Function at 0x407020
Capabilities:
Copy file
Create directory
Get common file path
Get graphical window text
Get system information on windows
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4806f5
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a1620]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00445098
mov eax, dword [esi + 0x20]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.004522e5
mov ebp, eax
cmp ebp, ebx
je 0x40710e
call fcn.0044bb76
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x407091
push 0x80004005
call fcn.004012e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x3c], edi
push 0x65
mov dword [esp + 0xfc], ebx
call fcn.0044bb6b
cmp eax, ebx
je 0x4070c3
push 0x65
push eax
lea ecx, [esp + 0x44]
call fcn.00401650
mov edi, dword [esp + 0x3c]
cmp dword [edi - 0xc], ebx
je 0x4070e7
mov ecx, dword [ebp + 4]
push ebx
push ebx
push 0x800
push ecx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov edx, dword [ebp + 4]
push edi
push 0x10
push ebx
push edx
call dword [sym.imp.USER32.dll_AppendMenuA]
lea eax, [edi - 0x10]
mov dword [esp + 0xf8], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40710e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov edi, 1
push edi
push 0x80
push ecx
call ebp
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x20]
push eax
push ebx
push 0x80
push edx
call ebp
mov eax, dword [esi + 0x20]
lea ebp, [esi + 0xe0]
mov dword [ebp], 0x1f8
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe8], 0x80
mov dword [esi + 0xec], 7
mov dword [esi + 0xf0], 0x401
call fcn.0044ea9f
mov eax, dword [eax + 8]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esi + 0xf4], eax
mov ecx, dword [0x48bd14]
mov dword [esi + 0xf8], ecx
mov dl, byte [0x48bd18]
push ebp
push ebx
mov byte [esi + 0xfc], dl
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0xb
lea ebp, [esi + 0x2f8]
push 0x48c358
mov ecx, ebp
mov dword [esi + 0xb4], 0x1000
mov dword [esi + 0xbc], ebx
call fcn.004018b0
lea ecx, [esp + 0x80]
call fcn.00451c24
push ebx
mov dword [esp + 0xfc], edi
mov ebp, dword [ebp]
push ebx
push ebp
lea ecx, [esp + 0x8c]
call fcn.00451c3a
test eax, eax
je 0x407202
lea ecx, [esp + 0x80]
call fcn.00451fe5
jmp 0x407218
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push 0x48c364
call ebp
push ebx
push 0x48c358
call ebp
push 0x48c36c
lea ecx, [esi + 0x4980]
mov dword [esi + 0x320], ebx
mov dword [esi + 0x330], edi
mov dword [esi + 0x334], ebx
mov dword [esi + 0x32c], ebx
mov dword [esi + 0x338], ebx
mov dword [esi + 0x33c], ebx
mov dword [esi + 0x340], ebx
mov dword [esi + 0x348], ebx
mov dword [esi + 0x34c], ebx
mov dword [esi + 0x344], ebx
mov dword [esi + 0x354], edi
mov dword [esi + 0x314], ebx
mov dword [esi + 0x328], ebx
mov byte [esi + 0x6ec], bl
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0x350], edi
mov byte [esi + 0x48c0], 1
mov dword [esi + 0x48bc], ebx
mov dword [esi + 0x4850], ebx
call fcn.004457c0
lea edi, [esi + 0x48c4]
mov byte [esi + 0x48a4], 1
mov eax, dword [edi + 8]
push 0x48be94
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be9c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48beac
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bea4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bcc8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c37c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c388
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bd0c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c390
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c39c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3ac
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3bc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3c8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3d4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bcec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3dc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3e8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3f4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c400
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c408
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c410
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c418
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bd70
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bd90
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c420
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c428
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c438
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c440
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c450
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c460
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c470
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c480
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c490
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4a0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4b0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4bc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4c8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4d8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4e0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bdb4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4ec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bddc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be04
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4fc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c518
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be14
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c534
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c544
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c554
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c564
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c570
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c580
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c590
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5a0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5b0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5c0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5d0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5e0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5f0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c600
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c610
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c620
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c630
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c640
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c650
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c660
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c66c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be3c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c674
