Function at 0x4bae80
Capabilities:
Lock the desktop
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x4bae89
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404cb0
mov eax, dword [ebp - 0xc]
call fcn.00404cb0
xor eax, eax
push ebp
push 0x4bbe97
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00408c18
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404898
mov edx, dword [ebp - 8]
mov eax, 0x4bbeb4
call fcn.00404e04
test eax, eax
jle 0x4baeee
call fcn.004b71e8
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbed0
call fcn.00404e04
test eax, eax
jle 0x4baf35
push 0
push 0
push 0
push 0x5b
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x46
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x46
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x5b
call sub.user32.dll_keybd_event
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbee4
call fcn.00404e04
test eax, eax
jle 0x4baf67
push 0
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004b6a60
mov edx, dword [ebp - 0x20]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov bl, 1
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbef8
call fcn.00404e04
test eax, eax
jle 0x4baf7f
call fcn.004b76b8
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbf10
call fcn.00404e04
test eax, eax
jle 0x4bb030
cmp dword [0x4daed8], 0
je 0x4bafc7
push 0
call fcn.0040b04c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x24]
mov eax, dword [0x4daed8]
call fcn.0040bcf4
mov edx, dword [ebp - 0x24]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
jmp 0x4bb028
push 0
call fcn.0040b04c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x2c]
mov eax, 0x4bbf20
call fcn.0040bcf4
push dword [ebp - 0x2c]
push 0x4bbf40
call fcn.0040b04c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004b14f4
movzx eax, ax
lea edx, [ebp - 0x30]
call fcn.004092bc
push dword [ebp - 0x30]
push 0x4bbf50
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404b80
mov edx, dword [ebp - 0x28]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov bl, 1
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbf5c
call fcn.00404e04
test eax, eax
jg 0x4bb063
mov edx, dword [ebp - 8]
mov eax, 0x4bbf74
call fcn.00404e04
test eax, eax
jg 0x4bb063
mov edx, dword [ebp - 8]
mov eax, 0x4bbf8c
call fcn.00404e04
test eax, eax
jle 0x4bb06b
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbfa8
call fcn.00404e04
test eax, eax
jle 0x4bb08c
call fcn.004bacac
push 0
push 2
call sub.user32.dll_ExitWindowsEx
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbfbc
call fcn.00404e04
test eax, eax
jle 0x4bb0ad
call fcn.004bacac
push 0
push 1
call sub.user32.dll_ExitWindowsEx
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbfd0
call fcn.00404e04
test eax, eax
jle 0x4bb0da
push 0
push 0xf140
push 0x112
mov eax, dword [ebp - 4]
call fcn.00468018
push eax
call sub.user32.dll_PostMessageA
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbfe8
call fcn.00404e04
test eax, eax
jle 0x4bb0f6
push 0
push 0
call sub.user32.dll_ExitWindowsEx
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bbffc
call fcn.00404e04
test eax, eax
jle 0x4bb116
mov eax, 0x4d920c
mov edx, dword [ebp - 8]
call fcn.00404854
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc010
call fcn.00404e04
test eax, eax
jle 0x4bb136
mov eax, 0x4d920c
mov edx, dword [ebp - 8]
call fcn.00404854
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc020
call fcn.00404e04
test eax, eax
jle 0x4bb14e
call sub.user32.dll_LockWorkStation
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc030
call fcn.00404e04
test eax, eax
jle 0x4bb166
call fcn.004b37e0
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc044
call fcn.00404e04
test eax, eax
jle 0x4bb1b2
call fcn.004b37e0
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc060
call fcn.00404e04
test eax, eax
jle 0x4bb1f3
mov al, 1
