Function at 0x4b5fa4
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x2c
push 0
push 0
dec ecx
jne 0x4b5fad
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b7e14
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4e8b88]
mov eax, dword [eax]
call fcn.0047b908
xor edx, edx
push ebp
push 0x4b7d65
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4b5e64]
call fcn.00405c50
add esp, 4
push 0
lea eax, [ebp - 0x38]
mov ecx, 1
mov edx, dword [0x4b5e8c]
call fcn.00405c50
add esp, 4
push 0
lea eax, [ebp - 0x34]
mov ecx, 1
mov edx, dword [0x4b5e8c]
call fcn.00405c50
add esp, 4
push 0
lea eax, [ebp - 0x44]
mov ecx, 1
mov edx, dword [0x4b5f04]
call fcn.00405c50
add esp, 4
push 0
lea eax, [ebp - 0x5c]
mov ecx, 1
mov edx, dword [0x4b5f7c]
call fcn.00405c50
add esp, 4
push 0
lea eax, [ebp - 0x40]
mov ecx, 1
mov edx, dword [0x4b5edc]
call fcn.00405c50
add esp, 4
push 0
lea eax, [ebp - 0x48]
mov ecx, 1
mov edx, dword [0x4b5f2c]
call fcn.00405c50
add esp, 4
push 0
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, dword [0x4b5f54]
call fcn.00405c50
add esp, 4
mov dl, 1
mov eax, dword [0x4131c8]
call fcn.00403c3c
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b6f17
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
xor eax, eax
push ebp
push 0x4b6e99
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e34
call fcn.00405044
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4b611d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x18]
call fcn.00408be4
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x18]
call fcn.00404ad8
mov eax, dword [ebp - 0x18]
call fcn.00404d00
test eax, eax
jne 0x4b614c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
lea eax, [ebp - 0x7c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0x7c]
mov edx, 0x4b7e34
call fcn.00404e4c
jne 0x4b617e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x5c]
mov ecx, 1
mov edx, dword [0x4b5f7c]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
mov edx, dword [ebp - 0x5c]
lea eax, [edx + eax*4 - 4]
mov edx, dword [ebp - 0x18]
call fcn.00404a94
lea eax, [ebp - 0x84]
push eax
mov ecx, 0xf
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.00408994
mov eax, dword [ebp - 0x80]
mov edx, 0x4b7e40
call fcn.00404e4c
jne 0x4b62aa
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e58
call fcn.00405044
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e64
call fcn.00405044
mov edi, eax
cmp dword [ebp - 0x50], 0
jle 0x4b6267
test edi, edi
jle 0x4b6267
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
sub ecx, dword [ebp - 0x50]
dec ecx
mov edx, dword [ebp - 0x50]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0x48]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x48]
mov ecx, 1
mov edx, dword [0x4b5f2c]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x48]
call fcn.00405a94
mov edx, dword [ebp - 0x48]
lea eax, [edx + eax*4 - 4]
mov edx, dword [ebp - 0x54]
call fcn.00404a94
jmp 0x4b627d
mov ecx, 0x4b7e70
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
dec eax
push eax
lea eax, [ebp - 0x5c]
mov ecx, 1
mov edx, dword [0x4b5f7c]
call fcn.00405c50
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
lea eax, [ebp - 0x8c]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.00408994
mov eax, dword [ebp - 0x88]
mov edx, 0x4b7e88
call fcn.00404e4c
jne 0x4b63a5
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e58
call fcn.00405044
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e64
call fcn.00405044
mov edi, eax
cmp dword [ebp - 0x50], 0
jle 0x4b6362
test edi, edi
jle 0x4b6362
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
sub ecx, dword [ebp - 0x50]
dec ecx
mov edx, dword [ebp - 0x50]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0x4c]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, dword [0x4b5f54]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x4c]
call fcn.00405a94
mov edx, dword [ebp - 0x4c]
lea eax, [edx + eax*4 - 4]
mov edx, dword [ebp - 0x54]
call fcn.00404a94
jmp 0x4b6378
mov ecx, 0x4b7e70
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
dec eax
push eax
lea eax, [ebp - 0x5c]
mov ecx, 1
mov edx, dword [0x4b5f7c]
call fcn.00405c50
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
lea eax, [ebp - 0x94]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00408994
mov eax, dword [ebp - 0x90]
mov edx, 0x4b7ea4
call fcn.00404e4c
jne 0x4b64f7