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c680
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c68c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c698
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6a4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be58
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be74
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6b0
push eax
mov ecx, edi
call fcn.0044f255
lea edi, [esi + 0x48d8]
mov byte [esi + 0x48ec], bl
mov eax, dword [edi + 8]
push 0x48be94
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be9c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bcc8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6bc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c39c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6c8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6d4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3e8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3f4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c388
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6e0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3ac
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bcec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3dc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6e8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6f0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6fc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c704
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be58
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c420
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c438
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4b0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bd0c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c390
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3bc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3c8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c450
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c428
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c70c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c410
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c418
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4a0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bd70
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bea4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c714
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c720
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4bc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bd90
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c440
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c490
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c470
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c480
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c3d4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4c8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4d8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4e0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bdb4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4ec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48bddc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be04
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c72c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c738
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c744
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6b0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c4fc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c518
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be14
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48beac
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c580
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c590
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5a0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5b0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c544
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c564
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c750
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c760
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c770
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c78c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c7a8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c7b4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c7c4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5c0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c554
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5d0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5e0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c5f0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c600
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c534
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c7d0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c7e4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c7f8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c80c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c820
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c834
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c848
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c85c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c870
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c884
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c894
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c400
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c408
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c610
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c620
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c570
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c8a4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c630
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c640
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c66c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c660
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be3c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c674
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c8b4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c8c4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c8d4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c8e4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c37c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be58
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48be74
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c680
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c68c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c698
