Function at 0x4b3560
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x9c
push 0
push 0
dec ecx
jne 0x4b3569
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5aef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88c]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x890]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x894]
xor edx, edx
call fcn.00431d58
mov dword [ebp - 0x38], 0x46
xor ecx, ecx
push ebp
push 0x4b5a2b
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [ebp - 0xc], 0
jne 0x4b36ea
mov edx, dword [ebp - 8]
mov eax, edx
shl edx, 3
sub edx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + edx*8 + 0xd7e6]
cmp al, 0x10
je 0x4b3639
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp al, 0xf
je 0x4b3639
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp al, 0xe
je 0x4b3639
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp al, 0xb
je 0x4b3639
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp al, 0xc
jne 0x4b3646
mov eax, dword [ebp - 4]
cmp dword [eax + edx*8 + 0xd7dc], 0xffffffff
je 0x4b3652
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 0xd624], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + edx*8 + 0xd7e8], 0
jne 0x4b3689
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
xor edx, edx
call fcn.00431e70
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.004b6464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xd7e8], 0
jle 0x4b36e2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd624]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd7e6], 5
je 0x4b36e2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd624]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd7e6], 6
je 0x4b36e2
mov eax, dword [ebp - 4]
call fcn.004b309c
mov eax, dword [ebp - 4]
call fcn.004b2f70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
mov byte [eax + 0xc6e6], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
xor edx, edx
call fcn.00431e70
inc dword [ebp - 0x38]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xd7e8], 0
jle 0x4b4bd4
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xd7e7]
sub al, 1
jb 0x4b3754
je 0x4b3781
jmp 0x4b37a5
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5f910]
call fcn.00403c8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xd7d8]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xc62c]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4b37f4
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5f900]
call fcn.00403c8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xd7d8]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4b37f4
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + edx*8 + 0xd7e7]
mov edx, dword [ebp - 4]
mov edx, dword [edx + esi*4 + 0xc6e0]
call fcn.00403c8c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4 + 0xc730]
mov edx, dword [ebp - 4]
add eax, dword [edx + ebx*8 + 0xd7d8]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
call fcn.004094f4
test al, al
jne 0x4b382f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x67c]
mov dl, 1
call fcn.00453328
mov eax, dword [ebp - 4]
mov byte [eax + 0xcbb0], 0x16
mov eax, dword [ebp - 4]
call fcn.004b30c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
mov eax, dword [ebp - 4]
add eax, 0xcbc4
mov edx, dword [ebp - 0x2c]
call fcn.0040634e
mov eax, dword [0x4e6304]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xcbc4
mov edx, 1
call fcn.00406885
call fcn.00402864
mov edx, dword [ebp - 0x30]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004068bc
call fcn.00402864
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xcbc4
mov ecx, 4
call fcn.004063f0
call fcn.00402864
inc dword [ebp - 0x38]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xd7e6]
cmp eax, 0x10
ja case.0x4b38ab.8
jmp dword [eax*4 + 0x4b38b2]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b08
lea edx, [ebp - 0x440]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x440]
push 0x4b5b18
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b08
lea edx, [ebp - 0x444]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x444]
push 0x4b5b28
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b08
lea edx, [ebp - 0x448]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x448]
push 0x4b5b38
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b48
lea edx, [ebp - 0x44c]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x44c]
push 0x4b5b58
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b08
