Function at 0x4f5558
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x47
push 0
push 0
dec ecx
jne 0x4f5560
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
xor eax, eax
push ebp
push 0x4f6ad7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x68]
mov eax, dword [0x500344]
mov eax, dword [eax]
call fcn.004f1f2c
jmp 0x4f68b3
xor eax, eax
push ebp
push 0x4f6897
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x4f6af0
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
push 0x3e8
call sub.kernel32.dll_Sleep_2
push 0x4f6b00
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x4f55f7
mov eax, 0x4f6b14
call fcn.004f7014
push 0
push 0x10
push 0x112
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_SendMessageA
push 0x1f4
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x40]
call fcn.00409fa0
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
mov edx, 0x4f6b2c
call fcn.00405058
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x418]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xdc]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x444]
xor edx, edx
call fcn.00458ea4
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x418]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4f5674
push 0x4f6b00
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x40], eax
jmp 0x4f5683
push 0x4f6b30
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x4f569b
push 0
push 0x10
push 0x112
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_SendMessageA
push 0x3e8
call sub.kernel32.dll_Sleep_2
cmp dword [ebp - 0x40], 0
jne 0x4f564a
mov eax, dword [0x500344]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
call fcn.004f3710
inc dword [ebp - 0x48]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4dc]
call fcn.00406138
lea edx, [ebp - 0x74]
call fcn.00409fa0
mov edx, dword [ebp - 0x74]
mov eax, dword [0x500344]
mov eax, dword [eax]
add eax, 0x4a4
call fcn.00404d94
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x48]
call fcn.00409fa0
mov edx, dword [ebp - 0x78]
mov eax, dword [0x500344]
mov eax, dword [eax]
add eax, 0x4a8
call fcn.00404d94
cmp dword [ebp - 0x3c], 0
je 0x4f571a
xor edx, edx
mov eax, dword [ebp - 0x3c]
call fcn.004f54b4
mov eax, dword [0x500344]
mov eax, dword [eax]
add eax, 0x4e0
mov ebx, dword [ebp - 0x48]
lea ebx, [ebx + ebx*4]
mov edx, dword [0x500344]
mov edx, dword [edx]
mov edx, dword [edx + 0x4dc]
mov edx, dword [edx + ebx*4 - 0x10]
call fcn.00404d94
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4dc]
mov eax, dword [eax + ebx*4 - 8]
mov edx, dword [0x500344]
mov edx, dword [edx]
mov dword [edx + 0x4e8], eax
cmp dword [ebp - 0x3c], 0
je 0x4f5772
xor edx, edx
mov eax, dword [ebp - 0x3c]
call fcn.004f5548
mov eax, dword [0x500344]
mov eax, dword [eax]
mov edx, dword [eax + 0x4e0]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x4f57f4
mov eax, dword [0x500344]
mov eax, dword [eax]
mov edx, dword [eax + 0x4e0]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov edx, dword [eax + 0x48c]
lea eax, [ebp - 0x7c]
mov ecx, 0x4f6b50
call fcn.00405058
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [0x500344]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x4b4], edx
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4bc]
mov edx, dword [eax]
call dword [edx + 8]
call fcn.004033e4
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x38c]
mov esi, dword [eax + 0x270]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0040340c
mov edx, eax
lea ecx, [ebp - 0x80]
mov eax, dword [0x500344]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [0x500344]
mov eax, dword [eax]
add eax, 0x4b8
call fcn.00404d94
call fcn.004033e4
mov eax, 3
call fcn.0040340c
add eax, 6
lea edx, [ebp - 0x84]
call fcn.00409fa0
mov ecx, dword [ebp - 0x84]
mov eax, dword [0x500344]
mov eax, dword [eax]
add eax, 0x490
mov edx, 0x4f6b64
call fcn.00405058
mov eax, dword [0x500344]
mov eax, dword [eax]
add eax, 0x490
mov edx, 0x4f6b70
call fcn.00404d94
call fcn.004033e4
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x430]
mov eax, dword [eax + 0x270]
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0040340c
mov edx, eax
lea ecx, [ebp - 0xc]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x430]
mov eax, dword [eax + 0x270]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x418]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4f597e
push 1
push 0x4f6b74
push 0x4f6b80
mov eax, dword [0x500344]
mov eax, dword [eax]
push dword [eax + 0x4b8]
push 0x4f6b8c