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c6a4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c8f4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c904
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c914
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c460
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c924
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c934
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c650
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c93c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c94c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x48f8]
lea edi, [esi + 0x48f0]
push 0x48c95c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c964
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c96c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c974
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c97c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c984
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c990
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c998
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9a0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9a8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9b0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9b8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9c4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9d0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9dc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9e4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x490c]
lea edi, [esi + 0x4904]
push 0x125f
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [esi + 0x4920]
lea ebp, [esi + 0x4918]
push ebx
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x1260
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 6
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x1262
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 7
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x1261
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 8
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x1263
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 9
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x44af
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 0xa
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x1264
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 0xc
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x1266
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 0xd
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x1265
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 0xe
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x1267
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 0xf
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x44b0
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 0x10
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x2a72
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 0x11
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x2a7a
push eax
mov ecx, edi
call fcn.004515a0
mov eax, dword [ebp + 8]
push 0x12
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [esi + 0x3dc]
lea edi, [esi + 0x3d4]
push 0x48c9ec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9f4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48c9fc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca04
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca0c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca14
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca1c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca24
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca2c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca34
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca3c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca44
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x3f0]
lea edi, [esi + 0x3e8]
push 0x48c9ec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca04
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca0c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca14
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca1c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca24
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca2c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca34
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca3c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca44
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x3c8]
lea edi, [esi + 0x3c0]
push 0x48ca4c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca54
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca5c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca64
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca6c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca74
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca7c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca84
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca8c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca94
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ca9c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48caa4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48caac
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cab4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x404]
lea edi, [esi + 0x3fc]
push 0x48cabc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cac8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cad4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cae4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48caf4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb04
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb14
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb24
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb34
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb44
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb58
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb64
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb74
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb84
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cb94
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cba8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cbbc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cbcc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cbd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cbe4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cbf4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc04
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc14
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc2c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc38
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc48
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc58
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc68