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e58
call fcn.00405044
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7eb8
call fcn.00405044
mov edi, eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e64
call fcn.00405044
mov ebx, eax
cmp dword [ebp - 0x50], 0
jle 0x4b64b4
test edi, edi
jle 0x4b64b4
test ebx, ebx
jle 0x4b64b4
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
sub ecx, dword [ebp - 0x50]
dec ecx
mov edx, dword [ebp - 0x50]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.00404f60
lea eax, [ebp - 0x58]
push eax
mov ecx, ebx
sub ecx, edi
dec ecx
lea edx, [edi + 1]
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0x40]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x40]
mov ecx, 1
mov edx, dword [0x4b5edc]
call fcn.00405c50
add esp, 4
mov eax, dword [0x4e8b88]
mov eax, dword [eax]
mov edx, dword [ebp - 0x54]
call fcn.0047ba08
mov ebx, eax
mov eax, dword [ebp - 0x40]
call fcn.00405a94
mov edx, dword [ebp - 0x40]
mov dword [edx + eax*8 - 8], ebx
mov eax, dword [ebp - 0x40]
call fcn.00405a94
mov edx, dword [ebp - 0x40]
lea eax, [edx + eax*8 - 4]
push eax
mov eax, dword [ebp - 0x58]
call fcn.00408fb8
pop edx
mov dword [edx], eax
jmp 0x4b64ca
mov ecx, 0x4b7e70
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
dec eax
push eax
lea eax, [ebp - 0x5c]
mov ecx, 1
mov edx, dword [0x4b5f7c]
call fcn.00405c50
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
lea eax, [ebp - 0x9c]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00408994
mov eax, dword [ebp - 0x98]
mov edx, 0x4b7ec4
call fcn.00404e4c
jne 0x4b6836
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e58
call fcn.00405044
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e64
call fcn.00405044
mov edi, eax
cmp dword [ebp - 0x50], 0
jle 0x4b6820
test edi, edi
jle 0x4b6820
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
sub ecx, dword [ebp - 0x50]
dec ecx
mov edx, dword [ebp - 0x50]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.00404f60
lea eax, [ebp - 0xa0]
mov ecx, dword [ebp - 0x54]
mov edx, 0x4b7ed4
call fcn.00404d4c
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x50]
call fcn.004035a4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x50], 0
jne 0x4b65d2
lea eax, [ebp - 0xa4]
mov ecx, 0x4b7ee0
mov edx, dword [ebp - 0x54]
call fcn.00404d4c
mov ecx, dword [ebp - 0xa4]
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
mov eax, dword [ebp - 0x54]
call fcn.00404d00
mov ebx, eax
jmp 0x4b6622
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [ebp - 0x54]
call fcn.00404e4c
jne 0x4b661f
lea eax, [ebp - 0xa8]
mov ecx, 0x4b7f04
mov edx, dword [ebp - 0x54]
call fcn.00404d4c
mov ecx, dword [ebp - 0xa8]
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
cmp eax, dword [ebp - 0x10]
jle 0x4b6645
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + eax*8 + 8]
call fcn.00404d00
cmp ebx, eax
jl 0x4b65de
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b6707
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xb0]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.00408be4
mov eax, dword [ebp - 0xac]
push eax
lea eax, [ebp - 0xb4]
mov ecx, 0x4b7f24
mov edx, dword [ebp - 0x54]
call fcn.00404d4c
mov edx, dword [ebp - 0xb4]
pop eax
call fcn.00404e4c
jne 0x4b66fb
cmp byte [ebp - 0x2d], 0
je 0x4b66f7
push 0x4b7f30
push dword [ebp - 0x54]
push 0x4b7f40
lea eax, [ebp - 0xb8]
mov edx, 3
call fcn.00404dc0
mov ecx, dword [ebp - 0xb8]
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
mov byte [ebp - 0x2d], 1
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b6673
cmp byte [ebp - 0x2d], 0
jne 0x4b6741
push 0x4b7f30
push dword [ebp - 0x54]
push 0x4b7f6c
lea eax, [ebp - 0xbc]
mov edx, 3
call fcn.00404dc0
mov ecx, dword [ebp - 0xbc]
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x3c]
mov ecx, 1
mov edx, dword [0x4b5eb4]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
mov ebx, eax
dec ebx
mov eax, dword [ebp - 0x10]
inc eax
sub eax, ebx
jg 0x4b6799
dec eax
mov dword [ebp - 0x6c], eax
lea edi, [ebx + ebx*2]
mov eax, dword [ebp - 0x3c]
lea eax, [eax + edi*8]
mov edx, dword [ebp - 0x3c]
lea edx, [edx + edi*8 - 0x18]
mov ecx, dword [0x4b5e38]
call fcn.00405604
dec ebx
inc dword [ebp - 0x6c]
jne 0x4b6778
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x3c]
lea eax, [edx + eax*8 + 8]
mov edx, dword [ebp - 0x54]
call fcn.00404a94
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x3c]
mov byte [edx + eax*8], 0
