Function at 0x494f98
Capabilities:
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Move file
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf3
push 0
push 0
dec ecx
jne 0x494fa0
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xb5]
mov edx, dword [0x4536b0]
call fcn.004045b4
xor eax, eax
push ebp
push 0x497315
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xffffff91
cmp eax, 0x67
ja case.0x494fe6.111
mov al, byte [eax + 0x494fed]
jmp dword [eax*4 + 0x495055]
lea eax, [ebp - 0x20]
mov edx, dword [0x4c8f04]
call fcn.00403c38
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x49515c
mov ecx, dword [ebp - 0x20]
mov edx, 0x497330
mov eax, 0x497340
call fcn.00453e98
mov edx, 0x497330
mov eax, 0x49738c
call fcn.004547d0
jmp case.0x494fe6.111
cmp eax, 1
jne 0x495187
mov eax, 0x49738c
mov edx, 0x497330
mov ecx, dword [ebp - 0x20]
call fcn.00453e98
mov eax, 0x497340
mov edx, 0x497330
call fcn.004547d0
jmp case.0x494fe6.111
cmp eax, 2
jne case.0x494fe6.111
mov eax, 0x497340
mov edx, 0x497330
call fcn.004547d0
mov eax, 0x49738c
mov edx, 0x497330
call fcn.004547d0
jmp case.0x494fe6.111
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x4c8f2d]
jne case.0x494fe6.111
cmp byte [0x4bd710], 0
jne case.0x494fe6.111
xor eax, eax
push ebp
push 0x49523a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4bd710], 1
cmp byte [0x4c8f20], 0
je 0x495208
mov byte [0x4c8f39], 0
mov eax, dword [ebx + 0x14]
mov dword [0x4c8fe8], eax
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00494cec
jmp 0x495225
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x4c8f2d]
mov edx, 0x76
mov eax, dword [ebp - 4]
call fcn.004948a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x494fe6.111
mov byte [0x4bd710], 0
ret
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x4c8fac], al
mov eax, 0x4c8f3f
call fcn.00403ba0
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x4c8eac], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x4c8eb0], eax
jmp case.0x494fe6.111
mov eax, dword [ebx + 0x10]
mov dword [0x4c8f98], eax
mov eax, dword [ebx + 0x14]
mov dword [0x4c8f9c], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 4]
call fcn.00444860
push eax
call sub.user32.dll_PostMessageA
jmp case.0x494fe6.111
push 0
push 0
push 0x505
mov eax, dword [ebp - 4]
call fcn.00444860
push eax
call sub.user32.dll_PostMessageA
jmp case.0x494fe6.111
push 0
push 0
push 0x503
mov eax, dword [ebp - 4]
call fcn.00444860
push eax
call sub.user32.dll_PostMessageA
jmp case.0x494fe6.111
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebp - 0x24]
call fcn.00499eb4
jmp case.0x494fe6.111
call fcn.00494ecc
jmp case.0x494fe6.111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.00457ebc
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049b2d8
jmp case.0x494fe6.111
mov eax, dword [0x4bda04]
mov byte [eax], 1
mov eax, dword [0x4bdc80]
mov dl, byte [0x4973d4]
cmp dl, byte [eax]
je 0x495343
xor ecx, ecx
mov dl, byte [0x4973d8]
xor eax, eax
call fcn.00487b8c
mov eax, dword [0x4bd888]
mov byte [eax], 1
mov eax, dword [0x4bd96c]
mov eax, dword [eax]
call fcn.0042e1d8
jmp case.0x494fe6.111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.00457ebc
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049b2d8
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.00492fb4
jmp case.0x494fe6.111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.00457ebc
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049b2d8
mov edx, dword [ebx + 0x10]
mov ax, 2
call fcn.00492fb4
jmp case.0x494fe6.111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.00457ebc
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049b2d8
mov eax, dword [0x4bdcd0]
cmp dword [eax], 2
jne 0x4953e5
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.00492fb4
jmp case.0x494fe6.111
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.00492fb4
jmp case.0x494fe6.111
cmp byte [0x4bd660], 2
je case.0x494fe6.111
cmp byte [0x4c8f3e], 3
jne case.0x494fe6.111
cmp byte [0x4c8f20], 0
jne case.0x494fe6.111
xor edx, edx
mov eax, dword [0x4c8f21]
call fcn.00412568
mov dword [ebp - 0xad], 0
mov dword [ebp - 0xa9], 0
lea edx, [ebp - 0xb1]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0xad]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0xa5]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x748]
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
call fcn.00431900
mov eax, dword [ebp - 0x748]
lea edx, [ebp - 0x744]
call fcn.0045380c
mov edx, dword [ebp - 0x744]
lea eax, [ebp - 8]
mov ecx, 0x4973e4
call fcn.00403e6c
lea eax, [ebp - 0x74c]
mov edx, dword [ebp - 8]
call fcn.00404314
mov eax, dword [ebp - 0x74c]
mov dx, 0xffff
call fcn.00453dec
mov ebx, eax
test ebx, ebx
je case.0x494fe6.111
mov ecx, dword [ebp - 0xad]
mov edx, dword [0x4c8f21]
