Function at 0x4a0750
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], ecx
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a17ae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x4a080c
mov eax, dword [ebp - 8]
cmp byte [eax + 0xb0], 0
je 0x4a080c
mov eax, dword [ebp - 8]
cmp dword [eax + 0x178], 0
je 0x4a07e6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x178]
call fcn.00447b34
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x178]
call fcn.00447b5c
mov eax, dword [ebp - 8]
add eax, 0x178
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x4c]
call fcn.00404ebc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x423]
mov dl, 1
mov eax, dword [0x49663c]
call fcn.004a2f8c
mov edx, dword [ebp - 8]
mov dword [edx + 0x178], eax
jmp 0x4a178b
xor ecx, ecx
push ebp
push 0x4a1781
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x138], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x180], 0
mov cl, 1
mov dl, 1
mov eax, dword [0x45666c]
call fcn.00456bb8
mov dword [ebp - 0x34], eax
xor ecx, ecx
push ebp
push 0x4a1770
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov byte [ebp - 0x29], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x134], edx
cmp byte [ebp - 9], 0
je 0x4a0bac
xor eax, eax
push ebp
push 0x4a08ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 0xa0], 0
je 0x4a08e4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
mov edx, dword [eax + 0x50]
mov dword [ebp - 0x40], edx
mov edx, dword [eax + 0x54]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
xor edx, edx
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
mov dl, 3
call fcn.004477c8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa0]
call fcn.00447b34
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xa0], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a08f8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486aa4
dec eax
test eax, eax
jl 0x4a0ab6
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x8d], 1
jne 0x4a0aaa
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0xac]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
test esi, esi
je 0x4a0aaa
cmp dword [esi + 0x20], 0
je 0x4a0aaa
mov dl, 1
mov eax, dword [0x4a0664]
call fcn.00404e8c
mov ebx, eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 8]
call fcn.00406f08
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xac]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xa8]
mov dword [ebx + 0xc], eax
lea edx, [ebp - 0x64]
mov eax, esi
call fcn.004874e0
mov edx, dword [ebp - 0x64]
lea eax, [ebx + 0x10]
call fcn.00406f08
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x14], eax
xor edx, edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x1c], eax
movzx eax, byte [esi + 0x30]
mov byte [ebx + 0x20], al
movzx eax, byte [esi + 0x31]
mov byte [ebx + 0x21], al
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0x24]
imul edx, dword [edx + 0xc0], 0x85
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x620]
mov edx, dword [ecx + edx + 0x27]
call fcn.00406f08
lea eax, [ebx + 0x28]
mov edx, dword [ebp - 0x24]
imul edx, dword [edx + 0xc0], 0x85
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x620]
mov edx, dword [ecx + edx + 0x2b]
call fcn.00406f08
mov eax, dword [ebp - 0x24]
imul eax, dword [eax + 0xc0], 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov eax, dword [edx + eax + 0x37]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [eax + 0xc0], 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov eax, dword [edx + eax + 0x3f]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [eax + 0xc0], 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov eax, dword [edx + eax + 0x43]
mov dword [ebx + 0x34], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0xac]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x18]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 0x34]
mov edx, ebx
call fcn.0043cf9c
inc dword [ebp - 0x18]
dec dword [ebp - 0x44]
jne 0x4a091a
xor eax, eax
push ebp
push 0x4a0aee
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
add eax, 0x620
mov ecx, 1
mov edx, dword [0x467674]
call fcn.00408ab8
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0af8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
xor edx, edx
mov dword [eax + 0x61c], edx
mov eax, dword [ebp - 8]
add eax, 0xd8
mov edx, dword [eax]
mov dword [ebp - 0x50], edx
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x50]
call fcn.00404ebc
push 0x1e
push 0x64
mov ecx, 0x22
mov dl, 1
mov eax, dword [0x4673a8]
call fcn.004759dc
mov edx, dword [ebp - 8]
mov dword [edx + 0xd8], eax
push 0xf
call sub.user32.dll_GetSysColor
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xd8]
mov dword [edx + 0x15], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x12c], 0
je 0x4a0b7e