push dword [ebp - 0xc]
push 0x4f6b98
lea eax, [ebp - 0x88]
mov edx, 5
call fcn.004050d4
mov eax, dword [ebp - 0x88]
call fcn.004051d0
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov edx, dword [eax + 0x48c]
lea eax, [ebp - 0x8c]
mov ecx, 0x4f6b14
call fcn.00405058
mov eax, dword [ebp - 0x8c]
call fcn.004051d0
push eax
push 0x4f6b9c
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4f59f5
push 1
push 0x4f6b74
push 0x4f6bac
mov eax, dword [0x500344]
mov eax, dword [eax]
push dword [eax + 0x490]
push 0x4f6bb8
mov eax, dword [0x500344]
mov eax, dword [eax]
push dword [eax + 0x4b8]
lea eax, [ebp - 0x90]
mov edx, 4
call fcn.004050d4
mov eax, dword [ebp - 0x90]
call fcn.004051d0
push eax
lea edx, [ebp - 0x94]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f4]
call fcn.004ea130
mov eax, dword [ebp - 0x94]
call fcn.004051d0
push eax
push 0x4f6b9c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x418]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4f5a1f
push 0x4f6b00
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x40], eax
jmp 0x4f5a2e
push 0x4f6b30
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x40], eax
push 0xa
call sub.kernel32.dll_Sleep_2
cmp dword [ebp - 0x40], 0
jle 0x4f59f5
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov cl, 1
mov edx, 0x4f6bc4
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_BringWindowToTop
jmp 0x4f5a6e
mov eax, dword [0x500344]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
call fcn.004f3710
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4bc]
cmp dword [eax + 8], 1
jl 0x4f5a5f
push 0x7d0
call sub.kernel32.dll_Sleep_2
xor ecx, ecx
mov edx, 0x4f6bd8
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
cmp dword [ebp - 0x3c], 0
je 0x4f5aaa
xor edx, edx
mov eax, dword [ebp - 0x3c]
call fcn.004f5548
push 0x7d0
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov edx, 0x1d4c0
call fcn.004f4650
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
call fcn.004f4184
test al, al
jne 0x4f5b33
xor ecx, ecx
mov edx, 0x4f6be8
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00406af4
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov edx, 0x1d4c0
call fcn.004f4650
xor ecx, ecx
mov edx, 0x4f6c00
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
call fcn.004f4184
test al, al
jne 0x4f5b65
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f68b3
push 0
push 0xf030
push 0x112
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x500344]
mov eax, dword [eax]
add eax, 0x4c0
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
xor edx, edx
call fcn.004f3c28
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x98]
call fcn.004069e4
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
call fcn.00406af4
mov edx, dword [ebp - 0x98]
lea eax, [ebp - 0x38]
call fcn.00416638
lea eax, [ebp - 0x9c]
call fcn.004069e4
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
call fcn.00406af4
mov edx, dword [ebp - 0x9c]
lea eax, [ebp - 4]
mov ecx, 0x4f6c0c
call fcn.00406a28
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov edx, 0xea60
call fcn.004f4650
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_BringWindowToTop
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
call fcn.004f4184
test al, al
je 0x4f682e
mov eax, dword [0x500344]
mov eax, dword [eax]
add eax, 0x4a0
mov edx, dword [ebp - 0x48]
lea edx, [edx + edx*4]
mov ecx, dword [0x500344]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x4dc]
mov edx, dword [ecx + edx*4 - 0x10]
call fcn.00404d94
cmp dword [ebp - 0x3c], 0
je 0x4f5c7a
xor edx, edx
mov eax, dword [ebp - 0x3c]
call fcn.004f5548
xor ecx, ecx
mov edx, 0x4f6c24
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [ebp - 0x48]
lea eax, [eax + eax*4]
mov edx, dword [0x500344]
mov edx, dword [edx]
mov edx, dword [edx + 0x4dc]
mov edx, dword [edx + eax*4 - 0x10]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov cl, 1
call fcn.004f47b4
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov edx, 0x1d4c0
call fcn.004f4650
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
call fcn.004f4184
test al, al
jne 0x4f5d8c
lea eax, [ebp - 0xa4]
call fcn.00405520
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x78]
call fcn.00406af4
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
mov edx, dword [ebp - 0x48]
lea edx, [edx + edx*4]
mov ecx, dword [0x500344]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x4dc]
mov edx, dword [ecx + edx*4 - 0x10]
call fcn.00405694
mov edx, dword [ebp - 0xa8]
pop eax
