Function at 0x480d5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x480d64
push ecx
push ebx
push esi
push edi
mov eax, 0x480844
call fcn.00406e38
xor eax, eax
push ebp
push 0x482c41
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402a88
test eax, eax
jne 0x4812d0
mov edx, 0x482c58
mov eax, 0x48b65c
call fcn.00402e80
mov eax, 0x48b65c
call fcn.00402c1c
call fcn.0040293c
test eax, eax
jne 0x482c23
mov edx, 0x482c74
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482cdc
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482d08
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482e10
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482e24
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
xor edx, edx
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482eac
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482f00
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482f24
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482f58
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482f80
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482fa4
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482fc8
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x482ff8
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483018
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48303c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48305c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48307c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483098
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4830b8
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4830d4
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4830f0
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483110
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48312c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48314c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48316c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48318c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4831a8
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4831c4
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4831e0
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483200
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483218
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483240
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483268
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483294
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4832bc
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4832e4
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483304
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483324
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483344
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483360
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48337c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483398
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4833b4
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4833d0
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x4833e8
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483408
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483424
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x483440
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov edx, 0x48345c
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov eax, 0x48b65c
call fcn.00402f48
call fcn.004028c8
push 1
push 0
push 0x483478
push 0x483490
push 0x48349c
mov eax, dword [0x489aec]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x482c23
mov edx, 0x48bb94
mov eax, 1
call fcn.00402ae8
mov eax, dword [0x48bb94]
call fcn.004095dc
test al, al
je 0x4812f7
mov eax, dword [0x48bb94]
call fcn.004095ec
mov edx, 0x48de3c
mov eax, 2
