Function at 0x50defc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x82
push 0
push 0
dec ecx
jne 0x50df04
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x50f8b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x39], 0
mov eax, dword [ebx + 0x11e4]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50dfad
mov esi, dword [ebx + 0x41c]
mov eax, esi
call fcn.004475f4
mov edx, eax
lea ecx, [ebp - 0x2c4]
mov eax, dword [esi + 0x228]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c4]
call fcn.0040b6e8
mov eax, dword [eax*4 + 0x594534]
mov eax, dword [eax + 0x84]
mov dword [ebp - 0x30], eax
mov esi, dword [ebx + 0x41c]
mov eax, esi
call fcn.004475f4
mov edx, eax
lea ecx, [ebp - 0x2c8]
mov eax, dword [esi + 0x228]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c8]
call fcn.0040b6e8
mov eax, dword [eax*4 + 0x594534]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x34], eax
jmp 0x50e010
mov eax, dword [ebx + 0x11e8]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50dff4
push 0
push 0x50f8c0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0x418
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x39], 1
jmp 0x50e010
mov eax, dword [0x594144]
mov eax, dword [eax + 0x1438]
mov dword [ebp - 0x30], eax
mov eax, dword [0x594144]
mov eax, dword [eax + 0x1440]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x30], 0
je 0x50f87e
mov eax, dword [ebx + 0x98c]
cmp byte [eax + 0x170], 0
je 0x50e333
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58eebc]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0xe6
lea eax, [ebp - 0x2b2]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
xor esi, esi
mov edi, 0x58d390
lea edx, [ebp - 0x2cc]
mov eax, esi
call fcn.0040b57c
mov eax, dword [ebp - 0x2cc]
push eax
mov ecx, esi
xor edx, edx
mov eax, dword [ebx + 0x950]
call fcn.004a7258
mov eax, dword [edi]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebx + 0x950]
call fcn.004a7258
inc esi
add edi, 8
cmp esi, 0x3a
jne 0x50e069
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
cmp dword [eax*4 + 0x58e9a8], 4
jb 0x50e0dd
mov eax, dword [0x58d40c]
push eax
mov ecx, 0xf
mov edx, 1
mov eax, dword [ebx + 0x950]
call fcn.004a7258
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58e9a8]
add eax, 0xfffffffc
sub eax, 2
jae 0x50e112
mov esi, 0x39
lea edi, [ebp - 0x240]
mov ax, word [edi]
mov word [edi - 0x70], ax
add edi, 2
dec esi
jne 0x50e105
xor esi, esi
lea edi, [ebp - 0x2b2]
lea edx, [ebp - 0x14]
movsx eax, word [edi]
call fcn.0040b57c
mov eax, dword [ebp - 0x14]
call fcn.00405298
mov ecx, eax
lea edx, [ebp - 0x14]
mov eax, 0x50f8d8
call fcn.00405580
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x2e
jne 0x50e153
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x50f8e4
call fcn.00405580
mov eax, dword [ebp - 0x14]
push eax
mov ecx, esi
mov edx, 2
mov eax, dword [ebx + 0x950]
call fcn.004a7258
inc esi
add edi, 2
cmp esi, 0x3a
jne 0x50e11a
mov eax, dword [ebx + 0x11b4]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50e333
mov eax, dword [ebx + 0x950]
mov eax, dword [eax + 0x24c]
dec eax
test eax, eax
jl 0x50e333
inc eax
mov dword [ebp - 0x40], eax
xor esi, esi
lea eax, [esi + 1]
mov edx, dword [ebx + 0x950]
mov edi, dword [edx + 0x24c]
dec edi
sub edi, eax
jb 0x50e329
inc edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2d0]
push eax
mov ecx, dword [ebp - 4]
mov edx, 1
mov eax, dword [ebx + 0x950]
call fcn.004a71e0
mov eax, dword [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2d4]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebx + 0x950]
call fcn.004a71e0
mov edx, dword [ebp - 0x2d4]
pop eax
call fcn.004053e4
jae 0x50e31f
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, 2
mov eax, dword [ebx + 0x950]
call fcn.004a71e0
lea eax, [ebp - 0x2d8]
push eax
mov ecx, esi
mov edx, 2
