Function at 0x465c4c
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x89
push 0
push 0
dec ecx
jne 0x465c54
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x190]
mov edx, dword [0x4073a8]
call fcn.00404a40
xor eax, eax
push ebp
push 0x468241
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4128a0]
call fcn.00403284
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1ec]
mov eax, dword [0x46b8b0]
mov eax, dword [eax]
call fcn.00456960
mov eax, dword [ebp - 0x1ec]
lea edx, [ebp - 0x1e8]
call fcn.00408c08
lea eax, [ebp - 0x1e8]
mov edx, 0x46825c
call fcn.00404350
mov ecx, dword [ebp - 0x1e8]
mov dl, 1
mov eax, dword [0x42a8d8]
call fcn.0042a988
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0x1f0]
push eax
mov ecx, 0x468270
mov edx, 0x468284
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
add eax, 0xe0
call fcn.004040dc
push 0
lea eax, [ebp - 0x1f4]
push eax
mov ecx, 0x468294
mov edx, 0x468284
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
add eax, 0xd8
call fcn.004040dc
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4682a4
mov edx, 0x468284
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx]
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4682b4
mov edx, 0x468284
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx]
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x2f8]
cmp dword [ebx + 0xe0], 0
je 0x465d86
cmp dword [ebx + 0xd8], 0
jne 0x465da1
mov eax, 0x4682c4
call fcn.004291bc
mov eax, dword [0x46b8b0]
mov eax, dword [eax]
call fcn.0045643c
jmp 0x4681aa
push 0x15
mov ecx, 0x4682f4
mov edx, 0x468284
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov eax, dword [ebp - 8]
call fcn.004032b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov ecx, 0x7530
mov dl, 1
call fcn.004633e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468304
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [ebp - 0x14]
call fcn.00464770
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468338
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1f8]
mov ecx, 0x468360
mov edx, dword [ebp - 0x10]
call fcn.00404394
mov eax, dword [ebp - 0x1f8]
call fcn.00402880
call fcn.00402844
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, 0x468370
call fcn.00464770
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x46837c
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x4683ac
call fcn.00408abc
test eax, eax
jne 0x466090
cmp dword [ebp - 0x188], 0x10
je 0x466072
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x466072
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x466072
lea eax, [ebp - 0x1fc]
mov ecx, dword [ebp - 0x184]
mov edx, 0x4683d0
call fcn.00404394
mov edx, dword [ebp - 0x1fc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebp - 0x184]
mov eax, 0x4683b8
call fcn.0040468c
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0x184]
call fcn.004045a8
mov edx, dword [ebp - 0x200]
lea eax, [ebp - 0x1c]
mov ecx, 0x4683f0
call fcn.00404394
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x1c]
lea eax, [ebp - 0x204]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x204]
call fcn.0040891c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.004089d8
push 0
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x1c]
lea eax, [ebp - 0x208]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x208]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov ecx, dword [ebp - 0x1c]
call fcn.004644d4
push 0
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x184]
lea eax, [ebp - 0x20c]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov ecx, dword [ebp - 0x184]
call fcn.004644d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [ebp - 0x1c]
call fcn.00464708
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x1c]
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x210]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x184]
lea eax, [ebp - 0x214]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x214]
call fcn.00408b4c
push 0x46840c
push dword [ebp - 0x184]
push 0x46841c
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x465e94
lea eax, [ebp - 0x190]
call fcn.00408b30
mov eax, 0x468428
call fcn.00402894
call fcn.00402844
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, 0x468438
call fcn.00464770
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468448
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
push ebp
push 0x4660f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00463978
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46610a
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 1
jno 0x46611c
call fcn.004031f4
test eax, eax
jl 0x4662bc
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x220]
mov eax, 0x4683b8
call fcn.0040468c
push eax
lea ecx, [ebp - 0x224]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x224]
mov edx, 1
pop ecx
call fcn.004045a8
lea eax, [ebp - 0x21c]
mov edx, 0x4683f0
call fcn.00404350
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x4662b0
lea ecx, [ebp - 0x22c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x228]
mov edx, 0x468478
call fcn.00404394
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 1
push 0
push dword [ebp - 0x10]
push 0x468498
lea ecx, [ebp - 0x234]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x230]
push eax
lea ecx, [ebp - 0x238]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
pop ecx
call fcn.004637e4
lea ecx, [ebp - 0x23c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.00464708
