Function at 0x4ab9b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x40
push 0
push 0
dec ecx
jne 0x4ab9c1
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ada2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb560], 0
jne 0x4aba1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431df8
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
jmp 0x4ad995
xor ecx, ecx
push ebp
push 0x4ad962
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [ebp - 0xc], 0
jne 0x4abad7
mov edx, dword [ebp - 8]
mov eax, edx
shl edx, 3
sub edx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + edx*8 + 0xb55e]
cmp al, 0xb
je 0x4aba5d
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp al, 0xc
jne 0x4aba6a
mov eax, dword [ebp - 4]
cmp dword [eax + edx*8 + 0xb554], 0xffffffff
je 0x4aba76
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xb39c], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb560], 0
jle 0x4abacf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb39c]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 5
je 0x4abacf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb39c]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 6
je 0x4abacf
mov eax, dword [ebp - 4]
call fcn.004ab64c
mov eax, dword [ebp - 4]
call fcn.004ab554
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b0]
mov edx, 0x4ada44
call fcn.00431df8
mov eax, dword [ebp - 4]
mov byte [eax + 0xa5de], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
xor edx, edx
call fcn.00431df8
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb560], 0
jle 0x4acedf
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb55f]
sub al, 1
jb 0x4abb51
je 0x4abb7e
jmp 0x4abba2
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fbc8]
call fcn.00403c7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb550]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xa524]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4abbf1
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fbb8]
call fcn.00403c7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb550]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4abbf1
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + edx*8 + 0xb55f]
mov edx, dword [ebp - 4]
mov edx, dword [edx + esi*4 + 0xa5d8]
call fcn.00403c7c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4 + 0xa628]
mov edx, dword [ebp - 4]
add eax, dword [edx + ebx*8 + 0xb550]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
call fcn.0040947c
test al, al
jne 0x4abc2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x770]
mov dl, 1
call fcn.004532b0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa928], 0x16
mov eax, dword [ebp - 4]
call fcn.004ab664
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov edx, dword [ebp - 0x2c]
call fcn.0040633e
mov eax, dword [0x4cf300]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov edx, 1
call fcn.00406841
call fcn.00402854
mov edx, dword [ebp - 0x30]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xa93c
call fcn.00406878
call fcn.00402854
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov ecx, 4
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xb55e]
cmp eax, 0xc
ja case.0x4abca5.8
jmp dword [eax*4 + 0x4abcac]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4ada58
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 8]
call fcn.0040920c
push dword [ebp - 0x164]
push 0x4ada68
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4ada58
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 8]
call fcn.0040920c
push dword [ebp - 0x168]
push 0x4ada78
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
lea eax, [ebp - 0x1c]
call fcn.00403be4
cmp dword [ebp - 0xc], 0
jne 0x4acc8e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4ffd8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x16c]
call fcn.00403eb0
mov eax, dword [ebp - 0x16c]
call fcn.004096b0
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4ffd8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x170]
call fcn.00403eb0
mov edx, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0049fab0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa924], 0
je 0x4ac0b7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa924]
call fcn.0040947c
test al, al
je 0x4ac0b7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x20]
call fcn.00408ebc
mov edx, dword [ebp - 0x20]
mov eax, 0x4ada88
call fcn.00404150
mov ebx, eax
test ebx, ebx
jle 0x4acc8e
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 5]
mov ecx, 0x14
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov edx, dword [ebp - 0x20]
mov eax, 0x4ada98
call fcn.00404150
test eax, eax
jne 0x4abee3
lea edx, [ebx + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa924]