mov eax, dword [ebx + 0x950]
call fcn.004a71e0
mov eax, dword [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 4]
mov edx, 2
mov eax, dword [ebx + 0x950]
call fcn.004a7258
mov eax, dword [ebp - 0x14]
push eax
mov ecx, esi
mov edx, 2
mov eax, dword [ebx + 0x950]
call fcn.004a7258
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebx + 0x950]
call fcn.004a71e0
lea eax, [ebp - 0x2dc]
push eax
mov ecx, esi
xor edx, edx
mov eax, dword [ebx + 0x950]
call fcn.004a71e0
mov eax, dword [ebp - 0x2dc]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebx + 0x950]
call fcn.004a7258
mov eax, dword [ebp - 0x14]
push eax
mov ecx, esi
xor edx, edx
mov eax, dword [ebx + 0x950]
call fcn.004a7258
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, 1
mov eax, dword [ebx + 0x950]
call fcn.004a71e0
lea eax, [ebp - 0x2e0]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebx + 0x950]
call fcn.004a71e0
mov eax, dword [ebp - 0x2e0]
push eax
mov ecx, dword [ebp - 4]
mov edx, 1
mov eax, dword [ebx + 0x950]
call fcn.004a7258
mov eax, dword [ebp - 0x14]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebx + 0x950]
call fcn.004a7258
inc dword [ebp - 4]
dec edi
jne 0x50e1bf
inc esi
dec dword [ebp - 0x40]
jne 0x50e1a3
mov dl, 1
mov eax, dword [0x41aea0]
call fcn.00404194
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ea0c]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
cmp dword [eax*4 + 0x58e9a8], 1
jne 0x50e3ad
cmp dword [ebp - 4], 0xffffffff
jae 0x50e396
add dword [ebp - 4], 0x8c
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58e9a8]
add eax, 0xfffffffb
sub eax, 3
jae 0x50e7cb
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
cmp dword [eax*4 + 0x58e9a8], 7
jne 0x50e3ea
add dword [ebp - 4], 8
add dword [ebp - 4], 0xc4
lea eax, [ebp - 8]
push eax
push 0x50
lea eax, [ebp - 0x1cc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 0x50
jne 0x50e7a8
lea edi, [ebp - 0x1cc]
lea eax, [ebp - 0x2e4]
mov edx, edi
call fcn.004051d0
mov edx, dword [ebp - 0x2e4]
mov eax, dword [ebx + 0x944]
call fcn.00463224
lea edx, [ebp - 0x2ec]
movsx eax, word [ebp - 0x1a6]
call fcn.0040b57c
push dword [ebp - 0x2ec]
push 0x50f8f0
lea edx, [ebp - 0x2f0]
movsx eax, word [ebp - 0x1a4]
call fcn.0040b57c
push dword [ebp - 0x2f0]
push 0x50f8fc
lea edx, [ebp - 0x2f4]
movsx eax, word [ebp - 0x1ac]
call fcn.0040b57c
push dword [ebp - 0x2f4]
lea eax, [ebp - 0x2e8]
mov edx, 5
call fcn.00405358
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x2fc]
movsx eax, word [ebp - 0x19e]
call fcn.0040b57c
push dword [ebp - 0x2fc]
push 0x50f8f0
lea edx, [ebp - 0x300]
movsx eax, word [ebp - 0x19c]
call fcn.0040b57c
push dword [ebp - 0x300]
push 0x50f8fc
lea edx, [ebp - 0x304]
movsx eax, word [ebp - 0x1a8]
call fcn.0040b57c
push dword [ebp - 0x304]
lea eax, [ebp - 0x2f8]
mov edx, 5
call fcn.00405358
mov edx, dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x30c]
movsx eax, word [ebp - 0x1a2]
call fcn.0040b57c
push dword [ebp - 0x30c]
push 0x50f8f0
lea edx, [ebp - 0x310]
movsx eax, word [ebp - 0x1a0]
call fcn.0040b57c
push dword [ebp - 0x310]
push 0x50f8fc
lea edx, [ebp - 0x314]
movsx eax, word [ebp - 0x1aa]
call fcn.0040b57c
push dword [ebp - 0x314]
lea eax, [ebp - 0x308]
mov edx, 5
call fcn.00405358
mov edx, dword [ebp - 0x308]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x198]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x318]
call fcn.0040b668
mov edx, dword [ebp - 0x318]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58e944]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
lea edx, [ebp - 0x320]
movzx eax, word [ebp - 0x18]
call fcn.0040b57c
push dword [ebp - 0x320]
push 0x50f8f0
lea edx, [ebp - 0x324]
movzx eax, word [ebp - 0x16]
call fcn.0040b57c
push dword [ebp - 0x324]
lea eax, [ebp - 0x31c]
mov edx, 3
call fcn.00405358