lea edx, [ebp - 0x450]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x450]
push 0x4b5b68
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b08
lea edx, [ebp - 0x454]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x454]
push 0x4b5b78
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
lea eax, [ebp - 0x1c]
call fcn.00403bf4
cmp dword [ebp - 0xc], 0
jne 0x4b4950
mov eax, dword [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xd7e8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5fd28]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x5fcd8]
lea eax, [ebp - 0x458]
call fcn.00403ec0
mov edx, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004a4190
mov eax, dword [ebp - 4]
cmp dword [eax + 0xcbac], 0
je 0x4b3dba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcbac]
call fcn.004094f4
test al, al
je 0x4b3dba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
lea edx, [ebp - 0x45c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x45c]
lea edx, [ebp - 0x20]
call fcn.00408f00
mov edx, dword [ebp - 0x20]
mov eax, 0x4b5b88
call fcn.00404160
mov ebx, eax
test ebx, ebx
jle 0x4b4950
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 5]
mov ecx, 0x14
mov eax, dword [ebp - 0x20]
call fcn.0040407c
mov edx, dword [ebp - 0x20]
mov eax, 0x4b5b98
call fcn.00404160
test eax, eax
jne 0x4b3be6
lea edx, [ebx + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
lea edx, [ebp - 0x464]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcbac]
call fcn.00409644
mov ecx, dword [ebp - 0x464]
lea eax, [ebp - 0x460]
mov edx, 0x4b5bac
call fcn.00403ec0
mov edx, dword [ebp - 0x460]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
call fcn.00428d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x4b3da2
lea edx, [ebp - 0x468]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x468]
lea edx, [ebp - 0x20]
call fcn.00408f00
mov edx, dword [ebp - 0x20]
mov eax, 0x4b5b98
call fcn.00404160
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 0xa]
mov ecx, 0xff
mov eax, dword [ebp - 0x20]
call fcn.0040407c
mov edx, dword [ebp - 0x20]
mov eax, 0x4b5bcc
call fcn.00404160
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040407c
jmp 0x4b3c74
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
dec ecx
mov edx, 2
mov eax, dword [ebp - 0x20]
call fcn.0040407c
mov eax, dword [ebp - 0x20]
mov al, byte [eax]
cmp al, 0x5c
je 0x4b3c58
cmp al, 0x2e
je 0x4b3c58
cmp al, 0x20
je 0x4b3c58
cmp al, 0x3d
je 0x4b3c58
cmp al, 0x27
je 0x4b3c58
cmp al, 0x22
je 0x4b3c58
jmp 0x4b3caf
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040407c
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x20
je 0x4b3c93
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x27
je 0x4b3c93
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x22
je 0x4b3c93
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5bd8
push dword [ebp - 0x20]
lea eax, [ebp - 0x46c]
mov edx, 4
call fcn.00403f34
mov eax, dword [ebp - 0x46c]
call fcn.004094f4
test al, al
jne 0x4b3da2
mov edx, ebx
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
mov edx, dword [ebp - 0x18]
add edx, 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
mov ecx, dword [eax]
call dword [ecx + 0xc4]
lea edx, [ebp - 0x474]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcbac]
call fcn.00409644
mov ecx, dword [ebp - 0x474]
lea eax, [ebp - 0x470]
mov edx, 0x4b5bac
call fcn.00403ec0
mov edx, dword [ebp - 0x470]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
call fcn.00428d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6b4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc4]
jmp 0x4b4950
mov eax, dword [ebp - 4]
add eax, 0xcbac
call fcn.00403bf4
jmp 0x4b4950
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5be4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f34
mov eax, dword [ebp - 0x1c]
call fcn.00409540
jmp 0x4b4950
cmp dword [ebp - 0xc], 5
jne 0x4b3e7c
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xd7fc], 0
jne 0x4b3e6f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcbbc]
call fcn.00409540
mov eax, dword [ebp - 4]
inc dword [eax + 0x60db8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5bf8
lea edx, [ebp - 0x478]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60db8]
call fcn.00409284
push dword [ebp - 0x478]
push 0x4b5c0c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
lea eax, [ebp - 0x1c]
call fcn.00403bf4