call fcn.004095cc
mov ecx, dword [ebp - 0x17c]
lea eax, [ebp - 0x178]
mov edx, 0x4adaac
call fcn.00403eb0
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
call fcn.00428c98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x4ac09f
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x20]
call fcn.00408ebc
mov edx, dword [ebp - 0x20]
mov eax, 0x4ada98
call fcn.00404150
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 0xa]
mov ecx, 0xff
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov edx, dword [ebp - 0x20]
mov eax, 0x4adacc
call fcn.00404150
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040406c
jmp 0x4abf71
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
dec ecx
mov edx, 2
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov eax, dword [ebp - 0x20]
mov al, byte [eax]
cmp al, 0x5c
je 0x4abf55
cmp al, 0x2e
je 0x4abf55
cmp al, 0x20
je 0x4abf55
cmp al, 0x3d
je 0x4abf55
cmp al, 0x27
je 0x4abf55
cmp al, 0x22
je 0x4abf55
jmp 0x4abfac
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x20
je 0x4abf90
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x27
je 0x4abf90
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x22
je 0x4abf90
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
push 0x4adad8
push dword [ebp - 0x20]
lea eax, [ebp - 0x184]
mov edx, 4
call fcn.00403f24
mov eax, dword [ebp - 0x184]
call fcn.0040947c
test al, al
jne 0x4ac09f
mov edx, ebx
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
mov edx, dword [ebp - 0x18]
add edx, 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc4]
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa924]
call fcn.004095cc
mov ecx, dword [ebp - 0x18c]
lea eax, [ebp - 0x188]
mov edx, 0x4adaac
call fcn.00403eb0
mov edx, dword [ebp - 0x188]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
call fcn.00428c98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc4]
jmp 0x4acc8e
mov eax, dword [ebp - 4]
add eax, 0xa924
call fcn.00403be4
jmp 0x4acc8e
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4acc8e
cmp dword [ebp - 0xc], 5
jne 0x4ac155
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb574], 0
jne 0x4ac148
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa934]
call fcn.004094c8
mov eax, dword [ebp - 4]
inc dword [eax + 0x51508]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adae4
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51508]
call fcn.0040920c
push dword [ebp - 0x190]
push 0x4adaf8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4acc8e
mov eax, dword [ebp - 4]
inc dword [eax + 0x51508]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adb08
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51508]
call fcn.0040920c
push dword [ebp - 0x194]
push 0x4adaf8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa56d], 1
jne 0x4ac2d3
cmp dword [ebp - 0xc], 0
jne 0x4ac26f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5d8]
mov edx, 0x4adb18
call fcn.00404150
test eax, eax
jle 0x4ac26f
xor eax, eax
push ebp
push 0x4ac216
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x198]
mov eax, 0x4adb30
call fcn.00461db4
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 4]
add eax, 0x514e0
call fcn.00405274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac26f
cmp dword [ebp - 0xc], 5
jne 0x4ac282
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4acc8e
mov eax, dword [ebp - 4]
inc dword [eax + 0x5150c]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adb4c
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5150c]
call fcn.0040920c
push dword [ebp - 0x1a0]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
push 0x4adb58
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4adb74
call fcn.00431df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa56e], 1
jne 0x4ac482
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5d8]
mov edx, 0x4adba4
call fcn.00404150
test eax, eax
je 0x4ac39d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5d8]
mov edx, 0x4adbbc
call fcn.00404150
test eax, eax
jne 0x4ac431
xor eax, eax
push ebp
push 0x4ac3d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1a4]
mov eax, 0x4adbd0
call fcn.00461db4
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 4]
add eax, 0x514f0
call fcn.00405274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac431
mov eax, dword [ebp - 4]
inc dword [eax + 0x51510]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adb4c
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51510]
call fcn.0040920c
push dword [ebp - 0x1ac]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
push 0x4adbec
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4adbfc
call fcn.00431df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa56f], 1