mov eax, dword [ebp - 8]
add eax, 0x12c
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x58]
call fcn.00404ebc
mov eax, dword [ebp - 8]
cmp dword [eax + 0x130], 0
je 0x4a0bac
mov eax, dword [ebp - 8]
add eax, 0x130
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x60]
call fcn.00404ebc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xd8]
mov dl, 1
mov eax, dword [0x483210]
call fcn.0048698c
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x12c], ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xe0]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xdc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xe0], 0x20
setne al
push eax
mov ecx, dword [0x4bf8b8]
movzx ecx, byte [ecx]
mov eax, ebx
mov edx, 0x4a17c8
call fcn.00486d44
mov edx, dword [0x4bf8e4]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
call fcn.00486bc4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xd8]
mov dl, 1
mov eax, dword [0x483210]
call fcn.0048698c
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x130], ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xe0]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xdc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xe0], 0x20
setne al
push eax
mov ecx, dword [0x4bf8b8]
movzx ecx, byte [ecx]
mov edx, dword [0x4bf6a4]
mov edx, dword [edx]
mov eax, ebx
call fcn.00486cac
mov edx, dword [0x4bf8e4]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486bc4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
cmp byte [eax + 0x1c], 0
jne 0x4a0cbd
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
cmp byte [eax + 0x1c], 0
jne 0x4a0cbd
mov eax, dword [0x4bf478]
cmp byte [eax + 0x85], 0
je 0x4a0cf9
mov eax, dword [0x4bf440]
mov dword [eax], 0xfffffffe
mov eax, dword [0x4bf764]
mov dword [eax], 0x20
mov eax, dword [0x4bf8a8]
mov dword [eax], 5
mov eax, dword [0x4bf548]
mov dword [eax], 0x20
mov eax, dword [0x4bf574]
mov dword [eax], 0x20
jmp 0x4a0d7a
mov eax, dword [0x4bf8b8]
cmp byte [eax], 0
je 0x4a0d45
mov eax, dword [0x4bf440]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4bf764]
mov dword [eax], 0x1c
mov eax, dword [0x4bf8a8]
mov dword [eax], 3
mov eax, dword [0x4bf548]
mov dword [eax], 0x14
mov eax, dword [0x4bf574]
mov dword [eax], 0x18
mov eax, dword [0x4bf87c]
mov dword [eax], 0x1e
jmp 0x4a0d7a
mov eax, dword [0x4bf440]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4bf764]
mov dword [eax], 0x18
mov eax, dword [0x4bf8a8]
mov dword [eax], 1
mov eax, dword [0x4bf548]
mov dword [eax], 0x14
mov eax, dword [0x4bf574]
mov dword [eax], 0x18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00471460
xor edx, edx
call fcn.0046a8e8
mov eax, dword [0x4bf8b8]
cmp byte [eax], 0
je 0x4a0db2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00471460
mov edx, dword [0x4bf478]
mov edx, dword [edx + 0x80]
call fcn.0046a8e8
mov dword [0x4bf3a0], 0xffffffff
mov dword [0x4bf3a4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4a12ec
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
call fcn.00486aa4
cmp eax, dword [ebp - 0x10]
jle 0x4a0e07
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
mov edx, dword [ebp - 0x10]
call fcn.00486aac
mov ebx, dword [eax + 0x1c]
jmp 0x4a0e0a
or ebx, 0xffffffff
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486aa4
cmp eax, dword [ebp - 0x14]
jle 0x4a0e33
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x14]
call fcn.00486aac
mov eax, dword [eax + 0x1c]
jmp 0x4a0e36
or eax, 0xffffffff
cmp eax, ebx
jg 0x4a0e3d
inc eax
jne 0x4a0e63
inc ebx
je 0x4a0e63
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
mov edx, dword [ebp - 0x10]
call fcn.00486aac
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov edx, eax
neg eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x10]
jmp 0x4a0e80
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x14]
call fcn.00486aac
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp byte [ebp - 0x29], 0
jne 0x4a0efb
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x20], 0
je 0x4a0ed6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.00408904
test eax, eax
jle 0x4a0efb
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.0040890c
imul eax, eax, 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov eax, dword [edx + eax + 0x13]
mov edx, dword [ebp - 8]
add dword [edx + 0x134], eax
jmp 0x4a0efb
mov byte [ebp - 0x29], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x134]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
add eax, dword [edx + 0x628]
add eax, 5
mov edx, dword [ebp - 8]
mov dword [edx + 0x134], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, 0x4a17ec
call fcn.00407b28
jne 0x4a0f43
mov eax, dword [0x4bf8b8]
cmp byte [eax], 0
je 0x4a0f43
mov eax, dword [ebp - 0x24]
mov byte [eax + 0xb8], 1
mov eax, dword [0x4bf478]