jmp 0x4b4950
mov eax, dword [ebp - 4]
inc dword [eax + 0x60db8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5c1c
lea edx, [ebp - 0x47c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60db8]
call fcn.00409284
push dword [ebp - 0x47c]
push 0x4b5c0c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc675], 1
jne 0x4b3fdf
cmp dword [ebp - 0xc], 0
jne 0x4b3f7b
xor eax, eax
push ebp
push 0x4b3f22
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x480]
mov eax, 0x4b5c2c
call fcn.00461e2c
mov edx, dword [ebp - 0x480]
mov eax, dword [ebp - 4]
add eax, 0x60d80
call fcn.00405284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3f7b
cmp dword [ebp - 0xc], 5
jne 0x4b3f8e
lea eax, [ebp - 0x1c]
call fcn.00403bf4
jmp 0x4b4950
mov eax, dword [ebp - 4]
inc dword [eax + 0x60dbc]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5c48
lea edx, [ebp - 0x488]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60dbc]
call fcn.00409284
push dword [ebp - 0x488]
push 0x4b5c58
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov edx, 0x4b5c68
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xcbc0
call fcn.00403bf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b6464
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
mov edx, 0x4b5c74
call fcn.00431e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc676], 1
jne 0x4b4166
cmp dword [ebp - 0xc], 0
jne 0x4b4115
xor eax, eax
push ebp
push 0x4b40bc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x48c]
mov eax, 0x4b5ca4
call fcn.00461e2c
mov edx, dword [ebp - 0x48c]
mov eax, dword [ebp - 4]
add eax, 0x60d90
call fcn.00405284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4115
mov eax, dword [ebp - 4]
inc dword [eax + 0x60dc0]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5c48
lea edx, [ebp - 0x494]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60dc0]
call fcn.00409284
push dword [ebp - 0x494]
push 0x4b5cc0
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov edx, 0x4b5c68
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xcbc0
call fcn.00403bf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b6464
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
mov edx, 0x4b5cd0
call fcn.00431e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc677], 1
jne 0x4b424b
mov eax, dword [ebp - 4]
inc dword [eax + 0x60dc4]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5d00
lea edx, [ebp - 0x498]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60dc4]
call fcn.00409284
push dword [ebp - 0x498]
push 0x4b5d10
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
jmp 0x4b4950
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov edx, 0x4b5c68
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xcbc0
call fcn.00403bf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b6464
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
mov edx, 0x4b5d20
call fcn.00431e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc678], 1
jne 0x4b4464
push 0
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xcbc4
mov ecx, 0x1e
call fcn.004063f0
call fcn.00402864
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd800], 0
je 0x4b4330
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd800], 3
jne 0x4b4347
mov ebx, 0x1e
lea eax, [ebp - 0x43c]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec ebx
jne 0x4b433b
lea eax, [ebp - 0x20]
call fcn.00403bf4
mov ebx, 0xf
lea esi, [ebp - 0x43c]
lea eax, [ebp - 0x49c]
mov dl, byte [esi]
call fcn.00403d9c
mov edx, dword [ebp - 0x49c]
lea eax, [ebp - 0x20]
call fcn.00403e7c
inc esi
dec ebx
jne 0x4b435a
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5bd8
push dword [ebp - 0x20]
push 0x4b5d58
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd800], 1
je 0x4b43d3
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd800], 4
jne 0x4b43d7
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
test al, al
je 0x4b4950
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov edx, 0x4b5c68
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xcbc0
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004b6464
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov edx, 0x4b5c68
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xcbc0
call fcn.00403bf4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b6464
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x650]
mov edx, 0x4b5d68
call fcn.00431e70
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