push 0x46840c
lea ecx, [ebp - 0x244]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x244]
push 0x4684a8
lea eax, [ebp - 0x240]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x18]
dec dword [ebp - 0x38]
jne 0x46612f
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x4684b8
call fcn.00408abc
test eax, eax
jne 0x46644f
cmp dword [ebp - 0x188], 0x10
je 0x466431
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x466431
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x466431
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x248]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x248]
call fcn.00408a48
test al, al
je 0x466368
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x24c]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x24c]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x250]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x250]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x254]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x254]
pop edx
call fcn.00408b64
test al, al
je 0x4663f7
push 0x4684d8
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x258]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x466431
push 0x468508
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x25c]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x4662d9
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x468534
call fcn.00408abc
test eax, eax
jne 0x4665e2
cmp dword [ebp - 0x188], 0x10
je 0x4665c4
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x4665c4
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x4665c4
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x260]
call fcn.00408a48
test al, al
je 0x4664fb
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x264]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x268]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x268]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x26c]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x26c]
pop edx
call fcn.00408b64
test al, al
je 0x46658a
push 0x4684d8
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x270]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4665c4
push 0x468508
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x274]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x274]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x46646c
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x468548
call fcn.00408abc
test eax, eax
jne 0x466775
cmp dword [ebp - 0x188], 0x10
je 0x466757
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x466757
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x466757
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x278]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x278]
call fcn.00408a48
test al, al
je 0x46668e
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x27c]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x280]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x284]
pop edx
call fcn.00408b64
test al, al
je 0x46671d
push 0x4684d8
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x466757
push 0x468508
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x28c]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x28c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x4665ff
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x468558
call fcn.00408abc
test eax, eax
jne 0x466908
cmp dword [ebp - 0x188], 0x10
je 0x4668ea
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x4668ea
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x4668ea
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x290]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x290]
call fcn.00408a48
test al, al
je 0x466821
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x294]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x294]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x298]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x298]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x29c]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x29c]
pop edx
call fcn.00408b64
test al, al
je 0x4668b0
push 0x4684d8
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x2a0]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x2a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4668ea
push 0x468508
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x2a4]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x2a4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x466792
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x468568
call fcn.00408abc
test eax, eax
jne 0x466a9b
cmp dword [ebp - 0x188], 0x10
je 0x466a7d
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x466a7d
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x466a7d
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2a8]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2a8]
call fcn.00408a48
test al, al
je 0x4669b4
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2ac]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2ac]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4684c8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2b0]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2b0]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x2b4]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2b4]
pop edx
call fcn.00408b64
test al, al
je 0x466a43
push 0x468578
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x2b8]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x2b8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x466a7d
