4c92ac]
call fcn.004a2f00
pop ecx
push ebp
mov eax, dword [0x4c92b0]
call fcn.004a2f00
pop ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4a3807
mov edx, dword [0x4bcce8]
mov edx, dword [edx]
lea eax, [ebp - 0x740]
mov ecx, 0x4a6980
call fcn.00403e90
mov edx, dword [ebp - 0x740]
lea eax, [ebp - 0x73c]
call fcn.00404350
mov eax, dword [ebp - 0x73c]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.00458340
jmp 0x4a382a
mov ecx, 0x4a6980
mov edx, dword [0x4bcce8]
mov edx, dword [edx]
lea eax, [ebp - 0x744]
call fcn.00403e90
mov eax, dword [ebp - 0x744]
call fcn.004090fc
mov eax, dword [ebp - 0x24]
call fcn.00402e9c
mov eax, 0x12c
call fcn.004572d8
mov eax, dword [0x4bca9c]
mov byte [eax], 1
mov eax, dword [0x4bcdf4]
mov dx, word [0x4a6958]
cmp dx, word [eax]
je 0x4a3865
mov dx, word [0x4a695c]
xor ecx, ecx
xor eax, eax
call fcn.00491870
mov eax, dword [0x4bc888]
mov byte [eax], 1
mov eax, dword [0x4bccdc]
mov eax, dword [eax]
call fcn.0042ee04
push 1
mov eax, dword [0x4c92b8]
call fcn.00404008
push eax
call sub.kernel32.dll_WinExec
jmp case.0x4a30f4.112
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov eax, dword [ebp - 0x30]
call fcn.00403e44
mov ebx, eax
inc ebx
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x34]
call fcn.00409754
mov eax, dword [ebp - 0x34]
call fcn.00403e44
inc eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x38]
call fcn.00409754
mov eax, dword [ebp - 0x30]
mov edx, 0x4a6994
call fcn.00403f54
jne 0x4a3921
lea eax, [ebp - 0x34]
call fcn.004a05ac
lea eax, [ebp - 0x38]
call fcn.004a05ac
mov edx, 0x20
mov eax, dword [ebp - 0x38]
call fcn.00408fe0
push 0
mov eax, dword [ebp - 0x38]
call fcn.00404008
push eax
mov eax, dword [ebp - 0x34]
call fcn.00404008
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x30]
mov edx, 0x4a69a8
call fcn.00403f54
jne 0x4a3b08
mov eax, dword [ebp - 0x34]
call fcn.00403e44
cmp eax, 3
jle case.0x4a30f4.112
lea eax, [ebp - 0x34]
call fcn.004a05ac
mov eax, dword [ebp - 0x34]
mov al, byte [eax]
call fcn.004029f4
mov byte [0x4c94ec], al
mov eax, dword [ebp - 0x34]
cmp byte [eax + 1], 0x3a
jne 0x4a39a3
mov al, byte [0x4c94ec]
call fcn.00457408
test al, al
je 0x4a39a3
mov al, byte [0x4c94ec]
call fcn.004883f4
test eax, eax
jne 0x4a39a3
lea edx, [ebp - 0x748]
mov al, byte [0x4c94ec]
call fcn.004885f0
mov edx, dword [ebp - 0x748]
mov eax, 0x4bc644
call fcn.00403c18
jmp 0x4a39ad
mov eax, 0x4bc644
call fcn.00403bc4
mov eax, dword [ebp - 0x34]
call fcn.00408f78
test al, al
je 0x4a3a18
mov edx, 2
mov eax, dword [ebp - 0x34]
call fcn.0049fa2c
cmp dword [0x4bc644], 0
je 0x4a3ae2
lea eax, [ebp - 0x750]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x34]
call fcn.0040404c
mov ecx, dword [ebp - 0x750]
lea eax, [ebp - 0x74c]
mov edx, dword [0x4bc644]
call fcn.00403e90
mov eax, dword [ebp - 0x74c]
mov edx, 2
call fcn.0049fa2c
jmp 0x4a3ae2
mov eax, dword [ebp - 0x34]
call fcn.0044bb6c
test al, al
je 0x4a3ae2
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0x34]
call fcn.00403c18
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 1
mov byte [0x4bc640], 1
xor eax, eax
push ebp
push 0x4a3a81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.00454248
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3a88
mov byte [0x4bc640], 0
ret
cmp dword [0x4bc644], 0
je case.0x4a30f4.112
mov eax, 0x4bc644
call fcn.00403bc4
mov al, byte [0x4c94ec]
call fcn.00488778
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x30]
mov edx, 0x4a69bc
call fcn.00403f54
jne 0x4a3b52
lea eax, [ebp - 0x34]
call fcn.004a05ac
lea eax, [ebp - 0x38]
call fcn.004a05ac
mov edx, 0x20
mov eax, dword [ebp - 0x38]
call fcn.00408fe0
push 3
mov eax, dword [ebp - 0x38]
call fcn.00404008
push eax
mov eax, dword [ebp - 0x34]
call fcn.00404008
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x30]
mov edx, 0x4a69d0
call fcn.00403f54
jne 0x4a3b9e
mov eax, dword [0x4c929c]
call fcn.00408f78
test al, al
je case.0x4a30f4.112
mov cl, 1
mov dl, 1
mov eax, dword [0x488f50]
call fcn.004892d0
mov ebx, eax
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 0x34]
call fcn.00403c18
mov byte [ebx + 0x34], 4
mov eax, ebx
call fcn.00416434
jmp case.0x4a30f4.112
lea eax, [ebp - 0x38]
call fcn.004a05ac
cmp dword [ebp - 0x38], 0
jne 0x4a3bb7
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x30]
call fcn.0040925c
lea eax, [ebp - 0x30]
call fcn.004a05ac
push 1
mov eax, dword [ebp - 0x38]
call fcn.00404008
push eax
mov eax, dword [ebp - 0x34]
call fcn.00404008
push eax
mov eax, dword [ebp - 0x30]
call fcn.00404008
push eax
push 0x4a69dc
mov eax, dword [ebp - 0x28]
call fcn.004455d0
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4a30f4.112
xor eax, eax
mov al, byte [0x4bc434]
mov edx, dword [ebp - 0x2c]
cmp eax, dword [edx + 0x10]
je case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x4bc434], al
xor ecx, ecx
mov cl, byte [0x4bc434]
mov edx, 0x4a69ec
mov eax, 0x4a6a00
call fcn.0045655c
call fcn.004ac728
jmp case.0x4a30f4.112
cmp dword [0x4c8138], 0x187604
jg case.0x4a30f4.112
cmp byte [0x4bc60c], 1
jbe case.0x4a30f4.112
mov byte [0x4bc510], 0xff
mov eax, dword [0x4bc8dc]
cmp dword [eax], 0
jle 0x4a3c94
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x17], 0x80
je 0x4a3c7f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
call fcn.0049d670
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
call fcn.0049d658
jmp case.0x4a30f4.112
mov eax, dword [0x4bcdd0]
cmp dword [eax], 0
jle 0x4a3cdf
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x17], 0x80
je 0x4a3cc3
push 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
push eax
mov eax, dword [0x4bcd34]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
push eax
mov eax, dword [0x4bcb94]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
xor ebx, ebx
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
test ah, 1
je 0x4a3cf1
mov ebx, 1
test eax, 0x80000000
je 0x4a3cfb
or ebx, 2
mov dword [ebp - 0x730], 1
mov edx, dword [ebp - 0x2c]
mov dx, word [edx + 0x10]
mov word [ebp - 0x72c], dx
shr eax, 8
mov word [ebp - 0x72a], ax
mov dword [ebp - 0x728], ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x724], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x720], eax
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4a30f4.112
cmp dword [0x4c8138], 0x187604
jg case.0x4a30f4.112
cmp byte [0x4bc60c], 1
jbe case.0x4a30f4.112
mov byte [0x4bc510], 0xff
mov eax, dword [0x4bc8dc]
cmp dword [eax], 0
jle 0x4a3e5e