mov eax, ebx
call fcn.0041261c
mov eax, ebx
call fcn.00402e78
lea eax, [ebp - 0x750]
mov edx, dword [ebp - 8]
call fcn.00404314
mov eax, dword [ebp - 0x750]
mov edx, dword [ebp - 0xa5]
call fcn.00453a0c
mov eax, dword [0x4c8f2d]
and eax, 0xff000000
cmp eax, 0x70000000
jb 0x495533
mov edx, dword [ebp - 0xb1]
mov eax, dword [ebp - 8]
call fcn.00408ea4
jmp 0x495540
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.00408ea4
lea edx, [ebp - 0xb1]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0xad]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0xa5]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
lea eax, [ebp - 0x754]
mov edx, dword [0x4c8eb4]
call fcn.00404314
mov eax, dword [ebp - 0x754]
mov dx, 0xffff
call fcn.00453dec
mov ebx, eax
test ebx, ebx
je case.0x494fe6.111
mov ecx, dword [ebp - 0xad]
mov edx, dword [0x4c8f21]
mov eax, ebx
call fcn.0041261c
mov eax, ebx
call fcn.00402e78
lea eax, [ebp - 0x758]
mov edx, dword [0x4c8eb4]
call fcn.00404314
mov eax, dword [ebp - 0x758]
mov edx, dword [ebp - 0xa5]
call fcn.00453a0c
lea edx, [ebp - 0xb1]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp eax, 4
jne 0x4956ea
mov edx, dword [0x4bdbac]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4973fc
call fcn.00403e6c
lea edx, [ebp - 0xad]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0xa5]
mov ecx, 4
mov eax, dword [0x4c8f21]
mov ebx, dword [eax]
call dword [ebx + 4]
lea eax, [ebp - 0x75c]
mov edx, dword [ebp - 8]
call fcn.00404314
mov eax, dword [ebp - 0x75c]
mov dx, 0xffff
call fcn.00453dec
mov ebx, eax
test ebx, ebx
je 0x4956ce
mov ecx, dword [ebp - 0xad]
mov edx, dword [0x4c8f21]
mov eax, ebx
call fcn.0041261c
mov eax, ebx
call fcn.00402e78
lea eax, [ebp - 0x760]
mov edx, dword [ebp - 8]
call fcn.00404314
mov eax, dword [ebp - 0x760]
mov edx, dword [ebp - 0xa5]
call fcn.00453a0c
mov eax, dword [0x4c8f2d]
and eax, 0xff000000
cmp eax, 0x70000000
jb 0x4956bf
mov edx, dword [ebp - 0xb1]
mov eax, dword [ebp - 8]
call fcn.00408ea4
jmp 0x4956ea
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.00408ea4
jmp 0x4956ea
mov eax, dword [0x4c8f21]
call fcn.00412558
mov edx, eax
add edx, dword [ebp - 0xad]
mov eax, dword [0x4c8f21]
call fcn.00412568
mov eax, 0x12c
call fcn.00454ea4
mov eax, dword [0x4bda04]
mov byte [eax], 1
mov eax, dword [0x4bdc80]
mov dl, byte [0x4973d4]
cmp dl, byte [eax]
je 0x49571a
mov dl, byte [0x4973d8]
xor ecx, ecx
xor eax, eax
call fcn.00487b8c
mov eax, dword [0x4bd888]
mov byte [eax], 1
mov eax, dword [0x4bd96c]
mov eax, dword [eax]
call fcn.0042e1d8
push 1
mov eax, dword [0x4c8eb4]
call fcn.00403fe4
push eax
call sub.kernel32.dll_WinExec
jmp case.0x494fe6.111
lea eax, [ebp - 8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebp - 8]
call fcn.00403e20
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0xc]
call fcn.00409528
mov eax, dword [ebp - 0xc]
call fcn.00403e20
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x10]
call fcn.00409528
mov eax, dword [ebp - 8]
mov edx, 0x497410
call fcn.00403f30
jne 0x4957cd
lea eax, [ebp - 0xc]
call fcn.00493cac
lea eax, [ebp - 0x10]
call fcn.00493cac
mov edx, 0x20
mov eax, dword [ebp - 0x10]
call fcn.00408ea4
push 0
mov eax, dword [ebp - 0x10]
call fcn.00403fe4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fe4
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x494fe6.111
mov eax, dword [ebp - 8]
mov edx, 0x497424
call fcn.00403f30
jne 0x49589e
mov eax, dword [ebp - 0xc]
call fcn.00403e20
cmp eax, 3
jle case.0x494fe6.111
lea eax, [ebp - 0xc]
call fcn.00493cac
mov eax, dword [ebp - 0xc]
call fcn.00408e3c
test al, al
je 0x495817
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00493a1c
jmp case.0x494fe6.111
mov eax, dword [ebp - 0xc]
call fcn.0044adf4
test al, al
je case.0x494fe6.111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0xc]
call fcn.00403bf4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 1
mov byte [0x4bd708], 1
xor eax, eax
push ebp
push 0x495880
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.00452a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495887
mov byte [0x4bd708], 0
ret
mov eax, dword [ebp - 8]
mov edx, 0x497438
call fcn.00403f30
jne 0x4958e8
lea eax, [ebp - 0xc]
call fcn.00493cac
lea eax, [ebp - 0x10]
call fcn.00493cac
mov edx, 0x20
mov eax, dword [ebp - 0x10]
call fcn.00408ea4
push 3
mov eax, dword [ebp - 0x10]
call fcn.00403fe4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fe4
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x494fe6.111
lea eax, [ebp - 0x10]
call fcn.00493cac
cmp dword [ebp - 0x10], 0
jne 0x495901
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040908c
lea eax, [ebp - 8]
call fcn.00493cac
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403fe4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fe4
