Function at 0x4ca16e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov byte [0xa4c1f0], 0
mov eax, dword [0x6afb4c]
test eax, eax
je 0x4ca18e
mov byte [0xa4c1f0], 1
mov eax, dword [0x6cfa34]
cmp eax, 1
jne 0x4ca1b3
mov dword [0x6cfa34], 2
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x6afb4c]
test eax, eax
jne 0x4ca1d4
mov eax, dword [0x6b5284]
test eax, eax
je 0x4ca1d4
mov dword [0xa4b740], 1
jmp 0x4cc0f3
mov eax, dword [0x6cfa34]
test eax, eax
jne 0x4cc0af
mov dword [0xa4c1f4], 0xffffffff
mov eax, dword [0x5520a0]
mov edx, dword [0x5520a4]
mov dword [0xa4c1f8], eax
mov dword [0xa4c1fc], edx
mov dword [0xa4c200], 0
jmp 0x4ca280
mov eax, dword [0xa4c200]
shl eax, 5
add eax, 0x6b5120
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov eax, dword [0xa4c1f8]
mov edx, dword [0xa4c1fc]
cmp ebx, edx
jg 0x4ca273
cmp ebx, edx
jl 0x4ca237
cmp ecx, eax
jae 0x4ca273
mov eax, dword [0xa4c200]
shl eax, 5
add eax, 0x6b5120
mov eax, dword [eax]
cmp eax, 3
jne 0x4ca273
mov eax, dword [0xa4c200]
shl eax, 5
add eax, 0x6b5120
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [0xa4c1f8], eax
mov dword [0xa4c1fc], edx
mov eax, dword [0xa4c200]
mov dword [0xa4c1f4], eax
mov eax, dword [0xa4c200]
add eax, 1
mov dword [0xa4c200], eax
mov eax, dword [0xa4c200]
cmp eax, 2
setle al
test al, al
jne 0x4ca20d
mov dword [0xa4c200], 0
jmp 0x4ca2ca
mov eax, dword [0xa4c200]
shl eax, 5
add eax, 0x6b5120
mov eax, dword [eax]
cmp eax, 1
jne 0x4ca2bd
mov eax, dword [0xa4c200]
mov dword [0xa4c1f4], eax
mov eax, dword [0xa4c200]
add eax, 1
mov dword [0xa4c200], eax
mov eax, dword [0xa4c200]
cmp eax, 2
setle al
test al, al
jne 0x4ca29f
mov eax, dword [0xa4c1f4]
cmp eax, 0xffffffff
jne 0x4ca2f4
mov dword [esp], str.Software_frame_buffer:_Failed_to_find_available_frame
call fcn.00470977
jmp 0x4cc0f3
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5120
mov dword [eax], 2
mov ecx, dword [0xa4c1f4]
mov eax, dword [0x5520a0]
mov edx, dword [0x5520a4]
shl ecx, 5
add ecx, 0x6b5120
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
add eax, 1
adc edx, 0
mov dword [0x5520a0], eax
mov dword [0x5520a4], edx
mov eax, dword [0x6afb4c]
test eax, eax
je 0x4ca389
mov dword [esp + 8], 1
fld qword [0x582408]
fstp qword [esp]
call fcn.004920fe
fstp qword [0xa4c208]
fld qword [0xa4c210]
fld qword [0xa4c208]
fsubp st(1)
fabs
fld qword [0x582590]
fucompi st(1)
fstp st(0)
ja 0x4cc04e
fld qword [0xa4c208]
fstp qword [0xa4c210]
mov eax, dword [0x6c5c74]
test eax, eax
je 0x4cc051
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov dword [0xa4c218], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx eax, ax
mov dword [0xa4c21c], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x20]
test ax, ax
jne 0x4ca418
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov ecx, dword [0x6b5294]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, ecx
mov eax, dword [eax]
imul eax, edx
mov dword [0xa4c218], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx edx, ax
mov ecx, dword [0x6b5290]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, ecx
mov eax, dword [eax]
imul eax, edx
mov dword [0xa4c21c], eax
mov eax, dword [0xa4c218]
cmp eax, 0x200
jg 0x4ca448
mov eax, dword [0xa4c21c]
cmp eax, 0x180
jg 0x4ca448
mov eax, dword [0xa4c218]
add eax, eax
mov dword [0xa4c218], eax
mov eax, dword [0xa4c21c]
add eax, eax
mov dword [0xa4c21c], eax
mov dword [0xa4c220], 0xffffffff
mov dword [0xa4c224], 0xffffffff
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov dword [0xa4c218], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx eax, ax
mov dword [0xa4c21c], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x20]
test ax, ax
jne 0x4ca4de
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov ecx, dword [0x6b5294]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, ecx
mov eax, dword [eax]
imul eax, edx
mov dword [0xa4c218], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx edx, ax
mov ecx, dword [0x6b5290]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, ecx
mov eax, dword [eax]
imul eax, edx
mov dword [0xa4c21c], eax
mov eax, dword [0xa4c218]
mov dword [0x6c5c94], eax
mov eax, dword [0xa4c21c]
mov dword [0x6c5c98], eax
mov dword [0xa4c228], 0
mov dword [0x6c5c9c], 0
mov eax, dword [0x6c5c78]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x20]
test ax, ax
jne 0x4cb68a
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
mov dword [0xa4c22c], eax
mov eax, dword [0x6b5294]