call fcn.00405720
jne 0x4f5d6b
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00406af4
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov edx, 0x1d4c0
call fcn.004f4650
xor ecx, ecx
mov edx, 0x4f6c38
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x458]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4f64a4
lea eax, [ebp - 8]
call fcn.00404d40
jmp 0x4f5ee5
call fcn.0040c6bc
fstp qword [ebp - 0x50]
wait
xor ecx, ecx
mov edx, 0x4f6c54
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
jmp 0x4f5e2c
xor eax, eax
push ebp
push 0x4f5e18
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xb8]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov ecx, 0x4f6c68
call fcn.004f1d04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f5e22
push 0x1f4
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 8]
call fcn.00409b44
cmp dword [ebp - 0xbc], 0
jne 0x4f5e72
call fcn.0040c6bc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.004d4368
cmp edx, 0
jne 0x4f5e6c
cmp eax, 0x2710
jb 0x4f5ddf
jmp 0x4f5e72
jl 0x4f5ddf
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 8]
mov edx, 0x4f6c78
call fcn.00405058
mov edx, dword [ebp - 0xc0]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 8]
call fcn.00409b44
cmp dword [ebp - 0xc4], 0
jne 0x4f5ee5
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00406af4
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov edx, 0x1d4c0
call fcn.004f4650
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 8]
call fcn.00409b44
cmp dword [ebp - 0xc8], 0
je 0x4f5dc5
xor eax, eax
push ebp
push 0x4f643c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xcc]
call fcn.004069e4
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
call fcn.00406af4
mov edx, dword [ebp - 0xcc]
lea eax, [ebp - 0x38]
call fcn.00416638
lea eax, [ebp - 0xd0]
mov ecx, dword [ebp - 8]
mov edx, 0x4f6c8c
call fcn.00405058
mov edx, dword [ebp - 0xd0]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
lea eax, [ebp - 8]
push eax
push 0x4f6c90
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.00411ea8
add esp, 0x10
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x28]
call fcn.00416720
push 0x4f6ca4
push 0x4f6cac
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00411ea8
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00411ea8
add esp, 0xc
lea eax, [ebp - 0xf0]
call fcn.00412b98
mov dword [ebp - 0x64], eax
push 0x4f6cc8
push 0x4f6cac
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00411ea8
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00411ea8
add esp, 0xc
lea eax, [ebp - 0x110]
call fcn.00412b98
mov dword [ebp - 0x60], eax
lea edx, [ebp - 0x124]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x454]
call fcn.00458f84
push dword [ebp - 0x124]
push 0x4f6cd8
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 0x64]
call fcn.00409fa0
push dword [ebp - 0x128]
push 0x4f6ce8
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 0x60]
call fcn.00409fa0
push dword [ebp - 0x12c]
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.004050d4
xor eax, eax
push ebp
push 0x4f60be
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404d40
lea eax, [ebp - 0x130]
call fcn.00405520
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.00406af4
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 8]
call fcn.00404fc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f60c8
push dword [ebp - 0x10]
push 0x4f6cf8
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 8]
call fcn.004d4160
push dword [ebp - 0x134]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004050d4
xor eax, eax
push ebp
push 0x4f61b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404d40
push 0x4f6d08
push 0x4f6d0c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00411ea8
add esp, 0x10
lea edx, [ebp - 0x144]
lea eax, [ebp - 0x28]
call fcn.00416720
push 0x4f6d28
push 0
push 0x4f6d38
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.00411ea8
add esp, 0x10
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.00411ea8
add esp, 0xc
lea edx, [ebp - 0x154]
lea eax, [ebp - 8]
call fcn.004154f0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4f6d4c
mov edx, 0x4f6b98
mov eax, dword [ebp - 8]
call fcn.0043ec74
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4f6d58
mov edx, 0x4f6d64
mov eax, dword [ebp - 0x14]
call fcn.0043ec74
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f61c0
push dword [ebp - 0x10]
push 0x4f6d70
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 8]