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
dec eax
je 0x4a3d98
dec eax
je 0x4a3dda
dec eax
je 0x4a3e1c
jmp case.0x4a30f4.112
mov eax, 0x12
call fcn.0049d658
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 9
call fcn.0049d658
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 9
call fcn.0049d670
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x12
call fcn.0049d670
jmp case.0x4a30f4.112
mov eax, 0x12
call fcn.0049d658
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.0049d658
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.0049d670
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x12
call fcn.0049d670
jmp case.0x4a30f4.112
mov eax, 0x11
call fcn.0049d658
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.0049d658
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.0049d670
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x11
call fcn.0049d670
jmp case.0x4a30f4.112
mov eax, dword [0x4bcdd0]
cmp dword [eax], 0
jle 0x4a3f6e
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
dec eax
je 0x4a3e84
dec eax
je 0x4a3ed2
dec eax
je 0x4a3f20
jmp case.0x4a30f4.112
push 1
push 0x12
mov eax, dword [0x4bcb94]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 9
mov eax, dword [0x4bcb94]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 9
mov eax, dword [0x4bcd34]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x12
mov eax, dword [0x4bcd34]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 1
push 0x12
mov eax, dword [0x4bcb94]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bcb94]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bcd34]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x12
mov eax, dword [0x4bcd34]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 1
push 0x11
mov eax, dword [0x4bcb94]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bcb94]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bcd34]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x11
mov eax, dword [0x4bcd34]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
mov dword [ebp - 0x730], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x724], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
dec eax
je 0x4a3faa
dec eax
je 0x4a405e
dec eax
je 0x4a4112
jmp case.0x4a30f4.112
mov word [ebp - 0x72c], 0x12
xor eax, eax
mov dword [ebp - 0x728], eax
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 9
xor eax, eax
mov dword [ebp - 0x728], eax
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 9
mov dword [ebp - 0x728], 2
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 0x12
mov dword [ebp - 0x728], 2
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4a30f4.112
mov word [ebp - 0x72c], 0x12
xor eax, eax
mov dword [ebp - 0x728], eax
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 0x1b
xor eax, eax
mov dword [ebp - 0x728], eax
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 0x1b
mov dword [ebp - 0x728], 2
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 0x12
mov dword [ebp - 0x728], 2
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4a30f4.112
mov word [ebp - 0x72c], 0x11
xor eax, eax
mov dword [ebp - 0x728], eax
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 0x1b
xor eax, eax
mov dword [ebp - 0x728], eax
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 0x1b
mov dword [ebp - 0x728], 2
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x724]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x72c], 0x11
mov dword [ebp - 0x728], 2
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4a30f4.112
cmp dword [0x4c8138], 0x187604
jg case.0x4a30f4.112
cmp byte [0x4bc60c], 1
jbe case.0x4a30f4.112
mov byte [0x4bc510], 0xff
mov ebx, 0x8000
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov dword [0x4c94dc], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x200
jg 0x4a4259
je 0x4a42b4
cmp eax, 0xa4
jg 0x4a4241
je 0x4a42d2
sub eax, 0x84
je 0x4a42b9
sub eax, 0x1c
je 0x4a42dc
dec eax
je 0x4a42be
dec eax
je 0x4a42c3
jmp case.0x4a4267.515
sub eax, 0xa5
je 0x4a42d7
sub eax, 2
je 0x4a42c8
dec eax
je 0x4a42cd
jmp case.0x4a4267.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4a4267.515
jmp dword [eax*4 + 0x4a426e]
or ebx, 2
jmp case.0x4a4267.515
or ebx, 4
jmp case.0x4a4267.515
or ebx, 0x20
jmp case.0x4a4267.515
or ebx, 0x40
jmp case.0x4a4267.515
or ebx, 8
jmp case.0x4a4267.515
or ebx, 0x10
jmp case.0x4a4267.515
or ebx, 1
jmp case.0x4a4267.515
or ebx, 1
jmp case.0x4a4267.515
or ebx, 2
jmp case.0x4a4267.515
or ebx, 4
jmp case.0x4a4267.515
or ebx, 0x20
jmp case.0x4a4267.515
or ebx, 0x40
jmp case.0x4a4267.515
or ebx, 8
jmp case.0x4a4267.515
or ebx, 0x10
jmp case.0x4a4267.515
or ebx, 1
jmp case.0x4a4267.515
or ebx, 0x800
mov eax, dword [0x4bce38]
mov eax, dword [eax]
call fcn.0042fe6c
dec eax
push eax
mov eax, dword [0x4c94dc]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
pop edx
mov ecx, edx
cdq
idiv ecx
mov esi, eax
mov eax, dword [0x4bce38]
mov eax, dword [eax]
call fcn.0042fe60
dec eax
push eax
mov eax, dword [0x4c94dc]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
cmp esi, 0x10000
jge case.0x4a30f4.112
cmp edi, 0x10000
jge case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x20a
jne 0x4a4363
mov edx, dword [0x4c94dc]
mov edx, dword [edx + 0x10]
mov dword [ebp - 0x3c], edx
jmp 0x4a4368
xor edx, edx
mov dword [ebp - 0x3c], edx
mov edx, dword [0x4bc8dc]
cmp dword [edx], 0
jle 0x4a44a0
cmp eax, 0x20a
je 0x4a4398
mov eax, dword [0x4c94dc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c94dc]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bc804]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4a43dc
je case.0x4a43b5.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4a30f4.112
jmp dword [eax*4 + 0x4a43bc]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4a30f4.112
jmp dword [eax*4 + 0x4a43f1]
push 1
mov eax, dword [0x4bcbb4]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 2
mov eax, dword [0x4bcbb4]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 0x10
mov eax, dword [0x4bcbb4]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 0x20
mov eax, dword [0x4bcbb4]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 4
mov eax, dword [0x4bcbb4]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 8
mov eax, dword [0x4bcbb4]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
mov eax, dword [0x4c94dc]
cmp dword [eax + 0x10], 0
jle 0x4a4490
push 1
mov eax, dword [0x4bc8cc]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 2