push 0
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xcbc4
mov ecx, 0x1e
call fcn.004063f0
call fcn.00402864
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd800], 0
je 0x4b454b
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd800], 3
jne 0x4b4562
mov ebx, 0x1e
lea esi, [ebp - 0x43c]
mov al, byte [esi]
sub al, byte [ebp - 0x14]
dec eax
mov byte [esi], al
inc esi
dec ebx
jne 0x4b4556
mov ebx, 0xf
lea esi, [ebp - 0x43c]
lea eax, [ebp - 0x4a0]
mov dl, byte [esi]
call fcn.00403d9c
mov edx, dword [ebp - 0x4a0]
lea eax, [ebp - 0x20]
call fcn.00403e7c
inc esi
dec ebx
jne 0x4b456d
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd7e6], 5
jne 0x4b45c1
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
push dword [ebp - 0x20]
push 0x4b5da8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f34
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd7e6], 6
jne 0x4b45f6
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
push dword [ebp - 0x20]
push 0x4b5db8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f34
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd800], 1
je 0x4b4624
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd800], 4
jne 0x4b4628
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 4]
add eax, 0xa08
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
test al, al
je 0x4b4950
mov ebx, 1
lea edx, [ebp - 0x4a4]
mov eax, dword [ebp - 0x1c]
call fcn.0040960c
mov edx, dword [ebp - 0x4a4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x5fd28]
call fcn.00403f84
jne 0x4b4783
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x601d8], 0
je 0x4b46d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x601d8]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4b46d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x601d8]
push eax
call sub.user32.dll_SetForegroundWindow
push 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x601d8]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fcd8]
call fcn.00404038
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x5fd28]
call fcn.00404038
push eax
push 0x4b5dc0
mov eax, dword [0x4e6268]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4b4790
lea edx, [ebp - 0x4a8]
mov eax, dword [ebp - 0x1c]
call fcn.0040960c
mov edx, dword [ebp - 0x4a8]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x5fd28]
call fcn.00403c48
mov eax, dword [ebp - 4]
mov dword [eax + 0x6068c], ebx
mov eax, dword [ebp - 4]
call fcn.004d0910
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x60690], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4f0]
mov dl, 1
call fcn.00453328
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
inc ebx
cmp ebx, 0x12d
jne 0x4b464d
cmp ebx, 0x12d
jne 0x4b48c0
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x5fd28], 0
je 0x4b47df
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x5fd28]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x5fcd8]
lea eax, [ebp - 0x4ac]
call fcn.00403ec0
mov eax, dword [ebp - 0x4ac]
call fcn.004094f4
test al, al
jne 0x4b48b3
mov eax, dword [ebp - 4]
mov dword [eax + 0x6068c], ebx
lea edx, [ebp - 0x4b0]
mov eax, dword [ebp - 0x1c]
call fcn.0040960c
mov edx, dword [ebp - 0x4b0]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x5fd28]
call fcn.00403c48
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fcd8]
call fcn.00404038
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x5fd28]
call fcn.00404038
push eax
push 0x4b5dc0
mov eax, dword [0x4e6268]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4b486d
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x60690], edx
mov eax, dword [ebp - 4]
call fcn.004d0910
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4f0]
mov dl, 1
call fcn.00453328
jmp 0x4b4894
push 0
mov ecx, 0x4b5dc8
mov edx, 0x4b5dd0
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.004504b4
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x5fd28]
call fcn.00403bf4
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
inc ebx
cmp ebx, 0x12d
jne 0x4b47a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x5f93d
call fcn.00403e18
mov eax, dword [ebp - 4]
call fcn.004b30c4
push 0
push 0x4b5df8
push dword [ebp - 0x20]
push 0x4b5e28
mov eax, dword [ebp - 4]
push dword [eax + 0xc9fc]
push 0x4b5e38
lea eax, [ebp - 0x4b4]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4b4]
call fcn.00404038
mov edx, eax
mov ecx, 0x4b5dc8