call fcn.004d4160
push dword [ebp - 0x168]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004050d4
xor eax, eax
push ebp
push 0x4f641b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f6d80
push 0x4f6d0c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.00411ea8
add esp, 0x10
lea edx, [ebp - 0x178]
lea eax, [ebp - 0x28]
call fcn.00416720
push 0x4f6d88
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.00411ea8
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x198]
mov edx, 1
mov cl, 1
call fcn.00416354
lea edx, [ebp - 0x198]
pop eax
call fcn.00417ebc
lea eax, [ebp - 0x188]
call fcn.00412b98
test eax, eax
jl 0x4f6411
inc eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x44], 0
xor eax, eax
push ebp
push 0x4f6303
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404d40
push 0x4f6d9c
push 0x4f6da4
mov eax, dword [ebp - 0x44]
push eax
push 0x4f6d38
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00411ea8
add esp, 0x10
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.00411ea8
add esp, 0x10
lea edx, [ebp - 0x1a8]
lea eax, [ebp - 8]
call fcn.004154f0
lea edx, [ebp - 0x1bc]
mov eax, dword [ebp - 8]
call fcn.0040982c
mov edx, dword [ebp - 0x1bc]
lea eax, [ebp - 8]
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f630d
push dword [ebp - 0x10]
push 0x4f6dc0
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x44]
call fcn.00409fa0
push dword [ebp - 0x1c0]
push 0x4f6dd0
lea edx, [ebp - 0x1c4]
mov eax, dword [ebp - 8]
call fcn.004d4160
push dword [ebp - 0x1c4]
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.004050d4
xor eax, eax
push ebp
push 0x4f63b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404d40
push 0x4f6de0
push 0x4f6da4
mov eax, dword [ebp - 0x44]
push eax
push 0x4f6d38
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1e4]
push eax
call fcn.00411ea8
add esp, 0x10
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x1d4]
push eax
call fcn.00411ea8
add esp, 0x10
lea edx, [ebp - 0x1d4]
lea eax, [ebp - 8]
call fcn.004154f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f63c3
push dword [ebp - 0x10]
push 0x4f6dc0
lea edx, [ebp - 0x1e8]
mov eax, dword [ebp - 0x44]
call fcn.00409fa0
push dword [ebp - 0x1e8]
push 0x4f6df0
lea edx, [ebp - 0x1ec]
mov eax, dword [ebp - 8]
call fcn.004d4160
push dword [ebp - 0x1ec]
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.004050d4
inc dword [ebp - 0x44]
dec dword [ebp - 0x54]
jne 0x4f627d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6425
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6446
lea eax, [ebp - 0x1f0]
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.004f47b4
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov edx, 0x1d4c0
call fcn.004f4650
push 0
push 0x10
push 0x112
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f68b3
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x450]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4f6518
cmp dword [ebp - 0x3c], 0
je 0x4f64d0
mov edx, 1
mov eax, dword [ebp - 0x3c]
call fcn.004f54b4
push 0x1f4
call sub.kernel32.dll_Sleep_2
jmp 0x4f64e6
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x444]
cmp byte [eax + 0x57], 0
jne 0x4f64dc
push 0
push 0x10
push 0x112
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f68b3
call fcn.004033e4
lea edx, [ebp - 0x1f4]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x46c]
call fcn.004ea130
mov eax, dword [ebp - 0x1f4]
call fcn.0040a0dc
mov ebx, eax
mov eax, 0x64
call fcn.0040340c
cmp ebx, eax
jge 0x4f6588
push 0x2710
call sub.kernel32.dll_Sleep_2
xor ecx, ecx
mov edx, 0x4f6e00
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
push 0
push 0x10
push 0x112
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f68b3
xor ecx, ecx
mov edx, 0x4f6e10
mov eax, dword [ebp - 0x3c]
call fcn.004f5454
lea eax, [ebp - 8]
call fcn.00404d40
call fcn.0040c6bc
fstp qword [ebp - 0x50]
wait
mov eax, dword [0x500344]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x500], edx
mov eax, dword [0x500344]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x4fc], edx
jmp 0x4f66a0
lea eax, [ebp - 0x1f8]
push eax
lea edx, [ebp - 0x200]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x468]
call fcn.00458f84
mov eax, dword [ebp - 0x200]
lea edx, [ebp - 0x1fc]
call fcn.00409b44
mov eax, dword [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x208]
call fcn.004069e4
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
call fcn.00406af4
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x204]
mov ecx, 0x4f6c0c