push 0x468598
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x2bc]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x2bc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x466925
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x4685c8
call fcn.00408abc
test eax, eax
jne 0x466c2e
cmp dword [ebp - 0x188], 0x10
je 0x466c10
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x466c10
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x466c10
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2c0]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2c0]
call fcn.00408a48
test al, al
je 0x466b47
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2c4]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2c4]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2c8]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2c8]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x2cc]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2cc]
pop edx
call fcn.00408b64
test al, al
je 0x466bd6
push 0x4685e8
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x2d0]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x466c10
push 0x468608
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x2d4]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x2d4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x466ab8
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x468638
call fcn.00408abc
test eax, eax
jne 0x466dc1
cmp dword [ebp - 0x188], 0x10
je 0x466da3
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x466da3
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x466da3
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2d8]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2d8]
call fcn.00408a48
test al, al
je 0x466cda
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2dc]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2dc]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2e0]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2e0]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x2e4]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2e4]
pop edx
call fcn.00408b64
test al, al
je 0x466d69
push 0x468648
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x2e8]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x466da3
push 0x468670
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x2ec]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x466c4b
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x4686ac
call fcn.00408abc
test eax, eax
jne 0x466f54
cmp dword [ebp - 0x188], 0x10
je 0x466f36
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x466f36
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x466f36
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2f0]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2f0]
call fcn.00408a48
test al, al
je 0x466e6d
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2f4]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2f4]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x2f8]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2f8]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x2fc]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x2fc]
pop edx
call fcn.00408b64
test al, al
je 0x466efc
push 0x4686bc
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x300]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x300]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x466f36
push 0x4686e0
push dword [ebp - 0x184]
push 0x4684f4
lea eax, [ebp - 0x304]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x304]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x466dde
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x468718
call fcn.00408abc
test eax, eax
jne 0x4670e7
cmp dword [ebp - 0x188], 0x10
je 0x4670c9
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x4670c9
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x4670c9
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x308]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x308]
call fcn.00408a48
test al, al
je 0x467000
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x30c]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x30c]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x310]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x310]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x314]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x314]
pop edx
call fcn.00408b64
test al, al
je 0x46708f
push 0x468728
push dword [ebp - 0x184]
push 0x468754
lea eax, [ebp - 0x318]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x318]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4670c9
push 0x468768
push dword [ebp - 0x184]
push 0x468754
lea eax, [ebp - 0x31c]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x31c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x466f71
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x4687a8
call fcn.00408abc
test eax, eax
jne 0x46727a
cmp dword [ebp - 0x188], 0x10
je 0x46725c
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x46725c
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x46725c
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x320]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x320]
call fcn.00408a48
test al, al
je 0x467193
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x324]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x324]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4685d8