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
dec eax
push eax
lea eax, [ebp - 0x5c]
mov ecx, 1
mov edx, dword [0x4b5f7c]
call fcn.00405c50
add esp, 4
push 0
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x3c]
lea eax, [edx + eax*8 + 0x10]
mov ecx, 1
mov edx, dword [0x4b5de8]
call fcn.00405c50
add esp, 4
push 0
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x3c]
lea eax, [edx + eax*8 + 0x14]
mov ecx, 1
mov edx, dword [0x4b5e10]
call fcn.00405c50
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
mov ecx, 0x4b7f94
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
lea eax, [ebp - 0xc4]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.00408994
mov eax, dword [ebp - 0xc0]
mov edx, 0x4b7fac
call fcn.00404e4c
jne 0x4b699a
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4b696d
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e58
call fcn.00405044
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e64
call fcn.00405044
mov edi, eax
cmp dword [ebp - 0x50], 0
jle 0x4b696d
test edi, edi
jle 0x4b696d
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
sub ecx, dword [ebp - 0x50]
dec ecx
mov edx, dword [ebp - 0x50]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b696d
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 4]
lea edx, [ebp - 0xc8]
call fcn.00408994
mov eax, dword [ebp - 0xc8]
push eax
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 0x54]
call fcn.00408994
mov edx, dword [ebp - 0xcc]
pop eax
call fcn.00404e4c
jne 0x4b6961
mov eax, dword [ebp - 0x44]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x44]
mov ecx, 1
mov edx, dword [0x4b5f04]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x44]
call fcn.00405a94
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx + ecx*2]
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov ecx, dword [ebx + ecx*4]
mov dword [edx + eax*4 - 4], ecx
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b68e7
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
dec eax
push eax
lea eax, [ebp - 0x5c]
mov ecx, 1
mov edx, dword [0x4b5f7c]
call fcn.00405c50
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
lea eax, [ebp - 0xd4]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xd0]
call fcn.00408994
mov eax, dword [ebp - 0xd0]
mov edx, 0x4b7fc0
call fcn.00404e4c
jne 0x4b6bef
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e58
call fcn.00405044
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7eb8
call fcn.00405044
mov edi, eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4b7e64
call fcn.00405044
mov ebx, eax
cmp dword [ebp - 0x50], 0
jle 0x4b6bd9
test edi, edi
jle 0x4b6bd9
test ebx, ebx
jle 0x4b6bd9
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
sub ecx, dword [ebp - 0x50]
dec ecx
mov edx, dword [ebp - 0x50]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.00404f60
lea eax, [ebp - 0x58]
push eax
mov ecx, ebx
sub ecx, edi
dec ecx
lea edx, [edi + 1]
mov eax, dword [ebp - 0x18]
call fcn.00404f60
lea eax, [ebp - 0xd8]
mov ecx, dword [ebp - 0x54]
mov edx, 0x4b7ed4
call fcn.00404d4c
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0x50]
call fcn.004035a4
cmp dword [ebp - 0x50], 0
jne 0x4b6a9d
lea eax, [ebp - 0xdc]
mov ecx, 0x4b7ee0
mov edx, dword [ebp - 0x54]
call fcn.00404d4c
mov ecx, dword [ebp - 0xdc]
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
mov eax, dword [ebp - 0x54]
call fcn.00404d00
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4b6afc
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + eax*4 + 4]
mov edx, dword [ebp - 0x54]
call fcn.00404e4c
jne 0x4b6af9
push 0x4b7fd0
push dword [ebp - 0x54]
push 0x4b7fe8
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.00404dc0
mov ecx, dword [ebp - 0xe0]
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
call fcn.00405a94
cmp eax, dword [ebp - 0x10]
jle 0x4b6b1f
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + eax*4 + 4]
call fcn.00404d00
cmp ebx, eax
jl 0x4b6aae
mov eax, dword [ebp - 0x34]
call fcn.00405a94
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x34]
mov ecx, 1
mov edx, dword [0x4b5e8c]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x34]
call fcn.00405a94
mov ebx, eax
dec ebx
mov eax, dword [ebp - 0x10]
inc eax
sub eax, ebx
jg 0x4b6b82
dec eax
mov dword [ebp - 0x6c], eax
lea esi, [ebx + ebx*2]
mov eax, dword [ebp - 0x34]
lea eax, [eax + esi*4]
mov edx, dword [ebp - 0x34]
lea edx, [edx + esi*4 - 0xc]