push eax
mov eax, dword [ebp - 8]
call fcn.00403fe4
push eax
push 0x497444
mov eax, dword [ebp - 4]
call fcn.00444860
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x494fe6.111
cmp byte [0x4bd6e4], 1
jbe case.0x494fe6.111
mov byte [0x4bd6a0], 0xff
mov eax, dword [0x4bd8c0]
cmp dword [eax], 0
jle 0x495986
test byte [ebx + 0x17], 0x80
je 0x495974
mov eax, dword [ebx + 0x10]
and eax, 0xff
call fcn.00492308
jmp case.0x494fe6.111
mov eax, dword [ebx + 0x10]
and eax, 0xff
call fcn.004922f0
jmp case.0x494fe6.111
mov eax, dword [0x4bdc5c]
cmp dword [eax], 0
jle 0x4959c8
test byte [ebx + 0x17], 0x80
je 0x4959af
push 1
mov eax, dword [ebx + 0x10]
and eax, 0xff
push eax
mov eax, dword [0x4bdbe0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 1
mov eax, dword [ebx + 0x10]
and eax, 0xff
push eax
mov eax, dword [0x4bdab4]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
xor esi, esi
mov eax, dword [ebx + 0x14]
test ah, 1
je 0x4959d7
mov esi, 1
test eax, 0x80000000
je 0x4959e1
or esi, 2
mov dword [ebp - 0x740], 1
mov dx, word [ebx + 0x10]
mov word [ebp - 0x73c], dx
shr eax, 8
mov word [ebp - 0x73a], ax
mov dword [ebp - 0x738], esi
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x734], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x730], eax
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x494fe6.111
cmp byte [0x4bd6e4], 1
jbe case.0x494fe6.111
mov byte [0x4bd6a0], 0xff
mov eax, dword [0x4bd8c0]
cmp dword [eax], 0
jle 0x495b2e
mov eax, dword [ebx + 0x10]
dec eax
je 0x495a68
dec eax
je 0x495aaa
dec eax
je 0x495aec
jmp case.0x494fe6.111
mov eax, 0x12
call fcn.004922f0
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 9
call fcn.004922f0
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 9
call fcn.00492308
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x12
call fcn.00492308
jmp case.0x494fe6.111
mov eax, 0x12
call fcn.004922f0
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.004922f0
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.00492308
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x12
call fcn.00492308
jmp case.0x494fe6.111
mov eax, 0x11
call fcn.004922f0
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.004922f0
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x1b
call fcn.00492308
push 0xa
call sub.kernel32.dll_Sleep
mov eax, 0x11
call fcn.00492308
jmp case.0x494fe6.111
mov eax, dword [0x4bdc5c]
cmp dword [eax], 0
jle 0x495c3b
mov eax, dword [ebx + 0x10]
dec eax
je 0x495b51
dec eax
je 0x495b9f
dec eax
je 0x495bed
jmp case.0x494fe6.111
push 1
push 0x12
mov eax, dword [0x4bdab4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 9
mov eax, dword [0x4bdab4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 9
mov eax, dword [0x4bdbe0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x12
mov eax, dword [0x4bdbe0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 1
push 0x12
mov eax, dword [0x4bdab4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bdab4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bdbe0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x12
mov eax, dword [0x4bdbe0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 1
push 0x11
mov eax, dword [0x4bdab4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bdab4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x1b
mov eax, dword [0x4bdbe0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep
push 1
push 0x11
mov eax, dword [0x4bdbe0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
mov dword [ebp - 0x740], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x734], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x730], eax
mov eax, dword [ebx + 0x10]
dec eax
je 0x495c74
dec eax
je 0x495d28
dec eax
je 0x495ddc
jmp case.0x494fe6.111
mov word [ebp - 0x73c], 0x12
xor eax, eax
mov dword [ebp - 0x738], eax
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 9
xor eax, eax
mov dword [ebp - 0x738], eax
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 9
mov dword [ebp - 0x738], 2
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 0x12
mov dword [ebp - 0x738], 2
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x494fe6.111
mov word [ebp - 0x73c], 0x12
xor eax, eax
mov dword [ebp - 0x738], eax
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 0x1b
xor eax, eax
mov dword [ebp - 0x738], eax
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 0x1b
mov dword [ebp - 0x738], 2
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 0x12
mov dword [ebp - 0x738], 2
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x494fe6.111
mov word [ebp - 0x73c], 0x11
xor eax, eax
mov dword [ebp - 0x738], eax
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 0x1b
xor eax, eax
mov dword [ebp - 0x738], eax
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 0x1b