mov eax, dword [0x4bc8cc]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
mov edx, dword [0x4bcdd0]
cmp dword [edx], 0
jle 0x4a457a
cmp eax, 0x20a
je 0x4a44d0
mov eax, dword [0x4c94dc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c94dc]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bcc4c]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4a44f6
je 0x4a450f
sub eax, 0xa1
je 0x4a450f
dec eax
je 0x4a451f
sub eax, 2
je 0x4a452f
dec eax
je 0x4a453f
jmp case.0x4a30f4.112
sub eax, 0x202
je 0x4a451f
sub eax, 2
je 0x4a452f
dec eax
je 0x4a453f
sub eax, 5
je 0x4a454f
jmp case.0x4a30f4.112
push 1
mov eax, dword [0x4bc908]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 1
mov eax, dword [0x4bcafc]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 1
mov eax, dword [0x4bcd30]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 1
mov eax, dword [0x4bc750]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
mov eax, dword [0x4c94dc]
cmp dword [eax + 0x10], 0
jle 0x4a456a
push 1
mov eax, dword [0x4bcb88]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
push 0xffffffffffffffff
mov eax, dword [0x4bcb88]
mov eax, dword [eax]
call eax
jmp case.0x4a30f4.112
cmp eax, 0x200
je 0x4a4597
push 0
push 0
lea eax, [edi + 1]
push eax
lea eax, [esi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4a45bc
push 0
mov eax, dword [ebp - 0x3c]
push eax
inc edi
push edi
inc esi
push esi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4a30f4.112
xor eax, eax
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x720], ebx
inc esi
mov dword [ebp - 0x72c], esi
inc edi
mov dword [ebp - 0x728], edi
xor eax, eax
mov dword [ebp - 0x724], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x71c], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x718], eax
push 0x1c
lea eax, [ebp - 0x730]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4a30f4.112
lea eax, [ebp - 0x144]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x11c], 0x1c0000
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov edx, eax
shr edx, 0x10
mov dword [ebp - 0xd8], edx
and eax, 0xffff
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xdc], eax
push 0
lea eax, [ebp - 0x144]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4a30f4.112
cmp dword [0x4bc420], 0x410006c
jb case.0x4a30f4.112
mov byte [0x4bc510], 0
mov byte [0x4bc60c], 0
xor eax, eax
mov dword [0x4bc51c], eax
mov dword [0x4c93ec], 0
mov dword [0x4c93f0], 0
mov byte [0x4bc520], 0
mov eax, dword [0x4bc8dc]
cmp dword [eax], 0
jne 0x4a46af
call fcn.0049d878
mov eax, dword [0x4bcdd0]
cmp dword [eax], 0
jne 0x4a46be
call fcn.0049daf8
cmp byte [0x4bc508], 0
jne 0x4a4769
mov byte [0x4bc508], 0xff
mov byte [0x4bc50c], 0
mov dl, 1
mov eax, dword [0x418a44]
call fcn.0041ef0c
mov dword [0x4bc514], eax
mov eax, dword [0x4bc514]
call fcn.0041f478
mov eax, dword [eax + 0xc]
mov edx, dword [0x4bcd9c]
mov edx, dword [edx]
call fcn.00419b28
mov eax, dword [0x4bc514]
call fcn.0041f478
mov eax, dword [eax + 0xc]
mov edx, 0x24
call fcn.00419ae8
mov eax, dword [0x4bc514]
call fcn.0041f478
mov eax, dword [eax + 0xc]
mov dl, byte [0x4a6a30]
call fcn.00419bcc
mov dl, 1
mov eax, dword [0x418a44]
call fcn.0041ef0c
mov dword [0x4c93f8], eax
mov dl, 1
mov eax, dword [0x418a44]
call fcn.0041ef0c
mov dword [0x4c93fc], eax
mov dword [0x4c9400], 0
mov dword [0x4c9404], 0
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x4c93e9], al
cmp byte [0x4c93e9], 0
je 0x4a4869
mov dword [0x4c94a8], 0xffffffff
mov dl, 6
mov eax, dword [0x4bc514]
call fcn.00420338
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x4bc5f0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x4bc5f4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bc604], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and eax, 0xf
mov dword [0x4bc608], eax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xff
mov byte [0x4c93f4], al
cmp byte [0x4bc3bc], 0
je 0x4a48ca
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0x20
jle 0x4a48ca
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x20], 0x43
jne 0x4a484d
mov eax, dword [0x4bc958]
mov eax, dword [eax]
call fcn.0049ca08
mov eax, dword [0x4bccd8]
cmp dword [eax], 0
jl 0x4a482e
mov eax, dword [0x4bccd8]
mov eax, dword [eax]
mov edx, dword [0x4bc820]
mov dword [edx], eax
jmp 0x4a4837
mov eax, dword [0x4bc820]
xor edx, edx
mov dword [eax], edx
mov edx, dword [0x4bc820]
mov edx, dword [edx]
mov eax, dword [0x4bc958]
mov eax, dword [eax]
call fcn.0049c84c
jmp 0x4a48ca
mov eax, dword [0x4bc820]
mov eax, dword [eax]
mov edx, dword [0x4bccd8]
mov dword [edx], eax
mov eax, dword [0x4bc820]
mov dword [eax], 0xffffffff
jmp 0x4a48ca
mov eax, dword [0x4bc820]
mov dword [eax], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bc604], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x4bc608], eax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xff
mov byte [0x4c93f4], al
cmp byte [0x4c93f4], 3
jbe 0x4a48be
mov dl, byte [0x4c93f4]
mov eax, dword [0x4bc514]
call fcn.00420338
jmp 0x4a48ca
mov dl, 6
mov eax, dword [0x4bc514]
call fcn.00420338
cmp dword [0x4bc518], 0
jne case.0x4a30f4.112
mov dl, 1
mov eax, dword [0x40f5b4]
call fcn.00402e6c
mov dword [0x4bc518], eax
jmp case.0x4a30f4.112
cmp byte [0x4bc3bc], 0
je case.0x4a30f4.112
mov eax, dword [0x4bc958]
mov eax, dword [eax]
call fcn.0049ca08
mov eax, dword [0x4bccd8]
cmp dword [eax], 0
jl 0x4a4921
mov eax, dword [0x4bccd8]
mov eax, dword [eax]
mov edx, dword [0x4bc820]
mov dword [edx], eax
jmp 0x4a492a
mov eax, dword [0x4bc820]
xor edx, edx
mov dword [eax], edx
mov edx, dword [0x4bc820]
mov edx, dword [edx]
mov eax, dword [0x4bc958]
mov eax, dword [eax]
call fcn.0049c84c
jmp case.0x4a30f4.112
cmp byte [0x4bc3bc], 0
je case.0x4a30f4.112
mov eax, dword [0x4bc958]
mov eax, dword [eax]
call fcn.0049ca08
mov eax, dword [0x4bc820]
inc dword [eax]
mov edx, dword [0x4bc820]
mov edx, dword [edx]
mov eax, dword [0x4bc958]
mov eax, dword [eax]
call fcn.0049c84c
jmp case.0x4a30f4.112
cmp byte [0x4bc3bc], 0
je case.0x4a30f4.112
mov eax, dword [0x4bc958]
mov eax, dword [eax]
call fcn.0049ca08
mov eax, dword [0x4bc820]
mov eax, dword [eax]
mov edx, dword [0x4bccd8]
mov dword [edx], eax
mov eax, dword [0x4bc820]
mov dword [eax], 0xffffffff
jmp case.0x4a30f4.112
cmp byte [0x4bc508], 0
je case.0x4a30f4.112
cmp byte [0x4bc3bc], 0
je 0x4a49d6
mov eax, dword [0x4bc958]
mov eax, dword [eax]
call fcn.0049ca08
mov byte [0x4bc508], 0
mov eax, 0x4bc514
call fcn.0040cbc8