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.004504b4
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
inc dword [ebp - 0x38]
cmp dword [ebp - 0xc], 0
jne 0x4b4974
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xd7e6], 0xa
je 0x4b4a93
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xd800]
cmp al, 1
je 0x4b49a1
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4b4a93
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xd7e8]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*8 + 0xd7e6]
test dl, dl
je 0x4b4a03
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 2
je 0x4b4a03
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 0xa
je 0x4b4a03
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 1
jne 0x4b4a50
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xd7fc], 0
jle 0x4b4a50
cmp dword [ebp - 0xc], 0
jne 0x4b4a22
mov edx, dword [ebp - 4]
sub esi, dword [edx + eax*8 + 0xd7fc]
jmp 0x4b4a50
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*8 + 0xd7e8]
add edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
sub edx, dword [ecx + eax*8 + 0xd7fc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xd7fc]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd7e6], 0
jne 0x4b4a7e
mov eax, dword [ebp - 0x30]
push eax
push esi
push 6
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004d9b0c
jmp 0x4b4a93
mov eax, dword [ebp - 0x30]
push eax
push esi
push 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004d9b0c
cmp dword [ebp - 0xc], 0
jne 0x4b4ab4
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xd7e6], 0xa
je 0x4b4bd4
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xd800]
test al, al
je 0x4b4ae1
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 3
jne 0x4b4bd4
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xd7e8]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xd7e6]
test al, al
je 0x4b4b22
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
jne 0x4b4ba6
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xd7fc], 0
jle 0x4b4ba6
cmp dword [ebp - 0xc], 0
jne 0x4b4b41
mov eax, dword [ebp - 4]
sub esi, dword [eax + ebx*8 + 0xd7fc]
jmp 0x4b4ba6
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.0040657c
call fcn.00402864
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*8 + 0xd7e8]
add edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + ebx*8 + 0xd7fc]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004068bc
call fcn.00402864
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xcbc4
mov ecx, 4
call fcn.004063f0
call fcn.00402864
mov eax, dword [ebp - 4]
mov esi, dword [eax + ebx*8 + 0xd7fc]
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.0040657c
call fcn.00402864
mov dword [ebp - 0x30], eax
push esi
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004ade4c
xor eax, eax
push ebp
push 0x4b4c15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xd7e8], 0
jle 0x4b4c0b
mov eax, dword [ebp - 4]
add eax, 0xcbc4
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4c1f
inc dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*8 + 0xd7e6]
cmp eax, 0x10
ja case.0x4b4c46.0
mov al, byte [eax + 0x4b4c4d]
jmp dword [eax*4 + 0x4b4c5e]
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x5fd28], 0
je 0x4b4cb1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x5fd28]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x5fcd8]
lea eax, [ebp - 0x4b8]
call fcn.00403ec0
mov eax, dword [ebp - 0x4b8]
call fcn.004094f4
test al, al
jne 0x4b4d73
mov eax, dword [ebp - 4]
mov dword [eax + 0x6068c], ebx
lea edx, [ebp - 0x4bc]
mov eax, dword [ebp - 0x1c]
call fcn.0040960c
mov edx, dword [ebp - 0x4bc]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x5fd28]
call fcn.00403c48
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fcd8]
call fcn.00404038
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x5fd28]
call fcn.00404038
push eax
push 0x4b5dc0
mov eax, dword [0x4e6268]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4b4d3f
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x60690], edx
mov eax, dword [ebp - 4]
call fcn.004d0910
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4f0]
mov dl, 1
call fcn.00453328
jmp 0x4b4d66
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x5fd28]
call fcn.00403bf4
push 0
mov ecx, 0x4b5dc8
mov edx, 0x4b5dd0
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.004504b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
inc ebx
cmp ebx, 0x12d