call fcn.00402ae8
mov byte [0x48dbbc], 0
mov byte [0x48de39], 0
mov byte [0x48de3a], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [0x48de3c]
call fcn.004050b4
mov eax, dword [ebp - 0x20]
mov edx, 0x4834ac
call fcn.00404fa0
jne 0x481349
mov byte [0x48dbbc], 1
lea edx, [ebp - 0x24]
mov eax, dword [0x48de3c]
call fcn.00478c6c
mov edx, dword [ebp - 0x24]
mov eax, 0x4834b8
call fcn.00405198
test eax, eax
jle 0x48136e
mov byte [0x48de39], 1
lea edx, [ebp - 0x28]
mov eax, dword [0x48de3c]
call fcn.00478c6c
mov edx, dword [ebp - 0x28]
mov eax, 0x4834c4
call fcn.00405198
test eax, eax
jle 0x481393
mov byte [0x48de3a], 1
mov ebx, 0x32
mov esi, 0x48dbc0
mov edi, 0x48dc88
mov dword [ebp - 0x1c], 0x48dd50
xor eax, eax
mov dword [esi], eax
mov eax, edi
call fcn.00404b94
mov eax, dword [ebp - 0x1c]
call fcn.00404b94
add dword [ebp - 0x1c], 4
add edi, 4
add esi, 4
dec ebx
jne 0x4813a9
xor eax, eax
mov dword [0x48de24], eax
mov edx, 0x48de18
mov eax, 3
call fcn.00402ae8
mov dword [0x48de48], 0xffffffff
mov dword [0x48de4c], 0xffffffff
mov eax, 0x48de50
call fcn.00404b94
mov eax, 0x48de18
mov edx, 0x4834d0
call fcn.00404e5c
jmp 0x481773
push 0x48de1c
mov edx, dword [0x48de18]
mov eax, 0x4834d0
call fcn.00405198
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x48de18]
call fcn.004050b4
push 0x48de18
mov edx, dword [0x48de18]
mov eax, 0x4834d0
call fcn.00405198
inc eax
push eax
mov eax, dword [0x48de18]
call fcn.00404e54
mov ecx, eax
mov eax, dword [0x48de18]
pop edx
call fcn.004050b4
cmp dword [0x48de1c], 0
je 0x481773
xor ebx, ebx
mov edx, dword [0x48de1c]
mov eax, 0x4834dc
call fcn.00405198
test eax, eax
jle 0x48153c
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [0x48de1c]
mov eax, 0x4834dc
call fcn.00405198
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x48de1c]
call fcn.004050b4
mov eax, dword [ebp - 0x2c]
call fcn.004790ac
mov ebx, eax
push 0x48de20
mov edx, dword [0x48de1c]
mov eax, 0x4834dc
call fcn.00405198
inc eax
push eax
mov eax, dword [0x48de1c]
call fcn.00404e54
mov ecx, eax
mov eax, dword [0x48de1c]
pop edx
call fcn.004050b4
cmp dword [0x48de20], 0
je 0x4816c1
inc dword [0x48de24]
mov eax, dword [0x48de24]
mov dword [eax*4 + 0x48dbbc], ebx
mov eax, dword [0x48de24]
lea eax, [eax*4 + 0x48dc84]
mov edx, dword [0x48de20]
call fcn.00404be8
mov eax, dword [0x48de24]
lea eax, [eax*4 + 0x48dd4c]
mov edx, 0x4834dc
call fcn.00404be8
jmp 0x4816c1
mov edx, dword [0x48de1c]
mov eax, 0x4834e8
call fcn.00405198
test eax, eax
jle 0x481603
lea eax, [ebp - 0x30]
push eax
mov edx, dword [0x48de1c]
mov eax, 0x4834e8
call fcn.00405198
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x48de1c]
call fcn.004050b4
mov eax, dword [ebp - 0x30]
call fcn.004790ac
mov ebx, eax
push 0x48de20
mov edx, dword [0x48de1c]
mov eax, 0x4834e8
call fcn.00405198
inc eax
push eax
mov eax, dword [0x48de1c]
call fcn.00404e54
mov ecx, eax
mov eax, dword [0x48de1c]
pop edx
call fcn.004050b4
cmp dword [0x48de20], 0
je 0x4816c1
inc dword [0x48de24]
mov eax, dword [0x48de24]
mov dword [eax*4 + 0x48dbbc], ebx
mov eax, dword [0x48de24]
lea eax, [eax*4 + 0x48dc84]
mov edx, dword [0x48de20]
call fcn.00404be8
mov eax, dword [0x48de24]
lea eax, [eax*4 + 0x48dd4c]
mov edx, 0x4834e8
call fcn.00404be8
jmp 0x4816c1
mov edx, dword [0x48de1c]
mov eax, 0x4834f4
call fcn.00405198
test eax, eax
jle 0x4816c1
lea eax, [ebp - 0x34]
push eax
mov edx, dword [0x48de1c]
mov eax, 0x4834f4
call fcn.00405198
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x48de1c]
call fcn.004050b4
mov eax, dword [ebp - 0x34]
call fcn.004790ac
mov ebx, eax
push 0x48de20
mov edx, dword [0x48de1c]
mov eax, 0x4834f4
call fcn.00405198
inc eax
push eax
mov eax, dword [0x48de1c]
call fcn.00404e54
mov ecx, eax
mov eax, dword [0x48de1c]
pop edx
call fcn.004050b4
cmp dword [0x48de20], 0
je 0x4816c1
inc dword [0x48de24]