mov edx, dword [0xa4c22c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [0xa4c230], eax
mov eax, dword [0x6b5290]
mov edx, dword [0xa4c22c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [0xa4c234], eax
mov eax, dword [0x6cfa20]
mov dword [0xa4c238], eax
mov dword [0xa4c23c], 0
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx eax, ax
imul eax, edx
add eax, eax
mov dword [0xa4c200], eax
mov eax, dword [0xa4c200]
mov edx, eax
mov eax, dword [0x552560]
cmp edx, eax
je 0x4ca5d4
mov eax, dword [0x6cfa24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0xa4c200]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [0x6cfa24], eax
mov eax, dword [0xa4c200]
mov dword [0x552560], eax
mov dword [0xa4c238], 0
mov eax, dword [0x552854]
test eax, eax
jne 0x4ca5eb
mov eax, dword [0xa4c238]
cmp eax, 1
je 0x4cc054
mov eax, dword [0xa4c238]
test eax, eax
jne 0x4ca616
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x48]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], 0xa4b7a0
call sub.msvcrt.dll_memcpy
jmp 0x4ca664
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x48]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], 0xa4b7a0
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4ca664
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x48]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], 0xa4b7a0
call sub.msvcrt.dll_memcpy
mov dword [0xa4c238], 0
mov eax, dword [0xa4c238]
test eax, eax
je 0x4ca69e
mov ecx, dword [0x552560]
mov eax, dword [0x6c5c74]
mov edx, dword [eax + 0x40]
mov eax, dword [0x6cfa24]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4ca69e
mov dword [0xa4c23c], 1
mov eax, dword [0x6cf90c]
and eax, 8
test eax, eax
je 0x4ca6b6
mov dword [0xa4c240], 1
jmp 0x4ca6c0
mov dword [0xa4c240], 0
mov eax, dword [0x6cf90c]
and eax, 8
test eax, eax
je 0x4ca6d8
mov dword [0xa4c244], 1
jmp 0x4ca6e2
mov dword [0xa4c244], 0
mov eax, dword [0x6afb4c]
test eax, eax
je 0x4ca7ae
mov dword [esp + 8], 1
fld qword [0x582408]
fstp qword [esp]
call fcn.004920fe
fld qword [0x582390]
fdivp st(1)
fstp qword [0xa4c248]
fld qword [0xa4c248]
fnstcw word [ebp - 0x2a]
movzx eax, word [ebp - 0x2a]
mov ah, 0xc
mov word [ebp - 0x2c], ax
fldcw word [ebp - 0x2c]
fistp qword [ebp - 0x38]
fldcw word [ebp - 0x2a]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [0xa4c250], eax
mov dword [0xa4c254], edx
mov eax, dword [0xa4c250]
mov edx, dword [0xa4c254]
mov ecx, eax
and ecx, 1
mov dword [ebp - 0x40], ecx
mov ebx, edx
and ebx, 0
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
or eax, dword [ebp - 0x40]
test eax, eax
je 0x4ca771
mov dword [0xa4c240], 1
jmp 0x4ca77b
mov dword [0xa4c240], 0
mov eax, dword [0xa4c250]
mov edx, dword [0xa4c254]
mov esi, eax
and esi, 1
mov edi, edx
and edi, 0
mov eax, edi
or eax, esi
test eax, eax
je 0x4ca7a4
mov dword [0xa4c244], 1
jmp 0x4ca7ae
mov dword [0xa4c244], 0
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x38]
cwde
sub eax, 1
mov dword [0xa4c258], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x3a]
cwde
sub eax, 1
mov dword [0xa4c25c], eax
mov eax, dword [0x6c5c74]
movzx eax, byte [eax + 0x51]
cmp al, 2
jne 0x4ca80e
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx eax, ax
lea edx, [eax - 1]
mov eax, dword [0xa4c25c]
cmp edx, eax
jle 0x4ca80e
mov eax, dword [0xa4c25c]
add eax, 1
mov dword [0xa4c25c], eax
mov dword [0xa4c258], 0
mov eax, dword [0xa4c238]
test eax, eax
je 0x4ca871
mov edx, dword [0xa4c244]
mov eax, dword [0xa4c260]
cmp edx, eax
je 0x4ca830
mov dword [0xa4c23c], 1
mov edx, dword [0xa4c240]
mov eax, dword [0xa4c264]
cmp edx, eax
je 0x4ca849
mov dword [0xa4c23c], 1
mov edx, dword [0xa4c258]
mov eax, dword [0x552874]
cmp edx, eax
jne 0x4ca867
mov edx, dword [0xa4c25c]
mov eax, dword [0x552878]
cmp edx, eax
je 0x4ca871
mov dword [0xa4c23c], 1
mov eax, dword [0xa4c238]
test eax, eax
jne 0x4ca884
mov dword [0xa4c23c], 1
mov eax, dword [0xa4c23c]
test eax, eax
je 0x4cc057
mov edx, dword [0x6c5c94]
mov eax, dword [0x6c5c98]
imul eax, edx
shl eax, 2
mov dword [0xa4c268], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax + 0xc]
mov eax, dword [0xa4c268]
cmp edx, eax
jge 0x4ca90e
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov ebx, dword [0xa4c1f4]
mov eax, dword [0xa4c268]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, ebx
shl edx, 5
add edx, 0x6b5130