mov edx, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov word [ebp - 0x18], 0
mov word [ebp - 0x16], 0
lea edx, [ebp - 0x32c]
movzx eax, word [ebp - 0x190]
call fcn.0040b57c
push dword [ebp - 0x32c]
push 0x50f8d8
lea edx, [ebp - 0x330]
movzx eax, word [ebp - 0x18a]
call fcn.0040b57c
push dword [ebp - 0x330]
push 0x50f8d8
lea edx, [ebp - 0x334]
movzx eax, word [ebp - 0x188]
call fcn.0040b57c
push dword [ebp - 0x334]
push 0x50f8d8
lea edx, [ebp - 0x338]
movzx eax, word [ebp - 0x186]
call fcn.0040b57c
push dword [ebp - 0x338]
push 0x50f8d8
lea edx, [ebp - 0x33c]
movzx eax, word [ebp - 0x184]
call fcn.0040b57c
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
mov edx, 9
call fcn.00405358
mov edx, dword [ebp - 0x328]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x344]
movzx eax, word [ebp - 0x17e]
call fcn.0040b57c
push dword [ebp - 0x344]
push 0x50f908
lea edx, [ebp - 0x348]
movzx eax, word [ebp - 0x180]
call fcn.0040b57c
push dword [ebp - 0x348]
lea eax, [ebp - 0x340]
mov edx, 3
call fcn.00405358
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x350]
xor eax, eax
mov al, byte [ebp - 0x18c]
call fcn.0040b57c
push dword [ebp - 0x350]
push 0x50f8f0
lea edx, [ebp - 0x354]
xor eax, eax
mov al, byte [ebp - 0x18b]
call fcn.0040b57c
push dword [ebp - 0x354]
push 0x50f914
lea edx, [ebp - 0x358]
movzx eax, word [ebp - 0x182]
call fcn.0040b57c
push dword [ebp - 0x358]
lea eax, [ebp - 0x34c]
mov edx, 5
call fcn.00405358
mov edx, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x50e9d5
mov dword [ebp - 4], 1
mov edx, dword [0x58f3e8]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 4]
cmp dword [ebp - 4], 7
jne 0x50e7af
jmp 0x50e9d5
cmp dword [ebp - 4], 0xffffffff
jae 0x50e7d8
add dword [ebp - 4], 0xa4
lea eax, [ebp - 8]
push eax
push 0x3c
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 0x3c
jne 0x50e9b7
lea edi, [ebp - 0x17c]
lea eax, [ebp - 0x35c]
mov edx, edi
call fcn.004051d0
mov edx, dword [ebp - 0x35c]
mov eax, dword [ebx + 0x944]
call fcn.00463224
lea edx, [ebp - 0x364]
movzx eax, word [ebp - 0x156]
call fcn.0040b57c
push dword [ebp - 0x364]
push 0x50f8f0
lea edx, [ebp - 0x368]
movzx eax, word [ebp - 0x154]
call fcn.0040b57c
push dword [ebp - 0x368]
lea eax, [ebp - 0x360]
mov edx, 3
call fcn.00405358
mov edx, dword [ebp - 0x360]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x370]
movzx eax, word [ebp - 0x14e]
call fcn.0040b57c
push dword [ebp - 0x370]
push 0x50f8f0
lea edx, [ebp - 0x374]
movzx eax, word [ebp - 0x14c]
call fcn.0040b57c
push dword [ebp - 0x374]
lea eax, [ebp - 0x36c]
mov edx, 3
call fcn.00405358
mov edx, dword [ebp - 0x36c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x37c]
movzx eax, word [ebp - 0x152]
call fcn.0040b57c
push dword [ebp - 0x37c]
push 0x50f8f0
lea edx, [ebp - 0x380]
movzx eax, word [ebp - 0x150]
call fcn.0040b57c
push dword [ebp - 0x380]
lea eax, [ebp - 0x378]
mov edx, 3
call fcn.00405358
mov edx, dword [ebp - 0x378]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x148]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x384]
call fcn.0040b668
mov edx, dword [ebp - 0x384]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x38c]
movzx eax, word [ebp - 0x142]
call fcn.0040b57c
push dword [ebp - 0x38c]
push 0x50f8f0
lea edx, [ebp - 0x390]
movzx eax, word [ebp - 0x154]
shl eax, 2
add eax, 0x1e
call fcn.0040b57c
push dword [ebp - 0x390]
lea eax, [ebp - 0x388]
mov edx, 3
call fcn.00405358
mov edx, dword [ebp - 0x388]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x394]
movzx eax, word [ebp - 0x144]
call fcn.0040b57c
mov edx, dword [ebp - 0x394]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x50e9d5
mov dword [ebp - 4], 1
mov edx, dword [0x58f3e8]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 4]
cmp dword [ebp - 4], 7
jne 0x50e9be