call fcn.004d15e4
push 0
mov cl, 1
mov edx, 0x4bc078
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x42c]
mov dl, 1
call fcn.00437918
mov bl, 1
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc09c
call fcn.00404e04
test eax, eax
jle 0x4bb214
call fcn.004bacac
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_SetSystemPowerState
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc0b0
call fcn.00404e04
test eax, eax
jle 0x4bb235
call fcn.004bacac
push 0
push 0
call sub.kernel32.dll_SetSystemPowerState
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc0c4
call fcn.00404e04
test eax, eax
jle 0x4bb26f
xor eax, eax
push ebp
push 0x4bb263
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004a0f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb26d
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc0d4
call fcn.00404e04
test eax, eax
jle 0x4bb292
mov eax, 0xb0
call fcn.004bad40
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc0e4
call fcn.00404e04
test eax, eax
jle 0x4bb2b5
mov eax, 0xb1
call fcn.004bad40
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc0f4
call fcn.00404e04
test eax, eax
jle 0x4bb2d2
mov eax, 0xb3
call fcn.004bad40
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc104
call fcn.00404e04
test eax, eax
jle 0x4bb2ef
mov eax, 0xb2
call fcn.004bad40
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc114
call fcn.00404e04
test eax, eax
jle 0x4bb312
mov eax, 0xb5
call fcn.004bad40
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc124
call fcn.00404e04
test eax, eax
jle 0x4bb33f
cmp dword [0x4d9208], 0
je 0x4bb33d
push 0
push 0
push 0x10
mov eax, dword [0x4d9208]
push eax
call sub.user32.dll_PostMessageA
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc138
call fcn.00404e04
test eax, eax
jle 0x4bb368
cmp dword [0x4d9208], 0
je 0x4bb366
push 3
mov eax, dword [0x4d9208]
push eax
call sub.user32.dll_ShowWindow
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc14c
call fcn.00404e04
test eax, eax
jle 0x4bb391
cmp dword [0x4d9208], 0
je 0x4bb38f
push 6
mov eax, dword [0x4d9208]
push eax
call sub.user32.dll_ShowWindow
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc160
call fcn.00404e04
test eax, eax
jle 0x4bb3ba
cmp dword [0x4d9208], 0
je 0x4bb3b8
push 9
mov eax, dword [0x4d9208]
push eax
call sub.user32.dll_ShowWindow
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc174
call fcn.00404e04
test eax, eax
jle 0x4bb3e3
cmp dword [0x4d9208], 0
je 0x4bb3e1
push 1
mov eax, dword [0x4d9208]
push eax
call sub.user32.dll_ShowWindow
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc184
call fcn.00404e04
test eax, eax
jle 0x4bb44b
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00408c4c
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0xc]
call fcn.00404898
cmp dword [ebp - 0xc], 0
jne 0x4bb429
lea edx, [ebp - 0x38]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
call fcn.004ba650
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0xc]
call fcn.00408c4c
lea eax, [ebp - 0x40]
push eax
xor ecx, ecx
mov edx, 0x4bc194
mov eax, dword [ebp - 0xc]
call fcn.00438dec
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x3c]
mov dl, 1
call fcn.004b48d8
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc1a0
call fcn.00404e04
test eax, eax
jle 0x4bb47c
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
call fcn.004ba650
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4d9208]
call fcn.004b9f64
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc1b4
call fcn.00404e04
test eax, eax
jle 0x4bb4ad
lea edx, [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
call fcn.004ba650
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4d9208]
call fcn.004ba260
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc1c8
call fcn.00404e04
test eax, eax
jle 0x4bb5b8
mov dword [ebp - 0x10], 0xffffb1e0