mov dword [edx], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0xa4c268]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 0xc], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0x6c5c94]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 4], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0x6c5c98]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 8], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [0x6c5c78], eax
mov eax, dword [0xa4c238]
test eax, eax
je 0x4caa9c
mov dword [0xa4c270], 0
mov dword [0xa4c274], 0
mov dword [0xa4c278], 0xffffffff
mov dword [0xa4c27c], 0
jmp 0x4caa11
mov eax, dword [0xa4c27c]
shl eax, 5
add eax, 0x6b5120
mov eax, dword [eax]
cmp eax, 4
je 0x4ca9b2
mov eax, dword [0xa4c27c]
shl eax, 5
add eax, 0x6b5120
mov eax, dword [eax]
cmp eax, 3
jne 0x4caa04
mov eax, dword [0xa4c27c]
shl eax, 5
add eax, 0x6b5120
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov eax, dword [0xa4c270]
mov edx, dword [0xa4c274]
cmp ebx, edx
jl 0x4caa04
cmp ebx, edx
jg 0x4ca9dc
cmp ecx, eax
jbe 0x4caa04
mov eax, dword [0xa4c27c]
shl eax, 5
add eax, 0x6b5120
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [0xa4c270], eax
mov dword [0xa4c274], edx
mov eax, dword [0xa4c27c]
mov dword [0xa4c278], eax
mov eax, dword [0xa4c27c]
add eax, 1
mov dword [0xa4c27c], eax
mov eax, dword [0xa4c27c]
cmp eax, 2
setle al
test al, al
jne 0x4ca98a
mov eax, dword [0xa4c278]
cmp eax, 0xffffffff
je 0x4caa86
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax + 4]
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax + 8]
imul eax, edx
shl eax, 2
mov ecx, eax
mov eax, dword [0xa4c278]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax]
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x4caa9c
mov dword [esp], str.Text_Screen_Update:_Failed_to_locate_previous_frames_data_for_comparison
call fcn.00470977
mov dword [0xa4c238], 0
mov dword [0xa4c280], 0
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x40]
mov dword [0xa4c284], eax
mov eax, dword [0x6cfa24]
mov dword [0xa4c288], eax
movzx eax, byte [0xa4c1f0]
test al, al
je 0x4caacd
call fcn.004ca0f2
mov dword [0xa4c28c], 0
mov dword [0xa4c21c], 0
jmp 0x4cb610
mov dword [0xa4c290], 0
mov dword [0xa4c218], 0
jmp 0x4cb5c4
mov eax, dword [0xa4c284]
movzx eax, byte [eax]
mov byte [0xa4c294], al
mov eax, dword [0xa4c284]
add eax, 1
mov dword [0xa4c284], eax
mov eax, dword [0xa4c284]
movzx eax, byte [eax]
mov byte [0xa4c295], al
mov eax, dword [0xa4c284]
add eax, 1
mov dword [0xa4c284], eax
mov eax, dword [0xa4c288]
movzx eax, byte [eax]
mov byte [0xa4c296], al
mov eax, dword [0xa4c288]
add eax, 1
mov dword [0xa4c288], eax
mov eax, dword [0xa4c288]
movzx eax, byte [eax]
mov byte [0xa4c297], al
mov eax, dword [0xa4c288]
add eax, 1
mov dword [0xa4c288], eax
mov eax, dword [0xa4c238]
test eax, eax
je 0x4cac35
movzx edx, byte [0xa4c294]
movzx eax, byte [0xa4c296]
cmp dl, al
jne 0x4cac35
movzx edx, byte [0xa4c295]
movzx eax, byte [0xa4c297]
cmp dl, al
jne 0x4cac35
movzx eax, byte [0xa4c295]
test al, al
jns 0x4cabba
mov edx, dword [0xa4c244]
mov eax, dword [0xa4c260]
cmp edx, eax
jne 0x4cac31
mov edx, dword [0xa4c218]
mov eax, dword [0xa4c258]
cmp edx, eax
jne 0x4cabe7
mov edx, dword [0xa4c21c]
mov eax, dword [0xa4c25c]
cmp edx, eax
jne 0x4cabe7
mov edx, dword [0xa4c240]
mov eax, dword [0xa4c264]
cmp edx, eax
jne 0x4cac34
mov edx, dword [0xa4c218]
mov eax, dword [0x552874]
cmp edx, eax
jne 0x4cb592
mov edx, dword [0xa4c21c]
mov eax, dword [0x552878]
cmp edx, eax
jne 0x4cb592
mov edx, dword [0xa4c258]
mov eax, dword [0x552874]
cmp edx, eax
jne 0x4cac35
mov edx, dword [0xa4c25c]
mov eax, dword [0x552878]
cmp edx, eax
je 0x4cb592
jmp 0x4cac35
nop
jmp 0x4cac35
nop
mov eax, dword [0xa4c288]
sub eax, 2
mov dword [0xa4c288], eax
mov eax, dword [0xa4c288]
movzx edx, byte [0xa4c294]
mov byte [eax], dl
mov eax, dword [0xa4c288]
add eax, 1
mov dword [0xa4c288], eax
mov eax, dword [0xa4c288]
movzx edx, byte [0xa4c295]
mov byte [eax], dl
mov eax, dword [0xa4c288]
add eax, 1
mov dword [0xa4c288], eax
mov dword [0xa4c298], 0
mov eax, dword [0xa4c22c]
cmp eax, 0x1f
jle 0x4cad4e
movzx eax, byte [0xa4c294]
movzx eax, al
movzx eax, word [eax + eax + 0x5520c0]
movzx eax, ax
mov dword [0xa4c29c], eax
mov dword [0xa4c2a0], 1
mov eax, dword [0xa4c2a4]
test eax, eax
je 0x4cacca
mov eax, dword [0xa4c2a4]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edx, dword [0xa4c2a0]
mov eax, dword [0x6b528c]
mov ecx, dword [0xa4c22c]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [esp + 0x20], 0xa4c2b8
mov dword [esp + 0x1c], 0xa4c2b4
mov dword [esp + 0x18], 0xa4c2b0