mov eax, dword [eax + 0x2c]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0xcc], eax
mov eax, dword [0x4bf478]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0xd0], eax
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x7a], 0
je 0x4a0f56
mov eax, dword [ebp - 8]
mov byte [eax + 0x180], 1
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0049e244
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0xc0], edx
imul ebx, dword [ebp - 0x1c], 0x85
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov eax, dword [eax + ebx + 0x13]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov dword [edx + ebx + 0x47], eax
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x8d], 1
jne 0x4a11fc
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov edx, 0x4a1808
mov esi, dword [eax]
call dword [esi + 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a0fe7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
movzx edx, byte [0x4a181c]
mov byte [eax + ebx + 2], dl
jmp 0x4a101d
cmp dword [ebp - 0x18], 1
jne 0x4a1006
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
movzx edx, byte [0x4a1820]
mov byte [eax + ebx + 2], dl
jmp 0x4a101d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
movzx edx, byte [0x4a1824]
mov byte [eax + ebx + 2], dl
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x68]
mov edx, 0x4a1834
call fcn.004079f0
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov edx, 0x4a1808
mov esi, dword [eax]
call dword [esi + 0xc]
dec eax
jne 0x4a106f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
movzx eax, byte [eax + ebx + 2]
or al, byte [0x4a1844]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov byte [edx + ebx + 2], al
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
lea eax, [eax + ebx + 0x2b]
call fcn.00406b28
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4a11fc
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0
xor edx, edx
push ebp
push 0x4a11e6
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.0043d160
mov ebx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, dword [ebx + 4]
call fcn.00407b28
je 0x4a10da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a11f0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x90]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebx + 8]
jg 0x4a10fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a11f0
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x90]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
lea edx, [ebp - 0x6c]
mov eax, esi
call fcn.004874e0
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebx + 0x10]
call fcn.00407b28
je 0x4a1131
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a11f0
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x2c], eax
movzx eax, byte [ebx + 0x20]
mov byte [esi + 0x30], al
movzx eax, byte [ebx + 0x21]
mov byte [esi + 0x31], al
xor eax, eax
mov dword [ebx + 0x14], eax
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x24]
call fcn.004861dc
mov edx, dword [ebx + 0xc]
mov eax, dword [ebp - 0x24]
call fcn.004861e4
imul esi, dword [ebp - 0x1c], 0x85
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
lea eax, [eax + esi + 0x27]
mov edx, dword [ebx + 0x24]
call fcn.00406f08
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
lea eax, [eax + esi + 0x2b]
mov edx, dword [ebx + 0x28]
call fcn.00406f08
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [ebx + 0x2c]
mov dword [eax + esi + 0x37], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [ebx + 0x30]
mov dword [eax + esi + 0x3f], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [ebx + 0x34]
mov dword [eax + esi + 0x43], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a11f0
inc dword [ebp - 0x18]
dec dword [ebp - 0x44]
jne 0x4a109e
imul ebx, dword [ebp - 0x1c], 0x85
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [ebp - 0x28]
mov dword [eax + ebx + 0x4b], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, 0x4a1854
call fcn.00407b28
jne 0x4a125c
mov eax, dword [0x4bf8b8]
cmp byte [eax], 0
je 0x4a124b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [0x4bf478]
mov edx, dword [edx + 0x24]
add dword [eax + ebx + 0x13], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x14c], edx
jmp 0x4a12e2
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, 0x4a17ec
call fcn.00407b28
jne 0x4a12c8
mov eax, dword [0x4bf8b8]
cmp byte [eax], 0
je 0x4a1291
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
mov edx, dword [0x4bf478]
mov edx, dword [edx + 0x34]
add dword [eax + ebx + 0x13], edx
mov eax, dword [ebp - 0x1c]
mov dword [0x4bf3a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
cmp dword [eax + ebx + 0x27], 0
jne 0x4a12e2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x620]
lea eax, [eax + ebx + 0x27]
mov edx, 0x4a186c
call fcn.00406f08
jmp 0x4a12e2