mov ecx, dword [0x4a0c10]
call fcn.00405604
dec ebx
inc dword [ebp - 0x6c]
jne 0x4b6b61
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
lea eax, [edx + eax*4 + 4]
mov edx, dword [ebp - 0x54]
call fcn.00404a94
mov eax, dword [ebp - 0x58]
call fcn.00408fb8
mov edx, dword [ebp - 0x10]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 0x34]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
dec eax
push eax
lea eax, [ebp - 0x5c]
mov ecx, 1
mov edx, dword [0x4b5f7c]
call fcn.00405c50
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
mov ecx, 0x4b800c
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
mov eax, dword [ebp - 0x34]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b6c3e
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xe4]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
mov edx, dword [edx + eax*4 + 4]
mov ecx, 0x4b8040
mov eax, dword [ebp - 0x18]
call fcn.004b5c74
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0x18]
call fcn.00404ad8
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b6c07
mov eax, dword [ebp - 0x18]
call fcn.00404d00
mov edx, dword [ebp - 0x18]
cmp byte [edx + eax - 1], 0x3a
jne 0x4b6ddd
xor eax, eax
push ebp
push 0x4b6dbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b6ccd
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx + eax*8 + 8]
lea eax, [ebp - 0xe8]
mov ecx, 0x4b7f24
call fcn.00404d4c
mov edx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x18]
call fcn.00404e4c
jne 0x4b6cc5
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
dec eax
mov edx, dword [ebp - 0x10]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + edx*8 + 0xc], eax
mov byte [ebp - 0x2d], 1
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b6c7e
cmp byte [ebp - 0x2d], 0
je 0x4b6ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d00
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
mov edx, 0x4b7ed4
call fcn.00404d4c
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0x14]
call fcn.004035a4
cmp dword [ebp - 0x14], 0
jle 0x4b6da0
lea eax, [ebp - 0xf8]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d00
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov edx, dword [ebp - 0xf8]
mov eax, dword [0x4e8b88]
mov eax, dword [eax]
call fcn.0047ba08
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xf4]
mov eax, 8
call fcn.00408f88
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0x18]
mov ecx, 0x4b7f24
call fcn.00404d4c
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
mov edx, dword [ebp - 0x5c]
lea eax, [edx + eax*4 - 4]
mov edx, dword [ebp - 0x18]
call fcn.00404a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b6e2c
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xfc]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx + eax*8 + 8]
mov ecx, 0x4b8040
mov eax, dword [ebp - 0x18]
call fcn.004b5c74
mov edx, dword [ebp - 0xfc]
lea eax, [ebp - 0x18]
call fcn.00404ad8
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b6df5
xor eax, eax
push ebp
push 0x4b6e6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004a82ac
test al, al
jne 0x4b6e65
mov ecx, 0x4b8080
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6e8f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6f0b
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b60d6
mov eax, dword [ebp - 0x48]
call fcn.00405a94
test eax, eax
jle 0x4b705d
mov eax, dword [ebp - 0x48]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b705d
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 0x34]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b6fae
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
lea edx, [ebp - 0x108]
call fcn.00408994
mov eax, dword [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + eax*4 + 4]
lea edx, [ebp - 0x10c]
call fcn.00408994
mov edx, dword [ebp - 0x10c]
pop eax
call fcn.00404e4c
jne 0x4b6fa6
mov byte [ebp - 0x2d], 1
jmp 0x4b6fae
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b6f5f
cmp byte [ebp - 0x2d], 0
jne 0x4b701b
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b701b
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
lea edx, [ebp - 0x110]
call fcn.00408994
mov eax, dword [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + eax*8 + 8]
lea edx, [ebp - 0x114]
call fcn.00408994
mov edx, dword [ebp - 0x114]
pop eax
call fcn.00404e4c
jne 0x4b7013
mov byte [ebp - 0x2d], 1
jmp 0x4b701b
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b6fcc