jne 0x4b4c73
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
cmp dword [ebp - 0xc], 0
jne 0x4b4f2e
cmp dword [ebp - 0x1c], 0
je 0x4b4da9
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
test al, al
jne 0x4b4dc8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc6d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4b4ddf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xd7dc], 0xffffffff
jne 0x4b4dfe
mov eax, dword [ebp - 4]
call fcn.004b8770
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov edx, 0x4b5e48
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
add byte [edx - 0x30c817ff], dh
idiv edi
add byte [edx - 0x30c817ff], dh
idiv edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x77c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xd7f9], 0xa
jae 0x4b4e6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
xor edx, edx
call fcn.00442438
jmp 0x4b4e7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x460]
mov dl, 1
call fcn.00442438
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004ce0d0
mov eax, dword [ebp - 4]
call fcn.004b30c4
xor eax, eax
push ebp
push 0x4b4eb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4ec2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc8]
xor eax, eax
push ebp
push 0x4b4f10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8a8]
call fcn.0045c380
test eax, eax
jne 0x4b4f06
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8b0]
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4f1a
mov eax, dword [ebp - 4]
mov byte [eax + 0x5fd10], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0xc5b0], 0
cmp dword [ebp - 0xc], 1
jne 0x4b4f7c
cmp dword [ebp - 0x1c], 0
je 0x4b4f46
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
test al, al
jne 0x4b4f65
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc6d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x620]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4b4f7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x620]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0xc], 5
jne 0x4b4fca
cmp dword [ebp - 0x1c], 0
je 0x4b4f94
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
test al, al
jne 0x4b4fb3
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc6d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4b4fca
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0x1c], 0
je 0x4b4fdc
mov eax, dword [ebp - 0x1c]
call fcn.004094f4
test al, al
jne 0x4b5014
xor eax, eax
push ebp
push 0x4b5005
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc6d8]
call fcn.00402f6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a1e
mov eax, dword [ebp - 0x1c]
call fcn.00409540
jmp 0x4b5a1e
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xd7e6]
cmp al, 0x10
je 0x4b5081
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xf
je 0x4b5081
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xe
je 0x4b5081
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xb
je 0x4b5081
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xc
jne 0x4b5251
xor eax, eax
mov dword [ebp - 0x3c], eax
push 0x4b5e54
lea edx, [ebp - 0x4c0]
mov eax, dword [ebp - 8]
call fcn.00409284
push dword [ebp - 0x4c0]
push 0x4b5f68
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403f34
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xd7e6]
add eax, 0xfffffff5
cmp eax, 5
ja case.0x4b50c4.13
jmp dword [eax*4 + 0x4b50cb]
lea eax, [ebp - 0x20]
mov edx, 0x4b5f74
call fcn.00403e7c
jmp case.0x4b50c4.13
lea eax, [ebp - 0x20]
mov edx, 0x4b5f80
call fcn.00403e7c
jmp case.0x4b50c4.13
lea eax, [ebp - 0x20]
mov edx, 0x4b5f8c
call fcn.00403e7c
jmp case.0x4b50c4.13
lea eax, [ebp - 0x20]
mov edx, 0x4b5f98
call fcn.00403e7c
jmp case.0x4b50c4.13
lea eax, [ebp - 0x20]
mov edx, 0x4b5fa4
call fcn.00403e7c
push dword [ebp - 0x20]
push 0x4b5fb0
push 0x4b5fc0
push 0x4b5fcc
push 0x4b5fc0
push 0x4b5fdc
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00403f34
mov eax, dword [ebp - 4]
inc dword [eax + 0x60db8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5bf8
lea edx, [ebp - 0x4c4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60db8]
call fcn.00409284
push dword [ebp - 0x4c4]
push 0x4b5fec
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x20]
call fcn.00403e74
test eax, eax
jle 0x4b51c6
mov ebx, 1
lea esi, [ebp - 0x43c]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4b51b8
mov eax, dword [ebp - 4]
add eax, 0xd38c