push dword [ebp - 0x184]
lea eax, [ebp - 0x328]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x328]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x32c]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x32c]
pop edx
call fcn.00408b64
test al, al
je 0x467222
push 0x4687b8
push dword [ebp - 0x184]
push 0x468754
lea eax, [ebp - 0x330]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x330]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46725c
push 0x4687d8
push dword [ebp - 0x184]
push 0x468754
lea eax, [ebp - 0x334]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x334]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x467104
lea eax, [ebp - 0x190]
call fcn.00408b30
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x468808
call fcn.00408abc
test eax, eax
jne 0x46743b
cmp dword [ebp - 0x188], 0x10
je 0x46741d
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x46741d
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x46741d
lea edx, [ebp - 0x33c]
mov eax, dword [0x46b8b0]
mov eax, dword [eax]
call fcn.00456960
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x338]
call fcn.00408c08
lea eax, [ebp - 0x338]
mov edx, dword [ebp - 0x184]
call fcn.00404350
mov eax, dword [ebp - 0x338]
call fcn.00408a48
test al, al
je 0x467352
lea edx, [ebp - 0x344]
mov eax, dword [0x46b8b0]
mov eax, dword [eax]
call fcn.00456960
mov eax, dword [ebp - 0x344]
lea edx, [ebp - 0x340]
call fcn.00408c08
lea eax, [ebp - 0x340]
mov edx, dword [ebp - 0x184]
call fcn.00404350
mov eax, dword [ebp - 0x340]
call fcn.00408b4c
lea edx, [ebp - 0x34c]
mov eax, dword [0x46b8b0]
mov eax, dword [eax]
call fcn.00456960
mov eax, dword [ebp - 0x34c]
lea edx, [ebp - 0x348]
call fcn.00408c08
lea eax, [ebp - 0x348]
mov edx, dword [ebp - 0x184]
call fcn.00404350
mov eax, dword [ebp - 0x348]
push eax
push dword [ebp - 0x10]
push 0x468498
push dword [ebp - 0x184]
lea eax, [ebp - 0x350]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x350]
pop edx
call fcn.00408b64
test al, al
je 0x4673ed
lea eax, [ebp - 0x354]
mov ecx, dword [ebp - 0x184]
mov edx, 0x468818
call fcn.00404394
mov edx, dword [ebp - 0x354]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46741d
lea eax, [ebp - 0x358]
mov ecx, dword [ebp - 0x184]
mov edx, 0x468840
call fcn.00404394
mov edx, dword [ebp - 0x358]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x467297
lea eax, [ebp - 0x190]
call fcn.00408b30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, 0x468878
call fcn.00464770
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468888
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x360]
mov eax, dword [0x46b8b0]
mov eax, dword [eax]
call fcn.00456960
mov eax, dword [ebp - 0x360]
lea edx, [ebp - 0x35c]
call fcn.00408c08
lea eax, [ebp - 0x35c]
mov edx, 0x4688bc
call fcn.00404350
mov ecx, dword [ebp - 0x35c]
mov dl, 1
mov eax, dword [0x42a8d8]
call fcn.0042a988
mov dword [ebp - 8], eax
push 1
mov ecx, 0x4688d0
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov dword [ebp - 0x20], eax
push 0
mov ecx, 0x4688f0
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov dword [ebp - 0x24], eax
push 0
mov ecx, 0x468900
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jne 0x4675d4
cmp dword [ebp - 0x24], 0
je 0x4675d4
cmp dword [ebp - 0x28], 0
je 0x4675d4
push 0x46890c
lea edx, [ebp - 0x368]
mov eax, dword [ebp - 0x20]
call fcn.0040852c
push dword [ebp - 0x368]
push 0x468924
lea eax, [ebp - 0x364]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x364]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add dword [ebp - 0x20], 1
jno 0x467567
call fcn.004031f4
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, 0x4688d0
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, 0x4688f0
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, 0x468900
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x54]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468940
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dl, 1
mov eax, dword [0x4128a0]
call fcn.00403284
mov ebx, eax
mov byte [ebp - 0x31], 1
jmp 0x467d09
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
call fcn.0040852c
lea edx, [ebp - 0x370]
mov eax, dword [ebp - 0x20]
call fcn.0040852c
mov ecx, dword [ebp - 0x370]
lea eax, [ebp - 0x36c]
mov edx, 0x46894c
call fcn.00404394
mov edx, dword [ebp - 0x36c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x467646
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x468974
call fcn.00404394
mov eax, dword [ebp - 0x2c]
call fcn.00404348
cmp eax, 5
jl 0x467636
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x374]
mov ecx, 0x4683ac
mov edx, dword [ebp - 0x2c]
call fcn.00404394
mov eax, dword [ebp - 0x374]
lea ecx, [ebp - 0x190]
mov edx, 0x3f
call fcn.00408abc
test eax, eax
jne 0x4676d2
cmp dword [ebp - 0x188], 0x10
je 0x4676c1
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x4676c1
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x4676c1
mov edx, dword [ebp - 0x184]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x467687
jmp 0x4676f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468980
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x467d13
lea eax, [ebp - 0x190]
call fcn.00408b30
mov dl, 1
mov eax, ebx
call fcn.00416c2c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 1
jno 0x467715
call fcn.004031f4
test eax, eax
jl 0x467c3b
inc eax
mov dword [ebp - 0x38], eax
xor esi, esi