mov eax, dword [0x4c93f8]
call fcn.00402e9c
mov eax, dword [0x4c93fc]
call fcn.00402e9c
call fcn.0049d914
call fcn.0049db94
call fcn.0049d3f8
mov eax, dword [0x4bc518]
call fcn.0041347c
jmp case.0x4a30f4.112
cmp byte [0x4bc508], 0
je case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bc604], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x4bc608], eax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xff
mov byte [0x4c93f4], al
cmp byte [0x4c93e9], 0
jne 0x4a4a67
cmp byte [0x4c93f4], 3
ja 0x4a4a78
mov dl, 6
mov eax, dword [0x4bc514]
call fcn.00420338
jmp case.0x4a30f4.112
mov dl, byte [0x4c93f4]
mov eax, dword [0x4bc514]
call fcn.00420338
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0
je 0x4a4ac5
lea eax, [ebp - 0x758]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov ecx, dword [ebp - 0x758]
mov dx, word [0x4a6a34]
mov al, 1
call fcn.00491870
jmp case.0x4a30f4.112
mov eax, dword [0x4bcdf4]
test byte [eax], 0x20
je 0x4a4ad6
mov byte [0x4bc488], 1
mov dx, word [0x4a695c]
xor ecx, ecx
xor eax, eax
call fcn.00491870
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor dl, 1
mov eax, dword [0x4bccdc]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e8]
call fcn.00437c70
jmp case.0x4a30f4.112
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.004455d0
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4a30f4.112
lea eax, [ebp - 0x760]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov eax, dword [ebp - 0x760]
lea edx, [ebp - 0x75c]
call fcn.00408954
mov edx, dword [ebp - 0x75c]
mov eax, 0x4c94e0
call fcn.00403c18
push 0
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.004455d0
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4a30f4.112
lea eax, [ebp - 0x50]
call fcn.00403bc4
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x9f
jne 0x4a4bad
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0x20
jle 0x4a4bad
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4a4bd4
cmp eax, 0xffffffff
je 0x4a4bd4
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.004455d0
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x50], 0
je case.0x4a30f4.112
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x50]
call fcn.00403c5c
jmp 0x4a3934
mov eax, dword [ebp - 0x28]
call fcn.004a1be8
jmp case.0x4a30f4.112
lea edx, [ebp - 0x764]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409754
mov edx, dword [ebp - 0x764]
mov eax, dword [0x4bc8d4]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp byte [0x4bc438], 2
je case.0x4a30f4.112
mov eax, dword [0x4c92d8]
call fcn.00408f78
test al, al
je 0x4a4c67
mov edx, 0x20
mov eax, dword [0x4c92d8]
call fcn.00408fe0
test eax, eax
jne case.0x4a30f4.112
lea eax, [ebp - 0x768]
mov edx, dword [0x4c92d8]
call fcn.00404350
mov eax, dword [ebp - 0x768]
push eax
mov eax, dword [0x4bc8d4]
mov eax, dword [eax]
push eax
call fcn.00458340
test al, al
je case.0x4a30f4.112
mov edx, 0x22
mov eax, dword [0x4c92d8]
call fcn.00408fe0
jmp case.0x4a30f4.112
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409754
lea eax, [ebp - 0x4c]
call fcn.00404014
push eax
call fcn.00426150
pop edx
call fcn.00425df8
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4a30f4.112
mov byte [0x4bc444], 2
mov byte [0x4bc4b0], 0
mov eax, 0x4a6a00
mov ecx, 0x400
mov edx, 0x4a6a40
call fcn.0045655c
call fcn.0049ec30
call fcn.0049f6c4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f8]
call fcn.0045c31c
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x4c927c]
je case.0x4a30f4.112
mov edx, 3
mov eax, dword [0x4c9490]
call fcn.004b3964
jmp case.0x4a30f4.112
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409754
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xaf
jne 0x4a4d92
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x28]
call fcn.004afff0
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xae
jne 0x4a4de8
mov edx, dword [ebp - 0x60]
mov eax, 0x4a6a54
call fcn.00404130
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle case.0x4a30f4.112
lea eax, [ebp - 0x76c]
push eax
mov ecx, dword [ebp - 0x40]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x60]
call fcn.0040404c
mov eax, dword [ebp - 0x76c]
or edx, 0xffffffff
call fcn.00408dbc
call fcn.004b00f4
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb4
jne 0x4a4e0a
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x60]
mov edx, dword [0x4c94a0]
call fcn.00403e90
jmp 0x4a3934
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb5
jne case.0x4a30f4.112
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x60]
mov edx, dword [0x4c94a0]
call fcn.00403e90
jmp 0x4a3934
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.004455d0
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4a30f4.112
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4a30f4.112
push 0
lea eax, [ebp - 0x174]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x16c]
sub eax, dword [ebp - 0x174]
mov edx, dword [ebp - 0x14c]
sub edx, dword [ebp - 0x154]
cmp eax, edx
jle case.0x4a30f4.112
mov eax, dword [ebp - 0x16c]
sub eax, dword [ebp - 0x174]
mov edx, dword [ebp - 0x14c]
sub edx, dword [ebp - 0x154]
sub eax, edx
sar eax, 1
jns 0x4a4ec3
adc eax, 0
add eax, dword [ebp - 0x174]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0x170]
mov edx, dword [ebp - 0x148]
sub edx, dword [ebp - 0x150]
sub eax, edx
sar eax, 1
jns 0x4a4ef0
adc eax, 0
add eax, dword [ebp - 0x170]
mov dword [ebp - 0x160], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x164]
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4a30f4.112
mov eax, dword [0x4bca94]
cmp dword [eax], 0
jne 0x4a4f48
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
call fcn.004883c8
test eax, eax
je case.0x4a30f4.112
cmp byte [0x4c9337], 0
je 0x4a4faa
lea edx, [ebp - 0x774]
xor eax, eax
call fcn.00402960
mov eax, dword [ebp - 0x774]
lea edx, [ebp - 0x770]
call fcn.00409228
mov edx, dword [ebp - 0x770]
lea eax, [ebp - 0x30]
mov ecx, 0x4a6a60
call fcn.00403e90
push 0
lea eax, [ebp - 0x30]
call fcn.00404014
push eax
mov eax, dword [0x4bc840]
call fcn.00404014
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab8
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
lea eax, [ebp - 0x778]
call fcn.00457f4c
mov eax, dword [ebp - 0x778]
call fcn.00404008
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x4bce30]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x4a509f
mov eax, dword [0x4c9270]
call fcn.00408f78
test al, al
je 0x4a509f
