Function at 0x4f1a28
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x4f1a31
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da0
xor eax, eax
push ebp
push 0x4f2895
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x49c3a0]
call fcn.0049c888
mov dword [ebp - 0x24], eax
mov dl, 1
mov eax, dword [0x4184b4]
call fcn.00403aac
xor eax, eax
push ebp
push 0x4f2588
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, 0x4f28b0
call fcn.004eb210
mov eax, dword [ebp - 0x14]
call fcn.004eb344
test al, al
jne 0x4f1aa8
mov eax, dword [0x504c64]
mov eax, dword [eax]
call fcn.0047e32c
push dword [ebp - 0x14]
push dword [ebp - 4]
push 0x4f28fc
lea eax, [ebp - 0x40]
mov ecx, 0x4f290c
mov edx, dword [ebp - 4]
call fcn.00404bfc
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.004bbca4
lea eax, [ebp - 0x3c]
lea edx, [ebp - 0x2c]
call fcn.004bbe74
push dword [ebp - 0x2c]
push 0x4f291c
mov eax, dword [0x504800]
push dword [eax]
push 0x4f2928
call fcn.00403250
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x44]
call fcn.0040ac88
push dword [ebp - 0x44]
lea eax, [ebp - 8]
mov edx, 8
call fcn.00404c70
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004f76d4
cmp dword [ebp - 0x10], 0
jne 0x4f1b3f
mov eax, dword [ebp - 0x24]
call fcn.0049e3a4
mov dword [eax + 0x6c], 0x86
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
call fcn.0049cb38
cmp dword [ebp - 0x10], 0
jne 0x4f1b88
mov eax, 0x4f2934
call fcn.00433d20
push 1
push 0
push 0
push 0x4f29a0
push 0x4f29c0
mov eax, dword [0x504bd4]
mov eax, dword [eax]
call fcn.00464b10
push eax
call sub.shell32.dll_ShellExecuteA
push 0x7d0
call sub.kernel32.dll_Sleep_1
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [0x504adc]
mov byte [eax], 0
xor eax, eax
push ebp
push 0x4f1be9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
call fcn.004f7b84
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.004bc41c
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x10]
call fcn.00404988
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 0x10]
call fcn.00405184
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x28]
call fcn.0049ff74
mov eax, dword [0x504f10]
call fcn.004048f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f1bfb
xor eax, eax
push ebp
push 0x4f1c67
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x54]
mov edx, 0x4f29cc
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x54], 0
je 0x4f1c5d
lea ecx, [ebp - 0x58]
mov edx, 0x4f29cc
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
call dword [edx + 0x7c]
cmp al, 1
jne 0x4f1c5d
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f25c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f1c71
xor eax, eax
push ebp
push 0x4f23cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x60]
mov edx, 0x4f29e0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x5048e4]
call fcn.00404b78
mov eax, dword [0x50471c]
mov edx, 0x4f29f0
call fcn.00404944
lea ecx, [ebp - 0x64]
mov edx, 0x4f29f8
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x64], 0
je 0x4f1cfa
lea ecx, [ebp - 0x6c]
mov edx, 0x4f29f8
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x68]
mov eax, dword [0x50471c]
call fcn.00404b78
lea ecx, [ebp - 0x70]
mov edx, 0x4f2a14
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x70], 0
je 0x4f1d3b
lea ecx, [ebp - 0x78]
mov edx, 0x4f2a14
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x74]
mov eax, dword [0x504da0]
call fcn.00404b78
mov eax, dword [0x504ddc]
mov dword [eax], 0xc8
lea ecx, [ebp - 0x7c]
mov edx, 0x4f2a30
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x7c], 0
je 0x4f1d7f
lea ecx, [ebp - 0x80]
mov edx, 0x4f2a30
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x80]
mov edx, dword [0x504ddc]
mov dword [edx], eax
lea ecx, [ebp - 0x84]
mov edx, 0x4f2a44
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x84], 0
je 0x4f1dc4
lea ecx, [ebp - 0x88]
mov edx, 0x4f2a44
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
call dword [edx + 0x80]
mov edx, dword [0x504a10]
mov dword [edx], eax
lea ecx, [ebp - 0x8c]
mov edx, 0x4f2a5c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x8c], 0
je 0x4f1e09
lea ecx, [ebp - 0x90]
mov edx, 0x4f2a5c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
call dword [edx + 0x80]
mov edx, dword [0x504938]
mov dword [edx], eax
lea ecx, [ebp - 0x94]
mov edx, 0x4f2a74
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x94], 0
je 0x4f1e4e
lea ecx, [ebp - 0x98]
mov edx, 0x4f2a74
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x80]
mov edx, dword [0x504ab8]
mov dword [edx], eax
lea ecx, [ebp - 0x9c]