mov dword [ebp - 0x738], 2
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x734]
push 0xa
call sub.kernel32.dll_Sleep
mov word [ebp - 0x73c], 0x11
mov dword [ebp - 0x738], 2
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x494fe6.111
cmp byte [0x4bd6e4], 1
jbe case.0x494fe6.111
mov byte [0x4bd6a0], 0xff
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x4c8fec], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x495f0d
je 0x495f68
cmp eax, 0xa4
jg 0x495ef5
je 0x495f86
sub eax, 0x84
je 0x495f6d
sub eax, 0x1c
je 0x495f90
dec eax
je 0x495f72
dec eax
je 0x495f77
jmp case.0x495f1b.515
sub eax, 0xa5
je 0x495f8b
sub eax, 2
je 0x495f7c
dec eax
je 0x495f81
jmp case.0x495f1b.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x495f1b.515
jmp dword [eax*4 + 0x495f22]
or esi, 2
jmp case.0x495f1b.515
or esi, 4
jmp case.0x495f1b.515
or esi, 0x20
jmp case.0x495f1b.515
or esi, 0x40
jmp case.0x495f1b.515
or esi, 8
jmp case.0x495f1b.515
or esi, 0x10
jmp case.0x495f1b.515
or esi, 1
jmp case.0x495f1b.515
or esi, 1
jmp case.0x495f1b.515
or esi, 2
jmp case.0x495f1b.515
or esi, 4
jmp case.0x495f1b.515
or esi, 0x20
jmp case.0x495f1b.515
or esi, 0x40
jmp case.0x495f1b.515
or esi, 8
jmp case.0x495f1b.515
or esi, 0x10
jmp case.0x495f1b.515
or esi, 1
jmp case.0x495f1b.515
or esi, 0x800
mov eax, dword [0x4bdcb8]
mov eax, dword [eax]
call fcn.0042f240
dec eax
push eax
mov eax, dword [0x4c8fec]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x4bdcb8]
mov eax, dword [eax]
call fcn.0042f234
dec eax
push eax
mov eax, dword [0x4c8fec]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x1c], eax
cmp edi, 0x10000
jge case.0x494fe6.111
cmp dword [ebp - 0x1c], 0x10000
jge case.0x494fe6.111
mov eax, dword [ebx + 0x10]
cmp eax, 0x20a
jne 0x496016
mov edx, dword [0x4c8fec]
mov edx, dword [edx + 0x10]
mov dword [ebp - 0x14], edx
jmp 0x49601b
xor edx, edx
mov dword [ebp - 0x14], edx
mov edx, dword [0x4bd8c0]
cmp dword [edx], 0
jle 0x496150
cmp eax, 0x20a
je 0x49604b
mov eax, dword [0x4c8fec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c8fec]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bd82c]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x49608c
je case.0x496065.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x494fe6.111
jmp dword [eax*4 + 0x49606c]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x494fe6.111
jmp dword [eax*4 + 0x4960a1]
push 1
mov eax, dword [0x4bdad0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 2
mov eax, dword [0x4bdad0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 0x10
mov eax, dword [0x4bdad0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 0x20
mov eax, dword [0x4bdad0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 4
mov eax, dword [0x4bdad0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 8
mov eax, dword [0x4bdad0]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
mov eax, dword [0x4c8fec]
cmp dword [eax + 0x10], 0
jle 0x496140
push 1
mov eax, dword [0x4bd8b4]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 2
mov eax, dword [0x4bd8b4]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
mov edx, dword [0x4bdc5c]
cmp dword [edx], 0
jle 0x496227
cmp eax, 0x20a
je 0x496180
mov eax, dword [0x4c8fec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c8fec]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bdb48]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4961a3
je 0x4961bc
sub eax, 0xa1
je 0x4961bc
dec eax
je 0x4961cc
sub eax, 2
je 0x4961dc
dec eax
je 0x4961ec
jmp case.0x494fe6.111
sub eax, 0x202
je 0x4961cc
sub eax, 2
je 0x4961dc
dec eax
je 0x4961ec
sub eax, 5
je 0x4961fc
jmp case.0x494fe6.111
push 1
mov eax, dword [0x4bd8dc]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 1
mov eax, dword [0x4bda48]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 1
mov eax, dword [0x4bdbdc]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 1
mov eax, dword [0x4bd794]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
mov eax, dword [0x4c8fec]
cmp dword [eax + 0x10], 0
jle 0x496217
push 1
mov eax, dword [0x4bdaac]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
push 0xffffffffffffffff
mov eax, dword [0x4bdaac]
mov eax, dword [eax]
call eax
jmp case.0x494fe6.111
cmp eax, 0x200
je 0x496245
push 0
push 0
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
cmp dword [ebx + 0x10], 0x20a
jne 0x49626a
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
inc eax
push eax
inc edi
push edi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x494fe6.111
xor eax, eax
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x730], esi
inc edi
mov dword [ebp - 0x73c], edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x738], eax
xor eax, eax