mov eax, dword [ebx + 0x964]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x964]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ea70]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50ea86
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50ea7f
xor esi, esi
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp + esi - 0x140]
push eax
mov eax, dword [ebp - 4]
add eax, esi
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
add esi, 0x10
cmp esi, 0x100
jb 0x50ea4e
mov dword [ebp - 8], pe_nt_image_headers32
jmp 0x50ea8b
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x50ea8b
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jne 0x50eaf3
xor esi, esi
lea eax, [ebp - 0x1c]
call fcn.00404fd8
cmp byte [ebp - 0x13f], 0x20
jb 0x50ead6
jmp 0x50eaca
lea eax, [ebp - 0x398]
mov dl, byte [ebp + esi - 0x140]
call fcn.004051c0
mov edx, dword [ebp - 0x398]
lea eax, [ebp - 0x1c]
call fcn.004052a0
inc esi
cmp byte [ebp + esi - 0x140], 0
jne 0x50eaa9
jmp 0x50eae6
lea esi, [ebp - 0x140]
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.00405f38
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
jmp 0x50eb01
lea eax, [ebp - 0xc]
mov edx, dword [0x58f3e8]
call fcn.00405070
lea eax, [ebp - 0x39c]
mov ecx, dword [0x58d330]
mov edx, dword [0x58d328]
call fcn.004052e4
mov edx, dword [ebp - 0x39c]
mov eax, dword [ebp - 0xc]
call fcn.004053e4
je 0x50eb5a
push dword [0x58d328]
push dword [0x58d32c]
push dword [0x58d330]
lea eax, [ebp - 0x3a0]
mov edx, 3
call fcn.00405358
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0xc]
call fcn.004053e4
jne 0x50eb70
cmp dword [0x594498], 0
je 0x50eb80
lea eax, [ebp - 0xc]
call fcn.004054f0
mov byte [eax], 0x79
jmp 0x50eb80
cmp dword [0x594294], 0
jg 0x50eb80
xor eax, eax
mov dword [0x594498], eax
cmp dword [0x594294], 0
jg 0x50ebfe
lea eax, [ebp - 0x3a4]
mov ecx, dword [0x58d330]
mov edx, dword [0x58d328]
call fcn.004052e4
mov edx, dword [ebp - 0x3a4]
mov eax, dword [ebp - 0xc]
call fcn.004053e4
je 0x50ebe2
push dword [0x58d328]
push dword [0x58d32c]
push dword [0x58d330]
lea eax, [ebp - 0x3a8]
mov edx, 3
call fcn.00405358
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0xc]
call fcn.004053e4
jne 0x50ebfe
mov eax, dword [ebx + 0x81c]
call fcn.0049b1e8
add eax, eax
mov dword [0x594294], eax
mov dword [0x594498], 1
mov eax, dword [ebx + 0x948]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x948]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor edx, edx
mov eax, dword [ebx + 0x948]
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor edx, edx
mov eax, dword [ebx + 0x948]
mov ecx, dword [eax]
call dword [ecx + 0xd8]
mov dl, 1
mov eax, dword [0x41aea0]
call fcn.00404194
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ead4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x50ec74
sub dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
push 0xc
lea eax, [ebp - 0x2c0]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 0xc
jne 0x50ecf3
lea edx, [ebp - 0x3ac]
mov eax, dword [ebp - 0x2b8]
call fcn.0040b57c
mov edx, dword [ebp - 0x3ac]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3b0]
mov eax, dword [ebp - 0x2bc]
call fcn.0040b57c
mov edx, dword [ebp - 0x3b0]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3b4]
mov eax, dword [ebp - 0x2c0]
call fcn.0040b57c
mov edx, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x50ed11
mov dword [ebp - 4], 1
mov edx, dword [0x58f3e8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jne 0x50ecfa
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x1d]
push eax
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58f178]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 1
jne 0x50ee41
xor eax, eax
mov al, byte [ebp - 0x1d]
cmp eax, 7
ja case.default.0x50ed52
jmp dword [eax*4 + 0x50ed59]
lea eax, [ebp - 0x10]
mov edx, 0x50f924
call fcn.00405070
jmp 0x50edfe
lea eax, [ebp - 0x10]