mov edx, 0x4f2a8c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x9c], 0
je 0x4f1e93
lea ecx, [ebp - 0xa0]
mov edx, 0x4f2a8c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
call dword [edx + 0x80]
mov edx, dword [0x50467c]
mov dword [edx], eax
lea ecx, [ebp - 0xa4]
mov edx, 0x4f2aa0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0xa4], 0
je 0x4f1ee9
lea ecx, [ebp - 0xac]
mov edx, 0x4f2aa0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0xa8]
mov eax, dword [0x504de4]
add eax, 8
call fcn.00404b78
lea ecx, [ebp - 0xb0]
mov edx, 0x4f2ab8
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0xb0], 0
je 0x4f1f3c
lea ecx, [ebp - 0xb8]
mov edx, 0x4f2ab8
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0xb4]
mov eax, dword [0x50493c]
call fcn.00404b78
lea ecx, [ebp - 0xbc]
mov edx, 0x4f2ad0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0xbc], 0
je 0x4f1f7e
lea ecx, [ebp - 0xc0]
mov edx, 0x4f2ad0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov edx, dword [0x504a4c]
mov byte [edx], al
lea ecx, [ebp - 0xc4]
mov edx, 0x4f2ae0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0xc4], 0
je 0x4f1fd1
lea ecx, [ebp - 0xcc]
mov edx, 0x4f2ae0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0xc8]
mov eax, dword [0x504b28]
call fcn.00404b78
lea ecx, [ebp - 0xd0]
mov edx, 0x4f2af4
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0xd0], 0
je 0x4f2026
lea ecx, [ebp - 0xd8]
mov edx, 0x4f2af4
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd4]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0xd4]
mov eax, dword [0x5048a0]
call fcn.00404b78
jmp 0x4f2030
mov eax, dword [0x5048a0]
call fcn.004048f0
lea ecx, [ebp - 0xdc]
mov edx, 0x4f2b04
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0xdc], 0
je 0x4f2085
lea ecx, [ebp - 0xe4]
mov edx, 0x4f2b04
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x504904]
call fcn.00404b78
jmp 0x4f208f
mov eax, dword [0x504904]
call fcn.004048f0
xor eax, eax
push ebp
push 0x4f2111
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xe8]
mov edx, 0x4f2b14
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0xe8], 0
je 0x4f2107
lea ecx, [ebp - 0xf0]
mov edx, 0x4f2b14
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xf0]
lea edx, [ebp - 0xec]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0xec]
mov eax, dword [0x504d30]
call fcn.00404b78
mov eax, dword [0x504d30]
mov eax, dword [eax]
call fcn.00409860
sub eax, 0x14
mov edx, dword [0x5049f4]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f211b
lea ecx, [ebp - 0xf4]
mov edx, 0x4f2b30
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0xf4], 0
je 0x4f216e
lea ecx, [ebp - 0xfc]
mov edx, 0x4f2b30
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0xfc]
lea edx, [ebp - 0xf8]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0xf8]
mov eax, dword [0x504d7c]
call fcn.00404b78
lea ecx, [ebp - 0x104]
mov edx, 0x4f2b4c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x100]
mov eax, dword [0x504c70]
call fcn.00404b78
lea ecx, [ebp - 0x10c]
mov edx, 0x4f2b5c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x108]
mov eax, dword [0x504aa0]
call fcn.00404b78
mov eax, dword [0x504718]
cmp byte [eax], 0
je 0x4f225e
lea ecx, [ebp - 0x114]
mov edx, 0x4f2b6c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x110]
mov eax, dword [0x5047c4]
call fcn.00404b78
lea ecx, [ebp - 0x11c]
mov edx, 0x4f2b80
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x118]
mov eax, dword [0x5049d8]
call fcn.00404b78
mov eax, dword [0x504718]
mov byte [eax], 0
jmp 0x4f227c
mov eax, dword [0x5047c4]
mov edx, 0x4f2b94
call fcn.00404944
mov eax, dword [0x5049d8]
mov edx, 0x4f2b94
call fcn.00404944
lea ecx, [ebp - 0x120]
mov edx, 0x4f2b9c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x120], 0
je 0x4f22cf
lea ecx, [ebp - 0x128]
mov edx, 0x4f2b9c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x128]
lea edx, [ebp - 0x124]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x124]
mov eax, dword [0x504c5c]
call fcn.00404b78
lea ecx, [ebp - 0x12c]
mov edx, 0x4f2bac
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x12c], 0
je 0x4f2320
lea ecx, [ebp - 0x134]
mov edx, 0x4f2bac
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x18]
call fcn.00404b78
lea ecx, [ebp - 0x138]
mov edx, 0x4f2bb8
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x138], 0
je 0x4f2371
lea ecx, [ebp - 0x140]
mov edx, 0x4f2bb8
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x1c]
call fcn.00404b78
lea ecx, [ebp - 0x144]
mov edx, 0x4f2bc4
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x144], 0
je 0x4f23c2
lea ecx, [ebp - 0x14c]