mov dword [esp + 0x14], 0xa4c2ac
mov dword [esp + 0x10], 0xa4c2a8
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0xa4c29c
mov dword [esp], eax
call fcn.0046fec5
mov dword [0xa4c2bc], eax
mov eax, dword [0xa4c2a8]
mov dword [0xa4c2a4], eax
mov eax, dword [0xa4c2a8]
mov dword [0xa4c2c0], eax
mov dword [0xa4c2c4], 0
jmp 0x4cae42
mov dword [0xa4c2c4], 0
mov eax, dword [0xa4c22c]
cmp eax, 8
jne 0x4cad79
movzx eax, byte [0xa4c294]
movzx eax, al
shl eax, 6
add eax, 0xa3e240
mov dword [0xa4c2c0], eax
mov eax, dword [0xa4c22c]
cmp eax, 0xe
jne 0x4cad9d
movzx eax, byte [0xa4c294]
movzx eax, al
shl eax, 7
add eax, 8
add eax, 0xa42240
mov dword [0xa4c2c0], eax
mov eax, dword [0xa4c22c]
cmp eax, 0x10
jne 0x4cadbe
movzx eax, byte [0xa4c294]
movzx eax, al
shl eax, 7
add eax, 0xa42240
mov dword [0xa4c2c0], eax
mov eax, dword [0xa4c22c]
cmp eax, 9
jne 0x4cade9
movzx eax, byte [0xa4c294]
movzx eax, al
shl eax, 6
add eax, 0xa3e240
mov dword [0xa4c2c0], eax
mov dword [0xa4c298], 1
mov eax, dword [0xa4c22c]
cmp eax, 0xf
jne 0x4cae17
movzx eax, byte [0xa4c294]
movzx eax, al
shl eax, 7
add eax, 8
add eax, 0xa42240
mov dword [0xa4c2c0], eax
mov dword [0xa4c298], 1
mov eax, dword [0xa4c22c]
cmp eax, 0x11
jne 0x4cae42
movzx eax, byte [0xa4c294]
movzx eax, al
shl eax, 7
add eax, 0xa42240
mov dword [0xa4c2c0], eax
mov dword [0xa4c298], 1
movzx eax, byte [0xa4c295]
and eax, 0xf
mov byte [0xa4c2c8], al
mov eax, dword [0x552650]
test eax, eax
je 0x4cae83
movzx eax, byte [0xa4c295]
movzx eax, al
sar eax, 4
and eax, 7
mov byte [0xa4c2c9], al
movzx eax, byte [0xa4c295]
movzx eax, al
sar eax, 7
mov byte [0xa4c2ca], al
jmp 0x4cae95
movzx eax, byte [0xa4c295]
movzx eax, al
sar eax, 4
mov byte [0xa4c2c9], al
movzx eax, byte [0xa4c2ca]
test al, al
je 0x4caebe
mov eax, dword [0xa4c244]
test eax, eax
je 0x4caebe
mov eax, dword [0x552650]
test eax, eax
je 0x4caebe
movzx eax, byte [0xa4c2c9]
mov byte [0xa4c2c8], al
movzx eax, byte [0xa4c2c8]
movzx eax, al
mov eax, dword [eax*4 + 0xa4b7a0]
mov dword [0xa4c278], eax
movzx eax, byte [0xa4c2c9]
movzx eax, al
mov eax, dword [eax*4 + 0xa4b7a0]
mov dword [0xa4c27c], eax
mov eax, dword [0x6c5c78]
mov ecx, dword [0xa4c28c]
mov edx, dword [0x6c5c94]
imul edx, ecx
mov ecx, edx
mov edx, dword [0xa4c280]
add ecx, edx
mov edx, dword [0xa4c290]
add edx, ecx
shl edx, 2
add eax, edx
mov dword [0xa4c2cc], eax
mov edx, dword [0x6c5c94]
mov ecx, dword [0x6b5294]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, ecx
mov eax, dword [eax]
mov ecx, edx
sub ecx, eax
mov eax, ecx
mov dword [0xa4c228], eax
mov dword [0xa4c2d0], 0
jmp 0x4cb01f
mov dword [0xa4c2d4], 0
jmp 0x4cafd3
mov eax, dword [0xa4c2c0]
movzx eax, byte [eax]
test al, al
je 0x4caf76
mov eax, dword [0xa4c2cc]
mov edx, dword [0xa4c278]
mov dword [eax], edx
jmp 0x4caf83
mov eax, dword [0xa4c2cc]
mov edx, dword [0xa4c27c]
mov dword [eax], edx
mov eax, dword [0xa4c298]
test eax, eax
je 0x4cafac
mov edx, dword [0xa4c2d4]
mov eax, dword [0xa4c298]
and eax, edx
test eax, eax
je 0x4cafb9
mov eax, dword [0xa4c2c0]
add eax, 1
mov dword [0xa4c2c0], eax
jmp 0x4cafb9
mov eax, dword [0xa4c2c0]
add eax, 1
mov dword [0xa4c2c0], eax
mov eax, dword [0xa4c2cc]
add eax, 4
mov dword [0xa4c2cc], eax
mov eax, dword [0xa4c2d4]
add eax, 1
mov dword [0xa4c2d4], eax
mov edx, dword [0xa4c2d4]
mov eax, dword [0xa4c230]
cmp edx, eax
setl al
test al, al
jne 0x4caf5b
mov eax, dword [0xa4c2cc]
mov edx, dword [0xa4c228]
shl edx, 2
add eax, edx
mov dword [0xa4c2cc], eax
mov edx, dword [0xa4c2c0]
mov eax, dword [0xa4c2c4]
add eax, edx
mov dword [0xa4c2c0], eax
mov eax, dword [0xa4c2d0]
add eax, 1
mov dword [0xa4c2d0], eax
mov edx, dword [0xa4c2d0]
mov eax, dword [0xa4c234]
cmp edx, eax
setl al
test al, al
jne 0x4caf4f
mov eax, dword [0x6c5c74]
movzx eax, byte [eax + 0x3c]
test al, al
je 0x4cb596
mov eax, dword [0xa4c240]
test eax, eax
je 0x4cb596
mov edx, dword [0xa4c258]
mov eax, dword [0xa4c218]
cmp edx, eax
jne 0x4cb596
mov edx, dword [0xa4c25c]
mov eax, dword [0xa4c21c]
cmp edx, eax
jne 0x4cb596
mov eax, dword [0x6c5c74]
movzx eax, byte [eax + 0x3d]
movzx eax, al
mov dword [0xa4c2d8], eax
mov eax, dword [0x6c5c74]
movzx eax, byte [eax + 0x3e]
movzx eax, al
mov dword [0xa4c2dc], eax
mov byte [0xa4c2e0], 0
mov byte [0xa4c2e1], 0
mov byte [0xa4c2e2], 0
mov byte [0xa4c2e3], 0
mov eax, dword [0xa4c2dc]
test eax, eax
jne 0x4cb0db
mov eax, dword [0xa4c2d8]
test eax, eax
jne 0x4cb595
mov byte [0xa4c2e2], 1
jmp 0x4cb239