mov dword [ebp - 0x734], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x72c], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x728], eax
push 0x1c
lea eax, [ebp - 0x740]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x494fe6.111
lea eax, [ebp - 0x151]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x129], 0x1c0000
mov eax, dword [ebx + 0x10]
mov edx, eax
shr edx, 0x10
mov dword [ebp - 0xe5], edx
and eax, 0xffff
mov dword [ebp - 0xe1], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0xe9], eax
push 0
lea eax, [ebp - 0x151]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x494fe6.111
cmp dword [0x4bd654], 0x40f04cb
jb case.0x494fe6.111
mov byte [0x4bd6a0], 0
mov byte [0x4bd6e4], 0
xor eax, eax
mov dword [0x4bd6ac], eax
mov byte [0x4bd6b0], 0
mov eax, dword [0x4bd8c0]
cmp dword [eax], 0
jne 0x496346
call fcn.00492510
mov eax, dword [0x4bdc5c]
cmp dword [eax], 0
jne 0x496355
call fcn.0049279c
cmp byte [0x4bd698], 0
jne 0x496400
mov byte [0x4bd698], 0xff
mov byte [0x4bd69c], 0
mov dl, 1
mov eax, dword [0x417eb4]
call fcn.0041e37c
mov dword [0x4bd6a4], eax
mov eax, dword [0x4bd6a4]
call fcn.0041e8e8
mov eax, dword [eax + 0xc]
mov edx, dword [0x4bdc38]
mov edx, dword [edx]
call fcn.00418f98
mov eax, dword [0x4bd6a4]
call fcn.0041e8e8
mov eax, dword [eax + 0xc]
mov edx, 0x24
call fcn.00418f58
mov eax, dword [0x4bd6a4]
call fcn.0041e8e8
mov eax, dword [eax + 0xc]
mov dl, byte [0x49744c]
call fcn.0041903c
mov dl, 1
mov eax, dword [0x417eb4]
call fcn.0041e37c
mov dword [0x4c8f88], eax
mov dl, 1
mov eax, dword [0x417eb4]
call fcn.0041e37c
mov dword [0x4c8f8c], eax
mov dword [0x4c8f90], 0
mov dword [0x4c8f94], 0
cmp byte [ebx + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x4c8f85], al
cmp byte [0x4c8f85], 0
je 0x4964e8
mov dword [0x4c8fc0], 0xffffffff
mov dl, 6
mov eax, dword [0x4bd6a4]
call fcn.0041f7a8
mov eax, dword [ebx + 0x10]
mov dword [0x4bd6d0], eax
mov eax, dword [ebx + 0x14]
mov dword [0x4bd6d4], eax
mov eax, dword [ebx + 0x18]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bd6dc], eax
mov eax, dword [ebx + 0x18]
shr eax, 8
and eax, 0xf
mov dword [0x4bd6e0], eax
mov al, byte [ebx + 0x18]
and al, 0xff
mov byte [0x4c8f86], al
cmp byte [0x4bd628], 0
je 0x496540
cmp dword [ebx + 4], 0x20
jle 0x496540
cmp byte [ebx + 0x20], 0x43
jne 0x4964cc
mov eax, dword [0x4bd920]
mov eax, dword [eax]
call fcn.004917dc
mov eax, dword [0x4bdba4]
cmp dword [eax], 0
jl 0x4964ad
mov eax, dword [0x4bdba4]
mov eax, dword [eax]
mov edx, dword [0x4bd840]
mov dword [edx], eax
jmp 0x4964b6
mov eax, dword [0x4bd840]
xor edx, edx
mov dword [eax], edx
mov edx, dword [0x4bd840]
mov edx, dword [edx]
mov eax, dword [0x4bd920]
mov eax, dword [eax]
call fcn.00491620
jmp 0x496540
mov eax, dword [0x4bd840]
mov eax, dword [eax]
mov edx, dword [0x4bdba4]
mov dword [edx], eax
mov eax, dword [0x4bd840]
mov dword [eax], 0xffffffff
jmp 0x496540
mov eax, dword [0x4bd840]
mov dword [eax], 0xffffffff
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bd6dc], eax
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x4bd6e0], eax
mov al, byte [ebx + 0x14]
and al, 0xff
mov byte [0x4c8f86], al
cmp byte [0x4c8f86], 3
jbe 0x496534
mov dl, byte [0x4c8f86]
mov eax, dword [0x4bd6a4]
call fcn.0041f7a8
jmp 0x496540
mov dl, 6
mov eax, dword [0x4bd6a4]
call fcn.0041f7a8
cmp dword [0x4bd6a8], 0
jne case.0x494fe6.111
mov dl, 1
mov eax, dword [0x40f158]
call fcn.00402e48
mov dword [0x4bd6a8], eax
jmp case.0x494fe6.111
cmp byte [0x4bd628], 0
je case.0x494fe6.111
mov eax, dword [0x4bd920]
mov eax, dword [eax]
call fcn.004917dc
mov eax, dword [0x4bdba4]
cmp dword [eax], 0
jl 0x496597
mov eax, dword [0x4bdba4]
mov eax, dword [eax]
mov edx, dword [0x4bd840]
mov dword [edx], eax
jmp 0x4965a0
mov eax, dword [0x4bd840]
xor edx, edx
mov dword [eax], edx
mov edx, dword [0x4bd840]
mov edx, dword [edx]
mov eax, dword [0x4bd920]
mov eax, dword [eax]
call fcn.00491620
jmp case.0x494fe6.111
cmp byte [0x4bd628], 0
je case.0x494fe6.111
mov eax, dword [0x4bd920]
mov eax, dword [eax]
call fcn.004917dc
mov eax, dword [0x4bd840]
inc dword [eax]
mov edx, dword [0x4bd840]
mov edx, dword [edx]
mov eax, dword [0x4bd920]
mov eax, dword [eax]
call fcn.00491620
jmp case.0x494fe6.111
cmp byte [0x4bd628], 0
je case.0x494fe6.111
mov eax, dword [0x4bd920]
mov eax, dword [eax]
call fcn.004917dc
mov eax, dword [0x4bd840]
mov eax, dword [eax]
mov edx, dword [0x4bdba4]
mov dword [edx], eax
mov eax, dword [0x4bd840]
mov dword [eax], 0xffffffff
jmp case.0x494fe6.111
cmp byte [0x4bd698], 0
je case.0x494fe6.111
cmp byte [0x4bd628], 0
je 0x49664c
mov eax, dword [0x4bd920]
mov eax, dword [eax]
call fcn.004917dc
mov byte [0x4bd698], 0
mov eax, 0x4bd6a4
call fcn.0040c944
mov eax, dword [0x4c8f88]
call fcn.00402e78
mov eax, dword [0x4c8f8c]
call fcn.00402e78
call fcn.004925b8
call fcn.00492858
call fcn.004921cc