mov edx, 0x50f930
call fcn.00405070
jmp 0x50edfe
lea eax, [ebp - 0x10]
mov edx, 0x50f93c
call fcn.00405070
jmp 0x50edfe
lea eax, [ebp - 0x10]
mov edx, 0x50f948
call fcn.00405070
jmp 0x50edfe
lea eax, [ebp - 0x10]
mov edx, 0x50f954
call fcn.00405070
jmp 0x50edfe
lea eax, [ebp - 0x10]
mov edx, 0x50f960
call fcn.00405070
jmp 0x50edfe
lea eax, [ebp - 0x10]
mov edx, 0x50f96c
call fcn.00405070
jmp 0x50edfe
lea eax, [ebp - 0x10]
mov edx, 0x50f978
call fcn.00405070
jmp 0x50edfe
lea eax, [ebp - 0x10]
mov edx, 0x50f908
call fcn.00405070
lea edx, [ebp - 0x3bc]
xor eax, eax
mov al, byte [ebp - 0x1d]
call fcn.0040b57c
push dword [ebp - 0x3bc]
push 0x50f984
push dword [ebp - 0x10]
push 0x50f990
lea eax, [ebp - 0x3b8]
mov edx, 4
call fcn.00405358
mov edx, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x50ee4f
mov edx, dword [0x58f3e8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58f04c]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50eed5
mov eax, dword [ebx + 0x1300]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50eec4
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.0040b6b8
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x30
je 0x50eee3
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x50f8e4
call fcn.004052e4
jmp 0x50eee3
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040b668
jmp 0x50eee3
lea eax, [ebp - 0x14]
mov edx, dword [0x58f3e8]
call fcn.00405070
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ed2c]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50ef74
mov eax, dword [ebx + 0x1300]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50ef63
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 4
call fcn.0040b6b8
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x30
je 0x50ef82
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x50f8e4
call fcn.004052e4
jmp 0x50ef82
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040b668
jmp 0x50ef82
lea eax, [ebp - 0x14]
mov edx, dword [0x58f3e8]
call fcn.00405070
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58f0b0]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50f013
mov eax, dword [ebx + 0x1300]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f002
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.0040b6b8
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x30
je 0x50f021
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x50f8e4
call fcn.004052e4
jmp 0x50f021
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040b668
jmp 0x50f021
lea eax, [ebp - 0x14]
mov edx, dword [0x58f3e8]
call fcn.00405070
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ee58]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 6
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 6
jne 0x50f0ba
lea edx, [ebp - 0x3c0]
movsx eax, word [ebp - 0x24]
call fcn.0040b57c
mov edx, dword [ebp - 0x3c0]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3c4]
movsx eax, word [ebp - 0x22]
call fcn.0040b57c
mov edx, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3c8]
movsx eax, word [ebp - 0x20]
call fcn.0040b57c
mov edx, dword [ebp - 0x3c8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x50f0d8
mov dword [ebp - 4], 1
mov edx, dword [0x58f3e8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jne 0x50f0c1
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58edf4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
je 0x50f114
mov dword [ebp - 4], 0xa
cmp dword [ebp - 8], 4
jne 0x50f200
mov eax, dword [ebp - 4]
sub eax, 1
jb 0x50f137
je 0x50f161
dec eax
je 0x50f18b
dec eax
je 0x50f1b2
jmp 0x50f1d9
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3cc]
call fcn.0040b668
mov edx, dword [ebp - 0x3cc]
lea eax, [ebp - 0x14]
mov ecx, 0x50f99c
call fcn.004052e4
jmp 0x50f20e
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3d0]
call fcn.0040b668