mov edx, dword [ebp - 0x1c]
call fcn.0040634e
mov eax, dword [0x4e6304]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xd38c
mov edx, 1
call fcn.0040689c
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004068bc
call fcn.00402864
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004064b8
call fcn.00402864
lea eax, [ebp - 0x20]
call fcn.00403bf4
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + 0x5fb8e]
cmp ebx, 1
jl 0x4b5271
cmp ebx, 0xc8
jle 0x4b5276
mov ebx, 0x19
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5fb8d], 0
jne 0x4b551b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
cmp byte [eax + 0x1f6], 1
jne 0x4b551b
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b5fec
call fcn.00404160
test eax, eax
jle 0x4b551b
push 0x4b5ffc
lea edx, [ebp - 0x4c8]
mov eax, ebx
call fcn.00409284
push dword [ebp - 0x4c8]
push 0x4b6078
push 0x4b5fc0
push 0x4b6084
push 0x4b5fc0
push 0x4b6090
push 0x4b5fc0
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403f34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
cmp byte [eax + 0x1f6], 1
jne 0x4b536c
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b5fec
call fcn.00404160
test eax, eax
jle 0x4b536c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5fce2], 2
je 0x4b533a
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd801], 1
jne 0x4b536c
push dword [ebp - 0x20]
push 0x4b60a8
push 0x4b5fc0
push 0x4b60cc
mov eax, dword [ebp - 4]
push dword [eax + 0x9f0]
push 0x4b60d8
push 0x4b5fc0
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00403f34
push dword [ebp - 0x20]
push 0x4b60e8
push 0x4b5fc0
push 0x4b6108
push 0x4b5fc0
push 0x4b612c
push 0x4b5fc0
push 0x4b6138
push 0x4b5fc0
push 0x4b6158
push 0x4b5fc0
push 0x4b6164
push 0x4b5fc0
push 0x4b6194
push 0x4b5fc0
push 0x4b61c0
push 0x4b5fc0
push 0x4b61f8
push 0x4b5fc0
push 0x4b621c
push 0x4b5fc0
push 0x4b6228
push 0x4b5fc0
push 0x4b624c
push 0x4b5fc0
lea eax, [ebp - 0x20]
mov edx, 0x19
call fcn.00403f34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
cmp byte [eax + 0x1f6], 1
jne 0x4b545e
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b5fec
call fcn.00404160
test eax, eax
jle 0x4b545e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5fce2], 2
je 0x4b543a
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd801], 1
jne 0x4b545e
push dword [ebp - 0x20]
push 0x4b6274
push 0x4b5fc0
push 0x4b62c0
push 0x4b5fc0
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00403f34
lea eax, [ebp - 0x20]
mov edx, 0x4b6308
call fcn.00403e7c
mov eax, dword [ebp - 0x20]
call fcn.00403e74
test eax, eax
jle 0x4b5490
mov ebx, 1
lea esi, [ebp - 0x43c]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4b5482
mov eax, dword [ebp - 4]
add eax, 0xd38c
mov edx, dword [ebp - 0x1c]
call fcn.0040634e
mov eax, dword [0x4e6304]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xd38c
mov edx, 1
call fcn.00406885
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004068bc
call fcn.00402864
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004064b8
call fcn.00402864
cmp dword [ebp - 0x20], 0
jne 0x4b566f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
cmp byte [eax + 0x1f6], 1
jne 0x4b566f
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b5fec
call fcn.00404160
test eax, eax
jle 0x4b566f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5fce2], 2
je 0x4b5577
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xd801], 1
jne 0x4b566f
push 0x4b631c
mov eax, dword [ebp - 4]
push dword [eax + 0x9f0]
push 0x4b6374
push 0x4b5fc0
push 0x4b6384
push 0x4b5fc0
push 0x4b63a8
push 0x4b5fc0
push 0x4b63f4
push 0x4b5fc0
push 0x4b643c
lea eax, [ebp - 0x20]
mov edx, 0xb
call fcn.00403f34
mov eax, dword [ebp - 0x20]
call fcn.00403e74
test eax, eax
jle 0x4b55e4
mov ebx, 1
lea esi, [ebp - 0x43c]
mov edx, dword [ebp - 0x20]
mov dl, byte [edx + ebx - 1]
mov byte [esi], dl
inc ebx
inc esi
dec eax
jne 0x4b55d6
mov eax, dword [ebp - 4]
add eax, 0xd38c
mov edx, dword [ebp - 0x1c]
call fcn.0040634e
mov eax, dword [0x4e6304]
mov byte [eax], 2
mov eax, dword [ebp - 4]
add eax, 0xd38c
mov edx, 1
call fcn.00406885
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004068bc
call fcn.00402864
push 0
mov eax, dword [ebp - 0x20]
call fcn.00403e74
mov ecx, eax
lea edx, [ebp - 0x43c]
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xd38c
call fcn.004064b8
call fcn.00402864
cmp dword [ebp - 0xc], 5
jne 0x4b575c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xd7e6]