jmp case.0x494fe6.111
cmp byte [0x4bd698], 0
je case.0x494fe6.111
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x4bd6dc], eax
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x4bd6e0], eax
mov al, byte [ebx + 0x14]
and al, 0xff
mov byte [0x4c8f86], al
cmp byte [0x4c8f85], 0
jne 0x4966ca
cmp byte [0x4c8f86], 3
ja 0x4966db
mov dl, 6
mov eax, dword [0x4bd6a4]
call fcn.0041f7a8
jmp case.0x494fe6.111
mov dl, byte [0x4c8f86]
mov eax, dword [0x4bd6a4]
call fcn.0041f7a8
jmp case.0x494fe6.111
cmp dword [ebx + 0x10], 0
je 0x496721
lea eax, [ebp - 0x764]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov ecx, dword [ebp - 0x764]
mov dl, byte [0x497450]
mov al, 1
call fcn.00487b8c
jmp case.0x494fe6.111
mov dl, byte [0x4973d8]
xor ecx, ecx
xor eax, eax
call fcn.00487b8c
jmp case.0x494fe6.111
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x4bd96c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f0]
call fcn.00437054
jmp case.0x494fe6.111
push 0
push 0
push 0x913
mov eax, dword [ebp - 4]
call fcn.00444860
push eax
call sub.user32.dll_PostMessageA
jmp case.0x494fe6.111
lea eax, [ebp - 0x76c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebp - 0x76c]
lea edx, [ebp - 0x768]
call fcn.00408818
mov edx, dword [ebp - 0x768]
mov eax, 0x4c8ff0
call fcn.00403bf4
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 4]
call fcn.00444860
push eax
call sub.user32.dll_PostMessageA
jmp case.0x494fe6.111
lea eax, [ebp - 0x2c]
call fcn.00403ba0
cmp byte [ebx + 0xc], 0x9f
jne 0x4967e6
cmp dword [ebx + 4], 0x20
jle 0x4967e6
lea eax, [ebp - 0x2c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x49680a
cmp eax, 0xffffffff
je 0x49680a
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 4]
call fcn.00444860
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x2c], 0
je case.0x494fe6.111
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x2c]
call fcn.00403c38
jmp 0x4957e0
lea edx, [ebp - 0x28]
lea eax, [ebx + 0x20]
call fcn.00409528
lea eax, [ebp - 0x28]
call fcn.00403ff0
push eax
call fcn.00425524
pop edx
call fcn.004251cc
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x494fe6.111
lea edx, [ebp - 0x3c]
lea eax, [ebx + 0x20]
call fcn.00409528
mov eax, dword [ebx + 0x10]
cmp eax, 0xaf
jne 0x4968b8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0049d630
jmp case.0x494fe6.111
cmp eax, 0xae
jne 0x4968d1
mov eax, dword [ebp - 0x3c]
call fcn.004851bc
call fcn.0049d734
jmp case.0x494fe6.111
cmp eax, 0xb4
jne 0x4968ee
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [0x4c8fb8]
call fcn.00403e6c
jmp 0x4957e0
cmp eax, 0xb5
jne case.0x494fe6.111
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [0x4c8fb8]
call fcn.00403e6c
jmp 0x4957e0
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 4]
call fcn.00444860
push eax
call sub.user32.dll_SendMessageA
jmp case.0x494fe6.111
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x494fe6.111
push 0
lea eax, [ebp - 0x184]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x164]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x17c]
mov esi, dword [ebp - 0x184]
sub eax, esi
mov edx, dword [ebp - 0x15c]
sub edx, dword [ebp - 0x164]
cmp eax, edx
jle case.0x494fe6.111
sub eax, edx
sar eax, 1
jns 0x496989
adc eax, 0
add eax, esi
mov dword [ebp - 0x174], eax
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x180]
sub edx, eax
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub edx, ecx
sar edx, 1
jns 0x4969b4
adc edx, 0
add edx, eax
mov dword [ebp - 0x170], edx
push 1
push 0
push 0
push edx
mov eax, dword [ebp - 0x174]
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x494fe6.111
lea eax, [ebp - 0x770]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov ecx, dword [ebp - 0x770]
mov edx, 0x49745c
mov eax, 0x497470
call fcn.00453e98
jmp case.0x494fe6.111
lea eax, [ebp - 0x7c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
lea eax, [ebp - 0x7c]
call fcn.00493cac
mov eax, dword [ebp - 0x7c]
call fcn.0044adf4
test al, al
je 0x496c03
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0x7c]
call fcn.00403bf4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 0
mov dl, 1
mov eax, dword [0x4536d4]
call fcn.00402e48
mov dword [0x4c8ff4], eax
mov edx, 0x20
mov eax, dword [0x4c8ff4]
mov ecx, dword [eax]
call dword [ecx]
mov edx, 0x20
mov eax, dword [0x4c8ff4]
call fcn.00412568
mov byte [0x4bd708], 2
xor eax, eax
push ebp
push 0x496bfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.00452a0c
mov eax, dword [0x4c8ff4]
call fcn.00412574
cmp eax, 0x20
jle 0x496bc2
mov eax, dword [0x4c8ff4]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xe8
mov byte [ebx + 0xe], 0
mov eax, dword [0x4c8ff4]
call fcn.00412574
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.004992fc
mov eax, dword [ebx + 4]
mov dword [ebp - 0x90], eax