lea eax, [ebp - 0x378]
push eax
lea ecx, [ebp - 0x37c]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x37c]
mov ecx, 3
mov edx, 6
call fcn.004045a8
mov eax, dword [ebp - 0x378]
call fcn.00408668
mov edx, dword [ebp - 0x24]
add edx, 1
jno 0x467766
call fcn.004031f4
cmp eax, edx
jne 0x467931
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x384]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x384]
mov eax, 0x4683b8
call fcn.0040468c
add eax, 1
jno 0x46779e
call fcn.004031f4
push eax
lea ecx, [ebp - 0x388]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x388]
mov ecx, 3
pop edx
call fcn.004045a8
mov eax, dword [ebp - 0x380]
mov edx, 0x4689b0
call fcn.00404494
je 0x467931
lea eax, [ebp - 0x38c]
push eax
lea ecx, [ebp - 0x390]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x390]
mov eax, 0x4683b8
call fcn.0040468c
add eax, 1
jno 0x467805
call fcn.004031f4
push eax
lea ecx, [ebp - 0x394]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x394]
mov ecx, 3
pop edx
call fcn.004045a8
mov eax, dword [ebp - 0x38c]
mov edx, 0x4689bc
call fcn.00404494
je 0x467931
push dword [ebp - 0x10]
push 0x4684c8
lea ecx, [ebp - 0x39c]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x39c]
lea eax, [ebp - 0x398]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x398]
push eax
push dword [ebp - 0x10]
push 0x468498
lea ecx, [ebp - 0x3a4]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x3a4]
lea eax, [ebp - 0x3a0]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x3a0]
pop edx
call fcn.00408b64
test al, al
je 0x467c31
mov eax, dword [ebp - 0x24]
add eax, 1
jno 0x4678be
call fcn.004031f4
push eax
mov ecx, 0x4688f0
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x54]
add dword [ebp - 0x24], 1
jno 0x4678e4
call fcn.004031f4
push 0x4689c8
lea edx, [ebp - 0x3ac]
mov eax, dword [ebp - 0x24]
call fcn.0040852c
push dword [ebp - 0x3ac]
push 0x4689ec
lea eax, [ebp - 0x3a8]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x467c31
lea eax, [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x3b4]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x3b4]
mov eax, 0x4683b8
call fcn.0040468c
add eax, 1
jno 0x467961
call fcn.004031f4
push eax
lea ecx, [ebp - 0x3b8]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x3b8]
mov ecx, 3
pop edx
call fcn.004045a8
mov eax, dword [ebp - 0x3b0]
mov edx, 0x4689b0
call fcn.00404494
jne 0x467aa7
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x3c0]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x3c0]
mov ecx, 3
mov edx, 6
call fcn.004045a8
mov eax, dword [ebp - 0x3bc]
call fcn.00408668
push eax
mov ecx, 0x468900
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x54]
lea eax, [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x3c8]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x3c8]
mov ecx, 3
mov edx, 6
call fcn.004045a8
mov eax, dword [ebp - 0x3c4]
call fcn.00408668
mov dword [ebp - 0x28], eax
push dword [ebp - 0x10]
push 0x468498
lea ecx, [ebp - 0x3d0]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x3d0]
lea eax, [ebp - 0x3cc]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x3cc]
call fcn.00408b4c
push 0x468a0c
lea edx, [ebp - 0x3d8]
mov eax, dword [ebp - 0x28]
call fcn.0040852c
push dword [ebp - 0x3d8]
push 0x468a3c
lea eax, [ebp - 0x3d4]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x3d4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x467c31
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x24]
add eax, 1
jno 0x467ab7
call fcn.004031f4
call fcn.0040852c
push 0x468a4c
push dword [ebp - 0x30]
push 0x468a60
lea eax, [ebp - 0x3dc]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x3dc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x467b05
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov edx, 0x468974
call fcn.00404394
mov eax, dword [ebp - 0x30]
call fcn.00404348
cmp eax, 3
jl 0x467af5
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x468a84
lea eax, [ebp - 0x3e0]
mov edx, 5
call fcn.00404408
mov eax, dword [ebp - 0x3e0]
call fcn.0040891c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.004089d8
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x468a84
lea eax, [ebp - 0x3e4]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x3e4]
push eax
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x468a84
lea eax, [ebp - 0x3e8]
mov edx, 5
call fcn.00404408
mov edx, dword [ebp - 0x3e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
pop ecx
call fcn.004644d4
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x468a84
lea eax, [ebp - 0x3ec]
mov edx, 5
call fcn.00404408
mov eax, dword [ebp - 0x3ec]
call fcn.00408b4c
push 0x468a94
mov al, byte [0x468ac4]
push eax
lea eax, [ebp - 0x3f4]
push eax
xor ecx, ecx
mov edx, 0x468974
mov eax, dword [ebp - 0x30]
call fcn.0040d334
push dword [ebp - 0x3f4]
push 0x4689ec
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x3f0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebp - 0x31], 0
jmp 0x467c3b
inc esi
dec dword [ebp - 0x38]
jne 0x467723
cmp byte [ebp - 0x31], 0
je 0x467d09
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jne 0x467d09
push 0x46890c
lea edx, [ebp - 0x3fc]
mov eax, dword [ebp - 0x20]
call fcn.0040852c
push dword [ebp - 0x3fc]
push 0x468924
lea eax, [ebp - 0x3f8]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x3f8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add dword [ebp - 0x20], 1
jno 0x467ca4
call fcn.004031f4
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, 0x4688d0