jne 0x4ac567
mov eax, dword [ebp - 4]
inc dword [eax + 0x51514]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adc2c
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51514]
call fcn.0040920c
push dword [ebp - 0x1b0]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
push 0x4adc3c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4adc4c
call fcn.00431df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa570], 1
jne 0x4ac806
push 0
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov ecx, 0x1e
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 0
je 0x4ac64c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 3
jne 0x4ac663
mov ebx, 0x1e
lea eax, [ebp - 0x160]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec ebx
jne 0x4ac657
mov ebx, 0xf
lea esi, [ebp - 0x160]
lea eax, [ebp - 0x1b4]
mov dl, byte [esi]
call fcn.00403d8c
mov edx, dword [ebp - 0x1b4]
lea eax, [ebp - 0x20]
call fcn.00403e6c
inc esi
dec ebx
jne 0x4ac66e
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push dword [ebp - 0x20]
push 0x4adc84
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 1
je 0x4ac6d9
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 4
jne 0x4ac6dd
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 0x1c]
call fcn.0040947c
test al, al
je 0x4acc8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004ae028
mov ebx, 1
lea edx, [ebp - 0x1b8]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x4ffd8]
call fcn.00403f74
je 0x4ac77e
inc ebx
cmp ebx, 0x12d
jne 0x4ac750
cmp ebx, 0x12d
jne 0x4ac7f9
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x4ffd8], 0
je 0x4ac7c5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x4ffd8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x1bc]
call fcn.00403eb0
mov eax, dword [ebp - 0x1bc]
call fcn.0040947c
test al, al
jne 0x4ac7f0
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa938]
call fcn.00409594
mov edx, dword [ebp - 0x1c0]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x4ffd8]
call fcn.00403c38
jmp 0x4ac7f9
inc ebx
cmp ebx, 0x12d
jne 0x4ac78b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4adc94
call fcn.00431df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
push 0
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov ecx, 0x1e
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 0
je 0x4ac8db
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 3
jne 0x4ac8f2
mov ebx, 0x1e
lea eax, [ebp - 0x160]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec ebx
jne 0x4ac8e6
mov ebx, 0xf
lea esi, [ebp - 0x160]
lea eax, [ebp - 0x1c4]
mov dl, byte [esi]
call fcn.00403d8c
mov edx, dword [ebp - 0x1c4]
lea eax, [ebp - 0x20]
call fcn.00403e6c
inc esi
dec ebx
jne 0x4ac8fd
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 5
jne 0x4ac951
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push dword [ebp - 0x20]
push 0x4adcd4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 6
jne 0x4ac986
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push dword [ebp - 0x20]
push 0x4adce4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 1
je 0x4ac9b4
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 4
jne 0x4ac9b8
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 4]
add eax, 0x844
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [ebp - 0x1c]
call fcn.0040947c
test al, al
je 0x4acc8e
mov ebx, 1
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50488]
call fcn.00403f74
jne 0x4acae9
mov eax, dword [ebp - 4]
mov esi, dword [eax + ebx*4 + 0x50938]
test esi, esi
je 0x4aca50
mov eax, dword [ebp - 4]
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x4aca50
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50938]
push eax
call sub.user32.dll_SetForegroundWindow
push 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50938]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ff90]
call fcn.00404028
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50488]
call fcn.00404028
push eax
push 0x4adcec
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4acaf6
lea edx, [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50488]
call fcn.00403c38
mov eax, dword [ebp - 4]
mov dword [eax + 0x50dec], ebx
mov eax, dword [ebp - 4]
call fcn.004c0e40
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50df0], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov dl, 1
call fcn.004532b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
inc ebx
cmp ebx, 0x12d
jne 0x4ac9dd
cmp ebx, 0x12d
jne 0x4acc14
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x50488], 0
je 0x4acb45
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x50488]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x1d0]
call fcn.00403eb0
mov eax, dword [ebp - 0x1d0]