mov eax, dword [0x48de24]
mov dword [eax*4 + 0x48dbbc], ebx
mov eax, dword [0x48de24]
lea eax, [eax*4 + 0x48dc84]
mov edx, dword [0x48de20]
call fcn.00404be8
mov eax, dword [0x48de24]
lea eax, [eax*4 + 0x48dd4c]
mov edx, 0x4834f4
call fcn.00404be8
cmp ebx, 0x35
jne 0x481773
mov eax, 0x48de50
mov edx, dword [0x48de24]
mov edx, dword [edx*4 + 0x48dd4c]
call fcn.00404be8
mov edx, dword [0x48de20]
mov eax, 0x483500
call fcn.00405198
test eax, eax
jle 0x481764
lea eax, [ebp - 0x38]
push eax
mov edx, dword [0x48de20]
mov eax, 0x483500
call fcn.00405198
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x48de20]
call fcn.004050b4
mov eax, dword [ebp - 0x38]
call fcn.004797d0
mov dword [0x48de48], eax
lea eax, [ebp - 0x3c]
push eax
mov edx, dword [0x48de20]
mov eax, 0x483500
call fcn.00405198
inc eax
push eax
mov eax, dword [0x48de20]
call fcn.00404e54
mov ecx, eax
mov eax, dword [0x48de20]
pop edx
call fcn.004050b4
mov eax, dword [ebp - 0x3c]
call fcn.004797d0
mov dword [0x48de4c], eax
jmp 0x481773
mov eax, dword [0x48de20]
call fcn.004797d0
mov dword [0x48de48], eax
mov edx, dword [0x48de18]
mov eax, 0x4834d0
call fcn.00405198
test eax, eax
jg 0x481411
mov edx, 0x48de28
mov eax, 4
call fcn.00402ae8
mov eax, dword [0x48de28]
mov edx, 0x4834d0
call fcn.00404fa0
je 0x481803
push 0x4834d0
push dword [0x48de28]
push 0x4834d0
mov eax, 0x48de28
mov edx, 3
call fcn.00404f14
jmp 0x4817ed
mov edx, dword [0x48de28]
mov eax, 0x4834d0
call fcn.00405198
mov ebx, eax
mov eax, 0x48de28
call fcn.004050ac
mov byte [eax + ebx - 1], 0x20
mov edx, dword [0x48de28]
mov eax, 0x4834d0
call fcn.00405198
test eax, eax
jg 0x4817cc
jmp 0x48180d
mov eax, 0x48de28
call fcn.00404b94
mov edx, 0x48dbb8
mov eax, 5
call fcn.00402ae8
push 0x4834d0
push dword [0x48dbb8]
push 0x4834d0
mov eax, 0x48dbb8
mov edx, 3
call fcn.00404f14
jmp 0x48185e
mov edx, dword [0x48dbb8]
mov eax, 0x4834d0
call fcn.00405198
mov ebx, eax
mov eax, 0x48dbb8
call fcn.004050ac
mov byte [eax + ebx - 1], 0x20
mov edx, dword [0x48dbb8]
mov eax, 0x4834d0
call fcn.00405198
test eax, eax
jg 0x48183d
mov edx, 0x48db98
mov eax, 6
call fcn.00402ae8
mov eax, 0x48dbb0
mov edx, 0x4834d0
call fcn.00404be8
cmp dword [0x48db98], 0
je 0x4818e1
mov edx, dword [0x48db98]
mov eax, 0x4834d0
call fcn.00405198
test eax, eax
jle 0x4818be
mov eax, 0x48dbb0
mov edx, 0x4834d0
call fcn.00404be8
jmp 0x4818e1
mov edx, dword [0x48db98]
mov eax, 0x48350c
call fcn.00405198
test eax, eax
jle 0x4818e1
mov eax, 0x48dbb0
mov edx, 0x48350c
call fcn.00404be8
cmp dword [0x48bb94], 0
je 0x482c23
xor esi, esi
call fcn.00402a88
sub eax, 7
jl 0x481933
inc eax
mov dword [ebp - 0x14], eax
mov ebx, 7
cmp ebx, 0x64
jge 0x48192d
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.00402ae8
mov eax, dword [ebp - 0x40]
call fcn.004095dc
test al, al
je 0x48192d
inc esi
lea edx, [esi*4 + 0x48ba00]
mov eax, ebx
call fcn.00402ae8
inc ebx
dec dword [ebp - 0x14]
jne 0x481903
test esi, esi
je 0x482c23
mov dl, 1
mov eax, dword [0x416dcc]
call fcn.00403d6c
mov dword [0x48de34], eax
xor edx, edx
mov eax, dword [0x48de34]
call fcn.0041b0ec
mov eax, dword [0x48de34]
mov byte [eax + 0x1d], 1
mov dl, 1
mov eax, dword [0x48de34]
call fcn.0041b19c
mov eax, 0x48de2c
call fcn.00404b94
test esi, esi
jle 0x482b66
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0x48ba04
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call fcn.004095dc
test al, al
je 0x482b59
mov eax, 0x48dea0
call fcn.00404b94
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, 0x483518
call fcn.00405198
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov edx, 1
call fcn.004050b4
mov edx, dword [ebp - 0x44]
mov eax, 0x48de58
mov ecx, 0x483524
call fcn.00404ea0
mov eax, dword [0x48de58]
call fcn.00405054
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00404d8c
mov eax, dword [ebp - 0x48]