mov dword [ebp - 0x14], 0xffffb1e0
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
call fcn.00408c4c
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0xc]
call fcn.00404898
cmp dword [ebp - 0xc], 0
jne 0x4bb505
lea edx, [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
call fcn.004ba650
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0xc]
call fcn.00408c4c
xor eax, eax
push ebp
push 0x4bb57a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc1dc
call fcn.00404e04
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404d20
mov eax, dword [ebp - 0x54]
call fcn.004093f8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc1dc
call fcn.00404e04
inc eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404ac0
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.00404d20
mov eax, dword [ebp - 0x18]
call fcn.004093f8
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb584
cmp dword [ebp - 0x10], 0xffffb1e0
je 0x4bb5b0
cmp dword [ebp - 0x14], 0xffffb1e0
je 0x4bb5b0
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4dadd8]
call fcn.00460f90
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4dadd8]
call fcn.00460fb4
mov bl, 1
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc1e8
call fcn.00404e04
test eax, eax
jle 0x4bb5e0
cmp dword [0x4d9208], 0
je 0x4bb5de
mov dl, 1
mov eax, dword [0x4d9208]
call fcn.004ba534
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc200
call fcn.00404e04
test eax, eax
jle 0x4bb608
cmp dword [0x4d9208], 0
je 0x4bb606
xor edx, edx
mov eax, dword [0x4d9208]
call fcn.004ba534
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc214
call fcn.00404e04
test eax, eax
jle 0x4bb62e
cmp dword [0x4d9208], 0
je 0x4bb62c
mov eax, dword [0x4d9208]
call fcn.004b9e6c
mov bl, 1
mov eax, dword [ebp - 8]
mov edx, 0x4bc228
call fcn.00404c0c
jne 0x4bb644
call fcn.004b9c90
mov bl, 1
mov eax, dword [ebp - 8]
mov edx, 0x4bc234
call fcn.00404c0c
jne 0x4bb65a
call fcn.004b9d38
mov bl, 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc240
call fcn.00404e04
test eax, eax
jle 0x4bb7c0
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc]
call fcn.00408c4c
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0xc]
call fcn.00404898
cmp dword [ebp + 8], 0
je 0x4bb6cf
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004ba7e0
cmp dword [ebp - 0x5c], 0
je 0x4bb6cf
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004ba7e0
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00408c4c
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 0xc]
call fcn.00404898
mov eax, dword [ebp - 0xc]
mov edx, 0x4bc254
call fcn.00404c0c
jne 0x4bb733
fld qword [0x4d9258]
fcomp dword [0x4bc25c]
fnstsw ax
sahf
je 0x4bb733
push 0
push 0x4bc268
lea eax, [ebp - 0x6c]
call fcn.004bad70
push dword [ebp - 0x6c]
push 0x4bc274
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00404b80
mov edx, dword [ebp - 0x68]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
xor eax, eax
mov dword [0x4d9258], eax
mov dword [0x4d925c], eax
jmp 0x4bb7b8
mov eax, dword [ebp - 0xc]
mov edx, 0x4bc290
call fcn.00404c0c
jne 0x4bb761
call fcn.0040b04c
fstp qword [0x4d9258]
wait
push 0
mov cl, 1
mov edx, 0x4bc2a0
mov eax, dword [ebp - 4]
call fcn.004b95b8
jmp 0x4bb7b8
fld qword [0x4d9258]
fcomp dword [0x4bc25c]
fnstsw ax
sahf
jne 0x4bb791
call fcn.0040b04c
fstp qword [0x4d9258]
wait
push 0
mov cl, 1
mov edx, 0x4bc2a0
mov eax, dword [ebp - 4]
call fcn.004b95b8
jmp 0x4bb7b8
push 0
lea eax, [ebp - 0x74]
call fcn.004bad70
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
mov edx, 0x4bc268
call fcn.00404b0c
mov edx, dword [ebp - 0x70]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov bl, 1
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc2bc
call fcn.00404e04
test eax, eax
jle 0x4bbbc8
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0xc]
call fcn.00408c4c
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0xc]