lea eax, [ebp - 0x77c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov ecx, dword [ebp - 0x77c]
mov eax, 0x4a6a00
mov edx, 0x4a6a78
call fcn.00455c80
call fcn.0040a22c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, 0x4a6a00
mov edx, 0x4a6a88
call fcn.00456118
mov eax, 0x4a6a00
mov edx, 0x4a6a9c
call fcn.004569fc
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab9
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
mov eax, 0x4a6a00
xor ecx, ecx
mov edx, 0x4a6aac
call fcn.0045655c
mov edx, 5
xor eax, eax
call fcn.004b3964
jmp case.0x4a30f4.112
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3aba
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
mov eax, dword [0x4bca94]
cmp dword [eax], 0
jne 0x4a50eb
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
cmp byte [0x4bc64c], 0
jne 0x4a51ae
call fcn.00488504
test eax, eax
jne 0x4a51ae
mov eax, dword [0x4bcbe8]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x4a51ae
mov eax, dword [0x4bca54]
cmp byte [eax], 0
je 0x4a5148
mov eax, dword [0x4bca54]
mov al, byte [eax]
call fcn.004883f4
test eax, eax
jne 0x4a5148
mov eax, dword [0x4bca54]
mov al, byte [eax]
xor ecx, ecx
mov edx, 2
call fcn.00488998
mov eax, 0x4a6a00
mov edx, 0x4a6a78
call fcn.004569fc
mov eax, 0x4a6a00
mov edx, 0x4a6a88
call fcn.004569fc
mov eax, 0x4a6a00
mov edx, 0x4a6a9c
call fcn.004569fc
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abb
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
mov eax, 0x4a6a00
xor ecx, ecx
mov edx, 0x4a6aac
call fcn.0045655c
mov edx, 5
xor eax, eax
call fcn.004b3964
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abc
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
call fcn.004883c8
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x4a52df
cmp byte [0x4bc64c], 0
jne 0x4a52df
xor eax, eax
push ebp
push 0x4a52d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4bc64c], 1
call fcn.00488504
test eax, eax
jne 0x4a52c3
push 0x7f
lea eax, [ebp - 0x1f4]
push eax
mov eax, dword [0x4bcc14]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x4a5265
lea eax, [ebp - 0x68]
lea edx, [ebp - 0x1f4]
mov ecx, 0x80
call fcn.00403df4
mov dword [ebp - 0x40], 2
jmp 0x4a5256
lea edx, [ebp - 0x68]
mov ecx, dword [ebp - 0x40]
mov eax, 0x4a6ac4
call fcn.004040d4
add dword [ebp - 0x40], 2
mov eax, dword [ebp - 0x68]
call fcn.00403e44
cmp eax, dword [ebp - 0x40]
jge 0x4a5242
jmp 0x4a5272
lea eax, [ebp - 0x68]
mov edx, 0x4a6ad0
call fcn.00403c5c
mov eax, dword [0x4bc898]
push dword [eax]
push 0x4a6adc
push dword [ebp - 0x68]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00403f04
push dword [ebp - 0x68]
push 0x4a6adc
mov eax, 0x4a6a00
mov edx, 0x4a6a9c
call fcn.00456778
lea edx, [ebp - 0x780]
call fcn.00408ce0
push dword [ebp - 0x780]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00403f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a52df
mov byte [0x4bc64c], 0
ret
mov eax, 0x4a6a00
mov edx, 0x4a6a88
call fcn.00456334
fstp qword [ebp - 0x88]
wait
mov eax, dword [0x4c9270]
call fcn.004a2c48
push eax
push 0
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x64]
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
mov eax, dword [0x4bca94]
cmp dword [eax], 0
jne 0x4a5354
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
mov dword [ebp - 0x70], 1
xor eax, eax
mov dword [ebp - 0x74], eax
cmp byte [0x4bc64c], 0
jne 0x4a5450
call fcn.00488504
test eax, eax
jne 0x4a5450
lea eax, [ebp - 0x68]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
lea edx, [ebp - 0x784]
mov eax, dword [ebp - 0x68]
call fcn.004a2ac4
mov eax, dword [ebp - 0x784]
mov edx, dword [ebp - 0x68]
call fcn.00403f54
je 0x4a53c9
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4a5450
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], 1
jmp 0x4a5450
cmp byte [0x4bc64c], 0
jne 0x4a5450
xor eax, eax
push ebp
push 0x4a5449
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4bc64c], 1
push 1
lea eax, [ebp - 0x788]
call fcn.00457f4c
mov eax, dword [ebp - 0x788]
call fcn.00404008
push eax
push 1
push 1
lea eax, [ebp - 0x68]
call fcn.00404014
push eax
mov eax, dword [0x4bc9c0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x4a5434
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4a5434
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5450
mov byte [0x4bc64c], 0
ret
mov eax, dword [ebp - 0x74]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x70]
mov edx, 0xb1
mov eax, dword [ebp - 0x28]
call fcn.004a1b78
cmp dword [ebp - 0x74], 1
jne case.0x4a30f4.112
mov eax, 0x4a6a00
xor ecx, ecx
mov edx, 0x4a6aac
call fcn.0045655c
mov edx, 5
xor eax, eax
call fcn.004b3964
jmp case.0x4a30f4.112
mov eax, dword [0x4bca94]
cmp dword [eax], 0
jne 0x4a54bf
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
mov dword [ebp - 0x70], 1
xor eax, eax
mov dword [ebp - 0x74], eax
cmp byte [0x4bc64c], 0
jne 0x4a5681
call fcn.00488504
test eax, eax
jne 0x4a5681
lea eax, [ebp - 0x68]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
call fcn.004a2b60
test al, al
je 0x4a5681
lea edx, [ebp - 0x78c]
mov eax, dword [ebp - 0x68]
call fcn.004a2ac4
mov eax, dword [ebp - 0x78c]
mov edx, dword [ebp - 0x68]
call fcn.00403f54
je 0x4a560b
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4a5681
cmp dword [ebp - 0x6c], 0
je 0x4a5574
push 0
lea eax, [ebp - 0x790]
call fcn.00457f4c
mov eax, dword [ebp - 0x790]
call fcn.00404008
push eax
push 1
push 1
lea eax, [ebp - 0x6c]
call fcn.00404014
push eax
mov eax, dword [0x4bc9c0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x70], eax
jmp 0x4a5579
xor eax, eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x4a5681
push 0
lea eax, [ebp - 0x794]
call fcn.00457f4c
mov eax, dword [ebp - 0x794]
call fcn.00404008
push eax
push 2
push 1
lea eax, [ebp - 0x68]
call fcn.00404014
push eax
mov eax, dword [0x4bc9c0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x4a5681
mov eax, dword [0x4bca54]
cmp byte [eax], 0
je 0x4a5602
lea eax, [ebp - 0x798]
mov edx, dword [0x4bca54]
mov dl, byte [edx]
call fcn.00403d6c
mov eax, dword [ebp - 0x798]
mov edx, dword [ebp - 0x68]
call fcn.00404130
test eax, eax
jle 0x4a5602
mov eax, 0x4a6a00
mov ecx, 1
mov edx, 0x4a6a9c
call fcn.0045655c
mov dword [ebp - 0x74], 1
jmp 0x4a5681
cmp byte [0x4bc64c], 0
jne 0x4a5677
xor eax, eax
push ebp
push 0x4a5670
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4bc64c], 1
push 1
lea eax, [ebp - 0x79c]
call fcn.00457f4c
mov eax, dword [ebp - 0x79c]
call fcn.00404008
push eax
push 2
push 1
lea eax, [ebp - 0x68]