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, 0x4688f0
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, 0x468900
mov edx, 0x4688e0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468940
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [ebp - 0x31], 0
jne 0x4675eb
mov eax, dword [ebp - 8]
call fcn.004032b4
lea eax, [ebp - 0x400]
mov ecx, 0x468360
mov edx, dword [ebp - 0x10]
call fcn.00404394
mov eax, dword [ebp - 0x400]
call fcn.00402880
call fcn.00402844
lea eax, [ebp - 0x404]
mov ecx, 0x468ad0
mov edx, dword [ebp - 0x10]
call fcn.00404394
mov eax, dword [ebp - 0x404]
call fcn.00408a48
test al, al
je 0x467dac
push 0
lea eax, [ebp - 0x408]
mov ecx, 0x468ad0
mov edx, dword [ebp - 0x10]
call fcn.00404394
mov edx, dword [ebp - 0x408]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov ecx, 0x468ae0
call fcn.004644d4
lea eax, [ebp - 0x40c]
mov ecx, 0x468ad0
mov edx, dword [ebp - 0x10]
call fcn.00404394
mov eax, dword [ebp - 0x40c]
call fcn.00408b4c
lea eax, [ebp - 0x410]
mov ecx, 0x468aec
mov edx, dword [ebp - 0x10]
call fcn.00404394
mov eax, dword [ebp - 0x410]
call fcn.00408a48
test al, al
je 0x46809e
lea eax, [ebp - 0x414]
mov ecx, 0x468aec
mov edx, dword [ebp - 0x10]
call fcn.00404394
mov eax, dword [ebp - 0x414]
call fcn.00404548
mov ebx, eax
lea eax, [ebp - 0x1d4]
mov edx, 0x44
call fcn.00406dac
mov dword [ebp - 0x1d4], 0x44
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x1d4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x467e41
mov eax, 0x468b00
call fcn.004291bc
jmp 0x46809e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1e4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x1e4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x418]
mov ecx, 0x468aec
mov edx, dword [ebp - 0x10]
call fcn.00404394
mov eax, dword [ebp - 0x418]
call fcn.00408b4c
lea ecx, [ebp - 0x190]
mov edx, 0x3f
mov eax, 0x4683ac
call fcn.00408abc
test eax, eax
jne 0x46809e
cmp dword [ebp - 0x188], 0x10
je 0x468080
mov eax, dword [ebp - 0x184]
mov edx, 0x4683b8
call fcn.00404494
je 0x468080
mov eax, dword [ebp - 0x184]
mov edx, 0x4683c4
call fcn.00404494
je 0x468080
lea eax, [ebp - 0x41c]
mov ecx, dword [ebp - 0x184]
mov edx, 0x4683d0
call fcn.00404394
mov edx, dword [ebp - 0x41c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x420]
push eax
mov edx, dword [ebp - 0x184]
mov eax, 0x4683b8
call fcn.0040468c
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0x184]
call fcn.004045a8
mov edx, dword [ebp - 0x420]
lea eax, [ebp - 0x1c]
mov ecx, 0x4683f0
call fcn.00404394
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x1c]
lea eax, [ebp - 0x424]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x424]
call fcn.0040891c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.004089d8
push 0
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x1c]
lea eax, [ebp - 0x428]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov ecx, dword [ebp - 0x1c]
call fcn.004644d4
push 0
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x184]
lea eax, [ebp - 0x42c]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov ecx, dword [ebp - 0x184]
call fcn.004644d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [ebp - 0x1c]
call fcn.00464708
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x1c]
lea eax, [ebp - 0x430]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x430]
call fcn.00408b4c
push dword [ebp - 0x10]
push 0x4683fc
push dword [ebp - 0x184]
lea eax, [ebp - 0x434]
mov edx, 3
call fcn.00404408
mov eax, dword [ebp - 0x434]
call fcn.00408b4c
push 0x46840c
push dword [ebp - 0x184]
push 0x46841c
lea eax, [ebp - 0x438]
mov edx, 3
call fcn.00404408
mov edx, dword [ebp - 0x438]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x190]
call fcn.00408b0c
test eax, eax
je 0x467ea2
lea eax, [ebp - 0x190]
call fcn.00408b30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x58]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468b3c
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
lea edx, [ebp - 0x440]
mov eax, dword [0x46b8b0]
mov eax, dword [eax]
call fcn.00456960
mov eax, dword [ebp - 0x440]
lea edx, [ebp - 0x43c]
call fcn.00408c08
lea eax, [ebp - 0x43c]
mov edx, 0x468b60
call fcn.00404350
mov eax, dword [ebp - 0x43c]
call fcn.00404548
push eax
lea edx, [ebp - 0x448]
mov eax, dword [0x46b8b0]
mov eax, dword [eax]
call fcn.00456960
mov eax, dword [ebp - 0x448]
lea edx, [ebp - 0x444]
call fcn.00408c08
lea eax, [ebp - 0x444]
mov edx, 0x4688bc
call fcn.00404350
mov eax, dword [ebp - 0x444]
call fcn.00404548
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x220]
mov edx, 0x468b74
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x58]
mov eax, dword [0x46ce74]
push eax
call sub.rasapi32.dll_RasHangUpA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
xor edx, edx
call fcn.00436c04
mov eax, dword [0x46ba88]
mov eax, dword [eax]
xor edx, edx
call fcn.00454338
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46824b
lea eax, [ebp - 0x448]
mov edx, 0xa
call fcn.004040ac
lea eax, [ebp - 0x420]
call fcn.00404088
lea eax, [ebp - 0x41c]
mov edx, 0x59
call fcn.004040ac
lea eax, [ebp - 0x2b8]
mov edx, 0x2e
call fcn.004040ac
lea eax, [ebp - 0x200]
call fcn.00404088
lea eax, [ebp - 0x1fc]
mov edx, 6
call fcn.004040ac
lea eax, [ebp - 0x190]
mov edx, dword [0x4073a8]
call fcn.00404b10
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004040ac
lea eax, [ebp - 0x1c]
call fcn.00404088
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004040ac
ret