call fcn.00404898
cmp dword [ebp + 8], 0
je 0x4bb83b
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004ba7e0
cmp dword [ebp - 0x7c], 0
je 0x4bb83b
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004ba7e0
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.00408c4c
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0xc]
call fcn.00404898
mov eax, dword [ebp - 0xc]
mov edx, 0x4bc254
call fcn.00404c0c
jne 0x4bb8a1
fld qword [0x4d9260]
fcomp dword [0x4bc25c]
fnstsw ax
sahf
je 0x4bb8a1
push 0
lea eax, [ebp - 0x8c]
call fcn.004badf8
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
mov edx, 0x4bc2cc
call fcn.00404b0c
mov edx, dword [ebp - 0x88]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
xor eax, eax
mov dword [0x4d9260], eax
mov dword [0x4d9264], eax
jmp 0x4bbbc0
cmp dword [ebp - 0xc], 0
je 0x4bbb69
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc268
call fcn.00404e04
test eax, eax
jle 0x4bb8fa
push 0x4d9268
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc268
call fcn.00404e04
mov edx, eax
inc edx
mov ecx, 0x3e8
mov eax, dword [ebp - 0xc]
call fcn.00404d20
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc268
call fcn.00404e04
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 0x3e8
call fcn.00404d60
mov edx, 0x4bc194
mov eax, dword [ebp - 0xc]
call fcn.0049af5c
test eax, eax
jne 0x4bb939
mov eax, dword [ebp - 0xc]
call fcn.004093f8
mov dword [ebp - 0x10], eax
call fcn.0040b04c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x10]
cdq
push edx
push eax
call fcn.004b1584
fstp qword [0x4d9260]
wait
jmp 0x4bbb24
mov edx, 0x4bc194
mov eax, dword [ebp - 0xc]
call fcn.0049af5c
dec eax
jne 0x4bb9fd
lea eax, [ebp - 0x90]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc194
call fcn.00404e04
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404d20
mov eax, dword [ebp - 0x90]
call fcn.004093f8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc194
call fcn.00404e04
inc eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404ac0
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.00404d20
mov eax, dword [ebp - 0x18]
call fcn.004093f8
mov dword [ebp - 0x14], eax
call fcn.0040b04c
fstp qword [0x4d9260]
wait
push dword [0x4d9264]
push dword [0x4d9260]
mov eax, dword [ebp - 0x10]
cdq
push edx
push eax
call fcn.004b1558
fstp qword [0x4d9260]
wait
push dword [0x4d9264]
push dword [0x4d9260]
mov eax, dword [ebp - 0x14]
cdq
push edx
push eax
call fcn.004b1584
fstp qword [0x4d9260]
wait
jmp 0x4bbb24
mov edx, 0x4bc194
mov eax, dword [ebp - 0xc]
call fcn.0049af5c
cmp eax, 2
jne 0x4bbb24
lea eax, [ebp - 0x94]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc194
call fcn.00404e04
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404d20
mov eax, dword [ebp - 0x94]
call fcn.004093f8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc194
call fcn.00404e04
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00404d60
lea eax, [ebp - 0x98]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc194
call fcn.00404e04
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404d20
mov eax, dword [ebp - 0x98]
call fcn.004093f8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc194
call fcn.00404e04
inc eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404ac0
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.00404d20
call fcn.0040b04c
fstp qword [0x4d9260]
wait
push dword [0x4d9264]
push dword [0x4d9260]
mov eax, dword [ebp - 0x10]
cdq
push edx
push eax
call fcn.004b1558
fstp qword [0x4d9260]
wait
push dword [0x4d9264]
push dword [0x4d9260]
mov eax, dword [ebp - 0x14]
cdq
push edx
push eax
call fcn.004b1584
fstp qword [0x4d9260]
wait
push dword [0x4d9264]
push dword [0x4d9260]
mov eax, dword [ebp - 0x18]
call fcn.004093f8
cdq
push edx
push eax
call fcn.004b15b0
fstp qword [0x4d9260]
wait
push 0
lea eax, [ebp - 0xa0]
call fcn.004badf8
mov ecx, dword [ebp - 0xa0]
lea eax, [ebp - 0x9c]
mov edx, 0x4bc2f0
call fcn.00404b0c
mov edx, dword [ebp - 0x9c]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
mov dl, 1
call fcn.00437918
jmp 0x4bbbc0
fld qword [0x4d9260]
fcomp dword [0x4bc25c]
fnstsw ax
sahf
jne 0x4bbb8d
push 0
mov cl, 1
mov edx, 0x4bc314
mov eax, dword [ebp - 4]
call fcn.004b95b8
jmp 0x4bbbc0
push 0
lea eax, [ebp - 0xa8]
call fcn.004badf8
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
mov edx, 0x4bc344
call fcn.00404b0c
mov edx, dword [ebp - 0xa4]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov bl, 1
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov edx, dword [ebp - 8]
mov eax, 0x4bc35c
call fcn.00404e04
test eax, eax
jle 0x4bbe4a
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0xc]
call fcn.00408c4c
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xc]
call fcn.00404898
cmp dword [ebp + 8], 0
je 0x4bbc55
lea eax, [ebp - 0xb0]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004ba7e0
cmp dword [ebp - 0xb0], 0
je 0x4bbc55
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004ba7e0
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00408c4c
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 0xc]
call fcn.00404898
mov eax, dword [ebp - 0xc]
mov edx, 0x4bc254
call fcn.00404c0c
jne 0x4bbc99
fld qword [0x4d926c]
fcomp dword [0x4bc25c]
fnstsw ax
sahf
je 0x4bbc99
push 0
mov cl, 1
mov edx, 0x4bc36c
mov eax, dword [ebp - 4]
call fcn.004b95b8
xor eax, eax
mov dword [0x4d926c], eax
mov dword [0x4d9270], eax
jmp 0x4bbe42
cmp dword [ebp - 0xc], 0
je 0x4bbddf
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc268
call fcn.00404e04
test eax, eax
jle 0x4bbcf2
push 0x4d9274
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc268
call fcn.00404e04
mov edx, eax
inc edx
mov ecx, 0x3e8
mov eax, dword [ebp - 0xc]
call fcn.00404d20
mov edx, dword [ebp - 0xc]
mov eax, 0x4bc268
call fcn.00404e04
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 0x3e8
call fcn.00404d60
mov eax, dword [ebp - 0xc]
call fcn.0049c2b8
fstp qword [ebp - 0xc0]
wait
call fcn.0040b04c
call fcn.00403024
fcomp qword [ebp - 0xc0]
fnstsw ax
sahf
jb 0x4bbd56
mov eax, dword [ebp - 0xc]
call fcn.0049c2b8
fstp qword [ebp - 0xc0]
wait
call fcn.0040b04c
fadd dword [0x4bc37c]
call fcn.00403054
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], edx
fild qword [ebp - 0xc8]
fadd qword [ebp - 0xc0]
fstp qword [0x4d926c]
wait
jmp 0x4bbd8e
mov eax, dword [ebp - 0xc]
call fcn.0049c2b8
fstp qword [ebp - 0xc0]
wait
call fcn.0040b04c
call fcn.00403054
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], edx
fild qword [ebp - 0xc8]
fadd qword [ebp - 0xc0]
fstp qword [0x4d926c]
wait
push 0
push dword [0x4d9270]
push dword [0x4d926c]
lea eax, [ebp - 0xd0]
call fcn.0040bce0
mov ecx, dword [ebp - 0xd0]
lea eax, [ebp - 0xcc]
mov edx, 0x4bc388
call fcn.00404b0c
mov edx, dword [ebp - 0xcc]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
mov dl, 1
call fcn.00437918
jmp 0x4bbe42
fld qword [0x4d926c]
fcomp dword [0x4bc25c]
fnstsw ax
sahf
jne 0x4bbe03
push 0
mov cl, 1
mov edx, 0x4bc3a0
mov eax, dword [ebp - 4]
call fcn.004b95b8
jmp 0x4bbe42
push 0
push dword [0x4d9270]
push dword [0x4d926c]
lea eax, [ebp - 0xd8]
call fcn.0040bce0
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
mov edx, 0x4bc3c0
call fcn.00404b0c
mov edx, dword [ebp - 0xd4]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov bl, 1
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov eax, dword [ebp + 0x14]
mov byte [eax], bl
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x4bbe5c
call fcn.004babb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbe9e
lea eax, [ebp - 0xd8]
mov edx, 4
call fcn.00404824
lea eax, [ebp - 0xb8]
mov edx, 0x29
call fcn.00404824
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404824
ret