cmp byte [ebp - 0x2d], 0
jne 0x4b7051
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*4]
lea eax, [ebp - 0x118]
mov ecx, 0x4b80e8
call fcn.00404d4c
mov ecx, dword [ebp - 0x118]
mov dl, 1
mov eax, dword [0x407d34]
call fcn.0040c75c
call fcn.004043f8
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b6f43
cmp byte [ebp - 6], 0
je 0x4b7071
mov byte [ebp - 7], 1
call fcn.004044a4
jmp 0x4b7d6c
cmp byte [ebp - 5], 0
je 0x4b709b
push 0
mov cx, word [0x4b812c]
mov dl, 3
mov eax, 0x4b8138
call fcn.0042bc04
cmp eax, 6
je 0x4b709b
call fcn.004044a4
jmp 0x4b7d6c
mov eax, dword [ebp - 0x34]
call fcn.00405a94
test eax, eax
jle 0x4b7144
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x34]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b70e0
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + eax*4 + 8]
add dword [ebp - 0x24], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b70c8
push 0x40
push 0x1000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov eax, dword [0x4e8740]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov edx, dword [ebp - 0x34]
mov dword [edx], eax
mov eax, dword [ebp - 0x34]
call fcn.00405a94
dec eax
test eax, eax
jle 0x4b7144
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + eax*4 - 0xc]
mov edx, dword [ebp - 0xc]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 0x34]
add eax, dword [ecx + edx*4 - 4]
mov edx, dword [ebp - 0xc]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 0x34]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b7116
push 0
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4b5e64]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x5c]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7790
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*4]
call fcn.00404ad8
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x18]
call fcn.004b5a98
mov eax, dword [ebp - 0x34]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b71fe
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x11c]
push eax
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + ebx*4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x120]
mov eax, 8
call fcn.00408f88
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x34]
mov edx, dword [eax + ebx*4 + 4]
mov eax, dword [ebp - 0x18]
call fcn.004b5c74
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x18]
call fcn.00404ad8
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b71ac
mov eax, dword [ebp - 0x38]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7268
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x124]
push eax
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + ebx*4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x128]
mov eax, 8
call fcn.00408f88
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + ebx*4 + 4]
mov eax, dword [ebp - 0x18]
call fcn.004b5c74
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x18]
call fcn.00404ad8
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b7216
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 0x18]
call fcn.00404d00
mov edx, dword [ebp - 0x18]
cmp byte [edx + eax - 1], 0x3a
je 0x4b74fa
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b74fa
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + ebx*8 + 8]
mov eax, dword [ebp - 0x18]
call fcn.004b5b8c
test al, al
je 0x4b74ee
mov eax, dword [ebp - 0x3c]
cmp byte [eax + ebx*8], 0
jne 0x4b74a7
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x12c]
mov eax, 8
call fcn.00408f88
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + ebx*8 + 8]
mov eax, dword [ebp - 0x18]
call fcn.004b5c74
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffff
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x134]
mov eax, 8
call fcn.00408f88
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + ebx*8 + 8]
mov eax, dword [ebp - 0x18]
call fcn.004b5c74
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x18]
call fcn.00404ad8
mov eax, dword [ebp - 0x20]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4b5e64]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [edx + eax*8 - 8], ecx
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
lea ecx, [edx + eax*8 - 4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004a82ac
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*8 - 4]
call fcn.00405a94
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