call fcn.004095ec
mov byte [0x48de5c], 1
mov dword [0x48de60], 0xffffffff
mov eax, 0x48de64
call fcn.00404b94
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, 0x48b490
call fcn.00402e80
mov eax, 0x48b490
call fcn.00402c10
call fcn.0040293c
test eax, eax
jne 0x482afb
mov edx, 0x48bb98
mov ecx, 0x1000
mov eax, 0x48b490
call fcn.004032d8
mov byte [0x48de30], 1
xor eax, eax
mov dword [0x48dba0], eax
jmp 0x482ad5
mov edx, 0x48b9f4
mov eax, 0x48b490
call fcn.0040323c
mov eax, 0x48b490
call fcn.004032a8
call fcn.004028c8
mov edx, dword [0x48b9f4]
mov eax, 0x483530
call fcn.00405198
dec eax
jne 0x481dae
mov edx, dword [0x48b9f4]
mov eax, 0x48353c
call fcn.00405198
test eax, eax
jle 0x481dae
mov edx, dword [0x48b9f4]
mov eax, 0x48354c
call fcn.00405198
test eax, eax
jle 0x481dae
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [0x48b9f4]
mov eax, 0x48353c
call fcn.00405198
mov edx, eax
add edx, 4
mov ecx, 1
mov eax, dword [0x48b9f4]
call fcn.004050b4
mov eax, dword [ebp - 0x4c]
call fcn.0047917c
mov ebx, eax
lea eax, [ebp - 0x54]
push eax
mov edx, dword [0x48b9f4]
mov eax, 0x48353c
call fcn.00405198
mov edx, eax
add edx, 4
mov ecx, 0xff
mov eax, dword [0x48b9f4]
call fcn.004050b4
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00478a64
mov edx, dword [ebp - 0x50]
mov eax, 0x48dea4
call fcn.00404be8
lea eax, [ebp - 0x5c]
push eax
mov edx, dword [0x48dea4]
mov eax, 0x48355c
call fcn.00405198
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x48dea4]
call fcn.004050b4
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.00408e28
mov edx, dword [ebp - 0x58]
mov eax, 0x48dea4
call fcn.00404be8
lea eax, [ebp - 0x64]
push eax
mov edx, dword [0x48b9f4]
mov eax, 0x48354c
call fcn.00405198
add eax, 4
push eax
mov eax, dword [0x48b9f4]
call fcn.00404e54
mov ecx, eax
mov eax, dword [0x48b9f4]
pop edx
call fcn.004050b4
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00408e28
mov edx, dword [ebp - 0x60]
mov eax, 0x48de54
call fcn.00404be8
lea eax, [ebp - 0x6c]
push eax
mov edx, dword [0x48de54]
mov eax, 0x48355c
call fcn.00405198
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x48de54]
call fcn.004050b4
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.00408e28
mov edx, dword [ebp - 0x68]
mov eax, 0x48de54
call fcn.00404be8
push 0x48355c
push dword [0x48dea4]
lea eax, [ebp - 0x70]
push eax
mov ecx, 5
mov edx, 4
mov eax, dword [0x48de54]
call fcn.004050b4
push dword [ebp - 0x70]
push 0x48355c
mov eax, 0x48dea4
mov edx, 4
call fcn.00404f14
test bl, bl
je 0x481c4b
mov edx, dword [0x48dea0]
mov eax, dword [0x48dea4]
call fcn.00405198
test eax, eax
jle 0x481c57
mov byte [0x48de30], 0
jmp 0x481dae
mov eax, 0x48dea0
mov edx, dword [0x48dea4]
call fcn.00404e5c
cmp dword [0x48de48], 0xffffffff
je 0x481da7
cmp dword [0x48de50], 0
je 0x481da7
lea eax, [ebp - 0x78]
push eax
mov edx, dword [0x48b9f4]
mov eax, 0x48354c
call fcn.00405198
add eax, 4
push eax
mov eax, dword [0x48b9f4]
call fcn.00404e54
mov ecx, eax
mov eax, dword [0x48b9f4]
pop edx
call fcn.004050b4
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.00408e28
mov edx, dword [ebp - 0x74]
mov eax, 0x48de54
call fcn.00404be8
lea eax, [ebp - 0x80]
push eax
mov edx, dword [0x48de54]
mov eax, 0x48355c
call fcn.00405198
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x48de54]
call fcn.004050b4
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00408e28
mov edx, dword [ebp - 0x7c]
mov eax, 0x48de54
call fcn.00404be8
mov eax, dword [0x48de54]
call fcn.004797d0
mov ebx, eax
cmp ebx, dword [0x48de60]
jle 0x481d30
mov dword [0x48de60], ebx
mov eax, 0x48de64
mov edx, dword [0x48de54]
call fcn.00404be8
mov eax, dword [0x48de50]
mov al, byte [eax]
sub al, 0x3c
je 0x481d80
dec al
je 0x481d45
dec al
je 0x481d71
jmp 0x481d9e
cmp ebx, dword [0x48de4c]
jle 0x481d54
mov byte [0x48de5c], 0
cmp ebx, dword [0x48de48]