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc78
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc88
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cc98
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cca8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccb8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccc8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x418]
lea edi, [esi + 0x410]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x42c]
lea edi, [esi + 0x424]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x440]
lea edi, [esi + 0x438]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x454]
lea edi, [esi + 0x44c]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x468]
lea edi, [esi + 0x460]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x47c]
lea edi, [esi + 0x474]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x490]
lea edi, [esi + 0x488]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x4a4]
lea edi, [esi + 0x49c]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x4cc]
lea edi, [esi + 0x4c4]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd18
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x4e0]
lea edi, [esi + 0x4d8]
push 0x48cd20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccd8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cce8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ccf8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x4f4]
lea edi, [esi + 0x4ec]
push 0x48cd28
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd58
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cd7c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cda0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cdc8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ce14
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ce38
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48ce5c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push str.10__
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cebc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x508]
lea edi, [esi + 0x500]
push 0x48cee4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x51c]
lea ebp, [esi + 0x514]
push 0x2fa30000
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x48cef0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [ebp + 8]
push 0x32320000
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x48cef8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [ebp + 8]
push 0x5ed10000
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x48cf00
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [ebp + 8]
push 0x5ed20000
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x48cf08
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [ebp + 8]
push 0x5ed30000
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x48cf10
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [ebp + 8]
push 0x5cd50000
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x48cf20
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [ebp + 8]
push 0xad7d0000
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [edi + 8]
push 0x48cf28
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [ebp + 8]
push 0x601e0000
push eax
mov ecx, ebp
call fcn.004515a0
mov eax, dword [esi + 0x530]
lea edi, [esi + 0x528]
push 0x48cf38
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf40
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf48
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf50
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x544]
lea edi, [esi + 0x53c]
push 0x48cf58
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf60
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf68
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf70
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf78
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf80
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf88
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf90
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cf98
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfa0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfa8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfb0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfb8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfc0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfc8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfd4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfdc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfe4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cfec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48cff8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d000
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d008
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d014
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d020
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d028
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d030
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d03c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d048
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d050
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d03c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d05c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x558]
lea edi, [esi + 0x550]
push 0x48d064
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d074
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d088
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d09c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d0b0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d0c4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d0d8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d0ec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d100
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d114
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x56c]
lea edi, [esi + 0x564]
push 0x48d128
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d13c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d150
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d164
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d178
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d18c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d1a0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d1b4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d1c8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d1dc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x580]
lea edi, [esi + 0x578]
push 0x48d1f0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d204
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d218
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d228
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d23c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d250