mov edx, dword [0xa4c2dc]
mov eax, dword [0xa4c2d8]
cmp edx, eax
jge 0x4cb100
mov eax, dword [0xa4c2dc]
mov byte [0xa4c2e3], al
mov byte [0xa4c2e2], 0xff
jmp 0x4cb239
mov edx, dword [0xa4c2d8]
mov eax, dword [0xa4c2dc]
cmp edx, eax
jne 0x4cb142
mov eax, dword [0xa4c2d8]
cmp eax, 3
jg 0x4cb12f
mov eax, dword [0xa4c2d8]
mov byte [0xa4c2e3], al
mov byte [0xa4c2e2], 1
jmp 0x4cb239
mov byte [0xa4c2e0], 1
mov byte [0xa4c2e2], 1
jmp 0x4cb239
mov eax, dword [0xa4c2d8]
cmp eax, 2
jle 0x4cb1aa
mov edx, dword [0xa4c2dc]
mov eax, dword [0xa4c2d8]
mov ebx, edx
sub ebx, eax
mov eax, ebx
cmp eax, 1
jne 0x4cb175
mov byte [0xa4c2e0], 1
mov byte [0xa4c2e2], 2
jmp 0x4cb239
mov edx, dword [0xa4c2dc]
mov eax, dword [0xa4c2d8]
mov ecx, edx
sub ecx, eax
mov eax, ecx
cmp eax, 2
jne 0x4cb19e
mov byte [0xa4c2e0], 1
mov byte [0xa4c2e2], 3
jmp 0x4cb239
mov byte [0xa4c2e1], 1
jmp 0x4cb239
mov eax, dword [0xa4c2d8]
cmp eax, 1
jg 0x4cb1f7
mov eax, dword [0xa4c2dc]
cmp eax, 3
jg 0x4cb1e4
mov eax, dword [0xa4c2d8]
mov byte [0xa4c2e3], al
mov eax, dword [0xa4c2dc]
mov edx, eax
mov eax, dword [0xa4c2d8]
mov ebx, edx
sub ebx, eax
mov eax, ebx
add eax, 1
mov byte [0xa4c2e2], al
jmp 0x4cb239
mov eax, dword [0xa4c2d8]
mov byte [0xa4c2e3], al
mov byte [0xa4c2e2], 0xff
jmp 0x4cb239
mov eax, dword [0xa4c2dc]
cmp eax, 3
jne 0x4cb211
mov byte [0xa4c2e3], 2
mov byte [0xa4c2e2], 2
jmp 0x4cb239
mov eax, dword [0xa4c2dc]
cmp eax, 4
jne 0x4cb22b
mov byte [0xa4c2e0], 1
mov byte [0xa4c2e2], 3
jmp 0x4cb239
mov byte [0xa4c2e3], 2
mov byte [0xa4c2e2], 0xff
mov edx, dword [0x6b5294]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [0xa4c2e4], eax
mov edx, dword [0x6b5290]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [0xa4c2e8], eax
movzx eax, byte [0xa4c2e1]
test al, al
je 0x4cb370
mov eax, dword [0xa4c2e8]
sub eax, 1
mov dword [0xa4c2d0], eax
mov eax, dword [0xa4c2e8]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov byte [0xa4c2e2], al
movzx eax, byte [0xa4c295]
and eax, 0xf
mov byte [0xa4c2c8], al
movzx eax, byte [0xa4c2c8]
movzx eax, al
mov eax, dword [eax*4 + 0xa4b7a0]
mov dword [0xa4c278], eax
mov eax, dword [0x6c5c78]
mov ecx, dword [0xa4c28c]
mov edx, dword [0xa4c2d0]
add ecx, edx
mov edx, dword [0x6c5c94]
imul edx, ecx
mov ecx, edx
mov edx, dword [0xa4c280]
add ecx, edx
mov edx, dword [0xa4c290]
add edx, ecx
shl edx, 2
add eax, edx
mov dword [0xa4c2cc], eax
mov dword [0xa4c2d4], 0
jmp 0x4cb32c
mov eax, dword [0xa4c2cc]
mov edx, dword [0xa4c278]
mov dword [eax], edx
mov eax, dword [0xa4c2cc]
add eax, 4
mov dword [0xa4c2cc], eax
mov eax, dword [0xa4c2d4]
add eax, 1
mov dword [0xa4c2d4], eax
mov edx, dword [0xa4c2d4]
mov eax, dword [0xa4c2e4]
cmp edx, eax
setl al
test al, al
jne 0x4cb305
mov eax, dword [0xa4c2d0]
sub eax, 1
mov dword [0xa4c2d0], eax
movzx eax, byte [0xa4c2e2]
sub eax, 1
mov byte [0xa4c2e2], al
movzx eax, byte [0xa4c2e2]
test al, al
je 0x4cb596
jmp 0x4cb2c1
movzx eax, byte [0xa4c2e0]
test al, al
je 0x4cb474
mov eax, dword [0xa4c2e8]
sub eax, 1
mov dword [0xa4c2d0], eax
mov eax, dword [0xa4c2d0]
cmp eax, 0xf
jne 0x4cb3a0
mov dword [0xa4c2d0], 0xe
movzx eax, byte [0xa4c295]
and eax, 0xf
mov byte [0xa4c2c8], al
movzx eax, byte [0xa4c2c8]
movzx eax, al
mov eax, dword [eax*4 + 0xa4b7a0]
mov dword [0xa4c278], eax
mov eax, dword [0x6c5c78]
mov ecx, dword [0xa4c28c]
mov edx, dword [0xa4c2d0]
add ecx, edx
mov edx, dword [0x6c5c94]
imul edx, ecx
mov ecx, edx
mov edx, dword [0xa4c280]
add ecx, edx
mov edx, dword [0xa4c290]
add edx, ecx
shl edx, 2
add eax, edx
mov dword [0xa4c2cc], eax
mov dword [0xa4c2d4], 0
jmp 0x4cb430
mov eax, dword [0xa4c2cc]
mov edx, dword [0xa4c278]
mov dword [eax], edx
mov eax, dword [0xa4c2cc]
add eax, 4
mov dword [0xa4c2cc], eax
mov eax, dword [0xa4c2d4]
add eax, 1
mov dword [0xa4c2d4], eax
mov edx, dword [0xa4c2d4]
mov eax, dword [0xa4c2e4]
cmp edx, eax
setl al
test al, al
jne 0x4cb409
mov eax, dword [0xa4c2d0]
sub eax, 1
mov dword [0xa4c2d0], eax
movzx eax, byte [0xa4c2e2]
sub eax, 1
mov byte [0xa4c2e2], al
movzx eax, byte [0xa4c2e2]
test al, al
je 0x4cb596
jmp 0x4cb3c5
movzx eax, byte [0xa4c2e3]
movzx edx, al
mov eax, dword [0xa4c2e8]
cmp edx, eax
jge 0x4cb596
movzx eax, byte [0xa4c2e3]
movzx eax, al
mov dword [0xa4c2d0], eax
movzx eax, byte [0xa4c295]
and eax, 0xf
mov byte [0xa4c2c8], al
movzx eax, byte [0xa4c2c8]
movzx eax, al
mov eax, dword [eax*4 + 0xa4b7a0]
mov dword [0xa4c278], eax
movzx eax, byte [0xa4c2e2]
cmp al, 0xff
jne 0x4cb4e6
mov eax, dword [0xa4c2e8]