cmp byte [0x4c8fcc], 0
je 0x496bb6
lea ebx, [ebp - 0x724]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf2
mov byte [ebx + 0xe], 0
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
xor edx, edx
mov eax, dword [0x4c8ff4]
call fcn.00412568
xor eax, eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x14], eax
inc dword [ebp - 0x8c]
mov eax, dword [0x4c8ff4]
call fcn.00412558
mov edx, dword [ebp - 0x90]
sub edx, eax
cmp edx, 0x500
jle 0x496b54
mov esi, 0x500
jmp 0x496b66
mov eax, dword [0x4c8ff4]
call fcn.00412558
mov esi, dword [ebp - 0x90]
sub esi, eax
lea edx, [ebx + 0x20]
mov ecx, esi
mov eax, dword [0x4c8ff4]
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [0x4c8ff4]
call fcn.00412558
mov edx, dword [ebp - 0x90]
sub edx, eax
mov dword [ebx + 0x18], edx
add esi, 0x20
mov dword [ebx + 4], esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049443c
test al, al
je 0x496bdd
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
call fcn.00431274
cmp dword [ebx + 0x18], 0
jne 0x496b24
jmp 0x496bdd
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049443c
jmp 0x496bdd
push 0
push 0
mov eax, dword [ebp - 0x7c]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 4]
call fcn.004948a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x494fe6.111
mov byte [0x4bd708], 0
mov eax, dword [0x4c8ff4]
call fcn.00402e78
ret
push 0
push 0
mov eax, dword [ebp - 0x7c]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 4]
call fcn.004948a8
jmp case.0x494fe6.111
lea eax, [ebp - 8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
lea eax, [ebp - 8]
call fcn.00493cac
push 0
lea eax, [ebp - 8]
call fcn.00403ff0
push eax
call sub.kernel32.dll_CreateDirectoryA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x71], al
push 0
push 0
lea eax, [ebp - 0x774]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, dword [ebp - 0x774]
push eax
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x71]
mov edx, 0xbd
mov eax, dword [ebp - 4]
call fcn.004948a8
jmp case.0x494fe6.111
mov dl, 1
mov eax, dword [0x40eeac]
call fcn.00402e48
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x778]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x7c]
xor edx, edx
mov eax, dword [ebp - 0x78]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x7c]
call fcn.00493cac
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x496daf
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x77c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x77c]
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x7c]
call fcn.00403e6c
mov eax, dword [ebp - 8]
call fcn.00408e3c
test al, al
je 0x496d2e
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00493a1c
jmp 0x496da0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 8]
call fcn.00403bf4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 1
mov byte [0x4bd708], 3
xor eax, eax
push ebp
push 0x496d87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.00452a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496d8e
mov byte [0x4bd708], 0
ret
inc dword [ebp - 0x18]
dec dword [ebp - 0x9c]
jne 0x496cf1
lea ecx, [ebp - 0x7c]
xor edx, edx
mov eax, dword [ebp - 0x78]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x78]
call fcn.00402e78
jmp 0x496a14
mov dl, 1
mov eax, dword [0x40eeac]
call fcn.00402e48
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x780]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov edx, dword [ebp - 0x780]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x7c]
xor edx, edx
mov eax, dword [ebp - 0x78]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 8]
mov edx, 1
mov eax, dword [ebp - 0x78]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0xc]
mov edx, 2
mov eax, dword [ebp - 0x78]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x7c]
call fcn.00493cac
lea eax, [ebp - 0x784]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x7c]
call fcn.00403e6c
mov eax, dword [ebp - 0x784]
call fcn.00403fe4
push eax
lea eax, [ebp - 0x788]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x7c]
call fcn.00403e6c
mov eax, dword [ebp - 0x788]
call fcn.00403fe4
push eax
call sub.kernel32.dll_MoveFileA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x71], al
mov eax, dword [ebp - 0x78]
call fcn.00402e78
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x71]
mov edx, 0xc0
mov eax, dword [ebp - 4]
call fcn.004948a8
jmp case.0x494fe6.111
mov eax, 0x4c8ff8
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dd0
mov eax, 0x4c8ff8
call fcn.00493cac
mov eax, dword [0x4c8ff8]
cmp byte [eax + 1], 0x3a
jne 0x496ede
mov eax, dword [0x4c8ff8]
mov al, byte [eax]
call fcn.004029e8
mov byte [0x4c8ffc], al
jmp case.0x494fe6.111
mov byte [0x4c8ffc], 0
jmp case.0x494fe6.111
mov al, byte [ebx + 0x10]
mov byte [0x4c9008], al