mov edx, dword [ebp - 0x3d0]
lea eax, [ebp - 0x14]
mov ecx, 0x50f9ac
call fcn.004052e4
jmp 0x50f20e
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3d4]
call fcn.0040b668
mov edx, dword [ebp - 0x3d4]
lea eax, [ebp - 0x14]
mov ecx, 0x50f9bc
call fcn.004052e4
jmp 0x50f20e
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3d8]
call fcn.0040b668
mov edx, dword [ebp - 0x3d8]
lea eax, [ebp - 0x14]
mov ecx, 0x50f9d0
call fcn.004052e4
jmp 0x50f20e
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3dc]
call fcn.0040b668
mov edx, dword [ebp - 0x3dc]
lea eax, [ebp - 0x14]
mov ecx, 0x50f9e4
call fcn.004052e4
jmp 0x50f20e
lea eax, [ebp - 0x14]
mov edx, dword [0x58f3e8]
call fcn.00405070
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ecc8]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50f29f
mov eax, dword [ebx + 0x1300]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f28e
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.0040b6b8
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x30
je 0x50f2ad
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x50f8e4
call fcn.004052e4
jmp 0x50f2ad
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040b668
jmp 0x50f2ad
lea eax, [ebp - 0x14]
mov edx, dword [0x58f3e8]
call fcn.00405070
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ec64]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50f355
mov eax, dword [ebp - 4]
sub eax, 0x3a
jae 0x50f309
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx*8 + 0x58d390]
call fcn.00405070
jmp 0x50f316
lea eax, [ebp - 0x14]
mov edx, 0x50f9f8
call fcn.00405070
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3e0]
call fcn.0040b668
push dword [ebp - 0x3e0]
push 0x50f984
push dword [ebp - 0x14]
push 0x50f990
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405358
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x50f363
mov edx, dword [0x58f3e8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ec00]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50f438
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58eb9c]
cmp eax, dword [ebp - 4]
ja 0x50f3ce
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58eb9c]
sub dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub eax, 0x2b5
jae 0x50f3ec
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx*4 + 0x58d560]
call fcn.00405070
jmp 0x50f3f9
lea eax, [ebp - 0x14]
mov edx, 0x50f9f8
call fcn.00405070
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3e4]
call fcn.0040b668
push dword [ebp - 0x3e4]
push 0x50f984
push dword [ebp - 0x14]
push 0x50f990
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405358
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x50f446
mov edx, dword [0x58f3e8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x59c]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov eax, dword [eax*4 + 0x58ed90]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 8], 4
jne 0x50f4cc
mov eax, dword [ebx + 0x1300]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f4bb
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 4
call fcn.0040b6b8
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x30
je 0x50f4da
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x50f8e4
call fcn.004052e4
jmp 0x50f4da
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040b668
jmp 0x50f4da
lea eax, [ebp - 0x14]
mov edx, dword [0x58f3e8]
call fcn.00405070
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebx + 0x968]
call fcn.004a72a8
mov eax, dword [ebx + 0x970]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x50f58d
mov eax, dword [ebx + 0x974]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x50f58d
mov eax, dword [ebx + 0x978]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x50f58d
mov eax, dword [ebx + 0x980]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x50f58d