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d264
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d278
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d288
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d29c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d2b0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d2c4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d2d8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d2ec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d300
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x5a8]
lea edi, [esi + 0x5a0]
push 0x48d314
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d320
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d32c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x5bc]
lea edi, [esi + 0x5b4]
push 0x48d338
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d340
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d348
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d350
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d358
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d364
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d370
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d37c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d388
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d394
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x594]
lea edi, [esi + 0x58c]
push 0x48d3a0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d3ac
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x5d0]
lea edi, [esi + 0x5c8]
push 0x48d3b8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d3cc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d3e0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d3f4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d408
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d414
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d420
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d430
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d444
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d450
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d464
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d478
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d408
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x5e4]
lea edi, [esi + 0x5dc]
push 0x48d48c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d498
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4a4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4ac
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4bc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x60c]
lea edi, [esi + 0x604]
push 0x48d4cc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4d0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4d4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4d8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4dc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4e0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4e4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4e8
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4ec
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4f0
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4f4
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d4fc
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d504
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d50c
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [edi + 8]
push 0x48d514
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x5f8]
lea edi, [esi + 0x5f0]
push 0x48d51c
push eax
mov ecx, edi
call fcn.0044f255
mov ebp, 0x546
mov dword [esi + 0x618], ebp
mov eax, dword [edi + 8]
push 0x48d528
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x61c], ebp
mov eax, dword [edi + 8]
push 0x48d48c
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x620], ebp
mov eax, dword [edi + 8]
push 0x48d4a4
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x624], ebp
mov eax, dword [edi + 8]
push 0x48d534
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x628], 0xbb8
mov eax, dword [edi + 8]
push 0x48d4bc
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x62c], 0xbb8
mov eax, dword [edi + 8]
push 0x48d540
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x630], ebp
mov eax, dword [edi + 8]
push 0x48d54c
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x634], ebp
mov eax, dword [edi + 8]
push 0x48d558
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x638], ebp
mov eax, dword [edi + 8]
push 0x48d564
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x63c], ebp
mov eax, dword [edi + 8]
push 0x48d570
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x640], ebp
mov eax, dword [edi + 8]
push 0x48d57c
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x644], ebp
mov eax, dword [edi + 8]
push 0x48d588
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x648], ebp
mov eax, dword [edi + 8]
push 0x48d594
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x64c], ebp
mov eax, dword [edi + 8]
push 0x48d5a0
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x650], ebp
mov eax, dword [edi + 8]
push 0x48d5ac
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x654], ebp
mov eax, dword [edi + 8]
push 0x48d5b8
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x658], ebp
mov eax, dword [edi + 8]
push 0x48d5c4
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x65c], ebp
mov eax, dword [edi + 8]
push 0x48d5d0
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x660], ebp
mov eax, dword [edi + 8]
push 0x48d5dc
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x664], ebp
mov eax, dword [edi + 8]
push 0x48d5e8
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x668], ebp
mov eax, dword [edi + 8]
push 0x48d5f4
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x66c], ebp
mov eax, dword [edi + 8]
push 0x48d600
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x670], ebp
mov eax, dword [edi + 8]
push 0x48d60c
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x674], ebp
mov eax, dword [edi + 8]
push 0x48d618
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x678], 0x5dc
mov eax, dword [edi + 8]
push 0x48d620
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x67c], 0x5dc
mov eax, dword [edi + 8]
push 0x48d62c
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x680], 0x4e2
mov eax, dword [edi + 8]
push 0x48d638
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x684], 0x1162
mov eax, dword [edi + 8]
push 0x48d644
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x688], ebp
mov eax, dword [edi + 8]
push 0x48d64c
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x68c], 0xfa
mov eax, dword [edi + 8]
push 0x48d658
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x690], ebp
mov eax, dword [edi + 8]
push 0x48d664
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x694], 0x2ee
mov eax, dword [edi + 8]