call fcn.0040947c
test al, al
jne 0x4acc07
mov eax, dword [ebp - 4]
mov dword [eax + 0x50dec], ebx
lea edx, [ebp - 0x1d4]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50488]
call fcn.00403c38
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ff90]
call fcn.00404028
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50488]
call fcn.00404028
push eax
push 0x4adcec
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4acbd3
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50df0], edx
mov eax, dword [ebp - 4]
call fcn.004c0e40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov dl, 1
call fcn.004532b0
jmp 0x4acbfa
push 0
mov ecx, 0x4adcf4
mov edx, 0x4adcfc
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50488]
call fcn.00403be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
inc ebx
cmp ebx, 0x12d
jne 0x4acb07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4fbf5
call fcn.00403e08
mov eax, dword [ebp - 4]
call fcn.004ab664
push 0
push 0x4add24
push dword [ebp - 0x20]
push 0x4add54
push 0x4add64
push 0x4add78
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x1d8]
call fcn.00404028
mov edx, eax
mov ecx, 0x4adcf4
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
cmp dword [ebp - 0xc], 0
jne 0x4accaf
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xb55e], 0xa
je 0x4acd9e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb578]
cmp al, 1
je 0x4accdc
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4acd9e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb560]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*8 + 0xb55e]
test dl, dl
je 0x4acd3e
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 2
je 0x4acd3e
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 0xa
je 0x4acd3e
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 1
jne 0x4acd8b
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb574], 0
jle 0x4acd8b
cmp dword [ebp - 0xc], 0
jne 0x4acd5d
mov edx, dword [ebp - 4]
sub esi, dword [edx + eax*8 + 0xb574]
jmp 0x4acd8b
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*8 + 0xb560]
add edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
sub edx, dword [ecx + eax*8 + 0xb574]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb574]
mov eax, dword [ebp - 0x30]
push eax
push esi
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004c88cc
cmp dword [ebp - 0xc], 0
jne 0x4acdbf
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xb55e], 0xa
je 0x4acedf
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb578]
test al, al
je 0x4acdec
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 3
jne 0x4acedf
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb560]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb55e]
test al, al
je 0x4ace2d
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
jne 0x4aceb1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb574], 0
jle 0x4aceb1
cmp dword [ebp - 0xc], 0
jne 0x4ace4c
mov eax, dword [ebp - 4]
sub esi, dword [eax + ebx*8 + 0xb574]
jmp 0x4aceb1
mov eax, dword [ebp - 4]
add eax, 0xa93c
call fcn.00406538
call fcn.00402854
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*8 + 0xb560]
add edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + ebx*8 + 0xb574]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xa93c
call fcn.00406878
call fcn.00402854
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov ecx, 4
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 4]
mov esi, dword [eax + ebx*8 + 0xb574]
mov eax, dword [ebp - 4]
add eax, 0xa93c
call fcn.00406538
call fcn.00402854
mov dword [ebp - 0x30], eax
push esi
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004a70f0
mov eax, dword [ebp - 4]
add eax, 0xa93c
call fcn.004064a8
call fcn.00402854
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xb55e]
cmp eax, 0xc
ja case.0x4acf15.0
mov al, byte [eax + 0x4acf1c]
jmp dword [eax*4 + 0x4acf29]
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x50488], 0
je 0x4acf7c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x50488]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x1dc]
call fcn.00403eb0
mov eax, dword [ebp - 0x1dc]
call fcn.0040947c
test al, al
jne 0x4ad03e
mov eax, dword [ebp - 4]
mov dword [eax + 0x50dec], ebx
lea edx, [ebp - 0x1e0]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50488]
call fcn.00403c38
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ff90]
call fcn.00404028
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50488]
call fcn.00404028
push eax
push 0x4adcec
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4ad00a
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50df0], edx
mov eax, dword [ebp - 4]
call fcn.004c0e40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov dl, 1