mov edx, eax
movzx eax, byte [0xa4c2e3]
mov ecx, edx
sub ecx, eax
mov eax, ecx
mov byte [0xa4c2e2], al
jmp 0x4cb4e6
nop
mov eax, dword [0x6c5c78]
mov ecx, dword [0xa4c28c]
mov edx, dword [0xa4c2d0]
add ecx, edx
mov edx, dword [0x6c5c94]
imul edx, ecx
mov ecx, edx
mov edx, dword [0xa4c280]
add ecx, edx
mov edx, dword [0xa4c290]
add edx, ecx
shl edx, 2
add eax, edx
mov dword [0xa4c2cc], eax
mov dword [0xa4c2d4], 0
jmp 0x4cb551
mov eax, dword [0xa4c2cc]
mov edx, dword [0xa4c278]
mov dword [eax], edx
mov eax, dword [0xa4c2cc]
add eax, 4
mov dword [0xa4c2cc], eax
mov eax, dword [0xa4c2d4]
add eax, 1
mov dword [0xa4c2d4], eax
mov edx, dword [0xa4c2d4]
mov eax, dword [0xa4c2e4]
cmp edx, eax
setl al
test al, al
jne 0x4cb52a
mov eax, dword [0xa4c2d0]
add eax, 1
mov dword [0xa4c2d0], eax
movzx eax, byte [0xa4c2e2]
sub eax, 1
mov byte [0xa4c2e2], al
movzx eax, byte [0xa4c2e2]
test al, al
jne 0x4cb4e5
jmp 0x4cb596
nop
jmp 0x4cb596
nop
mov edx, dword [0x6b5294]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, edx
mov edx, dword [eax]
mov eax, dword [0xa4c290]
add eax, edx
mov dword [0xa4c290], eax
mov eax, dword [0xa4c218]
add eax, 1
mov dword [0xa4c218], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [0xa4c218]
cmp edx, eax
setg al
test al, al
jne 0x4caaff
mov edx, dword [0x6b5290]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x30]
shl eax, 2
add eax, edx
mov edx, dword [eax]
mov eax, dword [0xa4c28c]
add eax, edx
mov dword [0xa4c28c], eax
mov eax, dword [0xa4c21c]
add eax, 1
mov dword [0xa4c21c], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx edx, ax
mov eax, dword [0xa4c21c]
cmp edx, eax
setg al
test al, al
jne 0x4caae6
mov eax, dword [0xa4c244]
mov dword [0xa4c260], eax
mov eax, dword [0xa4c240]
mov dword [0xa4c264], eax
mov eax, dword [0xa4c258]
mov dword [0x552874], eax
mov eax, dword [0xa4c25c]
mov dword [0x552878], eax
mov dword [0x6cfa20], 1
movzx eax, byte [0xa4c1f0]
test al, al
je 0x4cb670
call fcn.004ca0f2
mov eax, dword [0xa4c1f4]
mov edx, eax
sar edx, 0x1f
mov dword [0xa4c2f0], eax
mov dword [0xa4c2f4], edx
jmp 0x4cbe65
mov eax, dword [0x6c5c74]
movzx eax, byte [eax + 0x19]
cmp al, 0x20
jne 0x4cbae4
movzx eax, byte [0xa4c1f0]
test al, al
jne 0x4cb83b
mov dword [0xa4c2f8], 0
mov dword [0xa4c2fc], 0
mov dword [0xa4c278], 0xffffffff
mov dword [0xa4c27c], 0
jmp 0x4cb75e
mov eax, dword [0xa4c27c]
shl eax, 5
add eax, 0x6b5120
mov eax, dword [eax]
cmp eax, 4
je 0x4cb6ff
mov eax, dword [0xa4c27c]
shl eax, 5
add eax, 0x6b5120
mov eax, dword [eax]
cmp eax, 3
jne 0x4cb751
mov eax, dword [0xa4c27c]
shl eax, 5
add eax, 0x6b5120
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov eax, dword [0xa4c2f8]
mov edx, dword [0xa4c2fc]
cmp ebx, edx
jl 0x4cb751
cmp ebx, edx
jg 0x4cb729
cmp ecx, eax
jbe 0x4cb751
mov eax, dword [0xa4c27c]
shl eax, 5
add eax, 0x6b5120
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [0xa4c2f8], eax
mov dword [0xa4c2fc], edx
mov eax, dword [0xa4c27c]
mov dword [0xa4c278], eax
mov eax, dword [0xa4c27c]
add eax, 1
mov dword [0xa4c27c], eax
mov eax, dword [0xa4c27c]
cmp eax, 2
setle al
test al, al
jne 0x4cb6d7
mov eax, dword [0x6b509c]
test eax, eax
jne 0x4cb90f
mov eax, dword [0xa4c278]
cmp eax, 0xffffffff
je 0x4cb916
mov eax, dword [0x6cfa20]
test eax, eax
je 0x4cb912
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx eax, ax
imul eax, edx
shl eax, 2
mov dword [0xa4c200], eax
mov eax, dword [0xa4c278]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax + 4]
mov eax, dword [0xa4c278]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax + 8]
imul eax, edx
lea edx, [eax*4]
mov eax, dword [0xa4c200]
cmp edx, eax
jne 0x4cb915
mov eax, dword [0x552854]
test eax, eax
je 0x4cc05a
mov eax, dword [0xa4c200]
mov ecx, eax
mov eax, dword [0x6c5c74]
mov edx, dword [eax + 0x40]
mov eax, dword [0xa4c278]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4cc05d
jmp 0x4cb916
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx eax, ax
imul eax, edx
shl eax, 2
mov dword [0xa4c200], eax
mov edx, dword [0xa4c200]
mov eax, dword [0x55286c]
cmp edx, eax
je 0x4cb898
mov eax, dword [0xa4b794]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0xa4c200]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [0xa4b794], eax
mov eax, dword [0xa4c200]
mov dword [0x55286c], eax
jmp 0x4cb8e9
mov eax, dword [0x6b509c]
test eax, eax
jne 0x4cb8e5
mov eax, dword [0x552854]
test eax, eax
je 0x4cc060
mov eax, dword [0xa4c200]
mov ecx, eax
mov eax, dword [0x6c5c74]