mov eax, dword [ebx + 0x14]
mov dword [0x4c9004], eax
lea eax, [ebx + 0x20]
mov ebx, eax
mov eax, dword [ebx + 4]
mov dword [0x4c9010], eax
mov eax, dword [ebx + 8]
mov dword [0x4c9014], eax
mov eax, dword [ebx]
mov dword [0x4c900c], eax
mov eax, dword [ebx + 0xc]
mov dword [0x4c9018], eax
cmp byte [0x4c8ffc], 0x41
jb 0x496f58
mov al, byte [0x4c8ffc]
sub al, 0x41
inc eax
call fcn.0040920c
sub eax, dword [0x4c9010]
sbb edx, dword [0x4c9014]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], edx
jmp 0x496f6c
mov dword [ebp - 0x88], 0xffffffff
mov dword [ebp - 0x84], 0x7fff
cmp dword [ebp - 0x84], 0
jne 0x496f80
cmp dword [ebp - 0x88], 0
jae 0x496fa3
jmp 0x496f82
jge 0x496fa3
push 0
push 1
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xc3
mov eax, dword [ebp - 4]
call fcn.004948a8
jmp case.0x494fe6.111
mov al, byte [0x4c9008]
sub al, 2
jb 0x496fb3
je 0x496fc9
jmp case.0x494fe6.111
mov dl, 1
mov eax, dword [0x4536d4]
call fcn.00402e48
mov dword [0x4bd714], eax
jmp case.0x494fe6.111
lea eax, [ebp - 0x78c]
lea edx, [ebx + 0x10]
mov ecx, 0x401
call fcn.00403dd0
mov ecx, dword [ebp - 0x78c]
mov eax, 0x4c9000
mov edx, dword [0x4c8ff8]
call fcn.00403e6c
lea eax, [ebp - 0x790]
mov edx, dword [0x4c9000]
call fcn.00404314
mov eax, dword [ebp - 0x790]
mov dx, 0xffff
call fcn.00453dec
mov dword [0x4bd714], eax
cmp dword [0x4bd714], 0
jne 0x497056
push 0
push 0
lea eax, [ebp - 0x794]
lea edx, [ebx + 0x10]
mov ecx, 0x401
call fcn.00403dd0
mov eax, dword [ebp - 0x794]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xc3
mov eax, dword [ebp - 4]
call fcn.004948a8
jmp case.0x494fe6.111
push dword [0x4c9014]
push dword [0x4c9010]
mov eax, dword [0x4bd714]
call fcn.0044b330
push 0
push 0
mov eax, dword [0x4bd714]
call fcn.0044b2d0
jmp case.0x494fe6.111
call fcn.00494efc
jmp case.0x494fe6.111
mov edx, 0x4974b4
mov eax, 0x4974cc
call fcn.004547d0
jmp case.0x494fe6.111
mov edx, dword [0x4bdbac]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x49750c
call fcn.00403e6c
mov eax, dword [ebp - 8]
call fcn.00408e3c
test al, al
jne 0x497107
lea eax, [ebp - 0x798]
mov edx, dword [ebp - 8]
call fcn.00404314
mov eax, dword [ebp - 0x798]
mov dx, 0xffff
call fcn.00453dec
mov ebx, eax
test ebx, ebx
je 0x497107
mov eax, dword [0x4bd718]
call fcn.00403e20
push eax
mov eax, 0x4bd718
call fcn.00403ff0
mov edx, eax
mov eax, ebx
pop ecx
mov esi, dword [eax]
call dword [esi + 8]
mov eax, ebx
call fcn.00402e78
push 1
push 0x4973d4
push 0x4973d4
lea eax, [ebp - 8]
call fcn.00403ff0
push eax
push 0x497444
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x494fe6.111
mov eax, dword [0x4bdc28]
cmp dword [eax], 0
jne case.0x494fe6.111
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4886fc]
call fcn.00415768
mov edx, dword [0x4bdc28]
mov dword [edx], eax
jmp case.0x494fe6.111
mov eax, dword [0x4c7d64]
mov eax, dword [eax + 0x300]
cmp byte [eax + 0x8c], 0
je case.0x494fe6.111
lea edx, [ebp - 0x79c]
lea eax, [ebx + 0x20]
call fcn.00409528
mov edx, dword [ebp - 0x79c]
mov eax, dword [0x4c7d64]
mov eax, dword [eax + 0x300]
call fcn.00458348
jmp case.0x494fe6.111
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x4bd6e8], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x4bd6ec], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x4bd6f0], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x4bd6f4], eax
jmp case.0x494fe6.111
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd4
mov eax, dword [ebp - 4]
call fcn.004948a8
jmp case.0x494fe6.111
mov eax, dword [ebx + 0x14]
mov dword [0x4c8fd0], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebx + 0x10]
cdq
call fcn.004065fc
call fcn.004065fc
mov dword [0x4bd6f8], eax
mov dword [0x4bd6fc], edx
cmp dword [0x4bd6fc], 0
jne 0x497228
cmp dword [0x4bd6f8], 0
jbe case.0x494fe6.111
jmp 0x49722a
jle case.0x494fe6.111
mov eax, dword [0x4bd63c]
mov edx, dword [0x4bd640]
add eax, dword [0x4bd6f8]
adc edx, dword [0x4bd6fc]
mov dword [0x4bd6f8], eax
mov dword [0x4bd6fc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49731f
lea eax, [ebp - 0x79c]
call fcn.00403ba0
lea eax, [ebp - 0x798]
call fcn.004041d0
lea eax, [ebp - 0x794]
call fcn.00403ba0
lea eax, [ebp - 0x790]
call fcn.004041d0
lea eax, [ebp - 0x78c]
mov edx, 0xb
call fcn.00403bc4
lea eax, [ebp - 0x760]
mov edx, 6
call fcn.004041e8
lea eax, [ebp - 0x748]
mov edx, 2
call fcn.00403bc4
lea eax, [ebp - 0xb5]
mov edx, dword [0x4536b0]
call fcn.00404680
lea eax, [ebp - 0x7c]
call fcn.00403ba0
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00403bc4
lea eax, [ebp - 0x5c]
call fcn.00403ba0
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403bc4
lea eax, [ebp - 0x3c]
call fcn.00403ba0
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.00403bc4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403bc4
ret