jl 0x481d64
cmp ebx, dword [0x48de4c]
jle 0x481d68
xor eax, eax
jmp 0x481d6a
mov al, 1
mov byte [0x48de30], al
jmp 0x481dae
cmp ebx, dword [0x48de48]
setge byte [0x48de30]
jmp 0x481dae
cmp ebx, dword [0x48de48]
jle 0x481d8f
mov byte [0x48de5c], 0
cmp ebx, dword [0x48de48]
setle byte [0x48de30]
jmp 0x481dae
mov byte [0x48de5c], 0
jmp 0x481dae
mov byte [0x48de30], 1
cmp byte [0x48de30], 0
je 0x482ad5
mov edx, dword [0x48b9f4]
mov eax, 0x483568
call fcn.00405198
dec eax
jne 0x481e30
mov eax, 0x48b490
call fcn.004030b0
call fcn.004028c8
test al, al
jne 0x481e30
mov edx, 0x48b9f8
mov eax, 0x48b490
call fcn.0040323c
mov eax, 0x48b490
call fcn.004032a8
call fcn.004028c8
push 0x48355c
lea ecx, [ebp - 0x84]
mov eax, 0x48b9f8
mov dl, 9
call fcn.00478870
push dword [ebp - 0x84]
push 0x48355c
mov eax, 0x48de2c
mov edx, 3
call fcn.00404f14
cmp byte [0x48db9c], 0
je 0x481e3f
inc dword [0x48dba0]
mov edx, dword [0x48b9f4]
mov eax, 0x483580
call fcn.00405198
dec eax
jne 0x481e60
mov byte [0x48db9c], 1
xor eax, eax
mov dword [0x48dba0], eax
mov edx, dword [0x48b9f4]
mov eax, 0x483594
call fcn.00405198
dec eax
jne 0x481ef1
xor eax, eax
push ebp
push 0x481ee7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x48ba00
mov eax, 0x48b490
call fcn.0040323c
mov eax, 0x48b490
call fcn.004032a8
call fcn.004028c8
mov ebx, 0xa
lea ecx, [ebp - 0x88]
mov eax, 0x48ba00
mov dl, 9
call fcn.00478870
dec ebx
jne 0x481ea4
lea ecx, [ebp - 0x8c]
mov eax, 0x48ba00
mov dl, 9
call fcn.00478870
mov eax, dword [ebp - 0x8c]
call fcn.00478f14
fstp qword [0x48de68]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x481ef1
mov edx, dword [0x48b9f4]
mov eax, 0x4835ac
call fcn.00405198
dec eax
jne 0x481f1c
mov byte [0x48db9c], 0
mov eax, 0x48de2c
call fcn.00404b94
xor eax, eax
mov dword [0x48dba0], eax
cmp byte [0x48db9c], 0
je 0x482ad5
cmp dword [0x48dba0], 1
je 0x481f55
cmp dword [0x48dba0], 1
jle 0x482ad5
mov eax, dword [0x48dba0]
dec eax
mov ecx, 3
cdq
idiv ecx
test edx, edx
jne 0x482ad5
mov eax, 0x48b490
call fcn.004030b0
call fcn.004028c8
test al, al
jne 0x482ad5
mov edx, 0x48b9f8
mov eax, 0x48b490
call fcn.0040323c
mov eax, 0x48b490
call fcn.004032a8
call fcn.004028c8
inc dword [0x48dba0]
mov edx, 0x48b9fc
mov eax, 0x48b490
call fcn.0040323c
mov eax, 0x48b490
call fcn.004032a8
call fcn.004028c8
inc dword [0x48dba0]
lea ecx, [ebp - 0x90]
mov eax, 0x48b9f4
mov dl, 9
call fcn.00478870
mov edx, dword [ebp - 0x90]
mov eax, 0x48dba4
call fcn.00404be8
cmp dword [0x48dba4], 0
je 0x482ad5
mov edx, dword [0x48de28]
mov eax, dword [0x48de2c]
call fcn.00405198
test eax, eax
jne 0x482ad5
push 0x48355c
push dword [0x48dba4]
push 0x48355c
lea eax, [ebp - 0x94]
mov edx, 3
call fcn.00404f14
mov eax, dword [ebp - 0x94]
mov edx, dword [0x48dbb8]
call fcn.00405198
test eax, eax
jne 0x482ad5
mov edx, dword [0x48b9fc]
mov eax, dword [0x48b9f8]
call fcn.00480618
test al, al
je 0x482ad5
xor eax, eax
push ebp
push 0x482acb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x48dba4
lea ecx, [ebp - 0x9c]
mov edx, 0x14
mov al, 0x20
call fcn.00478998
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
mov edx, dword [0x48dba4]
call fcn.00404ea0
mov eax, dword [ebp - 0x98]
mov ecx, 0x14
mov edx, 1
call fcn.004050b4
lea ecx, [ebp - 0xa0]
mov eax, 0x48b9f4
mov dl, 9
call fcn.00478870
mov edx, dword [ebp - 0xa0]
mov eax, 0x48dba8
call fcn.00404be8
push 0x48dba8
lea ecx, [ebp - 0xa8]
mov edx, 0x32
mov al, 0x20
call fcn.00478998
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
mov edx, dword [0x48dba8]
call fcn.00404ea0
mov eax, dword [ebp - 0xa4]
mov ecx, 0x32
mov edx, 1
call fcn.004050b4
lea ecx, [ebp - 0xac]
mov eax, 0x48b9f4
mov dl, 9
call fcn.00478870
mov edx, dword [ebp - 0xac]
mov eax, 0x48dbac
call fcn.00404be8
mov eax, dword [0x48dbac]
call fcn.00478f14
fstp qword [0x48de78]
wait
fld qword [0x48de78]