mov edx, dword [eax + 0x40]
mov eax, dword [0xa4b794]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4cb8e8
mov eax, dword [0x6cfa20]
test eax, eax
jne 0x4cc063
jmp 0x4cb8e9
nop
jmp 0x4cb8e9
nop
mov eax, dword [0xa4c200]
mov ecx, eax
mov eax, dword [0x6c5c74]
mov edx, dword [eax + 0x40]
mov eax, dword [0xa4b794]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x4cb916
nop
jmp 0x4cb916
nop
jmp 0x4cb916
nop
mov edx, dword [0x6c5c94]
mov eax, dword [0x6c5c98]
imul eax, edx
shl eax, 2
mov dword [0xa4c300], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax + 0xc]
mov eax, dword [0xa4c300]
cmp edx, eax
jge 0x4cb993
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov ebx, dword [0xa4c1f4]
mov eax, dword [0xa4c300]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, ebx
shl edx, 5
add edx, 0x6b5130
mov dword [edx], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0xa4c300]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 0xc], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0x6c5c94]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 4], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0x6c5c98]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 8], eax
movzx eax, byte [0xa4c1f0]
test al, al
jne 0x4cba20
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax + 4]
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax + 8]
imul eax, edx
shl eax, 2
mov ecx, eax
mov eax, dword [0x6c5c74]
mov edx, dword [eax + 0x40]
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x4cbe61
mov eax, dword [0xa4b794]
mov dword [0xa4c304], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [0xa4c308], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax + 4]
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax + 8]
imul eax, edx
mov dword [0xa4c30c], eax
mov eax, dword [0xa4c30c]
test eax, eax
jle 0x4cbe61
jmp 0x4cbac9
mov eax, dword [0xa4c304]
mov edx, dword [eax]
mov dword [0xa4c310], edx
add eax, 4
mov dword [0xa4c304], eax
mov eax, dword [0xa4c308]
mov edx, dword [0xa4c310]
mov ecx, edx
and ecx, 0xff00ff00
mov edx, dword [0xa4c310]
and edx, 0xff0000
shr edx, 0x10
or ecx, edx
mov edx, dword [0xa4c310]
and edx, 0xff
shl edx, 0x10
or edx, ecx
mov dword [eax], edx
add eax, 4
mov dword [0xa4c308], eax
mov eax, dword [0xa4c30c]
test eax, eax
setne dl
sub eax, 1
mov dword [0xa4c30c], eax
test dl, dl
jne 0x4cba75
jmp 0x4cbe61
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x20]
cmp ax, 0xa
jne 0x4cbb85
call fcn.0046fef3
and eax, 0x200
mov dword [0xa4c278], eax
mov eax, dword [0xa4c278]
test eax, eax
je 0x4cbb19
mov dword [0xa4c278], 1
mov dword [0xa4c200], 0
jmp 0x4cbb76
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x48]
mov edx, dword [0xa4c200]
shl edx, 2
lea ecx, [eax + edx]
mov edx, dword [0xa4c278]
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x48]
mov ebx, dword [0xa4c200]
add ebx, 4
shl ebx, 2
add eax, ebx
mov ebx, dword [eax]
mov eax, edx
shl eax, 3
add eax, edx
add eax, ebx
mov eax, dword [eax*4 + 0xa3e1e0]
mov dword [ecx], eax
mov eax, dword [0xa4c200]
add eax, 1
mov dword [0xa4c200], eax
mov eax, dword [0xa4c200]
cmp eax, 3
setle al
test al, al
jne 0x4cbb25
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx eax, ax
imul eax, edx
mov dword [0xa4c200], eax
mov eax, dword [0x6c5c74]
movzx eax, byte [eax + 0x19]
movzx eax, al
mov edx, 1
mov ebx, edx
mov ecx, eax
shl ebx, cl
mov eax, ebx
mov dword [0xa4c278], eax
mov edx, dword [0xa4c200]
mov eax, dword [0x55286c]
cmp edx, eax
je 0x4cbbfd
mov eax, dword [0xa4b794]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0xa4c200]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [0xa4b794], eax
mov eax, dword [0xa4c200]
mov dword [0x55286c], eax
jmp 0x4cbc7b
mov eax, dword [0x6b509c]
test eax, eax
jne 0x4cbc74
mov eax, dword [0x552854]
test eax, eax
je 0x4cc066
mov eax, dword [0xa4c200]
mov ecx, eax
mov eax, dword [0x6c5c74]
mov edx, dword [eax + 0x40]
mov eax, dword [0xa4b794]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4cbc77
mov eax, dword [0xa4c278]
shl eax, 2
mov edx, eax
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x48]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0xa4b7a0
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4cbc7a
mov eax, dword [0x6cfa20]
test eax, eax
jne 0x4cc069
jmp 0x4cbc7b
nop
jmp 0x4cbc7b
nop
jmp 0x4cbc7b
nop
mov edx, dword [0x6c5c94]
mov eax, dword [0x6c5c98]
imul eax, edx
shl eax, 2