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, 0x4a187c
call fcn.00407b28
jne 0x4a12e2
mov eax, dword [ebp - 0x1c]
mov dword [0x4bf3a4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a12f6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12c]
call fcn.00486aa4
cmp eax, dword [ebp - 0x10]
jg 0x4a0dd0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486aa4
cmp eax, dword [ebp - 0x14]
jg 0x4a0dd0
cmp dword [0x4bf3a4], 0xffffffff
je 0x4a1476
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x4a1347
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
jmp 0x4a1411
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00470ac4
mov edx, eax
imul eax, dword [0x4bf3a4], 0x85
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x620]
add edx, dword [ecx + eax + 0x17]
add edx, 2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470adc
mov eax, dword [0x4bf8b8]
cmp byte [eax], 0
je 0x4a13a6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470ac4
mov edx, eax
mov eax, dword [0x4bf478]
add edx, dword [eax + 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470adc
mov eax, dword [0x4bf8b8]
cmp byte [eax], 0
je 0x4a13d5
mov edx, dword [0x4bf8a8]
mov edx, dword [edx]
mov eax, dword [0x4bf440]
add edx, dword [eax]
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x190]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b28
jmp 0x4a13e9
mov edx, dword [0x4bf8a8]
mov edx, dword [edx]
inc edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b28
imul eax, dword [0x4bf3a4], 0x85
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x620]
mov edx, dword [edx + eax + 0x13]
sub edx, 4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b78
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
je 0x4a1476
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00474894
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470ba0
sub eax, 2
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b5c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470b10
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.00470ac4
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.0046e9b4
push eax
call sub.user32.dll_MoveWindow
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
call fcn.0047539c
mov eax, dword [ebp - 8]
cmp byte [eax + 0x16c], 0
je 0x4a15ba
mov eax, dword [ebp - 8]
mov byte [eax + 0x16c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486aa4
dec eax
test eax, eax
jl 0x4a15ba
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
mov eax, dword [eax + 8]
mov dl, 1
call fcn.00456c28
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x170]
jne 0x4a15ae
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
cmp dword [eax + 0x3c], 0
je 0x4a15ba
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
mov ecx, dword [eax + 0x4c]
mov edx, dword [0x4bf630]
mov edx, dword [edx]
lea eax, [ebp - 0x70]
call fcn.004079f0
mov eax, dword [ebp - 0x70]
mov dl, 1
call fcn.0041ca24
test al, al
jne 0x4a15ba
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
mov ecx, dword [eax + 0x4c]
mov edx, dword [0x4bf630]
mov edx, dword [edx]
lea eax, [ebp - 0x74]
call fcn.004079f0
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
lea edx, [ebp - 0x78]
call fcn.00486128
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
lea edx, [ebp - 0x7c]
call fcn.00486140
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 8]
pop ecx
call fcn.0049eb30
jmp 0x4a15ba
inc dword [ebp - 0x18]
dec dword [ebp - 0x44]
jne 0x4a14b2
mov dl, 1
mov eax, dword [0x4357f0]
call fcn.00440abc
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x4a16b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
call fcn.00486aa4
dec eax
test eax, eax
jl 0x4a167e
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
cmp dword [eax + 0x3c], 0
je 0x4a1672
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
cmp dword [eax + 0xbc], 0
jle 0x4a1672
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
mov eax, dword [eax + 0xbc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x130]
mov edx, dword [ebp - 0x18]
call fcn.00486aac
mov ecx, dword [eax + 0x4c]
mov edx, dword [0x4bf630]
mov edx, dword [edx]
lea eax, [ebp - 0x80]
call fcn.004079f0
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x30]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x3c]
inc dword [ebp - 0x18]
dec dword [ebp - 0x44]
jne 0x4a15f9
mov eax, dword [ebp - 8]
cmp dword [eax + 0x174], 0
je 0x4a169b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x174]
mov edx, dword [ebp - 0x30]
call fcn.0048cc48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a16b8
mov eax, dword [ebp - 0x30]
call fcn.00404ebc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a17b5
lea eax, [ebp - 0x80]
mov edx, 8
call fcn.00406b88
lea eax, [ebp - 4]
call fcn.00406b28
ret