call fcn.004532b0
jmp 0x4ad031
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50488]
call fcn.00403be4
push 0
mov ecx, 0x4adcf4
mov edx, 0x4adcfc
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
inc ebx
cmp ebx, 0x12d
jne 0x4acf3e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
cmp dword [ebp - 0xc], 0
jne 0x4ad214
cmp dword [ebp - 0x1c], 0
jne 0x4ad087
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa5d0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4ad09e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb554], 0xffffffff
jne 0x4ad0ea
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4ff9c], 1
jne 0x4ad0c1
mov eax, dword [ebp - 4]
call fcn.004af34c
jmp 0x4ad0ea
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
call fcn.00428b24
mov eax, dword [ebp - 4]
call fcn.004af224
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4add88
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb571], 0xa
jae 0x4ad14a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
xor edx, edx
call fcn.004423c0
jmp 0x4ad15a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
mov dl, 1
call fcn.004423c0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004bfd70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x778]
mov dl, 1
call fcn.004532b0
xor eax, eax
push ebp
push 0x4ad19e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad1a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc8]
xor eax, eax
push ebp
push 0x4ad1f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x67c]
call fcn.0045c308
test eax, eax
jne 0x4ad1ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad200
mov eax, dword [ebp - 4]
mov byte [eax + 0x4ffc0], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4ac], 0
cmp dword [ebp - 0xc], 1
jne 0x4ad256
cmp dword [ebp - 0x1c], 0
jne 0x4ad23f
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa5d0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4ad256
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x674]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0xc], 5
jne 0x4ad298
cmp dword [ebp - 0x1c], 0
jne 0x4ad281
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa5d0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4ad298
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0x1c], 0
jne 0x4ad2b1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5d0]
call fcn.00402f5c
jmp 0x4ad958
mov eax, dword [ebp - 0x1c]
call fcn.004094c8
jmp 0x4ad958
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb55e]
cmp al, 0xb
je 0x4ad2eb
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xc
jne 0x4ad482
push 0x4add94
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x1e4]
mov eax, dword [ebp - 8]
call fcn.0040920c
push dword [ebp - 0x1e4]
push 0x4adea8
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403f24
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb55e], 0xb
jne 0x4ad339
lea eax, [ebp - 0x20]
mov edx, 0x4adeb4
call fcn.00403e6c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 0xc
jne 0x4ad35d
lea eax, [ebp - 0x20]
mov edx, 0x4adec0
call fcn.00403e6c
push dword [ebp - 0x20]
push 0x4adecc
push 0x4adedc
push 0x4adee8
push 0x4adedc
push 0x4adef8
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00403f24
mov eax, dword [ebp - 4]
inc dword [eax + 0x51508]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adae4
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x1e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51508]
call fcn.0040920c
push dword [ebp - 0x1e8]
push 0x4adf08
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x20]
call fcn.00403e64
test eax, eax
jle 0x4ad3f7
mov ebx, 1
lea esi, [ebp - 0x160]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4ad3e9
mov eax, dword [ebp - 4]
add eax, 0xb104
mov edx, dword [ebp - 0x1c]
call fcn.0040633e
mov eax, dword [0x4cf300]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xb104
mov edx, 1
call fcn.00406858
call fcn.00402854
mov eax, dword [ebp - 4]
add eax, 0xb104
call fcn.0040657c
call fcn.00402854
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xb104
call fcn.00406878
call fcn.00402854
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xb104
call fcn.00406444
call fcn.00402854
mov eax, dword [ebp - 4]
add eax, 0xb104
call fcn.004064a8
call fcn.00402854
mov edx, dword [ebp - 0x1c]
mov eax, 0x4adf08
call fcn.00404150
test eax, eax
jle 0x4ad57b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4ff9a], 2
je 0x4ad4be
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb579], 1
jne 0x4ad57b
lea eax, [ebp - 0x20]
mov edx, 0x4adf18
call fcn.00403c7c
mov eax, dword [ebp - 0x20]
call fcn.00403e64
test eax, eax
jle 0x4ad4f0
mov ebx, 1
lea esi, [ebp - 0x160]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4ad4e2