lea ecx, [edx + eax*8 - 4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
call fcn.004a82ac
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*8 - 4]
call fcn.00405a94
mov edi, eax
cmp edi, dword [ebp - 0x50]
jge 0x4b73f0
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
lea ecx, [edx + eax*8 - 4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004a82ac
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + ebx*8 + 0x10]
call fcn.00405a94
inc eax
push eax
mov eax, dword [ebp - 0x3c]
lea eax, [eax + ebx*8 + 0x10]
mov ecx, 1
mov edx, dword [0x4b5de8]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + eax*8 + 0x10]
call fcn.00405a94
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx + ebx*8 + 0x10]
lea eax, [edx + eax*4 - 4]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00405a94
dec eax
pop edx
mov dword [edx], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + ebx*8 + 0x14]
call fcn.00405a94
inc eax
push eax
mov eax, dword [ebp - 0x3c]
lea eax, [eax + ebx*8 + 0x14]
mov ecx, 1
mov edx, dword [0x4b5e10]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + eax*8 + 0x14]
call fcn.00405a94
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx + ebx*8 + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 4], ecx
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*8 - 4]
call fcn.00405a94
add dword [ebp - 0x1c], eax
mov byte [ebp - 0x2d], 1
jmp 0x4b74fa
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + ebx*8 + 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x13c]
mov eax, 8
call fcn.00408f88
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + ebx*8 + 8]
mov eax, dword [ebp - 0x18]
call fcn.004b5c74
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x18]
call fcn.00404ad8
jmp 0x4b74fa
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b729e
cmp byte [ebp - 0x2d], 0
jne 0x4b7784
mov eax, dword [ebp - 0x18]
call fcn.00404d00
mov edx, dword [ebp - 0x18]
cmp byte [edx + eax - 1], 0x3a
jne 0x4b7721
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7691
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + ebx*8 + 0xc]
cmp eax, dword [ebp - 0xc]
jne 0x4b7685
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x1c]
mov dword [eax + ebx*8 + 4], edx
mov eax, dword [ebp - 0x3c]
mov byte [eax + ebx*8], 1
mov byte [ebp - 0x2d], 1
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + ebx*8 + 0x10]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7691
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov esi, dword [ebp - 0x10]
lea esi, [esi + esi*2]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + esi*8 + 0x10]
mov eax, dword [eax + ebx*4]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*8 + 4]
call fcn.00405a94
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + esi*8 + 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x140]
mov eax, 8
call fcn.00408f88
mov ecx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + esi*8 + 8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + esi*8 + 0x14]
mov eax, dword [eax + ebx*4]
mov edi, dword [ebp - 0x5c]
mov eax, dword [edi + eax*4]
call fcn.004b5c74
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + eax*8 + 0x10]
mov eax, dword [eax + ebx*4]
mov edx, dword [ebp - 0x20]
lea ecx, [edx + eax*8 + 4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + esi*8 + 0x10]
mov eax, dword [eax + ebx*4]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx + eax*8]
mov eax, dword [ebp - 0x54]
call fcn.004a82ac
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + esi*8 + 0x10]
mov eax, dword [eax + ebx*4]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*8 + 4]
call fcn.00405a94
mov edi, eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + esi*8 + 0x10]
mov eax, dword [eax + ebx*4]
mov edx, dword [ebp - 0x20]
lea eax, [edx + eax*8 + 4]
mov ecx, 1
mov edx, dword [0x4a49c4]
call fcn.00405c50
add esp, 4
mov esi, edi
mov eax, dword [ebp - 0x50]
dec eax
sub eax, esi
jl 0x4b7679
inc eax
mov edx, dword [ebp - 0x10]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + edx*8 + 0x10]
mov edx, dword [edx + ebx*4]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + edx*8 + 4]
mov byte [edx + esi], 0x90
inc esi
dec eax
jne 0x4b765a
inc ebx
dec dword [ebp - 0x74]
jne 0x4b7580
jmp 0x4b7691
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b753a
cmp byte [ebp - 0x2d], 0
jne 0x4b7784
xor eax, eax
push ebp
push 0x4b7701