push 0x48d670
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x698], 0x2fda
mov eax, dword [edi + 8]
push 0x48d678
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x69c], ebp
mov eax, dword [edi + 8]
push 0x48d684
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x6a0], ebp
mov eax, dword [edi + 8]
push 0x48d690
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x6a4], 0x170c
mov eax, dword [edi + 8]
push 0x48d69c
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x6a8], ebp
mov eax, dword [edi + 8]
push 0x48d6a8
push eax
mov ecx, edi
call fcn.0044f255
mov dword [esi + 0x6ac], ebp
mov eax, dword [edi + 8]
push 0x48d670
push eax
mov ecx, edi
call fcn.0044f255
mov eax, dword [esi + 0x710]
push 0x26
push ebx
push 0x1331
push eax
mov dword [esi + 0x6b0], 0x30a2
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x48d6b4
push ebx
lea edi, [esi + 0x6f0]
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d6d4
push 1
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d6f4
push 2
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d6fc
push 3
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d704
push 4
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d70c
push 5
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d714
push 6
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d720
push 7
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d728
push 8
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d730
push 9
push 1
mov ecx, edi
call fcn.00451722
push ebx
push ebx
push 0x48d738
push 0xa
push 1
mov ecx, edi
call fcn.00451722
mov ebp, dword [esi + 0x2454]
lea edi, [esi + 0x2454]
push 0x3f2
mov ecx, esi
add ebp, 0x134
call fcn.004456c3
mov edx, dword [ebp]
push eax
push 0x6c
mov ecx, edi
call edx
mov eax, dword [esi + 0x7b8]
lea ebp, [esi + 0x7b8]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x68
mov ecx, ebp
call edx
mov eax, dword [esi + 0x120c]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x69
lea ecx, [esi + 0x120c]
call edx
mov eax, dword [esi + 0x2040]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x6b
lea ecx, [esi + 0x2040]
call edx
mov eax, dword [esi + 0x744]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x67
lea ecx, [esi + 0x744]
call edx
mov eax, dword [esi + 0x16ac]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x6a
lea ecx, [esi + 0x16ac]
call edx
mov eax, dword [esi + 0x28c4]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x6d
lea ecx, [esi + 0x28c4]
call edx
mov eax, dword [esi + 0x2d98]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x6e
lea ecx, [esi + 0x2d98]
call edx
mov eax, dword [esi + 0x2f84]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x74
lea ecx, [esi + 0x2f84]
call edx
mov eax, dword [esi + 0x3108]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x76
lea ecx, [esi + 0x3108]
call edx
mov eax, dword [esi + 0x3964]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push 0x77
lea ecx, [esi + 0x3964]
call edx
mov eax, dword [esi + 0x3fc0]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
push eax
mov eax, dword [esp + 0x18]
push 0x78
lea ecx, [esi + 0x3fc0]
mov edx, dword [eax]
call edx
mov eax, dword [esi + 0x4624]
mov eax, dword [eax]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x4624]
push eax
mov eax, dword [edx]
push 0x79
call eax
mov ecx, dword [esi + 0x4628]
mov eax, dword [ecx]
add eax, 0x134
push 0x3f2
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004456c3
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x4628]
push eax
mov eax, dword [edx]
push 0x7a
call eax
mov edx, dword [esi + 0x710]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
add dword [esp + 0x20], 0x28
mov edx, dword [esp + 0x1c]
sub eax, 1
mov dword [esp + 0x28], eax
sub eax, dword [esp + 0x20]
sub ecx, 2
push 1
add edx, 1
push eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], ecx
sub ecx, edx
push ecx
push eax
push edx
lea ecx, [esi + 0x744]
mov dword [esp + 0x30], edx
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, ebp
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x120c]
call fcn.0044581c
mov ecx, dword [esp + 0x28]
push 1
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x16ac]
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x2040]
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, edi
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x28c4]
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x2d98]
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x2f84]
call fcn.0044581c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x3108]
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x3964]
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x3fc0]
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [esi + 0x4624]
push 1
sub edx, eax
push edx
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
call fcn.0044581c
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [esi + 0x4628]
push 1
sub edx, eax
push edx
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
call fcn.0044581c
push ebx
lea ecx, [esi + 0x744]
call fcn.0044585a
push ebx
mov ecx, ebp
call fcn.0044585a
push ebx
lea ecx, [esi + 0x120c]
call fcn.0044585a
push ebx
lea ecx, [esi + 0x16ac]
call fcn.0044585a
push ebx
lea ecx, [esi + 0x2040]
call fcn.0044585a
mov ebp, 1
push ebp
mov ecx, edi
call fcn.0044585a
push ebx
lea ecx, [esi + 0x28c4]
call fcn.0044585a
push ebx
lea ecx, [esi + 0x2d98]
call fcn.0044585a
push ebx
lea ecx, [esi + 0x2f84]
call fcn.0044585a
push ebx
lea ecx, [esi + 0x3108]
call fcn.0044585a
push ebx
lea ecx, [esi + 0x3964]
call fcn.0044585a
push ebx
lea ecx, [esi + 0x3fc0]
call fcn.0044585a
mov ecx, dword [esi + 0x4624]
push ebx
call fcn.0044585a
mov ecx, dword [esi + 0x4628]
push ebx
call fcn.0044585a
mov ecx, dword [esi + 0x710]
push ebx
push ebx
push 0x130c
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x48d744
lea ecx, [esi + 0x4a8c]
call fcn.00401830
push 0x48d754
lea ecx, [esi + 0x4ae8]
call fcn.00401830
push 0x48d75c
lea ecx, [esi + 0x4b44]
call fcn.00401830
push 0x48d764
lea ecx, [esi + 0x4ea4]
call fcn.00401830
push 0x48d76c
lea ecx, [esi + 0x4f04]
call fcn.00401830
push 0x48d77c
lea ecx, [esi + 0x4f64]
call fcn.00401830
push 0x48d788
lea ecx, [esi + 0x4fc4]
call fcn.00401830
push 0x48d798
lea ecx, [esi + 0x8ac]
call fcn.00401830
push 0x48d7a4
lea ecx, [esi + 0x90c]
call fcn.00401830
push 0x48d7a4
lea ecx, [esi + 0x96c]
call fcn.00401830
push 0x48d7b0
lea ecx, [esi + 0x9cc]
call fcn.00401830
push 0x48d7c0
lea ecx, [esi + 0xa2c]
call fcn.00401830
push 0x48d7cc
lea ecx, [esi + 0xa8c]
call fcn.00401830
push 0x48d7d0
lea ecx, [esi + 0xaec]
call fcn.00401830
push 0x48d7d4
lea ecx, [esi + 0xb4c]
call fcn.00401830
push 0x48d7e0
lea ecx, [esi + 0xbac]
call fcn.00401830
push 0x48d7f4
lea ecx, [esi + 0xc0c]
call fcn.00401830
push 0x48d800
lea ecx, [esi + 0xc6c]
call fcn.00401830
push 0x48d810
lea ecx, [esi + 0xccc]
call fcn.00401830
push 0x48d81c
lea ecx, [esi + 0xd2c]
