Function at 0x4d64b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x30
push 0
push 0
dec ecx
jne 0x4d64b8
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d7807
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4e2700]
mov byte [eax], 1
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x364]
xor edx, edx
call fcn.0043468c
push 0x4d7818
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
mov eax, esi
call fcn.004d246c
mov edx, dword [0x4e26cc]
mov edx, dword [edx]
dec edx
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x22c]
call fcn.0043beb4
mov eax, dword [eax + 8]
mov ecx, 0x4d7834
mov edx, 0xc
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea eax, [ebp - 0x1c]
call fcn.004d27dc
push dword [ebp - 0x1c]
push 0x4d7848
push 0x4d7854
mov eax, dword [0x4e284c]
push dword [eax]
push 0x4d786c
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.0040454c
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov al, byte [0x4d7870]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x340]
call fcn.004afd34
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0x4d787c
call fcn.0040d88c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 0x4d7890
call fcn.004044d8
mov al, byte [0x4d7870]
push eax
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x340]
call fcn.004afd34
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040904c
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x4d787c
call fcn.0040d88c
mov edx, dword [ebp - 0x28]
mov eax, dword [0x4e247c]
mov ecx, 0x4d78ac
call fcn.004044d8
mov al, byte [0x4d7870]
push eax
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x3c]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x340]
call fcn.004afd34
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040904c
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov edx, 0x4d787c
call fcn.0040d88c
mov edx, dword [ebp - 0x34]
mov eax, dword [0x4e22f8]
mov ecx, 0x4d78d0
call fcn.004044d8
lea eax, [ebp - 0x44]
call fcn.004d27dc
push dword [ebp - 0x44]
push 0x4d7848
push 0x4d78f4
mov eax, dword [0x4e247c]
push dword [eax]
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.0040454c
mov edx, dword [ebp - 0x40]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x4c]
call fcn.004d27dc
push dword [ebp - 0x4c]
push 0x4d7848
push 0x4d78f4
mov eax, dword [0x4e22f8]
push dword [eax]
lea eax, [ebp - 0x48]
mov edx, 4
call fcn.0040454c
mov edx, dword [ebp - 0x48]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4e247c]
mov eax, dword [eax]
call fcn.00408fb4
mov eax, dword [0x4e22f8]
mov eax, dword [eax]
call fcn.00408fb4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x50]
mov ecx, 0x4d7908
mov edx, dword [0x4e4590]
call fcn.004044d8
mov eax, dword [ebp - 0x50]
mov ecx, dword [0x4e22d8]
mov ecx, dword [ecx]
mov edx, dword [0x4e2450]
mov edx, dword [edx]
call fcn.004d2360
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [0x4e284c]
mov ecx, dword [ecx]
lea eax, [ebp - 0x54]
mov edx, 0x4d7924
call fcn.004044d8
mov ecx, dword [ebp - 0x54]
mov edx, 0x4d7930
mov eax, dword [ebp - 4]
call fcn.004d20d4
push 0x4d7948
mov ecx, 0x4d7954
mov edx, 0x4d7968
mov eax, dword [ebp - 4]
call fcn.004d20d4
mov eax, dword [0x4e284c]
mov eax, dword [eax]
push eax
mov ecx, 0x4d797c
mov edx, 0x4d7990
mov eax, dword [ebp - 4]
call fcn.004d20d4
mov edx, 0x4d79a0
mov eax, 0x4d79b4
call fcn.004d1fe8
mov edx, 0x4d79c8
mov eax, 0x4d79dc
call fcn.004d1fe8
mov edx, 0x4d79f0
mov eax, 0x4d7a00
call fcn.004d1fe8
mov edx, dword [0x4e2450]
mov edx, dword [edx]
mov eax, 0x4d7a14
call fcn.004d1fe8
mov edx, dword [0x4e284c]
mov edx, dword [edx]
mov eax, 0x4d7a28
call fcn.004d1fe8
mov edx, dword [0x4e2350]
mov edx, dword [edx]
mov eax, 0x4d7a3c
call fcn.004d1fe8
mov edx, dword [0x4e2350]
mov edx, dword [edx]
mov eax, 0x4d7a50
call fcn.004d1fe8
mov edx, dword [0x4e21c8]