call fcn.00404014
push eax
mov eax, dword [0x4bc9c0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x70], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5677
mov byte [0x4bc64c], 0
ret
cmp dword [ebp - 0x70], 0
jne 0x4a552d
mov eax, dword [ebp - 0x74]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x70]
mov edx, 0xb3
mov eax, dword [ebp - 0x28]
call fcn.004a1b78
cmp dword [ebp - 0x74], 1
jne case.0x4a30f4.112
mov eax, dword [0x4bc4ec]
xor edx, edx
call fcn.004043c4
je 0x4a56c1
mov eax, dword [0x4bc4ec]
call fcn.00404360
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, 0x4a6a00
xor ecx, ecx
mov edx, 0x4a6aac
call fcn.0045655c
mov edx, 5
xor eax, eax
call fcn.004b3964
jmp case.0x4a30f4.112
mov eax, dword [0x4bca94]
cmp dword [eax], 0
jne 0x4a570e
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
lea eax, [ebp - 0x68]
mov edx, dword [0x4bc898]
mov edx, dword [edx]
call fcn.00403c5c
lea edx, [ebp - 0x7a0]
mov eax, dword [ebp - 0x68]
call fcn.004a2ac4
call fcn.004883c8
test eax, eax
jne 0x4a57f3
cmp dword [ebp - 0x68], 0
je 0x4a57f3
mov dword [ebp - 0x70], 1
lea eax, [ebp - 0x7a4]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00403d6c
mov eax, dword [ebp - 0x7a4]
mov edx, dword [ebp - 0x68]
call fcn.00404130
test eax, eax
jle 0x4a57e9
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4a57e9
cmp byte [0x4bc64c], 0
jne 0x4a57e9
xor eax, eax
push ebp
push 0x4a57e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4bc64c], 1
call fcn.00488504
test eax, eax
jne 0x4a57cd
push 1
lea eax, [ebp - 0x7a8]
call fcn.00457f4c
mov eax, dword [ebp - 0x7a8]
call fcn.00404008
push eax
push 0
push 1
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x4bc9c0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x70], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a57e9
mov byte [0x4bc64c], 0
ret
cmp dword [ebp - 0x70], 0
je case.0x4a30f4.165
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004a1b78
jmp case.0x4a30f4.112
mov eax, dword [0x4bca94]
cmp dword [eax], 0
jne 0x4a5838
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
lea eax, [ebp - 0x68]
mov edx, dword [0x4bc898]
mov edx, dword [edx]
call fcn.00403c5c
lea edx, [ebp - 0x7ac]
mov eax, dword [ebp - 0x68]
call fcn.004a2ac4
call fcn.004883c8
test eax, eax
jne 0x4a591d
cmp dword [ebp - 0x68], 0
je 0x4a591d
mov dword [ebp - 0x70], 1
lea eax, [ebp - 0x7b0]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00403d6c
mov eax, dword [ebp - 0x7b0]
mov edx, dword [ebp - 0x68]
call fcn.00404130
test eax, eax
jle 0x4a5913
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4a5913
cmp byte [0x4bc64c], 0
jne 0x4a5913
xor eax, eax
push ebp
push 0x4a590c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4bc64c], 1
call fcn.00488504
test eax, eax
jne 0x4a58f7
push 1
lea eax, [ebp - 0x7b4]
call fcn.00457f4c
mov eax, dword [ebp - 0x7b4]
call fcn.00404008
push eax
push 0
push 3
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x4bc9c0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x70], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5913
mov byte [0x4bc64c], 0
ret
cmp dword [ebp - 0x70], 0
je case.0x4a30f4.165
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004a1b78
jmp case.0x4a30f4.112
mov dl, 1
mov eax, dword [0x40f308]
call fcn.00402e6c
mov ebx, eax
mov edx, 0x4a6ae8
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x4a6afc
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x4a6b10
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x4a6b24
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [0x4bcce8]
mov edx, dword [edx]
lea eax, [ebp - 0x7c]
mov ecx, 0x4a6b38
call fcn.00403e90
mov edx, dword [ebp - 0x7c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, ebx
call fcn.00402e9c
push 1
mov eax, dword [ebp - 0x7c]
call fcn.00404008
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov edx, 0x4a6b4c
call fcn.004095a8
mov ecx, 0x4a6b58
mov dx, word [0x4a6b64]
mov al, 1
call fcn.00491870
jmp case.0x4a30f4.170
lea eax, [ebp - 0x7b8]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov ecx, dword [ebp - 0x7b8]
mov edx, 0x4a6b70
mov eax, 0x4a6b84
call fcn.00455c80
jmp case.0x4a30f4.112
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
lea eax, [ebp - 0x90]
call fcn.004a05ac
mov eax, dword [ebp - 0x90]
mov al, byte [eax]
call fcn.004029f4
mov byte [0x4c94ec], al
mov eax, dword [ebp - 0x90]
cmp byte [eax + 1], 0x3a
jne 0x4a5ab3
mov al, byte [0x4c94ec]
call fcn.00457408
test al, al
je 0x4a5ab3
mov al, byte [0x4c94ec]
call fcn.004883f4
test eax, eax
jne 0x4a5ab3
lea edx, [ebp - 0x7bc]
mov al, byte [0x4c94ec]
call fcn.004885f0
mov edx, dword [ebp - 0x7bc]
mov eax, 0x4bc644
call fcn.00403c18
lea eax, [ebp - 0x7c0]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x90]
call fcn.0040404c
mov ecx, dword [ebp - 0x7c0]
lea eax, [ebp - 0x90]
mov edx, dword [0x4bc644]
call fcn.00403e90
jmp 0x4a5abd
mov eax, 0x4bc644
call fcn.00403bc4
mov eax, dword [ebp - 0x90]
call fcn.0044bb6c
test al, al
je 0x4a5ce1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0x90]
call fcn.00403c18
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 0
mov dl, 1
mov eax, dword [0x4550b8]
call fcn.00402e6c
mov dword [0x4c94e4], eax
mov edx, 0x20
mov eax, dword [0x4c94e4]
mov ecx, dword [eax]
call dword [ecx]
mov edx, 0x20
mov eax, dword [0x4c94e4]
call fcn.004130f8
mov byte [0x4bc640], 2
xor eax, eax
push ebp
push 0x4a5cb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.00454248
mov eax, dword [0x4c94e4]
call fcn.00413104
cmp eax, 0x20
jle 0x4a5c77
mov eax, dword [0x4c94e4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xe8
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [0x4c94e4]
call fcn.00413104
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x2c]
call fcn.004a9dac
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x714]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xf2
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
xor edx, edx
mov eax, dword [0x4c94e4]
call fcn.004130f8
xor esi, esi
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x14], esi
inc esi
mov eax, dword [0x4c94e4]
call fcn.004130e8
mov edx, dword [ebp - 0x9c]
sub edx, eax
cmp edx, 0x500
jle 0x4a5c08
mov ebx, 0x500
jmp 0x4a5c1a
mov eax, dword [0x4c94e4]
call fcn.004130e8
mov ebx, dword [ebp - 0x9c]
sub ebx, eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov ecx, ebx
mov eax, dword [0x4c94e4]
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [0x4c94e4]