call fcn.00401830
push 0x48d828
lea ecx, [esi + 0xd8c]
call fcn.00401830
push 0x48d82c
lea ecx, [esi + 0xdec]
call fcn.00401830
push 0x48d830
lea ecx, [esi + 0xe4c]
call fcn.00401830
push 0x48d834
lea ecx, [esi + 0xeac]
call fcn.00401830
push 0x48d838
lea ecx, [esi + 0x1028]
call fcn.00401830
push 0x48d848
lea ecx, [esi + 0x1088]
call fcn.00401830
push 0x48d848
lea ecx, [esi + 0x10e8]
call fcn.00401830
push 0x48d858
lea ecx, [esi + 0x1148]
call fcn.00401830
push 0x48d870
lea ecx, [esi + 0x11a8]
call fcn.00401830
push 0x48d870
lea ecx, [esi + 0x1208]
call fcn.00401830
push 0x48d888
lea ecx, [esi + 0x1360]
call fcn.00401830
push 0x48d898
lea ecx, [esi + 0x13c0]
call fcn.00401830
push 0x48d8a8
lea ecx, [esi + 0x1420]
call fcn.00401830
push 0x48d8b8
lea ecx, [esi + 0x153c]
call fcn.00401830
push 0x48d8c8
lea ecx, [esi + 0x159c]
call fcn.00401830
push 0x48d8d4
lea ecx, [esi + 0x147c]
call fcn.00401830
push 0x48d8e0
lea ecx, [esi + 0x14d8]
call fcn.00401830
push 0x48d8e4
lea ecx, [esi + 0x164c]
call fcn.00401830
push 0x48d8e8
lea ecx, [esi + 0x16a8]
call fcn.00401830
push 0x48d8ec
lea ecx, [esi + 0x17b4]
call fcn.00401830
push 0x48d8f8
lea ecx, [esi + 0x1814]
call fcn.00401830
push 0x48d904
lea ecx, [esi + 0x1874]
call fcn.00401830
push 0x48d910
lea ecx, [esi + 0x18dc]
call fcn.00401830
push 0x48d910
lea ecx, [esi + 0x193c]
call fcn.00401830
push 0x48d918
lea ecx, [esi + 0x199c]
call fcn.00401830
push 0x48d918
lea ecx, [esi + 0x19fc]
call fcn.00401830
push 0x48d924
lea ecx, [esi + 0x1a5c]
call fcn.00401830
push 0x48d924
lea ecx, [esi + 0x1abc]
call fcn.00401830
push 0x48d928
lea ecx, [esi + 0x1b1c]
call fcn.00401830
push 0x48d938
lea ecx, [esi + 0x1b7c]
call fcn.00401830
push 0x48d948
lea ecx, [esi + 0x1bdc]
call fcn.00401830
push 0x48d950
lea ecx, [esi + 0x1c3c]
call fcn.00401830
push 0x48d958
lea ecx, [esi + 0x1fdc]
call fcn.00401830
push 0x48d974
lea ecx, [esi + 0x203c]
call fcn.00401830
push 0x48d8e4
lea ecx, [esi + 0x1f1c]
call fcn.00401830
push 0x48d8e8
lea ecx, [esi + 0x1f78]
call fcn.00401830
push 0x48d978
lea ecx, [esi + 0x2278]
call fcn.00401830
push 0x48d9a0
lea ecx, [esi + 0x22d8]
call fcn.00401830
push 0x48d9b8
lea ecx, [esi + 0x2338]
call fcn.00401830
push 0x48d9d0
lea ecx, [esi + 0x2398]
call fcn.00401830
push 0x48d8e4
lea ecx, [esi + 0x23f4]
call fcn.00401830
push 0x48d8e8
lea ecx, [esi + 0x2450]
call fcn.00401830
push 0x48d9e0
lea ecx, [esi + 0x25dc]
call fcn.00401830
push 0x48d9f0
lea ecx, [esi + 0x263c]
call fcn.00401830
push 0x48da04
lea ecx, [esi + 0x2698]
call fcn.00401830
push 0x48da0c
lea ecx, [esi + 0x26f4]
call fcn.00401830
push 0x48da20
lea ecx, [esi + 0x2750]
call fcn.00401830
push 0x48da2c
lea ecx, [esi + 0x27ac]
call fcn.00401830
push 0x48da34
lea ecx, [esi + 0x2808]
call fcn.00401830
push 0x48da3c
lea ecx, [esi + 0x2864]
call fcn.00401830
push 0x48da44
lea ecx, [esi + 0x28c0]
call fcn.00401830
push 0x48da4c
lea ecx, [esi + 0x2a9c]
call fcn.00401830
push 0x48da54
lea ecx, [esi + 0x2afc]
call fcn.00401830
push 0x48da5c
lea ecx, [esi + 0x2b5c]
call fcn.00401830
push 0x48da64
lea ecx, [esi + 0x2bbc]
call fcn.00401830
push 0x48da7c
lea ecx, [esi + 0x2c1c]
call fcn.00401830
push 0x48da94
lea ecx, [esi + 0x2cdc]
call fcn.00401830
push 0x48daa8
lea ecx, [esi + 0x2c7c]
call fcn.00401830
push 0x48dabc
lea ecx, [esi + 0x2d38]
call fcn.00401830
push 0x48dac8
lea ecx, [esi + 0x2d94]
call fcn.00401830
push 0x48dadc
lea ecx, [esi + 0x30a8]
call fcn.00401830
push 0x48d8e4
lea ecx, [esi + 0x3104]
call fcn.00401830
push 0x48d8e4
lea ecx, [esi + 0x3648]
call fcn.00401830
push 0x48d8e8
lea ecx, [esi + 0x36a4]
call fcn.00401830
push 0x48dae8
lea ecx, [esi + 0x31d8]
call fcn.00401830
push 0x48daf0
lea ecx, [esi + 0x3238]
call fcn.00401830
push 0x48db08
lea ecx, [esi + 0x3298]
call fcn.00401830
push 0x48db1c
lea ecx, [esi + 0x32f8]
call fcn.00401830
push 0x48db38
lea ecx, [esi + 0x3358]
call fcn.00401830
push 0x48db54
lea ecx, [esi + 0x34cc]
call fcn.00401830
push 0x48d714
lea ecx, [esi + 0x352c]
call fcn.00401830
push 0x48db64
lea ecx, [esi + 0x358c]
call fcn.00401830
push 0x48db74
lea ecx, [esi + 0x35ec]
call fcn.00401830
push 0x48db78
lea ecx, [esi + 0x3a54]
call fcn.00401830
push 0x48db84
lea ecx, [esi + 0x3ab4]
call fcn.00401830
push 0x48db90
lea ecx, [esi + 0x3b74]
call fcn.00401830
push 0x48db94
lea ecx, [esi + 0x3b14]
call fcn.00401830
push 0x48db9c
lea ecx, [esi + 0x3ed4]
call fcn.00401830
push 0x48dbac
lea ecx, [esi + 0x3bd4]
call fcn.00401830
push 0x48dbbc
lea ecx, [esi + 0x3c34]
call fcn.00401830
push 0x48dbc4
lea ecx, [esi + 0x3c94]
call fcn.00401830
push 0x48dbd0
lea ecx, [esi + 0x3cf4]
call fcn.00401830
push 0x48dbd8
lea ecx, [esi + 0x3d54]
call fcn.00401830
push 0x48dbe4
lea ecx, [esi + 0x3db4]
call fcn.00401830
push 0x48dbe8
lea ecx, [esi + 0x3e14]
call fcn.00401830
push 0x48dbd0
lea ecx, [esi + 0x3e74]
call fcn.00401830
push 0x48dbf4
lea ecx, [esi + 0x3f30]
call fcn.00401830
push 0x48dc00
lea ecx, [esi + 0x40f0]
call fcn.00401830
push 0x48dc10
lea ecx, [esi + 0x4150]
call fcn.00401830
push 0x48dc18
lea ecx, [esi + 0x41b0]
call fcn.00401830
push 0x48dc24
lea ecx, [esi + 0x4210]
call fcn.00401830
push 0x48dc30
lea ecx, [esi + 0x4270]
call fcn.00401830
push 0x48dc3c
lea ecx, [esi + 0x42d0]
call fcn.00401830
push 0x48dc48
lea ecx, [esi + 0x4330]
call fcn.00401830
push 0x48dc54
lea ecx, [esi + 0x4390]
call fcn.00401830
push 0x48dc60
lea ecx, [esi + 0x43f0]
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dc6c
add ecx, 0x1d0
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dc78
add ecx, 0x230
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dc8c
add ecx, 0x290
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dc94
add ecx, 0x2f0
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dc98
add ecx, 0x350
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dca0
add ecx, 0x3b0
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dca8
add ecx, 0x410
call fcn.00401830
push 0x48dcb8
mov ecx, dword [esi + 0x4624]
add ecx, 0x470
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dcc0
add ecx, 0x4d0
call fcn.00401830
mov ecx, dword [esi + 0x4624]
push 0x48dcc8
add ecx, 0x52c
call fcn.00401830
mov edx, dword [esi + 0x46bc]
mov eax, dword [edx + 0x134]
lea edi, [esi + 0x46bc]
push ebx
push 0x6f
mov ecx, edi
call eax
push ebp
mov ecx, edi
call fcn.0044585a
call fcn.0041d110
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0xa2]
movzx eax, word [esp + 0xa0]
push edx
push eax
lea ecx, [esi + 0x47e8]
push str._.2d_.3d
push ecx
call fcn.004023e0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x48dccc
call fcn.004014f0
push ecx
mov byte [esp + 0x100], 2
mov ecx, esp
mov dword [esp + 0x4c], esp
push str._wap_verver.asp
call fcn.004014f0
push ecx
mov byte [esp + 0x104], 3
mov ecx, esp
mov dword [esp + 0x44], esp
push str.haoyue168.w18.mc_test.com
call fcn.004014f0
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0x108], 1
call fcn.00420020