mov eax, dword [ebx + 0x97c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x50f58d
mov eax, dword [ebx + 0x988]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x50f58d
mov eax, dword [ebx + 0x984]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x50f58d
mov eax, dword [ebx + 0x818]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f85f
push pe_nt_image_headers32
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_GetWindowTextA
lea edi, [ebp - 0x140]
lea eax, [ebp - 0x3e8]
mov edx, edi
call fcn.004051d0
mov edx, dword [ebp - 0x3e8]
mov eax, 0x50f990
call fcn.004055dc
mov esi, eax
test esi, esi
jne 0x50f5f5
lea eax, [ebp - 0x3ec]
mov edx, edi
call fcn.004051d0
mov edx, dword [ebp - 0x3ec]
mov eax, 0x50fa08
call fcn.004055dc
mov esi, eax
dec esi
cmp esi, 0xffffffff
jne 0x50f5f5
mov esi, 0xff
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3f0]
mov edx, edi
call fcn.004051d0
mov eax, dword [ebp - 0x3f0]
mov ecx, esi
xor edx, edx
call fcn.004054f8
lea eax, [ebp - 0x1c]
mov edx, 0x50fa18
call fcn.004052a0
mov eax, dword [ebx + 0x970]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f65f
push dword [ebp - 0x1c]
push 0x50fa28
lea ecx, [ebp - 0x3f4]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x3f4]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
mov eax, dword [ebx + 0x974]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f69f
push dword [ebp - 0x1c]
push 0x50fa38
lea ecx, [ebp - 0x3f8]
mov edx, 1
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x3f8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
mov eax, dword [ebx + 0x978]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f6df
push dword [ebp - 0x1c]
push 0x50fa48
lea ecx, [ebp - 0x3fc]
mov edx, 2
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
mov eax, dword [ebx + 0x980]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f71f
push dword [ebp - 0x1c]
push 0x50fa58
lea ecx, [ebp - 0x400]
mov edx, 5
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x400]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
mov eax, dword [ebx + 0x97c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f75f
push dword [ebp - 0x1c]
push 0x50fa68
lea ecx, [ebp - 0x404]
mov edx, 4
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x404]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
mov eax, dword [ebx + 0x988]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f79f
push dword [ebp - 0x1c]
push 0x50fa78
lea ecx, [ebp - 0x408]
mov edx, 3
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x408]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
mov eax, dword [ebx + 0x984]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f7fa
push dword [ebp - 0x1c]
push 0x50f914
lea ecx, [ebp - 0x40c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x40c]
push 0x50fa88
lea ecx, [ebp - 0x410]
mov edx, 1
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x410]
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405358
mov eax, dword [ebx + 0x818]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x50f84d
cmp dword [0x594294], 0
jl 0x50f84d
push dword [ebp - 0x1c]
push 0x50fa94
lea edx, [ebp - 0x414]
mov eax, dword [0x594294]
sar eax, 1
jns 0x50f82f
adc eax, 0
call fcn.0040b57c
push dword [ebp - 0x414]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
dec dword [0x594294]
mov eax, dword [ebp - 0x1c]
call fcn.00405498
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_SetWindowTextA
mov eax, dword [ebp - 0x2c]
call fcn.004041c4
mov eax, dword [ebp - 0x28]
call fcn.004041c4
cmp byte [ebp - 0x39], 0
je 0x50f87e
mov eax, dword [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f8b8
lea eax, [ebp - 0x414]
mov edx, 0x55
call fcn.00404ffc
lea eax, [ebp - 0x1c]
call fcn.00404fd8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404ffc
ret