fcomp dword [0x4835b4]
fnstsw ax
sahf
je 0x482ac1
lea ecx, [ebp - 0xb0]
mov eax, 0x48b9f4
mov dl, 9
call fcn.00478870
mov eax, dword [ebp - 0xb0]
call fcn.00478f14
fstp qword [0x48de80]
wait
lea ecx, [ebp - 0xb4]
mov eax, 0x48b9f4
mov dl, 9
call fcn.00478870
mov eax, dword [ebp - 0xb4]
call fcn.00478f14
fstp qword [0x48de88]
wait
lea ecx, [ebp - 0xb8]
mov eax, 0x48b9f4
mov dl, 9
call fcn.00478870
mov eax, dword [ebp - 0xb8]
call fcn.00478f14
fstp qword [0x48de88]
wait
fld qword [0x48de78]
fmul qword [0x48de80]
fld qword [0x48de78]
fmul qword [0x48de80]
fmul qword [0x48de88]
fdiv dword [0x4835b8]
fsubp st(1)
fstp qword [0x48de70]
wait
fld qword [0x48de70]
fmul qword [0x48de68]
fdiv dword [0x4835b8]
fsubr qword [0x48de70]
fstp qword [0x48de70]
wait
fld qword [0x48de78]
fcomp dword [0x4835b4]
fnstsw ax
sahf
jne 0x482223
xor eax, eax
mov dword [0x48de98], eax
mov dword [0x48de9c], eax
jmp 0x482238
fld qword [0x48de78]
fabs
fdivr qword [0x48de70]
fstp qword [0x48de98]
wait
cmp byte [0x48dbbc], 0
je 0x48228f
lea eax, [ebp - 0xc0]
mov ecx, dword [0x48dbac]
mov edx, 0x4834ac
call fcn.00404ea0
mov eax, dword [ebp - 0xc0]
call fcn.00478f14
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
lea eax, [ebp - 0xbc]
push eax
xor ecx, ecx
mov dl, 1
mov al, 0xa
call fcn.00479a1c
mov edx, dword [ebp - 0xbc]
mov eax, 0x48dbac
call fcn.00404be8
jmp 0x4822c4
mov eax, dword [0x48dbac]
call fcn.00478f14
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
lea eax, [ebp - 0xc4]
push eax
xor ecx, ecx
mov dl, 1
mov al, 0xa
call fcn.00479a1c
mov edx, dword [ebp - 0xc4]
mov eax, 0x48dbac
call fcn.00404be8
cmp byte [0x48de39], 0
je 0x4826f9
cmp byte [0x48de3a], 0
je 0x48238a
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dba8]
push dword [0x48dbb0]
push dword [0x48dbac]
push dword [0x48dbb0]
push dword [0x48de9c]
push dword [0x48de98]
lea eax, [ebp - 0xc8]
push eax
xor ecx, ecx
mov dl, 6
mov al, 0xf
call fcn.0047926c
push dword [ebp - 0xc8]
push dword [0x48dbb0]
push dword [0x48de74]
push dword [0x48de70]
lea eax, [ebp - 0xcc]
push eax
xor ecx, ecx
mov dl, 6
mov al, 0x14
call fcn.0047926c
push dword [ebp - 0xcc]
push dword [0x48dbb0]
lea eax, [ebp - 0xd0]
push eax
mov ecx, dword [0x48b9fc]
mov edx, dword [0x48b9f8]
mov eax, dword [0x48db98]
call fcn.00480420
push dword [ebp - 0xd0]
mov eax, 0x48dbb4
mov edx, 0xb
call fcn.00404f14
jmp 0x4823e0
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dba8]
push dword [0x48dbb0]
push dword [0x48dbac]
push dword [0x48dbb0]
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [0x48b9fc]
mov edx, dword [0x48b9f8]
mov eax, dword [0x48db98]
call fcn.00480420
push dword [ebp - 0xd4]
mov eax, 0x48dbb4
mov edx, 7
call fcn.00404f14
mov eax, dword [0x48de34]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4826e4
mov byte [0x48de38], 0
mov eax, dword [0x48de34]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4826c2
mov dword [ebp - 0x18], eax
mov ebx, 1
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xdc]
mov edx, ebx
dec edx
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xdc]
mov ecx, 0x47
mov edx, 1
call fcn.004050b4
mov eax, dword [ebp - 0xd8]
push eax
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dba8]
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.00404f14
mov edx, dword [ebp - 0xe0]
pop eax
call fcn.00404fa0
jne 0x4826b8
mov byte [0x48de38], 1
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xe8]
mov edx, ebx
dec edx
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xe8]
mov ecx, 0xa
mov edx, 0x49
call fcn.004050b4
mov eax, dword [ebp - 0xe4]
call fcn.00478f14
fstp qword [0x48de40]
wait
mov eax, dword [0x48dbac]
call fcn.00478f14
fadd qword [0x48de40]
fstp qword [0x48de40]
wait
push dword [0x48de44]
push dword [0x48de40]
push 0
lea eax, [ebp - 0xec]
push eax
xor ecx, ecx
mov dl, 1
mov al, 0xa