mov dword [0xa4c314], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax + 0xc]
mov eax, dword [0xa4c314]
cmp edx, eax
jge 0x4cbcf8
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov ebx, dword [0xa4c1f4]
mov eax, dword [0xa4c314]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, ebx
shl edx, 5
add edx, 0x6b5130
mov dword [edx], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0xa4c314]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 0xc], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0x6c5c94]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 4], eax
mov edx, dword [0xa4c1f4]
mov eax, dword [0x6c5c98]
shl edx, 5
add edx, 0x6b5130
mov dword [edx + 8], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax]
mov dword [0x6c5c78], eax
mov eax, dword [0xa4c200]
mov ecx, eax
mov eax, dword [0x6c5c74]
mov edx, dword [eax + 0x40]
mov eax, dword [0xa4b794]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [0xa4c278]
shl eax, 2
mov edx, eax
mov eax, dword [0x6c5c74]
mov eax, dword [eax + 0x48]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0xa4b7a0
call sub.msvcrt.dll_memcpy
movzx eax, byte [0xa4c1f0]
test al, al
je 0x4cbd94
call fcn.004ca0f2
mov eax, dword [0xa4b794]
mov dword [0xa4c318], eax
mov eax, dword [0x6c5c78]
mov dword [0xa4c31c], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov dword [0xa4c290], eax
mov eax, dword [0x6c5c74]
movzx eax, word [eax + 0x16]
movzx eax, ax
mov dword [0xa4c28c], eax
mov dword [0xa4c21c], 0
jmp 0x4cbe3b
mov dword [0xa4c218], 0
jmp 0x4cbe1a
mov edx, dword [0xa4c31c]
mov eax, dword [0xa4c318]
movzx ecx, byte [eax]
movzx ecx, cl
mov ecx, dword [ecx*4 + 0xa4b7a0]
mov dword [edx], ecx
add edx, 4
mov dword [0xa4c31c], edx
add eax, 1
mov dword [0xa4c318], eax
mov eax, dword [0xa4c218]
add eax, 1
mov dword [0xa4c218], eax
mov edx, dword [0xa4c218]
mov eax, dword [0xa4c290]
cmp edx, eax
setl al
test al, al
jne 0x4cbde2
mov eax, dword [0xa4c21c]
add eax, 1
mov dword [0xa4c21c], eax
mov edx, dword [0xa4c21c]
mov eax, dword [0xa4c28c]
cmp edx, eax
setl al
test al, al
jne 0x4cbdd6
movzx eax, byte [0xa4c1f0]
test al, al
je 0x4cbe64
call fcn.004ca0f2
jmp 0x4cbe64
nop
jmp 0x4cbe65
nop
mov dword [0x6b509c], 0
mov dword [0x6cfa20], 1
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5120
mov dword [eax], 3
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5120
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [0x6b5188], eax
mov dword [0x6b518c], edx
mov eax, dword [0x6afb4c]
test eax, eax
je 0x4cc06a
mov eax, dword [0x6b5200]
test eax, eax
je 0x4cc06a
mov eax, dword [0xa4c320]
test eax, eax
jne 0x4cbf13
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], str.output_image.raw
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [0xa4c320], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax + 4]
mov dword [0xa4c324], eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov eax, dword [eax + 8]
mov dword [0xa4c328], eax
mov eax, dword [0xa4c32c]
add eax, 1
mov dword [0xa4c32c], eax
mov eax, dword [0xa4c32c]
mov dword [0xa4c330], eax
mov eax, dword [0xa4c324]
mov dword [0xa4c334], eax
mov eax, dword [0xa4c328]
mov dword [0xa4c338], eax
mov eax, dword [0xa4c320]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call eax
sub esp, 0x10
mov edx, dword [0xa4c324]
mov eax, dword [0xa4c328]
imul eax, edx
shl eax, 2
mov ecx, eax
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5130
mov edx, dword [eax]
mov eax, dword [0xa4c320]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
mov eax, dword [0xa4c320]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call eax
sub esp, 4
mov eax, dword [0xa4c320]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call eax
sub esp, 0x10
mov eax, dword [0xa4c320]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0xa4c330
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
jmp 0x4cc06a
nop
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5120
mov eax, dword [eax]
cmp eax, 2
jne 0x4cc0af
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5120
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [0x6b5188], eax
mov dword [0x6b518c], edx
mov eax, dword [0xa4c1f4]
shl eax, 5
add eax, 0x6b5120
mov dword [eax], 1
mov eax, dword [0x6cfa34]
cmp eax, 1
jne 0x4cc0d4
mov dword [0x6cfa34], 2
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x5522d8]
cmp eax, 0xffffffff
jne 0x4cc0e8
mov dword [0x5522d8], 0
mov dword [0xa4b740], 1
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret