Function at 0x4f5c94
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1600
push 0
push 0
dec ecx
jne 0x4f5c9d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404100
xor eax, eax
push ebp
push 0x4f7e98
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], 0x14
xor edx, edx
push ebp
push 0x4f7da3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb54], 1
jne 0x4f5d4b
lea edx, [ebp - 0xaec0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151a4]
call fcn.004090d8
mov eax, dword [ebp - 0xaec0]
push eax
lea edx, [ebp - 0xaec4]
mov eax, dword [ebp - 8]
call fcn.004090d8
mov edx, dword [ebp - 0xaec4]
pop eax
call fcn.0040405c
jne 0x4f5d4b
push 0
mov ecx, 0x4f7eac
mov edx, 0x4f7eb8
mov eax, dword [0x50b418]
mov eax, dword [eax]
call fcn.00453df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7dfb
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x151a4]
mov eax, dword [ebp - 4]
call fcn.004cfa04
test al, al
jne 0x4f5dfa
lea edx, [ebp - 0xaec8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151a4]
call fcn.004090d8
mov eax, dword [ebp - 0xaec8]
push eax
lea edx, [ebp - 0xaecc]
mov eax, dword [ebp - 8]
call fcn.004090d8
mov edx, dword [ebp - 0xaecc]
pop eax
call fcn.0040405c
jne 0x4f5dfa
push 0
push 0x4f7f14
mov eax, dword [ebp - 4]
push dword [eax + 0x151a4]
push 0x4f7f24
push 0x4f7f38
push 0x4f7f44
push 0x4f7f50
lea eax, [ebp - 0xaed0]
mov edx, 6
call fcn.0040400c
mov eax, dword [ebp - 0xaed0]
call fcn.00404110
mov edx, eax
mov ecx, 0x4f7eac
mov eax, dword [0x50b418]
mov eax, dword [eax]
call fcn.00453df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7dfb
cmp dword [ebp - 0xc], 0
je 0x4f5e19
cmp dword [ebp - 0xc], 1
jne 0x4f5e4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151a4]
mov edx, dword [ebp - 8]
call fcn.0040405c
jne 0x4f5e4d
xor eax, eax
push ebp
push 0x4f5e43
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x146bc
call fcn.00406604
call fcn.00402874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f5e4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
call fcn.004637d0
test eax, eax
je 0x4f5e7d
cmp dword [ebp - 8], 0
je 0x4f5e7d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15568], 1
jne 0x4f5e8f
cmp dword [ebp - 0xc], 2
je 0x4f5e8f
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7dfb
mov eax, dword [0x50b594]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00451eec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
call fcn.004637d0
add eax, 2
push eax
lea eax, [ebp - 0x28]
mov ecx, 1
mov edx, dword [0x4f5c64]
call fcn.00405afc
add esp, 4
mov eax, dword [ebp - 4]
push dword [eax + 0x1555c]
mov eax, dword [ebp - 4]
push dword [eax + 0x155ac]
push 0x4f7f70
lea eax, [ebp - 0xaed4]
mov edx, 3
call fcn.0040400c
mov edx, dword [ebp - 0xaed4]
mov eax, dword [ebp - 8]
call fcn.0040405c
je 0x4f5f1a
cmp dword [ebp - 0xc], 5
je 0x4f5f1a
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004dff04
mov dword [ebp - 0x5c], 0x15
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5c]
cmp byte [eax + 0x47], 0
jne 0x4f5f5a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14fe0]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp byte [edx + eax*8 + 0xe], 0
jbe 0x4f5f5a
mov eax, dword [ebp - 4]
mov byte [eax + 0x14400], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
call fcn.00465370
call fcn.00463028
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp byte [edx + eax*8 + 0xe], 5
je 0x4f5fae
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
call fcn.00465370
call fcn.00463028
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp byte [edx + eax*8 + 0xe], 6
jne 0x4f5fb8
mov eax, dword [ebp - 4]
mov byte [eax + 0x14400], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x14400], 1
jne 0x4f5ff9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
call fcn.004637d0
test eax, eax
jle 0x4f5ff9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
call fcn.00465370
call fcn.00463028
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004f30f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
call fcn.004637d0
dec eax
test eax, eax
jl 0x4f60a9
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
mov edx, ebx
call fcn.00463c38
mov eax, dword [eax + 8]
lea edx, [ebp - 0xaed8]
call fcn.00409274
mov eax, dword [ebp - 0xaed8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
mov edx, ebx
call fcn.00463c38
pop edx
call fcn.00462908
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
mov edx, ebx
call fcn.00463c38
cmp dword [eax + 8], 0
jne 0x4f609f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
mov edx, ebx
call fcn.00463c38
mov edx, 0x4f7f88
call fcn.00462908
inc ebx
dec dword [ebp - 0x74]
jne 0x4f601c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0x2c]
mov ecx, 0x4f7f98
call fcn.00403f98
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0x30]
mov ecx, 0x4f7fb0
call fcn.00403f98
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004d4cbc
mov dword [ebp - 0x5c], 0x16
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
call fcn.004637d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x151e4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
call fcn.004637d0
imul eax, eax, 0x38
mov edx, dword [ebp - 4]
mov dword [edx + 0x15278], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x254]
call fcn.004637d0
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004f3950
xor esi, esi
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x5c], 0x17
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
dec eax
test eax, eax
jl 0x4f6347
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov ecx, dword [ebp - 0x28]
push esi
lea esi, [edx + eax*8]
lea edi, [ecx + eax*8]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
pop esi
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 0x10], 0
jle 0x4f6214
mov edx, dword [ebp - 0x28]
lea ecx, [esi + 1]
mov dword [edx + eax*8], ecx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov al, byte [edx + eax*8 + 0xe]
cmp al, 4
je 0x4f61fa
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x15194]
cmp al, 5
je 0x4f61fa
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x15194]
cmp al, 6
jne 0x4f61fd
add esi, 0x1e
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
add esi, dword [edx + eax*8 + 0x10]
add esi, 4
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 4], 0
jle 0x4f626c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 8], 0
jle 0x4f626c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp byte [edx + eax*8 + 0xe], 0
jne 0x4f626c
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
inc ecx
mov dword [edx + eax*8 + 4], ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov edx, dword [edx + eax*8 + 8]
add edx, dword [ebp - 0x34]
add edx, 4
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 0x1c], 0
jle 0x4f630b
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp byte [edx + eax*8 + 0x20], 2
jbe 0x4f62e8
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp byte [edx + eax*8 + 0x20], 0x1e
jae 0x4f62e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x155a4]
mov edx, 0x4f7fc8
call fcn.0040405c
jb 0x4f62d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x155a4]
mov edx, 0x4f7fdc
call fcn.0040405c
jbe 0x4f62e8
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov dword [edx + eax*8 + 0x1c], ecx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x50]
inc ecx
mov dword [edx + eax*8 + 0x18], ecx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + eax*8 + 0x1c]
add dword [ebp - 0x50], eax
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 0x2c], 0
jle 0x4f633d
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x58]
mov dword [edx + eax*8 + 0x30], ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
imul eax, dword [edx + eax*8 + 0x2c], 0x78
add dword [ebp - 0x58], eax
inc ebx
dec dword [ebp - 0x74]
jne 0x4f617f
mov eax, dword [ebp - 4]
mov dword [eax + 0x15274], esi
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x15280], edx
mov dword [ebp - 0x5c], 0x18
mov eax, dword [ebp - 8]
call fcn.00409728
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
je 0x4f63c0
mov eax, dword [ebp - 0x40]
and eax, 1
dec eax
jne 0x4f63c0
push 0
mov ecx, 0x4f7eac
mov edx, 0x4f7fe8
mov eax, dword [0x50b418]
mov eax, dword [eax]
call fcn.00453df0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004eef94
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x50b594]
mov eax, dword [eax]
xor edx, edx
call fcn.00451eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7dfb
xor eax, eax
push ebp
push 0x4f6442
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
lea eax, [ebp - 0xaebc]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 2
cmp dword [ebp - 0xc], 2
jne 0x4f6423
mov edx, 1
lea eax, [ebp - 0xaebc]
call fcn.004069d1
call fcn.00402874
lea eax, [ebp - 0xaebc]
call fcn.0040670c
call fcn.00402874
mov edx, eax
lea eax, [ebp - 0xaebc]
call fcn.00406a08
call fcn.00402874
jmp 0x4f6438
mov edx, 1
lea eax, [ebp - 0xaebc]
call fcn.004069e8
call fcn.00402874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6494
lea eax, [ebp - 0xaebc]
call fcn.0040670c
call fcn.00402874
mov dword [ebp - 0x70], eax
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x151ac]
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov eax, dword [ebp - 4]
push dword [eax + 0x1555c]
mov eax, dword [ebp - 4]
push dword [eax + 0x155ac]
push 0x4f803c
mov eax, dword [ebp - 4]
push dword [eax + 0x155ac]
push 0x4f8048
lea eax, [ebp - 0xaedc]
mov edx, 5
call fcn.0040400c
mov edx, dword [ebp - 0xaedc]
lea eax, [ebp - 0xa98c]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 2
mov edx, 1
lea eax, [ebp - 0xa98c]
call fcn.004069e8
call fcn.00402874
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x151ac]
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0xa98c]
call fcn.004065a0
call fcn.00402874
mov dword [ebp - 0x5c], 0x19
lea edx, [ebp - 0xaee0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0xaee0], 0
je 0x4f666a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x148d4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x148d4]
lea eax, [ebp - 0xac24]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0xac24]
call fcn.004069d1
call fcn.00402874
lea eax, [ebp - 0xac24]
call fcn.0040670c
call fcn.00402874
mov edx, dword [ebp - 4]
mov dword [edx + 0x1527c], eax
mov dword [ebp - 0x18], 0xa000
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0xa078]
mov ecx, 0xa000
lea eax, [ebp - 0xac24]
call fcn.0040653c
call fcn.00402874
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x4f6626
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0xa078]
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x1522d]
add byte [eax], dl
inc eax
dec dword [ebp - 0x74]
jne 0x4f6615
push 0
lea edx, [ebp - 0xa078]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
cmp dword [ebp - 0x18], 0xa000
je 0x4f65e6
lea eax, [ebp - 0xac24]
call fcn.00406604
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x148d4]
call fcn.00409764
jmp 0x4f6675
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1527c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
dec eax
test eax, eax
jl 0x4f66b3
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
push 0
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x28]
lea edx, [edx + eax*8]
mov ecx, 0x38
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
inc ebx
dec dword [ebp - 0x74]
jne 0x4f6689
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
dec eax
test eax, eax
jl 0x4f66f7
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
push 0
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
lea edx, [edx + eax*8]
mov ecx, 0x38
lea eax, [ebp - 0xa98c]
call fcn.004065a0
call fcn.00402874
inc ebx
dec dword [ebp - 0x74]
jne 0x4f66c7
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0x14]
mov ecx, 0x4f8058
call fcn.00403f98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov edx, dword [ebp - 0x14]
call fcn.00466510
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.005070b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x15270], eax
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x15270]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14508]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x15270]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14508]
lea eax, [ebp - 0xa98c]
call fcn.004065a0
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14508]
call fcn.004027bc
mov eax, dword [ebp - 0x14]
call fcn.00409764
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
test eax, eax
jl 0x4f67dd
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
push 0
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
lea edx, [edx + eax*8]
mov ecx, 0x38
lea eax, [ebp - 0xa98c]
call fcn.004065a0
call fcn.00402874
inc ebx
dec dword [ebp - 0x74]
jne 0x4f67ad
lea eax, [ebp - 0xa98c]
call fcn.00406604
call fcn.00402874
mov dword [ebp - 0x5c], 0x1a
mov eax, dword [ebp - 4]
call fcn.004d7314
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15550]
call fcn.00404110
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 0x151ac]
mov eax, dword [ebp - 4]
call fcn.004d7638
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx + 0x1553b]
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x1522d], al
inc ebx
cmp ebx, 0x15
jne 0x4f6822
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15554]
call fcn.00404110
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 0x151ac]
mov eax, dword [ebp - 4]
call fcn.004d7638
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx + 0x1553b]
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x15241], al
inc ebx
cmp ebx, 0x15
jne 0x4f6862
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15558]
call fcn.00404110
mov ecx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 0x151ac]
mov eax, dword [ebp - 4]
call fcn.004d7638
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx + 0x1553b]
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x15255], al
inc ebx
cmp ebx, 0x15
jne 0x4f68a2
mov eax, dword [ebp - 4]
lea edx, [eax + 0x151ac]
mov eax, dword [ebp - 4]
call fcn.004d7488
mov edx, dword [ebp - 4]
mov byte [edx + 0x1528f], al
cmp dword [ebp - 0xc], 5
jne 0x4f68f9
mov eax, dword [ebp - 4]
add eax, 0x1529a
mov edx, 0x4f8064
mov cl, 0xf
call fcn.00402b0c
mov eax, dword [ebp - 4]
inc dword [eax + 0x15290]
call fcn.00402a7c
mov eax, 3
call fcn.00402c9c
cmp eax, 2
jne 0x4f695c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb44], 0x1f4
jge 0x4f695c
push 0x3a2
lea edx, [ebp - 0xaee4]
mov eax, dword [0x50b418]
mov eax, dword [eax]
call fcn.00454160
mov edx, dword [ebp - 0xaee4]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004d5068
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1443c], 0xd
je 0x4f695c
mov eax, dword [ebp - 4]
sub dword [eax + 0x151e4], 0x2712
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0xaebc]
call fcn.00406a08
call fcn.00402874
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x151ac]
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
lea eax, [ebp - 0xaebc]
call fcn.0040670c
call fcn.00402874
mov edx, eax
lea eax, [ebp - 0xaebc]
call fcn.00406a08
call fcn.00402874
mov dword [ebp - 0x5c], 0x1b
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x15198]
lea eax, [ebp - 0xac24]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0xac24]
call fcn.004069d1
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
dec eax
test eax, eax
jl 0x4f6bb3
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 0x10], 0
jle 0x4f6ba9
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov edx, dword [edx + eax*8]
dec edx
lea eax, [ebp - 0xac24]
call fcn.00406a08
call fcn.00402874
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x38]
mov ecx, 4
lea eax, [ebp - 0xac24]
call fcn.0040653c
call fcn.00402874
push 0
lea edx, [ebp - 0x38]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov al, byte [edx + eax*8 + 0xe]
cmp al, 4
je 0x4f6ab4
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x15194]
cmp al, 5
je 0x4f6ab4
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x15194]
cmp al, 6
jne 0x4f6af0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0xa078]
mov ecx, 0x1e
lea eax, [ebp - 0xac24]
call fcn.0040653c
call fcn.00402874
push 0
lea edx, [ebp - 0xa078]
mov ecx, 0x1e
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov dword [ebp - 0x18], 0xa000
xor esi, esi
jmp 0x4f6b86
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov eax, dword [edx + eax*8 + 0x10]
sub eax, esi
cmp eax, 0xa000
jle 0x4f6b3c
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0xa078]
mov ecx, 0xa000
lea eax, [ebp - 0xac24]
call fcn.0040653c
call fcn.00402874
jmp 0x4f6b68
lea edx, [ebp - 0x18]
push edx
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x15194]
mov ecx, eax
lea edx, [ebp - 0xa078]
lea eax, [ebp - 0xac24]
call fcn.0040653c
call fcn.00402874
push 0
lea edx, [ebp - 0xa078]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
add esi, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa000
jne 0x4f6ba9
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp esi, dword [edx + eax*8 + 0x10]
jl 0x4f6afe
inc ebx
dec dword [ebp - 0x74]
jne 0x4f6a01
lea eax, [ebp - 0xac24]
call fcn.00406604
call fcn.00402874
mov dword [ebp - 0x5c], 0x1c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1519c]
lea eax, [ebp - 0xa1c4]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0xa1c4]
call fcn.004069d1
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
dec eax
test eax, eax
jl 0x4f6d72
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 4], 0
jle 0x4f6d68
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 8], 0
jle 0x4f6d68
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp byte [edx + eax*8 + 0xe], 0
jne 0x4f6d68
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov edx, dword [edx + eax*8 + 4]
dec edx
lea eax, [ebp - 0xa1c4]
call fcn.00406a08
call fcn.00402874
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x38]
mov ecx, 4
lea eax, [ebp - 0xa1c4]
call fcn.0040653c
call fcn.00402874
push 0
lea edx, [ebp - 0x38]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov dword [ebp - 0x18], 0xa000
xor esi, esi
jmp 0x4f6d45
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov eax, dword [edx + eax*8 + 8]
sub eax, esi
cmp eax, 0xa000
jle 0x4f6cfb
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0xa078]
mov ecx, 0xa000
lea eax, [ebp - 0xa1c4]
call fcn.0040653c
call fcn.00402874
jmp 0x4f6d27
lea edx, [ebp - 0x18]
push edx
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x15194]
mov ecx, eax
lea edx, [ebp - 0xa078]
lea eax, [ebp - 0xa1c4]
call fcn.0040653c
call fcn.00402874
push 0
lea edx, [ebp - 0xa078]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
add esi, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa000
jne 0x4f6d68
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp esi, dword [edx + eax*8 + 8]
jl 0x4f6cbd
inc ebx
dec dword [ebp - 0x74]
jne 0x4f6c13
lea eax, [ebp - 0xa1c4]
call fcn.00406604
call fcn.00402874
mov dword [ebp - 0x5c], 0x1d
lea eax, [ebp - 0xaebc]
call fcn.004066c8
call fcn.00402874
mov dword [ebp - 0x64], eax
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x152ac]
mov ecx, 0x290
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x161dd]
mov edx, dword [ebp - 4]
mov byte [edx + 0x15413], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x161de]
mov edx, dword [ebp - 4]
mov byte [edx + 0x15414], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x161df]
mov edx, dword [ebp - 4]
mov byte [edx + 0x15415], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x161e0]
mov edx, dword [ebp - 4]
mov byte [edx + 0x15416], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x161e1]
mov edx, dword [ebp - 4]
mov byte [edx + 0x15417], al
lea eax, [ebp - 0xafe4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x155a8]
mov ecx, 0xff
call fcn.00403f28
lea edx, [ebp - 0xafe4]
mov eax, dword [ebp - 4]
add eax, 0x1532d
mov cl, 0x14
call fcn.00402b58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15364], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15360], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15368], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1536c], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x213], 2
jne 0x4f6e99
mov eax, dword [ebp - 4]
mov dword [eax + 0x15364], 0xfffffff2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165e8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15370], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165e4]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15374], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165ec]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15378], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165f0]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1537c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165f4]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15380], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c4]
mov eax, dword [eax + 0x60]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15384], eax
lea edx, [ebp - 0xafe8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x58]
call fcn.0041bab0
mov edx, dword [ebp - 0xafe8]
lea eax, [ebp - 0xafe4]
mov ecx, 0xff
call fcn.00403f28
lea edx, [ebp - 0xafe4]
mov eax, dword [ebp - 4]
add eax, 0x15398
mov cl, 0x16
call fcn.00402b58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x58]
call fcn.0041bb24
mov edx, dword [ebp - 4]
mov dword [edx + 0x153b0], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa0c]
mov eax, dword [eax + 0x58]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x153b4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x798]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15440], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x96c]
cmp byte [eax + 0x2c], 1
jne 0x4f6faa
mov eax, dword [ebp - 4]
mov byte [eax + 0x15434], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x970]
cmp byte [eax + 0x2c], 1
jne 0x4f6fc3
mov eax, dword [ebp - 4]
mov byte [eax + 0x15434], 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x974]
cmp byte [eax + 0x2c], 1
jne 0x4f6fdc
mov eax, dword [ebp - 4]
mov byte [eax + 0x15434], 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x944]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15438], eax
mov dword [ebp - 0x5c], 0x1e
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x15388], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15567], 3
jne 0x4f7307
cmp dword [ebp - 0xc], 2
jne 0x4f7307
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0xafec]
mov ecx, 0x4f8070
call fcn.00403f98
mov eax, dword [ebp - 0xafec]
call fcn.00409718
test al, al
je 0x4f70d5
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0x60]
mov ecx, 0x4f8070
call fcn.00403f98
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, dword [0x50e840]
mov edx, dword [edx + 0x148dc]
call fcn.00403d20
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, 0x4f808c
call fcn.00403f54
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00494870
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, 0x4f809c
call fcn.00403f54
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00404110
push eax
mov eax, dword [ebp - 0x60]
call fcn.00404110
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x50e840]
mov byte [eax + 0x15401], 4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0xaff0]
mov ecx, 0x4f80b0
call fcn.00403f98
mov eax, dword [ebp - 0xaff0]
call fcn.00409718
test al, al
je 0x4f7192
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0x60]
mov ecx, 0x4f80b0
call fcn.00403f98
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, dword [0x50e840]
mov edx, dword [edx + 0x148dc]
call fcn.00403d20
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, 0x4f808c
call fcn.00403f54
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00494870
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, 0x4f80cc
call fcn.00403f54
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00404110
push eax
mov eax, dword [ebp - 0x60]
call fcn.00404110
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x50e840]
mov byte [eax + 0x15401], 3
jmp 0x4f7307
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0xaff4]
mov ecx, 0x4f80e0
call fcn.00403f98
mov eax, dword [ebp - 0xaff4]
call fcn.00409718
test al, al
je 0x4f724f
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0x60]
mov ecx, 0x4f80e0
call fcn.00403f98
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, dword [0x50e840]
mov edx, dword [edx + 0x148dc]
call fcn.00403d20
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, 0x4f808c
call fcn.00403f54
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00494870
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, 0x4f80fc
call fcn.00403f54
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00404110
push eax
mov eax, dword [ebp - 0x60]
call fcn.00404110
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x50e840]
mov byte [eax + 0x15401], 1
jmp 0x4f7307
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0xaff8]
mov ecx, 0x4f8110
call fcn.00403f98
mov eax, dword [ebp - 0xaff8]
call fcn.00409718
test al, al
je 0x4f7307
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1555c]
lea eax, [ebp - 0x60]
mov ecx, 0x4f8110
call fcn.00403f98
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, dword [0x50e840]
mov edx, dword [edx + 0x148dc]
call fcn.00403d20
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, 0x4f808c
call fcn.00403f54
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00494870
mov eax, dword [ebp - 4]
add eax, 0x165d4
mov edx, 0x4f812c
call fcn.00403f54
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00404110
push eax
mov eax, dword [ebp - 0x60]
call fcn.00404110
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x50e840]
mov byte [eax + 0x15401], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165dc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1538c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165e0]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15390], eax
mov dword [ebp - 0x5c], 0x1f
lea edx, [ebp - 0xaffc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6ec]
call fcn.00435428
cmp dword [ebp - 0xaffc], 0
je 0x4f73e8
mov eax, dword [ebp - 4]
push dword [eax + 0x1555c]
mov eax, dword [ebp - 4]
push dword [eax + 0x155ac]
push 0x4f8140
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040400c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6ec]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.005070b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x15394], eax
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x15394]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14508]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14508]
call fcn.004027bc
mov eax, dword [ebp - 0x14]
call fcn.00409764
jmp 0x4f73f3
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x15394], edx
cmp dword [ebp - 0xc], 1
je 0x4f73ff
cmp dword [ebp - 0xc], 2
jne 0x4f7475
mov eax, dword [ebp - 4]
cmp dword [eax + 0x165d8], 0
je 0x4f7475
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d8]
call fcn.00409718
test al, al
je 0x4f7475
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x165d8]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.005070b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x153d0], eax
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x153d0]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14508]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14508]
call fcn.004027bc
jmp 0x4f7480
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x153d0], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x50]
mov dword [eax + 0x153d4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x54]
mov dword [eax + 0x153fc], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15388]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x15394]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x153d0]
mov edx, dword [ebp - 4]
mov dword [edx + 0x153d8], eax
mov dword [ebp - 0x5c], 0x20
mov ebx, 1
mov eax, 0xaa
call fcn.00402c9c
mov edx, ebx
imul edx, edx, 0x17
add al, dl
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x153dc], al
inc ebx
cmp ebx, 0x15
jne 0x4f74c8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14a94], 0
je 0x4f7568
mov eax, 0xaa
call fcn.00402c9c
add al, 0x37
mov edx, dword [ebp - 4]
mov byte [edx + 0x153dd], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14a94]
call fcn.00403f4c
mov edx, dword [ebp - 4]
mov byte [edx + 0x153de], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14a94]
call fcn.00403f4c
add eax, 2
sub eax, 3
jl 0x4f757d
inc eax
mov dword [ebp - 0x74], eax
mov ebx, 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14a94]
mov al, byte [eax + ebx - 3]
mov edx, dword [ebp - 4]
add al, byte [edx + 0x153dd]
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x153dc], al
inc ebx
dec dword [ebp - 0x74]
jne 0x4f7540
jmp 0x4f757d
mov eax, 0x1e
call fcn.00402c9c
add al, 0xb
mov edx, dword [ebp - 4]
mov byte [edx + 0x153dd], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x15567]
mov edx, dword [ebp - 4]
mov byte [edx + 0x153f0], al
mov ebx, 1
mov eax, dword [ebp - 4]
mov byte [eax + ebx + 0x15450], 0
inc ebx
cmp ebx, 0xec
jne 0x4f7594
mov dword [ebp - 0x5c], 0x21
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x151a0]
lea eax, [ebp - 0xa840]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0xa840]
call fcn.004069d1
call fcn.00402874
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x153d4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
dec eax
test eax, eax
jl 0x4f7709
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 0x28]
cmp dword [edx + eax*8 + 0x1c], 0
jle 0x4f76ff
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov edx, dword [edx + eax*8 + 0x18]
dec edx
lea eax, [ebp - 0xa840]
call fcn.00406a08
call fcn.00402874
mov dword [ebp - 0x18], 0xa000
xor esi, esi
jmp 0x4f76d3
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov eax, dword [edx + eax*8 + 0x1c]
sub eax, esi
cmp eax, 0xa000
jle 0x4f7689
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0xa078]
mov ecx, 0xa000
lea eax, [ebp - 0xa840]
call fcn.0040653c
call fcn.00402874
jmp 0x4f76b5
lea edx, [ebp - 0x18]
push edx
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x15194]
mov ecx, eax
lea edx, [ebp - 0xa078]
lea eax, [ebp - 0xa840]
call fcn.0040653c
call fcn.00402874
push 0
lea edx, [ebp - 0xa078]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
add esi, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa000
jne 0x4f76f6
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp esi, dword [edx + eax*8 + 0x1c]
jl 0x4f764b
mov eax, dword [ebp - 4]
add dword [eax + 0x153d4], esi
inc ebx
dec dword [ebp - 0x74]
jne 0x4f7603
lea eax, [ebp - 0xa840]
call fcn.00406604
call fcn.00402874
mov dword [ebp - 0x5c], 0x22
cmp dword [ebp - 0xc], 5
je 0x4f779c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14a98], 0
je 0x4f779c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14a98]
call fcn.00409718
test al, al
je 0x4f779c
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14a98]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.005070b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x153f4], eax
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x153f4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14508]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14508]
call fcn.004027bc
jmp 0x4f77a7
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x153f4], edx
mov dword [ebp - 0x5c], 0x23
lea edx, [ebp - 0xb000]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14a90]
call fcn.00409274
mov eax, dword [ebp - 0xb000]
call fcn.00403f4c
mov edx, dword [ebp - 4]
mov dword [edx + 0x15408], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x15408], 0
jle 0x4f783c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14a90]
call fcn.00403f4c
test eax, eax
jle 0x4f781b
mov dword [ebp - 0x74], eax
mov ebx, 1
lea eax, [ebp - 0xa078]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x14a90]
mov dl, byte [edx + ebx - 1]
add dl, 0x64
mov byte [eax], dl
inc ebx
inc eax
dec dword [ebp - 0x74]
jne 0x4f7802
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x15408]
lea edx, [ebp - 0xa078]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x148ec]
mov ecx, 0x18c
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov dword [ebp - 0x5c], 0x24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x148dc]
call fcn.00409718
test al, al
je 0x4f7908
mov eax, dword [ebp - 4]
cmp byte [eax + 0x15567], 3
je 0x4f788b
cmp dword [ebp - 0xc], 2
jne 0x4f7908
lea eax, [ebp - 0xaebc]
call fcn.00406604
call fcn.00402874
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x148dc]
lea eax, [ebp - 0xb004]
mov ecx, 0x4f8154
call fcn.00403f98
mov eax, dword [ebp - 0xb004]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x148dc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004f26d8
add eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x1541c], eax
mov edx, dword [ebp - 8]
lea eax, [ebp - 0xaebc]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 2
mov edx, 1
lea eax, [ebp - 0xaebc]
call fcn.004069d1
call fcn.00402874
jmp 0x4f7913
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1541c], edx
mov dword [ebp - 0x5c], 0x25
lea eax, [ebp - 0xaebc]
call fcn.0040670c
call fcn.00402874
mov edx, eax
lea eax, [ebp - 0xaebc]
call fcn.00406a08
call fcn.00402874
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xb28]
lea eax, [ebp - 0xa1c4]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 0
mov edx, 1
lea eax, [ebp - 0xa1c4]
call fcn.004069d1
call fcn.00402874
lea eax, [ebp - 0xaebc]
call fcn.004066c8
call fcn.00402874
sub eax, dword [ebp - 0x70]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1543c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
dec eax
test eax, eax
jl 0x4f7a89
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov esi, ebx
shl esi, 3
sub esi, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15194]
cmp dword [eax + esi*8 + 0x2c], 0
jle 0x4f7a7f
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov eax, dword [edx + eax*8 + 0x2c]
inc eax
push eax
lea eax, [ebp - 0x68]
mov ecx, 1
mov edx, dword [0x4f5c7c]
call fcn.00405afc
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15194]
mov edx, dword [eax + esi*8 + 0x30]
lea eax, [ebp - 0xa1c4]
call fcn.00406a08
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15194]
mov eax, dword [eax + esi*8 + 0x2c]
dec eax
test eax, eax
jl 0x4f7a7f
inc eax
mov dword [ebp - 0x78], eax
xor edi, edi
push 0
mov esi, edi
shl esi, 4
sub esi, edi
mov eax, dword [ebp - 0x68]
lea edx, [eax + esi*8]
mov ecx, 0x78
lea eax, [ebp - 0xa1c4]
call fcn.0040653c
call fcn.00402874
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x6c]
mov dword [eax + esi*8], edx
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + esi*8 + 4]
mov edx, dword [ebp - 0x6c]
add edx, 0x1e
add eax, edx
mov dword [ebp - 0x6c], eax
push 0
mov eax, dword [ebp - 0x68]
lea edx, [eax + esi*8]
mov ecx, 0x78
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
inc edi
dec dword [ebp - 0x78]
jne 0x4f7a1d
inc ebx
dec dword [ebp - 0x74]
jne 0x4f79a1
lea eax, [ebp - 0xaebc]
call fcn.004066c8
call fcn.00402874
sub eax, dword [ebp - 0x70]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15430], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151e4]
dec eax
test eax, eax
jl 0x4f7c7b
inc eax
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
cmp dword [edx + eax*8 + 0x2c], 0
jle 0x4f7c71
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov eax, dword [edx + eax*8 + 0x2c]
push eax
lea eax, [ebp - 0x68]
mov ecx, 1
mov edx, dword [0x4f5c7c]
call fcn.00405afc
add esp, 4
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov eax, dword [edx + eax*8 + 0x2c]
dec eax
test eax, eax
jl 0x4f7c71
inc eax
mov dword [ebp - 0x78], eax
xor edi, edi
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x15194]
mov edx, dword [edx + eax*8 + 0x30]
imul eax, edi, 0x78
add edx, eax
lea eax, [ebp - 0xa1c4]
call fcn.00406a08
call fcn.00402874
push 0
mov esi, edi
shl esi, 4
sub esi, edi
mov eax, dword [ebp - 0x68]
lea edx, [eax + esi*8]
mov ecx, 0x78
lea eax, [ebp - 0xa1c4]
call fcn.0040653c
call fcn.00402874
mov eax, dword [ebp - 0x68]
mov edx, dword [eax + esi*8]
lea eax, [ebp - 0xa1c4]
call fcn.00406a08
call fcn.00402874
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0xa078]
mov ecx, 0x1e
lea eax, [ebp - 0xa1c4]
call fcn.0040653c
call fcn.00402874
push 0
lea edx, [ebp - 0xa078]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov dword [ebp - 0x18], 0xa000
xor esi, esi
jmp 0x4f7c4a
mov eax, edi
shl eax, 4
sub eax, edi
mov edx, dword [ebp - 0x68]
mov eax, dword [edx + eax*8 + 4]
sub eax, esi
cmp eax, 0xa000
jle 0x4f7c06
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0xa078]
mov ecx, 0xa000
lea eax, [ebp - 0xa1c4]
call fcn.0040653c
call fcn.00402874
jmp 0x4f7c2c
lea edx, [ebp - 0x18]
push edx
mov edx, edi
shl edx, 4
sub edx, edi
mov ecx, dword [ebp - 0x68]
mov ecx, eax
lea edx, [ebp - 0xa078]
lea eax, [ebp - 0xa1c4]
call fcn.0040653c
call fcn.00402874
push 0
lea edx, [ebp - 0xa078]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
add esi, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa000
jne 0x4f7c67
mov eax, edi
shl eax, 4
sub eax, edi
mov edx, dword [ebp - 0x68]
cmp esi, dword [edx + eax*8 + 4]
jl 0x4f7bce
inc edi
dec dword [ebp - 0x78]
jne 0x4f7b26
inc ebx
dec dword [ebp - 0x74]
jne 0x4f7abd
lea eax, [ebp - 0xa1c4]
call fcn.00406604
call fcn.00402874
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0xaebc]
call fcn.00406a08
call fcn.00402874
push 0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x152ac]
mov ecx, 0x290
lea eax, [ebp - 0xaebc]
call fcn.004065a0
call fcn.00402874
mov dword [ebp - 0x5c], 0x26
lea eax, [ebp - 0xaebc]
call fcn.00406604
call fcn.00402874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x165d4]
call fcn.00409764
cmp dword [ebp - 0xc], 2
je 0x4f7d02
push 0xe4
push 0
mov ecx, 0xe4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d9d7c
jmp 0x4f7d1b
push 0xe4
mov eax, dword [ebp - 0x70]
push eax
mov ecx, 0xe4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d9d7c
mov eax, dword [0x50b594]
mov eax, dword [eax]
xor edx, edx
call fcn.00451eec
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x4f7d4f
cmp dword [ebp - 0xc], 1
jne 0x4f7d99
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x151a4]
mov edx, dword [ebp - 8]
call fcn.0040405c
jne 0x4f7d99
mov eax, dword [ebp - 4]
add eax, 0x146bc
mov edx, dword [ebp - 8]
call fcn.0040649a
mov eax, dword [0x50b4bc]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0x146bc
mov edx, 1
call fcn.004069d1
call fcn.00402874
mov eax, dword [ebp - 4]
add eax, 0x146bc
call fcn.0040670c
call fcn.00402874
mov edx, dword [ebp - 4]
mov dword [edx + 0xaf8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7dfb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7ea2
lea eax, [ebp - 0xb004]
mov edx, 2
call fcn.00403cf0
lea eax, [ebp - 0xaffc]
call fcn.00403ccc
lea eax, [ebp - 0xaff8]
mov edx, 4
call fcn.00403cf0
lea eax, [ebp - 0xafe8]
call fcn.00403ccc
lea eax, [ebp - 0xaee4]
mov edx, 0xa
call fcn.00403cf0
lea eax, [ebp - 0x68]
mov edx, dword [0x4f5c7c]
call fcn.00405b08
lea eax, [ebp - 0x60]
call fcn.00403ccc
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00403cf0
lea eax, [ebp - 0x28]
mov edx, dword [0x4f5c64]
call fcn.00405b08
lea eax, [ebp - 0x24]
call fcn.00403ccc
lea eax, [ebp - 0x14]
call fcn.00403ccc
lea eax, [ebp - 8]
call fcn.00403ccc
ret