mov edx, 0x4f2bc4
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x20]
call fcn.00404b78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f23d6
lea ecx, [ebp - 0x150]
mov edx, 0x4f2bd0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x150], 0
je 0x4f246e
lea ecx, [ebp - 0x158]
mov edx, 0x4f2bd0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov eax, dword [ebp - 0x154]
mov edx, 0x4f2be8
call fcn.004052bc
je 0x4f246e
lea ecx, [ebp - 0x160]
mov edx, 0x4f2bd0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x15c]
mov eax, dword [0x504de4]
call fcn.00404b78
mov eax, dword [0x504bd4]
mov eax, dword [eax]
call fcn.004ea2ec
lea ecx, [ebp - 0x164]
mov edx, 0x4f2bf0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x164], 0
je 0x4f253f
xor eax, eax
push ebp
push 0x4f2535
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x30
push 0x4f2c00
push 0x4f2c08
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_MessageBoxA_1
push 0x4f2c3c
lea ecx, [ebp - 0x174]
mov edx, 0x4f2bf0
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x170]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
push dword [ebp - 0x170]
push 0x4f2c74
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00405274
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 0x168]
call fcn.00404b78
mov edx, dword [ebp - 0x168]
mov eax, dword [0x504c54]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004efb28
mov eax, dword [0x504c54]
mov eax, dword [eax]
call fcn.004236b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f253f
mov eax, dword [0x5048e4]
cmp dword [eax], 0
je 0x4f257e
push 0x4f2ca0
mov eax, dword [0x5048e4]
push dword [eax]
push 0x4f2cc4
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00404c70
mov edx, dword [ebp - 0x178]
mov eax, dword [0x504c54]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004efb28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f259f
mov eax, dword [0x504bd4]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d4]
mov dl, 1
call fcn.004358e0
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x58]
mov eax, dword [ebp - 0x24]
call fcn.00403adc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f289f
lea eax, [ebp - 0x178]
call fcn.004048f0
lea eax, [ebp - 0x174]
call fcn.004067a8
lea eax, [ebp - 0x170]
mov edx, 2
call fcn.00405014
lea eax, [ebp - 0x168]
call fcn.004048f0
lea eax, [ebp - 0x164]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x15c]
call fcn.00404ffc
lea eax, [ebp - 0x158]
call fcn.004067a8
lea eax, [ebp - 0x154]
call fcn.00404ffc
lea eax, [ebp - 0x150]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x148]
call fcn.00404ffc
lea eax, [ebp - 0x144]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x13c]
call fcn.00404ffc
lea eax, [ebp - 0x138]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x130]
call fcn.00404ffc
lea eax, [ebp - 0x12c]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x124]
call fcn.00404ffc
lea eax, [ebp - 0x120]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x118]
call fcn.00404ffc
lea eax, [ebp - 0x114]
call fcn.004067a8
lea eax, [ebp - 0x110]
call fcn.00404ffc
lea eax, [ebp - 0x10c]
call fcn.004067a8
lea eax, [ebp - 0x108]
call fcn.00404ffc
lea eax, [ebp - 0x104]
call fcn.004067a8
lea eax, [ebp - 0x100]
call fcn.00404ffc
lea eax, [ebp - 0xfc]
call fcn.004067a8
lea eax, [ebp - 0xf8]
call fcn.00404ffc
lea eax, [ebp - 0xf4]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0xec]
call fcn.00404ffc
lea eax, [ebp - 0xe8]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0xe0]
call fcn.00404ffc
lea eax, [ebp - 0xdc]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0xd4]
call fcn.00404ffc
lea eax, [ebp - 0xd0]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0xc8]
call fcn.00404ffc
lea eax, [ebp - 0xc4]
mov edx, dword [0x49f8b0]
mov ecx, 4
call fcn.0040550c
lea eax, [ebp - 0xb4]
call fcn.00404ffc
lea eax, [ebp - 0xb0]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0xa8]
call fcn.00404ffc
lea eax, [ebp - 0xa4]
mov edx, dword [0x49f8b0]
mov ecx, 0xc
call fcn.0040550c
lea eax, [ebp - 0x74]
call fcn.00404ffc
lea eax, [ebp - 0x70]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x68]
call fcn.00404ffc
lea eax, [ebp - 0x64]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x5c]
call fcn.00404ffc
lea eax, [ebp - 0x58]
mov edx, dword [0x49f8b0]
mov ecx, 2
call fcn.0040550c
lea eax, [ebp - 0x50]
call fcn.00404ffc
lea eax, [ebp - 0x4c]
mov edx, 4
call fcn.00404914
lea eax, [ebp - 0x2c]
call fcn.004048f0
lea eax, [ebp - 0x28]
call fcn.004067a8
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404914
ret