call fcn.004130e8
mov edx, dword [ebp - 0x9c]
sub edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x18], edx
add ebx, 0x20
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], ebx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004a17c0
test al, al
je 0x4a5c95
mov eax, dword [0x4bcbec]
mov eax, dword [eax]
call fcn.00431ea0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x18], 0
jne 0x4a5be0
jmp 0x4a5c95
push 0
push 0
mov eax, dword [ebp - 0x90]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5cbb
mov byte [0x4bc640], 0
mov eax, dword [0x4c94e4]
call fcn.00402e9c
ret
push 0
push 0
mov eax, dword [ebp - 0x90]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
lea eax, [ebp - 0x30]
call fcn.004a05ac
mov eax, dword [ebp - 0x30]
mov al, byte [eax]
call fcn.004029f4
mov byte [0x4c94ec], al
mov eax, dword [ebp - 0x30]
cmp byte [eax + 1], 0x3a
jne 0x4a5da3
mov al, byte [0x4c94ec]
call fcn.00457408
test al, al
je 0x4a5da3
mov al, byte [0x4c94ec]
call fcn.004883f4
test eax, eax
jne 0x4a5da3
lea edx, [ebp - 0x7c4]
mov al, byte [0x4c94ec]
call fcn.004885f0
mov edx, dword [ebp - 0x7c4]
mov eax, 0x4bc644
call fcn.00403c18
lea eax, [ebp - 0x7c8]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x30]
call fcn.0040404c
mov ecx, dword [ebp - 0x7c8]
lea eax, [ebp - 0x30]
mov edx, dword [0x4bc644]
call fcn.00403e90
jmp 0x4a5dad
mov eax, 0x4bc644
call fcn.00403bc4
push 0
lea eax, [ebp - 0x30]
call fcn.00404014
push eax
call sub.kernel32.dll_CreateDirectoryA
neg eax
sbb ebx, ebx
neg ebx
cmp dword [0x4bc644], 0
je 0x4a5de0
mov eax, 0x4bc644
call fcn.00403bc4
mov al, byte [0x4c94ec]
call fcn.00488778
push 0
push 0
lea eax, [ebp - 0x7cc]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov eax, dword [ebp - 0x7cc]
push eax
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
mov dl, 1
mov eax, dword [0x40f308]
call fcn.00402e6c
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x7d0]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov edx, dword [ebp - 0x7d0]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x90]
xor edx, edx
mov eax, dword [ebp - 0x8c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x90]
call fcn.004a05ac
mov eax, dword [ebp - 0x90]
mov al, byte [eax]
call fcn.004029f4
mov byte [0x4c94ec], al
mov eax, dword [ebp - 0x90]
cmp byte [eax + 1], 0x3a
jne 0x4a5f01
mov al, byte [0x4c94ec]
call fcn.00457408
test al, al
je 0x4a5f01
mov al, byte [0x4c94ec]
call fcn.004883f4
test eax, eax
jne 0x4a5f01
lea edx, [ebp - 0x7d4]
mov al, byte [0x4c94ec]
call fcn.004885f0
mov edx, dword [ebp - 0x7d4]
mov eax, 0x4bc644
call fcn.00403c18
lea eax, [ebp - 0x7d8]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x90]
call fcn.0040404c
mov ecx, dword [ebp - 0x7d8]
lea eax, [ebp - 0x90]
mov edx, dword [0x4bc644]
call fcn.00403e90
jmp 0x4a5f0b
mov eax, 0x4bc644
call fcn.00403bc4
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4a5ff0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x40], 1
lea ecx, [ebp - 0x7dc]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x8c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x7dc]
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x90]
call fcn.00403e90
mov eax, dword [ebp - 0x30]
call fcn.00408f78
test al, al
je 0x4a5f6f
mov edx, 2
mov eax, dword [ebp - 0x30]
call fcn.0049fa2c
jmp 0x4a5fe1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0x30]
call fcn.00403c18
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 1
mov byte [0x4bc640], 3
xor eax, eax
push ebp
push 0x4a5fc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.00454248
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5fcf
mov byte [0x4bc640], 0
ret
inc dword [ebp - 0x40]
dec dword [ebp - 0xa8]
jne 0x4a5f2c
cmp dword [0x4bc644], 0
je 0x4a600d
mov eax, 0x4bc644
call fcn.00403bc4
mov al, byte [0x4c94ec]
call fcn.00488778
lea ecx, [ebp - 0x90]
xor edx, edx
mov eax, dword [ebp - 0x8c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8c]
call fcn.00402e9c
jmp 0x4a5a19
mov dl, 1
mov eax, dword [0x40f308]
call fcn.00402e6c
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x7e0]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov edx, dword [ebp - 0x7e0]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x90]
xor edx, edx
mov eax, dword [ebp - 0x8c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x30]
mov edx, 1
mov eax, dword [ebp - 0x8c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x34]
mov edx, 2
mov eax, dword [ebp - 0x8c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x90]
call fcn.004a05ac
mov eax, dword [ebp - 0x90]
mov al, byte [eax]
call fcn.004029f4
mov byte [0x4c94ec], al
mov eax, dword [ebp - 0x90]
cmp byte [eax + 1], 0x3a
jne 0x4a613c
mov al, byte [0x4c94ec]
call fcn.00457408
test al, al
je 0x4a613c
mov al, byte [0x4c94ec]
call fcn.004883f4
test eax, eax
jne 0x4a613c
lea edx, [ebp - 0x7e4]
mov al, byte [0x4c94ec]
call fcn.004885f0
mov edx, dword [ebp - 0x7e4]
mov eax, 0x4bc644
call fcn.00403c18
lea eax, [ebp - 0x7e8]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x90]
call fcn.0040404c
mov ecx, dword [ebp - 0x7e8]
lea eax, [ebp - 0x90]
mov edx, dword [0x4bc644]
call fcn.00403e90
jmp 0x4a6146
mov eax, 0x4bc644
call fcn.00403bc4
lea eax, [ebp - 0x7ec]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x90]
call fcn.00403e90
mov eax, dword [ebp - 0x7ec]
call fcn.00404008
push eax
lea eax, [ebp - 0x7f0]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x90]
call fcn.00403e90
mov eax, dword [ebp - 0x7f0]
call fcn.00404008
push eax
call sub.kernel32.dll_MoveFileA
neg eax
sbb ebx, ebx
neg ebx
cmp dword [0x4bc644], 0
je 0x4a61ae
mov eax, 0x4bc644
call fcn.00403bc4
mov al, byte [0x4c94ec]
call fcn.00488778
mov eax, dword [ebp - 0x8c]
call fcn.00402e9c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0
push 0
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
mov eax, 0x4c94e8
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00403df4
mov eax, 0x4c94e8
call fcn.004a05ac
cmp dword [0x4c949c], 0
je 0x4a6232
lea edx, [ebp - 0x7f4]
mov eax, dword [0x4c94e8]
call fcn.00408954
mov edx, dword [ebp - 0x7f4]
mov eax, dword [0x4c949c]
call fcn.00404130
dec eax
jne 0x4a6232
mov byte [0x4c94ec], 1
jmp 0x4a6257
mov eax, dword [0x4c94e8]
cmp byte [eax + 1], 0x3a
jne 0x4a6250
mov eax, dword [0x4c94e8]
mov al, byte [eax]
call fcn.004029f4
mov byte [0x4c94ec], al
jmp 0x4a6257
mov byte [0x4c94ec], 0
cmp byte [0x4c94ec], 0x41
jb 0x4a62c4
mov al, byte [0x4c94ec]
call fcn.004883f4
test eax, eax
jne 0x4a62c4
lea edx, [ebp - 0x7f8]
mov al, byte [0x4c94ec]
call fcn.004885f0
mov edx, dword [ebp - 0x7f8]
mov eax, 0x4bc644
call fcn.00403c18
lea eax, [ebp - 0x7fc]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [0x4c94e8]
call fcn.0040404c
mov ecx, dword [ebp - 0x7fc]
mov eax, 0x4c94e8
mov edx, dword [0x4bc644]
call fcn.00403e90
jmp case.0x4a30f4.112
mov eax, 0x4bc644
call fcn.00403bc4
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x4c94f8], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x4c94f4], eax
mov eax, dword [ebp - 0x2c]
lea ebx, [eax + 0x20]
mov eax, dword [ebx + 4]
mov dword [0x4c9500], eax
mov eax, dword [ebx + 8]
mov dword [0x4c9504], eax
mov eax, dword [ebx]
mov dword [0x4c94fc], eax
mov eax, dword [ebx + 0xc]
mov dword [0x4c9508], eax
cmp byte [0x4c94ec], 1
jne 0x4a6348
mov eax, dword [0x4c949c]
call fcn.00457fec
sub eax, dword [0x4c9500]
sbb edx, dword [0x4c9504]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
jmp 0x4a643d
cmp dword [0x4bc644], 0
je 0x4a63f1
cmp dword [0x4c9504], 0
jne 0x4a636c
cmp dword [0x4c9500], 0x6400000
jae 0x4a63b1
jmp 0x4a636e
jge 0x4a63b1
mov al, byte [0x4c94ec]
call fcn.004888ec
push edx
push eax
push 0
push 3
mov eax, dword [0x4c9500]
mov edx, dword [0x4c9504]
call fcn.0040666c
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x12c00000
sbb edx, 0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
jmp 0x4a643d
mov al, byte [0x4c94ec]
call fcn.004888ec
push edx
push eax
push 0
push 2
mov eax, dword [0x4c9500]
mov edx, dword [0x4c9504]
call fcn.0040666c
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x1f400000
sbb edx, 0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
jmp 0x4a643d
cmp byte [0x4c94ec], 0x41
jb 0x4a6429
mov al, byte [0x4c94ec]
sub al, 0x41
inc eax
call fcn.004093dc
sub eax, dword [0x4c9500]
sbb edx, dword [0x4c9504]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
jmp 0x4a643d
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0x94], 0x7fff
cmp dword [ebp - 0x94], 0
jne 0x4a6451
cmp dword [ebp - 0x98], 0
jae 0x4a6474
jmp 0x4a6453
jge 0x4a6474
push 0
push 1
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
mov al, byte [0x4c94f8]
sub al, 2
jb 0x4a6484
je 0x4a649a
jmp case.0x4a30f4.112
mov dl, 1
mov eax, dword [0x4550b8]
call fcn.00402e6c
mov dword [0x4bc650], eax
jmp case.0x4a30f4.112
lea eax, [ebp - 0x800]
lea edx, [ebx + 0x10]
mov ecx, 0x401
call fcn.00403df4
mov ecx, dword [ebp - 0x800]
mov eax, 0x4c94f0
mov edx, dword [0x4c94e8]
call fcn.00403e90
lea eax, [ebp - 0x804]
mov edx, dword [0x4c94f0]
call fcn.00404350
mov eax, dword [ebp - 0x804]
mov dx, 0xffff
call fcn.00455b58
mov dword [0x4bc650], eax
cmp dword [0x4bc650], 0
jne 0x4a6527
push 0
push 0
lea eax, [ebp - 0x808]
lea edx, [ebx + 0x10]
mov ecx, 0x401
call fcn.00403df4
mov eax, dword [ebp - 0x808]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
push dword [0x4c9504]
push dword [0x4c9500]
mov eax, dword [0x4bc650]
call fcn.0044c0a8
push 0
push 0
mov eax, dword [0x4bc650]
call fcn.0044c048
jmp case.0x4a30f4.112
call fcn.004a2d0c
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x4bc610], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x4bc614], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x4bc618], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x4bc61c], eax
jmp case.0x4a30f4.112
lea eax, [ebp - 0x80c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404338
mov eax, dword [ebp - 0x80c]
xor edx, edx
call fcn.00455b58
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x4a6708
xor eax, eax
push ebp
push 0x4a6701
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x714]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xf3
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
push 0
push 0
mov eax, dword [ebp - 0xa0]
call fcn.0044c048
xor esi, esi
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x14], esi
inc esi
mov eax, dword [ebp - 0xa0]
call fcn.0044bfd4
push edx
push eax
mov eax, dword [ebp - 0xa0]
call fcn.0044c024
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4a6654
cmp eax, 0x500
jbe 0x4a665d
jmp 0x4a6656
jle 0x4a665d
mov ebx, 0x500
jmp 0x4a6677
mov eax, dword [ebp - 0xa0]
call fcn.0044bfd4
mov ebx, eax
mov eax, dword [ebp - 0xa0]
call fcn.0044c024
sub ebx, eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov ecx, ebx
mov eax, dword [ebp - 0xa0]
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [ebp - 0xa0]
call fcn.0044bfd4
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x18], eax
add ebx, 0x20
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], ebx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004a17c0
test al, al
je 0x4a66e8
mov eax, dword [0x4bcbec]
mov eax, dword [eax]
call fcn.00431ea0
mov eax, dword [ebp - 0xa0]
call fcn.0044bfd4
push edx
push eax
mov eax, dword [ebp - 0xa0]
call fcn.0044c024
cmp edx, dword [esp + 4]
jne 0x4a66e0
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4a661e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4a30f4.112
mov eax, dword [ebp - 0xa0]
call fcn.00402e9c
ret
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd0
mov eax, dword [ebp - 0x28]
call fcn.004a1ab4
jmp case.0x4a30f4.112
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x4c94b8], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.0040666c
call fcn.0040666c
mov dword [0x4bc62c], eax
mov dword [0x4bc630], edx
cmp dword [0x4bc630], 0
jne 0x4a676a
cmp dword [0x4bc62c], 0
jbe case.0x4a30f4.112
jmp 0x4a676c
jle case.0x4a30f4.112
mov eax, dword [0x4bc3e0]
mov edx, dword [0x4bc3e4]
add eax, dword [0x4bc62c]
adc edx, dword [0x4bc630]
mov dword [0x4bc62c], eax
mov dword [0x4bc630], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a685f
lea eax, [ebp - 0x80c]
call fcn.004041f4
lea eax, [ebp - 0x808]
call fcn.00403bc4
lea eax, [ebp - 0x804]
call fcn.004041f4
lea eax, [ebp - 0x800]
mov edx, 0x26
call fcn.00403be8
lea eax, [ebp - 0x768]
call fcn.004041f4
lea eax, [ebp - 0x764]
mov edx, 0xa
call fcn.00403be8
lea eax, [ebp - 0x73c]
call fcn.004041f4
lea eax, [ebp - 0x738]
mov edx, 2
call fcn.00403be8
lea eax, [ebp - 0x90]
call fcn.00403bc4
lea eax, [ebp - 0x7c]
call fcn.00403bc4
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00403be8
lea eax, [ebp - 0x60]
call fcn.00403bc4
lea eax, [ebp - 0x58]
mov edx, 6
call fcn.00403be8
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00403be8
lea eax, [ebp - 0x19]
mov edx, dword [0x455094]
call fcn.004046bc
ret