mov edx, dword [edx]
mov eax, 0x4d7a64
call fcn.004d1fe8
lea ecx, [ebp - 0x58]
mov edx, dword [0x4e284c]
mov edx, dword [edx]
mov eax, dword [0x4e4604]
call fcn.004d1eb4
mov edx, dword [ebp - 0x58]
mov eax, 0x4d7a78
call fcn.004d1fe8
lea ecx, [ebp - 0x5c]
mov edx, dword [0x4e2350]
mov edx, dword [edx]
mov eax, dword [0x4e4608]
call fcn.004d1eb4
mov edx, dword [ebp - 0x5c]
mov eax, 0x4d7a8c
call fcn.004d1fe8
lea edx, [ebp - 0x60]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x36c]
call fcn.004afd34
mov edx, dword [ebp - 0x60]
mov eax, 0x4d7aa0
call fcn.004d1fe8
lea edx, [ebp - 0x64]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x368]
call fcn.004515c8
mov edx, dword [ebp - 0x64]
mov eax, 0x4d7ab0
call fcn.004d1fe8
mov edx, 0x4d7ac0
mov eax, 0x4d7acc
call fcn.004d1fe8
mov edx, 0x4d7ac0
mov eax, 0x4d7ae0
call fcn.004d1fe8
mov edx, 0x4d7ac0
mov eax, 0x4d7af4
call fcn.004d1fe8
mov edx, dword [0x4e247c]
mov edx, dword [edx]
mov eax, 0x4d7b08
call fcn.004d1fe8
mov edx, dword [0x4e22f8]
mov edx, dword [edx]
mov eax, 0x4d7b1c
call fcn.004d1fe8
call fcn.004d4c70
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x338]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4d7735
mov eax, dword [0x4e21c8]
mov eax, dword [eax]
call fcn.004d1da4
lea eax, [ebp - 0x6c]
call fcn.004d27dc
push dword [ebp - 0x6c]
push 0x4d7848
push 0x4d7b30
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x68]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor ebx, ebx
push 0x4d7818
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
jne 0x4d69dd
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x338]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4d7735
inc ebx
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0x4d7818
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
cmp ebx, 0x12c
jbe 0x4d69d5
call fcn.004d4e40
lea eax, [ebp - 0x74]
call fcn.004d27dc
push dword [ebp - 0x74]
push 0x4d7848
push 0x4d7b48
lea eax, [ebp - 0x70]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x70]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d7735
test esi, esi
je 0x4d6957
mov eax, dword [0x4e2544]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4e2544]
cmp dword [eax], 0
jne 0x4d6a23
push 0x4d7818
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x4d7735
push 0
push 0x4d1c9c
call sub.user32.dll_EnumWindows
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4e2544]
cmp dword [eax], 0
je 0x4d69f0
mov eax, dword [0x4e283c]
xor edx, edx
mov dword [eax], edx
push 0
push 0x4d1bc0
call sub.user32.dll_EnumWindows
lea eax, [ebp - 0x7c]
call fcn.004d27dc
push dword [ebp - 0x7c]
push 0x4d7848
push 0x4d7b60
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x78]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d7ac0
mov al, byte [0x4d7870]
push eax
lea eax, [ebp - 0x80]
push eax
lea edx, [ebp - 0x84]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x340]
call fcn.004afd34
mov eax, dword [ebp - 0x84]
xor ecx, ecx
mov edx, 0x4d7b78
call fcn.0040d88c
lea eax, [ebp - 0x80]
mov edx, 0x4d7b8c
call fcn.00404494
mov eax, dword [ebp - 0x80]
mov ecx, 0x4d7bb0
mov edx, 0x4d7bcc
call fcn.004d20d4
lea eax, [ebp - 0x8c]
call fcn.004d27dc
push dword [ebp - 0x8c]
push 0x4d7848
push 0x4d7be0
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x88]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x1770
call fcn.004d2424
lea edx, [ebp - 0x90]
mov eax, 0x4d7a50
call fcn.004d2230
mov eax, dword [ebp - 0x90]
call fcn.004d4458
push 0x3e8
call fcn.004d2424
lea eax, [ebp - 0x98]
call fcn.004d27dc
push dword [ebp - 0x98]
push 0x4d7848
push 0x4d7bf8
lea eax, [ebp - 0x94]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x94]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4e2550]
mov eax, dword [eax]
add eax, 0x82
push eax
mov eax, dword [0x4e2544]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetCursorPos
push 0x64
call fcn.004d2424
push 0
push 0
push 0
push 0
push 2
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 4
call sub.user32.dll_mouse_event
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
lea eax, [ebp - 8]
push eax
mov al, byte [0x4d7870]
push eax
lea eax, [ebp - 0x9c]
push eax
lea edx, [ebp - 0xa0]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x340]
call fcn.004afd34
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
mov edx, 0x4d787c
call fcn.0040d88c
lea eax, [ebp - 0x9c]
mov edx, 0x4d7b8c
call fcn.00404494
mov eax, dword [ebp - 0x9c]
mov ecx, 0x4d7bb0
mov edx, 0x4d7bcc
call fcn.004d217c
lea eax, [ebp - 0xa8]
call fcn.004d27dc
push dword [ebp - 0xa8]
push 0x4d7c0c
push dword [ebp - 8]
lea eax, [ebp - 0xa4]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xa4]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d6fd8
mov eax, 0xc8
call fcn.004d2b48
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x338]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4d7735
inc ebx
lea eax, [ebp - 8]
push eax
mov al, byte [0x4d7870]
push eax
lea eax, [ebp - 0xac]
push eax
lea edx, [ebp - 0xb0]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x340]
call fcn.004afd34
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
mov edx, 0x4d787c
call fcn.0040d88c
lea eax, [ebp - 0xac]
mov edx, 0x4d7b8c
call fcn.00404494
mov eax, dword [ebp - 0xac]
mov ecx, 0x4d7bb0
mov edx, 0x4d7bcc
call fcn.004d217c
lea eax, [ebp - 0xb8]
call fcn.004d27dc
push dword [ebp - 0xb8]
push 0x4d7c0c
push dword [ebp - 8]
lea eax, [ebp - 0xb4]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xb4]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [ebp - 8], 0
je 0x4d6d55
mov eax, dword [ebp - 8]
mov edx, 0x4d7ac0
call fcn.004045d8
jne 0x4d6f05
lea eax, [ebp - 0xc0]
call fcn.004d27dc
push dword [ebp - 0xc0]
push 0x4d7848
push 0x4d7c20
lea eax, [ebp - 0xbc]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4e247c]
mov eax, dword [eax]
call fcn.00408fa4
test al, al
jne 0x4d6dc0
mov eax, dword [0x4e22f8]
mov eax, dword [eax]
call fcn.00408fa4
test al, al
je 0x4d6e7e
lea eax, [ebp - 0xc8]
call fcn.004d27dc
push dword [ebp - 0xc8]
push 0x4d7848
push 0x4d7c38
lea eax, [ebp - 0xc4]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xc4]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xcc]
mov eax, 0x4d7af4
call fcn.004d2230
mov eax, dword [ebp - 0xcc]
mov edx, 0x4d7ac0
call fcn.004045d8
jne 0x4d6f05
lea eax, [ebp - 0xd4]
call fcn.004d27dc
push dword [ebp - 0xd4]
push 0x4d7848
push 0x4d7c50
lea eax, [ebp - 0xd0]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xd0]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.004d452c
jmp 0x4d6f05
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1e
jle 0x4d6f05
mov eax, esi
call fcn.004d246c
lea eax, [ebp - 0xdc]
call fcn.004d27dc
push dword [ebp - 0xdc]
push 0x4d7848
push 0x4d7c68
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xd8]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x4e26cc]
mov edx, dword [edx]
dec edx
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x22c]
call fcn.0043beb4
xor edx, edx
call fcn.0043b860
call fcn.004d4e40
jmp 0x4d7735
push 0x4d7818
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
jne 0x4d6f6e
inc edi
cmp edi, 0xa
jle 0x4d6f6e
lea eax, [ebp - 0xe4]
call fcn.004d27dc
push dword [ebp - 0xe4]
push 0x4d7848
push 0x4d7c7c
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.004d4e40
jmp 0x4d7735
push 0x3e8
call sub.kernel32.dll_Sleep_1
cmp ebx, 0x12c
jbe 0x4d6fd8
mov eax, esi
call fcn.004d246c
call fcn.004d4e40
lea eax, [ebp - 0xec]
call fcn.004d27dc
push dword [ebp - 0xec]
push 0x4d7848
push 0x4d7c94
lea eax, [ebp - 0xe8]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d7735
cmp dword [ebp - 8], 0
je 0x4d6c76
mov eax, dword [ebp - 8]
mov edx, 0x4d7ac0
call fcn.004045d8
je 0x4d6c76
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x338]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4d7735
xor ebx, ebx
push 0x4d7818
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
jmp 0x4d70b6
push 0x4d7818
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
call fcn.004d4348
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x338]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4d7735
inc ebx
push 0xc8
call sub.kernel32.dll_Sleep_1
call fcn.004d2634
cmp ebx, 0xb4
jbe 0x4d70b6
call fcn.004d4e40
lea eax, [ebp - 0xf4]
call fcn.004d27dc
push dword [ebp - 0xf4]
push 0x4d7848
push 0x4d7cbc
lea eax, [ebp - 0xf0]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xf0]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d7735
call fcn.004d2634
test eax, eax
jne 0x4d70c7
test esi, esi
jne 0x4d7022
lea eax, [ebp - 0xfc]
call fcn.004d27dc
push dword [ebp - 0xfc]
push 0x4d7848
push 0x4d7cd4
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0xf8]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x104]
call fcn.004d27dc
push dword [ebp - 0x104]
push 0x4d7848
push 0x4d7cd4
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x100]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.004d2634
mov esi, eax
lea eax, [ebp - 0x10c]
call fcn.004d27dc
push dword [ebp - 0x10c]
push 0x4d7848
push 0x4d7cec
lea edx, [ebp - 0x110]
mov eax, esi
call fcn.00408a9c
push dword [ebp - 0x110]
lea eax, [ebp - 0x108]
mov edx, 4
call fcn.0040454c
mov edx, dword [ebp - 0x108]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x114]
mov eax, esi
call fcn.00408a9c
mov eax, dword [ebp - 0x114]
push eax
mov edx, dword [0x4e26cc]
mov edx, dword [edx]
dec edx
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x22c]
call fcn.0043beb4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov edi, dword [eax]
call dword [edi + 0x20]
mov eax, 0x2710
call fcn.004d289c
lea eax, [ebp - 0x11c]
call fcn.004d27dc
push dword [ebp - 0x11c]
push 0x4d7848
push 0x4d7d00
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x118]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, 0xfa0
call fcn.004d289c
lea eax, [ebp - 0x124]
call fcn.004d27dc
push dword [ebp - 0x124]
push 0x4d7848
push 0x4d7d18
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x120]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test esi, esi
jne 0x4d73e6
inc ebx
call fcn.004d2634
mov esi, eax
lea eax, [ebp - 0x12c]
call fcn.004d27dc
push dword [ebp - 0x12c]
push 0x4d7848
push 0x4d7d2c
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.00408a9c
push dword [ebp - 0x130]
lea eax, [ebp - 0x128]
mov edx, 4
call fcn.0040454c
mov edx, dword [ebp - 0x128]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14]
push eax
push esi
call sub.user32.dll_GetWindowThreadProcessId
push 0x7d0
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x138]
call fcn.004d27dc
push dword [ebp - 0x138]
push 0x4d7848
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x13c]
call fcn.00408b88
push dword [ebp - 0x13c]
lea eax, [ebp - 0x134]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x134]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x338]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4d7735
cmp ebx, 0xb4
jbe 0x4d73de
call fcn.004d64b0
lea eax, [ebp - 0x144]
call fcn.004d27dc
push dword [ebp - 0x144]
push 0x4d7848
push 0x4d7cbc
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x140]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d7735
test esi, esi
je 0x4d729e
test esi, esi
jle 0x4d75b7
push 0x7d0
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x14c]
call fcn.004d27dc
push dword [ebp - 0x14c]
push 0x4d7848
push 0x4d7d40
lea edx, [ebp - 0x150]
mov eax, esi
call fcn.00408a9c
push dword [ebp - 0x150]
lea eax, [ebp - 0x148]
mov edx, 4
call fcn.0040454c
mov edx, dword [ebp - 0x148]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x154]
mov eax, esi
call fcn.00408a9c
mov eax, dword [ebp - 0x154]
push eax
mov edx, dword [0x4e26cc]
mov edx, dword [edx]
dec edx
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x22c]
call fcn.0043beb4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 0x14]
call fcn.00408a9c
mov eax, dword [ebp - 0x158]
push eax
mov edx, dword [0x4e26cc]
mov edx, dword [edx]
dec edx
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x22c]
call fcn.0043beb4
pop edx
call fcn.0043b8c8
mov edx, dword [0x4e284c]
mov edx, dword [edx]
mov eax, 0x4d7a3c
call fcn.004d1fe8
push 0x64
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x15c]
mov eax, esi
call fcn.00408a9c
mov edx, dword [ebp - 0x15c]
mov eax, 0x4d7d54
call fcn.004d1fe8
push 0x7530
call sub.kernel32.dll_Sleep_1
push esi
mov edx, dword [0x4e26a8]
mov edx, dword [edx]
lea eax, [ebp - 0x160]
mov ecx, 0x4d7d68
call fcn.004044d8
mov eax, dword [ebp - 0x160]
push eax
call dword [0x4e4588]
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x168]
call fcn.004d27dc
push dword [ebp - 0x168]
push 0x4d7848
push 0x4d7d7c
lea edx, [ebp - 0x16c]
mov eax, esi
call fcn.00408a9c
push dword [ebp - 0x16c]
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.0040454c
mov edx, dword [ebp - 0x164]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov edx, 0x4d7d90
mov eax, 0x4d79b4
call fcn.004d1fe8
push 0x7d0
call sub.kernel32.dll_Sleep_1
xor ebx, ebx
jmp 0x4d7664
mov eax, 0x64
call fcn.004d2b48
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x338]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4d7735
inc ebx
lea eax, [ebp - 0x174]
call fcn.004d27dc
push dword [ebp - 0x174]
push 0x4d7848
push 0x4d7da4
mov eax, 0x3c
sub eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x178]
call fcn.00408b88
push dword [ebp - 0x178]
lea eax, [ebp - 0x170]
mov edx, 4
call fcn.0040454c
mov edx, dword [ebp - 0x170]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp ebx, 0x3c
jbe 0x4d765a
mov edx, 0x4d7d90
mov eax, 0x4d79b4
call fcn.004d1fe8
jmp 0x4d768a
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x17c]
mov eax, 0x4d79b4
call fcn.004d2230
mov eax, dword [ebp - 0x17c]
mov edx, 0x4d7d90
call fcn.004045d8
jne 0x4d75be
push 0
push 0
push 0x481
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x184]
call fcn.004d27dc
push dword [ebp - 0x184]
push 0x4d7848
push 0x4d7db4
lea eax, [ebp - 0x180]
mov edx, 3
call fcn.0040454c
mov edx, dword [ebp - 0x180]
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x328]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov edx, dword [0x4e26cc]
mov edx, dword [edx]
dec edx
mov eax, dword [0x4e458c]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x22c]
call fcn.0043beb4
mov eax, dword [eax + 8]
mov ecx, 0x4d7d90
mov edx, 0xc
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, 0xfa0
call fcn.004d2854
push esi
call sub.user32.dll_CloseWindow
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7811
lea eax, [ebp - 0x184]
mov edx, 0x35
call fcn.004041f0
lea eax, [ebp - 0xb0]
call fcn.004041cc
lea eax, [ebp - 0xac]
mov edx, 3
call fcn.004041f0
lea eax, [ebp - 0xa0]
call fcn.004041cc
lea eax, [ebp - 0x9c]
mov edx, 6
call fcn.004041f0
lea eax, [ebp - 0x84]
call fcn.004041cc
lea eax, [ebp - 0x80]
mov edx, 7
call fcn.004041f0
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.004041f0
lea eax, [ebp - 0x5c]
mov edx, 8
call fcn.004041f0
lea eax, [ebp - 0x3c]
call fcn.004041cc
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004041f0
lea eax, [ebp - 0x30]
call fcn.004041cc
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004041f0
lea eax, [ebp - 0x24]
call fcn.004041cc
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004041f0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041f0
ret