cmp al, 2
je 0x4b56b7
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
je 0x4b56b7
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xa
jne 0x4b575c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xd7fc], 0
jne 0x4b56fd
mov eax, dword [ebp - 4]
add eax, 0xcbbc
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov eax, dword [ebp - 4]
mov byte [eax + 0xc6a1], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov edx, 0x4b644c
call fcn.00471f60
jmp 0x4b574f
cmp dword [ebp - 0x1c], 0
jne 0x4b5730
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc6d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc6d8]
call fcn.00402f6c
jmp 0x4b574f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x1c]
call fcn.00409540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xcb98]
cmp ebx, dword [ebp - 8]
je 0x4b585a
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b08
lea edx, [ebp - 0x4d0]
mov eax, ebx
call fcn.00409284
push dword [ebp - 0x4d0]
push 0x4b5b68
lea eax, [ebp - 0x4cc]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4cc]
call fcn.00409540
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b08
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcb98]
call fcn.00409284
push dword [ebp - 0x4d8]
push 0x4b5b78
lea eax, [ebp - 0x4d4]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4d4]
call fcn.00409540
mov eax, dword [ebp - 4]
push dword [eax + 0x5fcd8]
mov eax, dword [ebp - 4]
push dword [eax + 0x5fd28]
push 0x4b5b48
lea edx, [ebp - 0x4e0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcb98]
call fcn.00409284
push dword [ebp - 0x4e0]
push 0x4b5b58
lea eax, [ebp - 0x4dc]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4dc]
call fcn.00409540
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xcb98], edx
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp dword [ecx + edx*8 + 0xd7dc], 0xffffffff
jne 0x4b5950
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xd7e6]
cmp al, 0xb
je 0x4b58bf
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xc
je 0x4b58bf
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 0xe
jne 0x4b5950
mov eax, dword [ebp - 4]
mov byte [eax + 0xc6e5], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8b8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [ebp - 4]
add eax, 0xcb9c
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov eax, dword [0x4e62ac]
cmp dword [eax], 0
jne 0x4b590b
mov ecx, dword [0x4e62ac]
mov eax, dword [0x4e6268]
mov eax, dword [eax]
mov edx, dword [0x49f244]
call fcn.004502dc
mov eax, dword [0x4e62ac]
mov eax, dword [eax]
call fcn.0044d228
lea eax, [ebp - 0x4e4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcb9c]
call fcn.004043fc
mov edx, dword [ebp - 0x4e4]
mov eax, dword [0x4e62ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00471f60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov edx, 0x4b5c68
call fcn.00431e70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
mov dl, 1
call fcn.00431d58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x62c]
call fcn.00432084
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x780]
xor edx, edx
call fcn.00431d58
mov eax, dword [ebp - 4]
add eax, 0xcbc0
mov edx, dword [ebp - 0x1c]
call fcn.00403c48
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004b6464
mov eax, dword [ebp - 4]
mov byte [eax + 0xc5b0], 0
jmp 0x4b5a1e
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x5f93d
call fcn.00403e18
mov eax, dword [ebp - 4]
call fcn.004b30c4
push 0
push 0x4b5df8
push dword [ebp - 0x20]
push 0x4b5e28
mov eax, dword [ebp - 4]
push dword [eax + 0xc9fc]
push 0x4b5e38
lea eax, [ebp - 0x4e8]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0x4e8]
call fcn.00404038
mov edx, eax
mov ecx, 0x4b5dc8
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.004504b4
inc dword [ebp - 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a5f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5af9
lea eax, [ebp - 0x4e8]
call fcn.00403bf4
lea eax, [ebp - 0x4e4]
call fcn.004042b8
lea eax, [ebp - 0x4e0]
mov edx, 0x14
call fcn.00403c18
lea eax, [ebp - 0x490]
mov edx, dword [0x4011b0]
mov ecx, 2
call fcn.00404670
lea eax, [ebp - 0x488]
call fcn.00403bf4
lea eax, [ebp - 0x484]
mov edx, dword [0x4011b0]
mov ecx, 2
call fcn.00404670
lea eax, [ebp - 0x47c]
mov edx, 0x10
call fcn.00403c18
lea eax, [ebp - 0x2c]
call fcn.00403bf4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403c18
ret