call fcn.00479a1c
mov edx, dword [ebp - 0xec]
mov eax, 0x48dbac
call fcn.00404be8
cmp byte [0x48de3a], 0
je 0x48264f
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0xf4]
mov edx, ebx
dec edx
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xf4]
mov ecx, 0x14
mov edx, 0x64
call fcn.004050b4
mov eax, dword [ebp - 0xf0]
call fcn.00478f14
fstp qword [0x48de90]
wait
fld qword [0x48de70]
fadd qword [0x48de90]
fstp qword [0x48de70]
wait
fld qword [0x48de40]
fcomp dword [0x4835b4]
fnstsw ax
sahf
jne 0x48258e
xor eax, eax
mov dword [0x48de98], eax
mov dword [0x48de9c], eax
jmp 0x4825a3
fld qword [0x48de40]
fabs
fdivr qword [0x48de70]
fstp qword [0x48de98]
wait
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dba8]
push dword [0x48dbb0]
push dword [0x48dbac]
push dword [0x48dbb0]
push dword [0x48de9c]
push dword [0x48de98]
lea eax, [ebp - 0xf8]
push eax
xor ecx, ecx
mov dl, 6
mov al, 0xf
call fcn.0047926c
push dword [ebp - 0xf8]
push dword [0x48dbb0]
push dword [0x48de74]
push dword [0x48de70]
lea eax, [ebp - 0xfc]
push eax
xor ecx, ecx
mov dl, 6
mov al, 0x14
call fcn.0047926c
push dword [ebp - 0xfc]
push dword [0x48dbb0]
lea eax, [ebp - 0x100]
push eax
mov ecx, dword [0x48b9fc]
mov edx, dword [0x48b9f8]
mov eax, dword [0x48db98]
call fcn.00480420
push dword [ebp - 0x100]
mov eax, 0x48dbb4
mov edx, 0xb
call fcn.00404f14
jmp 0x4826a5
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dba8]
push dword [0x48dbb0]
push dword [0x48dbac]
push dword [0x48dbb0]
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [0x48b9fc]
mov edx, dword [0x48b9f8]
mov eax, dword [0x48db98]
call fcn.00480420
push dword [ebp - 0x104]
mov eax, 0x48dbb4
mov edx, 7
call fcn.00404f14
mov edx, ebx
dec edx
mov ecx, dword [0x48dbb4]
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0x20]
inc ebx
dec dword [ebp - 0x18]
jne 0x482413
cmp byte [0x48de38], 0
jne 0x482ac1
mov edx, dword [0x48dbb4]
mov eax, dword [0x48de34]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x482ac1
mov edx, dword [0x48dbb4]
mov eax, dword [0x48de34]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x482ac1
cmp byte [0x48de3a], 0
je 0x4827a6
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dbac]
push dword [0x48dbb0]
push dword [0x48de9c]
push dword [0x48de98]
lea eax, [ebp - 0x108]
push eax
xor ecx, ecx
mov dl, 6
mov al, 0xf
call fcn.0047926c
push dword [ebp - 0x108]
push dword [0x48dbb0]
push dword [0x48de74]
push dword [0x48de70]
lea eax, [ebp - 0x10c]
push eax
xor ecx, ecx
mov dl, 6
mov al, 0x14
call fcn.0047926c
push dword [ebp - 0x10c]
push dword [0x48dbb0]
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [0x48b9fc]
mov edx, dword [0x48b9f8]
mov eax, dword [0x48db98]
call fcn.00480420
push dword [ebp - 0x110]
mov eax, 0x48dbb4
mov edx, 9
call fcn.00404f14
jmp 0x4827f0
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dbac]
push dword [0x48dbb0]
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [0x48b9fc]
mov edx, dword [0x48b9f8]
mov eax, dword [0x48db98]
call fcn.00480420
push dword [ebp - 0x114]
mov eax, 0x48dbb4
mov edx, 5
call fcn.00404f14
mov eax, dword [0x48de34]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x482ab1
mov byte [0x48de38], 0
mov eax, dword [0x48de34]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x482a96
mov dword [ebp - 0x18], eax
mov ebx, 1
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
mov edx, ebx
dec edx
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x11c]
mov ecx, 0x14
mov edx, 1
call fcn.004050b4
mov eax, dword [ebp - 0x118]
mov edx, dword [0x48dba4]
call fcn.00404fa0
jne 0x482a8c
mov byte [0x48de38], 1
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x124]
mov edx, ebx
dec edx
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x124]
mov ecx, 0xa
mov edx, 0x16
call fcn.004050b4
mov eax, dword [ebp - 0x120]