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d00
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
mov edx, 0x4b7ed4
call fcn.00404d4c
mov eax, dword [ebp - 0x144]
call fcn.00408fb8
mov dword [ebp - 0x1c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7784
mov eax, dword [ebp - 0x20]
call fcn.00405a94
inc eax
push eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4b5e64]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [edx + eax*8 - 8], ecx
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
lea ecx, [edx + eax*8 - 4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004a82ac
mov eax, dword [ebp - 0x20]
call fcn.00405a94
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*8 - 4]
call fcn.00405a94
add dword [ebp - 0x1c], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b7178
mov byte [ebp - 0x2e], 1
mov eax, dword [ebp - 0x40]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7814
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
push 0x40
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax + edx*8 + 4]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*8]
mov eax, dword [0x4e8740]
mov eax, dword [eax]
call fcn.0047b548
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0xc]
cmp dword [eax + edx*8], 0x4c4b400
jbe 0x4b780c
mov eax, dword [0x4e8bb8]
cmp dword [eax], 0
je 0x4b780c
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*8 + 4]
shr eax, 0xc
mov edx, eax
shl edx, 0xc
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*8]
xor ecx, ecx
call fcn.0047b590
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b77ac
mov eax, dword [ebp - 0x20]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b78dc
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
push 0x40
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*8 + 4]
call fcn.00405a94
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*8]
mov eax, dword [0x4e8740]
mov eax, dword [eax]
call fcn.0047b548
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*8 + 4]
call fcn.00405a94
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax + edx*8 + 4]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*8]
mov eax, dword [0x4e8740]
mov eax, dword [eax]
call fcn.0047b578
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x2d], al
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*8 + 4]
call fcn.00405a94
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*8]
mov eax, dword [0x4e8740]
mov eax, dword [eax]
call fcn.0047b548
cmp byte [ebp - 0x2d], 0
jne 0x4b78d0
mov byte [ebp - 0x2e], 0
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b7830
cmp byte [ebp - 0x2e], 0
jne 0x4b78fb
cmp byte [ebp - 5], 0
je 0x4b7cf2
mov eax, 0x4b816c
call fcn.0042bcfc
jmp 0x4b7cf2
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4b79e1
mov eax, dword [ebp - 0x44]
call fcn.00405a94
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00405a94
cmp ebx, eax
jne 0x4b797d
mov dword [ebp - 0x64], 0xffffffff
mov eax, dword [ebp - 0x44]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7965
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
cmp eax, dword [ebp - 0x64]
jae 0x4b795d
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x64], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b793e
push 0x8000
push 0
mov eax, dword [ebp - 0x64]
push eax
mov eax, dword [0x4e8740]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualFreeEx
mov eax, dword [ebp - 0x34]
call fcn.00405a94
push eax
mov eax, dword [ebp + 8]
mov ecx, 1
mov edx, dword [0x4a0c30]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x34]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b79e1
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0xc]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 0x34]
lea edx, [ecx + edx*4]
mov ecx, dword [0x4a0c10]
call fcn.00405604
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b79b4
mov eax, dword [ebp - 0x4c]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7a16
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*4]
mov eax, dword [0x4e8b88]
mov eax, dword [eax]
call fcn.0047b930
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b79f9
mov eax, dword [ebp - 0x48]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7bcf
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 0x34]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7af7
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
lea edx, [ebp - 0x14c]
call fcn.00408994