mov eax, dword [ebp - 4]
add eax, 0xb104
mov edx, dword [ebp - 0x1c]
call fcn.0040633e
mov eax, dword [0x4cf300]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xb104
mov edx, 1
call fcn.00406841
call fcn.00402854
mov eax, dword [ebp - 4]
add eax, 0xb104
call fcn.0040657c
call fcn.00402854
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xb104
call fcn.00406878
call fcn.00402854
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xb104
call fcn.00406444
call fcn.00402854
mov eax, dword [ebp - 4]
add eax, 0xb104
call fcn.004064a8
call fcn.00402854
cmp dword [ebp - 0xc], 5
jne 0x4ad668
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb55e]
cmp al, 2
je 0x4ad5c3
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
je 0x4ad5c3
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xa
jne 0x4ad668
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb574], 0
jne 0x4ad609
mov eax, dword [ebp - 4]
add eax, 0xa934
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [ebp - 4]
mov byte [eax + 0xa599], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x548]
mov edx, 0x4adfe4
call fcn.00471ee8
jmp 0x4ad65b
cmp dword [ebp - 0x1c], 0
jne 0x4ad63c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa5d0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5d0]
call fcn.00402f5c
jmp 0x4ad65b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x1c]
call fcn.004094c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xa910]
cmp ebx, dword [ebp - 8]
je 0x4ad715
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4ada58
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x1f0]
mov eax, ebx
call fcn.0040920c
push dword [ebp - 0x1f0]
push 0x4ada68
lea eax, [ebp - 0x1ec]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x1ec]
call fcn.004094c8
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4ada58
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x1f8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa910]
call fcn.0040920c
push dword [ebp - 0x1f8]
push 0x4ada78
lea eax, [ebp - 0x1f4]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x1f4]
call fcn.004094c8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xa910], edx
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp dword [ecx + edx*8 + 0xb554], 0xffffffff
jne 0x4ad7fa
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb55e]
cmp al, 0xb
je 0x4ad769
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xc
jne 0x4ad7fa
mov eax, dword [ebp - 4]
mov byte [eax + 0xa5dd], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x740]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 4]
add eax, 0xa914
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [0x4cf2a8]
cmp dword [eax], 0
jne 0x4ad7b5
mov ecx, dword [0x4cf2a8]
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov edx, dword [0x49c274]
call fcn.00450264
mov eax, dword [0x4cf2a8]
mov eax, dword [eax]
call fcn.0044d1b0
lea eax, [ebp - 0x1fc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa914]
call fcn.004043ec
mov edx, dword [ebp - 0x1fc]
mov eax, dword [0x4cf2a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00471ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 4
jne 0x4ad8d5
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x4ffd8], 0
je 0x4ad8a1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x4ffd8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x200]
call fcn.00403eb0
mov eax, dword [ebp - 0x200]
call fcn.0040947c
test al, al
jne 0x4ad8cc
lea edx, [ebp - 0x204]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa938]
call fcn.00409594
mov edx, dword [ebp - 0x204]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x4ffd8]
call fcn.00403c38
jmp 0x4ad8d5
inc ebx
cmp ebx, 0x12d
jne 0x4ad867
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4ac], 0
jmp 0x4ad958
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4fbf5
call fcn.00403e08
mov eax, dword [ebp - 4]
call fcn.004ab664
push 0
push 0x4add24
push dword [ebp - 0x20]
push 0x4add54
push 0x4add64
push 0x4add78
lea eax, [ebp - 0x208]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x208]
call fcn.00404028
mov edx, eax
mov ecx, 0x4adcf4
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ada34
lea eax, [ebp - 0x208]
mov edx, 3
call fcn.00403c08
lea eax, [ebp - 0x1fc]
call fcn.004042a8
lea eax, [ebp - 0x1f8]
mov edx, 0x14
call fcn.00403c08
lea eax, [ebp - 0x1a8]
mov edx, dword [0x4011a0]
mov ecx, 2
call fcn.00404660
lea eax, [ebp - 0x1a0]
call fcn.00403be4
lea eax, [ebp - 0x19c]
mov edx, dword [0x4011a0]
mov ecx, 2
call fcn.00404660
lea eax, [ebp - 0x194]
mov edx, 0xd
call fcn.00403c08
lea eax, [ebp - 0x2c]
call fcn.00403be4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403c08
ret