call fcn.00478f14
fstp qword [0x48de40]
wait
mov eax, dword [0x48dbac]
call fcn.00478f14
fadd qword [0x48de40]
fstp qword [0x48de40]
wait
push dword [0x48de44]
push dword [0x48de40]
push 0
lea eax, [ebp - 0x128]
push eax
xor ecx, ecx
mov dl, 1
mov al, 0xa
call fcn.00479a1c
mov edx, dword [ebp - 0x128]
mov eax, 0x48dbac
call fcn.00404be8
cmp byte [0x48de3a], 0
je 0x482a2f
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x130]
mov edx, ebx
dec edx
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x130]
mov ecx, 0x14
mov edx, 0x31
call fcn.004050b4
mov eax, dword [ebp - 0x12c]
call fcn.00478f14
fstp qword [0x48de90]
wait
fld qword [0x48de70]
fadd qword [0x48de90]
fstp qword [0x48de70]
wait
fld qword [0x48de40]
fcomp dword [0x4835b4]
fnstsw ax
sahf
jne 0x48297a
xor eax, eax
mov dword [0x48de98], eax
mov dword [0x48de9c], eax
jmp 0x48298f
fld qword [0x48de40]
fabs
fdivr qword [0x48de70]
fstp qword [0x48de98]
wait
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dbac]
push dword [0x48dbb0]
push dword [0x48de9c]
push dword [0x48de98]
lea eax, [ebp - 0x134]
push eax
xor ecx, ecx
mov dl, 6
mov al, 0xf
call fcn.0047926c
push dword [ebp - 0x134]
push dword [0x48dbb0]
push dword [0x48de74]
push dword [0x48de70]
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov dl, 6
mov al, 0x14
call fcn.0047926c
push dword [ebp - 0x138]
push dword [0x48dbb0]
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [0x48b9fc]
mov edx, dword [0x48b9f8]
mov eax, dword [0x48db98]
call fcn.00480420
push dword [ebp - 0x13c]
mov eax, 0x48dbb4
mov edx, 9
call fcn.00404f14
jmp 0x482a79
push dword [0x48dba4]
push dword [0x48dbb0]
push dword [0x48dbac]
push dword [0x48dbb0]
lea eax, [ebp - 0x140]
push eax
mov ecx, dword [0x48b9fc]
mov edx, dword [0x48b9f8]
mov eax, dword [0x48db98]
call fcn.00480420
push dword [ebp - 0x140]
mov eax, 0x48dbb4
mov edx, 5
call fcn.00404f14
mov edx, ebx
dec edx
mov ecx, dword [0x48dbb4]
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0x20]
inc ebx
dec dword [ebp - 0x18]
jne 0x482823
cmp byte [0x48de38], 0
jne 0x482ac1
mov edx, dword [0x48dbb4]
mov eax, dword [0x48de34]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x482ac1
mov edx, dword [0x48dbb4]
mov eax, dword [0x48de34]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x482ad5
mov eax, 0x48b490
call fcn.004030b0
call fcn.004028c8
test al, al
je 0x481a5f
mov eax, 0x48b490
call fcn.00402f48
call fcn.004028c8
cmp byte [0x48de5c], 0
je 0x482b59
cmp dword [0x48de64], 0
je 0x482b59
mov edx, dword [0x48de58]
mov eax, 0x48b828
call fcn.00402e80
mov eax, 0x48b828
call fcn.00402c1c
call fcn.0040293c
test eax, eax
jne 0x482b59
mov edx, dword [0x48de64]
mov eax, 0x48b828
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
mov eax, 0x48b828
call fcn.00402f48
call fcn.004028c8
add dword [ebp - 0x1c], 4
dec dword [ebp - 0x14]
jne 0x481989
mov eax, dword [0x48de34]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x482c19
mov edx, 0x480264
mov eax, dword [0x48de34]
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov edx, dword [0x48bb94]
mov eax, 0x48b65c
call fcn.00402e80
mov eax, 0x48b65c
call fcn.00402c1c
call fcn.0040293c
test eax, eax
jne 0x482c23
mov edx, 0x48cb98
mov ecx, 0x1000
mov eax, 0x48b65c
call fcn.004032d8
mov eax, dword [0x48de34]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x482c0a
mov dword [ebp - 0x14], eax
mov ebx, 1
lea ecx, [ebp - 0x144]
mov edx, ebx
dec edx
mov eax, dword [0x48de34]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x144]
mov eax, 0x48b65c
call fcn.00405270
call fcn.004034e8
call fcn.004028c8
inc ebx
dec dword [ebp - 0x14]
jne 0x482bd7
mov eax, 0x48b65c
call fcn.00402f48
call fcn.004028c8
mov eax, dword [0x48de34]
call fcn.00403d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482c48
lea eax, [ebp - 0x144]
mov edx, 0x4a
call fcn.00404bb8
ret