mov eax, dword [ebp - 0x14c]
push eax
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + ebx*4 + 4]
lea edx, [ebp - 0x150]
call fcn.00408994
mov edx, dword [ebp - 0x150]
pop eax
call fcn.00404e4c
jne 0x4b7aeb
xor eax, eax
push ebp
push 0x4b7adf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*4]
mov eax, dword [0x4e8b88]
mov eax, dword [eax]
call fcn.0047b930
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0x34]
mov edx, dword [eax + ebx*4]
mov eax, dword [0x4e8b88]
mov eax, dword [eax]
call fcn.0047b960
mov byte [ebp - 0x2d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7af7
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b7a52
cmp byte [ebp - 0x2d], 0
jne 0x4b7bc3
mov eax, dword [ebp - 0x3c]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7bc3
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
lea edx, [ebp - 0x154]
call fcn.00408994
mov eax, dword [ebp - 0x154]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + eax*8 + 8]
lea edx, [ebp - 0x158]
call fcn.00408994
mov edx, dword [ebp - 0x158]
pop eax
call fcn.00404e4c
jne 0x4b7bb7
xor eax, eax
push ebp
push 0x4b7bad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov edx, dword [eax + edx*4]
mov eax, dword [0x4e8b88]
mov eax, dword [eax]
call fcn.0047b930
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx + eax*8 + 4]
mov eax, dword [0x4e8b88]
mov eax, dword [eax]
call fcn.0047b960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7bb7
inc dword [ebp - 0x10]
dec dword [ebp - 0x6c]
jne 0x4b7b1d
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b7a32
cmp byte [ebp - 5], 0
je 0x4b7cf2
lea eax, [ebp - 0x54]
call fcn.00404a40
mov eax, dword [ebp - 0x34]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7c4e
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
push dword [ebp - 0x54]
push 0x4b819c
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
push dword [edx + eax*4 + 4]
push 0x4b81a8
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + eax*4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x15c]
mov eax, 8
call fcn.00408f88
push dword [ebp - 0x15c]
lea eax, [ebp - 0x54]
mov edx, 5
call fcn.00404dc0
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b7bf9
mov eax, dword [ebp - 0x38]
call fcn.00405a94
test eax, eax
jle 0x4b7cd4
lea eax, [ebp - 0x54]
mov edx, 0x4b81b4
call fcn.00404ad8
mov eax, dword [ebp - 0x38]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7cd4
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
push dword [ebp - 0x54]
push 0x4b819c
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x38]
push dword [edx + eax*4 + 4]
push 0x4b81a8
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + eax*4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x160]
mov eax, 8
call fcn.00408f88
push dword [ebp - 0x160]
lea eax, [ebp - 0x54]
mov edx, 5
call fcn.00404dc0
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b7c7f
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 0x54]
mov edx, 0x4b81f0
call fcn.00404d4c
mov eax, dword [ebp - 0x164]
call fcn.0042bcfc
mov al, byte [ebp - 0x2e]
mov byte [ebp - 7], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7d6c
mov eax, dword [ebp - 0x20]
call fcn.00405a94
dec eax
test eax, eax
jl 0x4b7d44
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], 0
push 0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
lea eax, [eax + edx*8 + 4]
mov ecx, 1
mov edx, dword [0x4a49c4]
call fcn.00405c50
add esp, 4
inc dword [ebp - 0xc]
dec dword [ebp - 0x68]
jne 0x4b7d1d
push 0
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4b5e64]
call fcn.00405c50
add esp, 4
mov eax, dword [ebp - 0x60]
call fcn.00403c6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7e1e
lea eax, [ebp - 0x164]
mov edx, 0x3c
call fcn.00404a64
lea eax, [ebp - 0x5c]
mov edx, dword [0x4b5f7c]
call fcn.00405c5c
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00404a64
lea eax, [ebp - 0x4c]
mov edx, dword [0x4b5f54]
call fcn.00405c5c
lea eax, [ebp - 0x48]
mov edx, dword [0x4b5f2c]
call fcn.00405c5c
lea eax, [ebp - 0x44]
mov edx, dword [0x4b5f04]
call fcn.00405c5c
lea eax, [ebp - 0x40]
mov edx, dword [0x4b5edc]
call fcn.00405c5c
lea eax, [ebp - 0x3c]
mov edx, dword [0x4b5eb4]
call fcn.00405c5c
lea eax, [ebp - 0x38]
mov edx, dword [0x4b5e8c]
mov ecx, 2
call fcn.004054f4
lea eax, [ebp - 0x20]
mov edx, dword [0x4b5e64]
call fcn.00405c5c
lea eax, [ebp - 0x18]
call fcn.00404a40
ret