mov byte [esp + 0xf8], 4
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx - 0xc]
cmp eax, ebx
jl 0x40a865
push 0x48dd08
push ecx
call fcn.004665a4
add esp, 8
cmp eax, ebx
je 0x40a865
sub eax, dword [esp + 0x34]
jns 0x40a87c
push ebx
push 0x48bd14
push 0x48dd10
mov ecx, esi
call fcn.00447772
jmp 0x40a965
lea ecx, [esp + 0x6c]
call fcn.0044ee5a
push ecx
mov byte [esp + 0xfc], 5
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x48dd48
call fcn.004014f0
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x100], 6
mov eax, dword [esp + 0x3c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x50], esp
mov edi, esp
push eax
call fcn.00402200
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x104], 5
call fcn.00419cb0
cmp dword [esp + 0x74], ebp
jg 0x40a8df
jmp fcn.0044c4a2
mov ecx, dword [esp + 0x70]
mov eax, dword [ecx + 4]
push eax
call fcn.004669bd
add esp, 4
cmp eax, 0x13303c3
jle 0x40a90f
push ebx
push 0x48bd14
push 0x48dd4c
mov ecx, esi
call fcn.00447772
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 0x74], 2
jg 0x40a91b
jmp fcn.0044c4a2
mov edx, dword [esp + 0x70]
mov eax, dword [edx + 8]
push eax
call fcn.004669bd
add esp, 4
cmp eax, 0x13303c3
je 0x40a954
push 0x104
push 0x48bd14
push 0x48dd80
mov ecx, esi
call fcn.00447772
cmp eax, 6
jne 0x40a954
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x6c]
mov byte [esp + 0xf8], 4
call fcn.0044f09f
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp + 0xc8]
cmp ax, 9
je 0x40ae7e
cmp ax, 6
je 0x40ae7e
call fcn.0044bb76
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40a9a9
push 0x80004005
call fcn.004012e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
mov byte [esp + 0xf8], 7
mov eax, dword [esi - 8]
mov ecx, ebp
sub ecx, dword [esi - 4]
sub eax, 0xc
or eax, ecx
jge 0x40a9df
push 0xc
lea ecx, [esp + 0x1c]
call fcn.00401360
mov esi, dword [esp + 0x18]
push 0x48ddd4
push 0xc
push esi
push 0x48dde8
push 0x48ddec
push 0x48ddf4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp esi, ebx
jne 0x40aa04
xor eax, eax
jmp 0x40aa21
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40aa10
sub eax, edx
js 0x40aed9
cmp eax, dword [esi - 8]
jg 0x40aed9
push 0x48de00
mov dword [esi - 0xc], eax
push esi
mov byte [eax + esi], bl
call fcn.00466452
add esp, 8
cmp eax, ebx
je 0x40ae56
lea ecx, [esp + 0x2c]
call fcn.00402440
push 0x104
push 0x104
lea ecx, [esp + 0x34]
mov byte [esp + 0x100], 8
call fcn.00401330
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.00436f30
push 0x48de04
lea ecx, [esp + 0x30]
call fcn.004367a0
mov ecx, dword [esp + 0x18]
push 0x48dde8
push ecx
call fcn.00466452
add esp, 8
cmp eax, ebx
jne 0x40aba2
lea ecx, [esp + 0x18]
call fcn.00401940
lea edx, [esp + 0xbc]
push edx
call fcn.004669f1
add esp, 4
push eax
call fcn.004669c2
add esp, 4
mov esi, 8
jmp 0x40aad0
call fcn.004669cf
cdq
mov ecx, 0x1a
idiv ecx
lea ecx, [esp + 0x18]
add dl, 0x41
mov byte [esp + 0x14], dl
mov edx, dword [esp + 0x14]
push edx
call fcn.00436ed0
sub esi, ebp
jne 0x40aad0
mov eax, dword [esp + 0x18]
push 0x48ddd4
push eax
push 0x48ddec
push 0x48ddf4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x50]
push eax
call fcn.00405650
add esp, 0xc
push str..sys
push eax
lea ecx, [esp + 0x6c]
push ecx
mov byte [esp + 0x104], 9
call fcn.00405710
mov eax, dword [eax]
add esp, 0xc
push ebx
push eax
push str.SYSHelloDDK.sys
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ab71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40acad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40acad
lea ecx, [esp + 0xa4]
call fcn.0045272d
lea ecx, [esp + 0x40]
call fcn.00402440
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x104], 0xb
call fcn.00405650
add esp, 0xc
push str..sys
push eax
lea ecx, [esp + 0x70]
push ecx
mov byte [esp + 0x104], 0xc
call fcn.00405710
add esp, 0xc
mov byte [esp + 0xf8], 0xd
mov eax, dword [eax]
push ebx
push eax
lea ecx, [esp + 0xac]
call fcn.004527b9
lea ecx, [esp + 0x68]
mov esi, eax
call fcn.004010b0
lea ecx, [esp + 0x58]
mov byte [esp + 0xf8], 0xb
call fcn.004010b0
cmp esi, ebx
jne 0x40ac84
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.00405650
add esp, 0xc
push str..sys
push eax
lea edx, [esp + 0x54]
push edx
mov byte [esp + 0x104], 0xe
call fcn.00405710
mov eax, dword [eax]
add esp, 0xc
push ebx
push eax
push str.SYSHelloDDK.sys
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x4c]
call fcn.004010b0
lea ecx, [esp + 0x50]
mov byte [esp + 0xf8], 0xb
call fcn.004010b0
lea ecx, [esp + 0xa4]
call fcn.00452376
lea ecx, [esp + 0x40]
call fcn.004010b0
lea ecx, [esp + 0xa4]
mov byte [esp + 0xf8], 8
call fcn.00452751
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x5c]
push edx
call fcn.00405650
add esp, 0xc
push str..sys
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x104], 0xf
call fcn.00405710
add esp, 0xc
mov byte [esp + 0xf8], 0x11
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ad07
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x30]
cmp dword [esi - 4], ebp
jle 0x40ad21
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [esp + 0x34]
call fcn.004013b0
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 4], ebp
jle 0x40ad3b
mov edx, dword [ecx - 0xc]
push edx
lea ecx, [esp + 0x1c]
call fcn.004013b0
mov ecx, dword [esp + 0x18]
push esi
call fcn.00436530
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
jne 0x40ad4d
xor eax, eax
jmp 0x40ad63
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40ad52
sub eax, edx
js 0x40aed9
cmp eax, dword [ebp - 8]
jg 0x40aed9
mov dword [ebp - 0xc], eax
mov byte [eax + ebp], bl
mov esi, dword [esp + 0x30]
cmp esi, ebx
jne 0x40ad7e
xor eax, eax
jmp 0x40ad94
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40ad83
sub eax, edx
js 0x40aed9
cmp eax, dword [esi - 8]
jg 0x40aed9
mov dword [esi - 0xc], eax
mov ecx, dword [esp + 0x30]
push ecx
mov byte [ecx + eax], bl
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.HelloDDK
call fcn.004014f0
call fcn.00436630
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push ebx
lea edx, [esp + 0x60]
push edx
push ebx
push ebx
push ebx
push ebx
push 0x222054
push esi
mov dword [esp + 0x80], eax
call edi
push ebx
lea eax, [esp + 0x60]
push eax
push ebx
push ebx
push 4
lea ecx, [esp + 0x74]
push ecx
push 0x222048
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0xf8], 8
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ae2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [esp + 0x18]
mov byte [esp + 0xf8], 7
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae5a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [esp + 0x18]
lea eax, [ebp - 0x10]
mov byte [esp + 0xf8], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xf8], 1
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aea6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x80]
mov dword [esp + 0xf8], 0xffffffff
call fcn.00452021
mov eax, 1
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004012e0
int3