call fcn.00406a28
mov eax, dword [ebp - 0x204]
xor edx, edx
pop ecx
call fcn.004f5030
mov edx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x28]
call fcn.00416638
xor eax, eax
push ebp
push 0x4f6696
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f6e1c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00411ea8
add esp, 0xc
lea edx, [ebp - 0x218]
lea eax, [ebp - 8]
call fcn.004154f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f66a0
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 8]
call fcn.00409b44
cmp dword [ebp - 0x21c], 0
jne 0x4f66e6
call fcn.0040c6bc
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.004d4368
cmp edx, 0
jne 0x4f66e0
cmp eax, 0x2710
jb 0x4f65cb
jmp 0x4f66e6
jl 0x4f65cb
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 8]
call fcn.00409b44
cmp dword [ebp - 0x220], 0
je 0x4f682e
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_BringWindowToTop
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x230]
mov edx, dword [0x500344]
mov edx, dword [edx]
mov edx, dword [edx + 0x4f8]
call fcn.00416638
lea eax, [ebp - 0x230]
mov cl, 1
lea edx, [ebp - 0x28]
call fcn.004f3c4c
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c4]
sub eax, 0x14
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c0]
add eax, 8
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c4]
sub eax, 0x14
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c0]
add eax, 8
push eax
push 2
call sub.user32.dll_mouse_event
push 0
push 0
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c4]
sub eax, 0x14
push eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c0]
add eax, 8
push eax
push 4
call sub.user32.dll_mouse_event
mov edx, 0x32
mov eax, 0x23
call fcn.004f4604
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_BringWindowToTop
call fcn.004033e4
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x500]
add dword [ebp - 0x60], eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4fc]
add dword [ebp - 0x64], eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x504]
add dword [ebp - 0x5c], eax
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x508]
add dword [ebp - 0x58], eax
mov dl, 1
lea eax, [ebp - 0x64]
call fcn.004f4034
mov edx, 0x32
mov eax, 0x1e
call fcn.004f4604
lea edx, [ebp - 0x234]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d4]
call fcn.00458f84
mov eax, dword [ebp - 0x234]
call fcn.0040a0dc
push eax
lea edx, [ebp - 0x238]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d0]
call fcn.00458f84
mov eax, dword [ebp - 0x238]
call fcn.0040a0dc
pop edx
call fcn.004f4604
push 0
push 0x10
push 0x112
mov eax, dword [ebp - 0x40]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f68b3
lea edx, [ebp - 0x23c]
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x3bc]
call fcn.00458f84
mov eax, dword [ebp - 0x23c]
mov edx, 0x4f6e2c
call fcn.00405168
jne 0x4f68f8
mov eax, dword [0x500344]
mov eax, dword [eax]
mov eax, dword [eax + 0x4dc]
call fcn.00406138
cmp eax, dword [ebp - 0x48]
jg 0x4f5595
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6ae1
lea eax, [ebp - 0x23c]
mov edx, 3
call fcn.00404d64
lea eax, [ebp - 0x230]
call fcn.00411ea0
lea eax, [ebp - 0x220]
mov edx, 2
call fcn.00404d64
lea eax, [ebp - 0x218]
call fcn.00411ea0
lea eax, [ebp - 0x208]
call fcn.004069e4
lea eax, [ebp - 0x204]
call fcn.004069e4
lea eax, [ebp - 0x200]
call fcn.00404d40
lea eax, [ebp - 0x1fc]
call fcn.00404d40
lea eax, [ebp - 0x1f8]
call fcn.004069e4
lea eax, [ebp - 0x1f4]
call fcn.00404d40
lea eax, [ebp - 0x1f0]
mov edx, 3
call fcn.00404d64
lea eax, [ebp - 0x1e4]
mov edx, dword [0x401150]
mov ecx, 2
call fcn.004059a0
lea eax, [ebp - 0x1c4]
mov edx, 3
call fcn.00404d64
lea eax, [ebp - 0x1b8]
mov edx, dword [0x401150]
mov ecx, 5
call fcn.004059a0
lea eax, [ebp - 0x168]
call fcn.00404d40
lea eax, [ebp - 0x164]
mov edx, dword [0x401150]
mov ecx, 3
call fcn.004059a0
lea eax, [ebp - 0x134]
call fcn.00404d40
lea eax, [ebp - 0x130]
call fcn.00405520
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.00404d64
lea eax, [ebp - 0x124]
call fcn.00404d40
lea eax, [ebp - 0x120]
mov edx, dword [0x401150]
mov ecx, 5
call fcn.004059a0
lea eax, [ebp - 0xd0]
call fcn.00404d40
lea eax, [ebp - 0xcc]
call fcn.004069e4
lea eax, [ebp - 0xc8]
mov edx, 4
call fcn.00404d64
lea eax, [ebp - 0xb8]
call fcn.00411ea0
lea eax, [ebp - 0xa8]
mov edx, 2
call fcn.00405538
lea eax, [ebp - 0xa0]
call fcn.00404d40
lea eax, [ebp - 0x9c]
mov edx, dword [0x40122c]
mov ecx, 2
call fcn.004059a0
lea eax, [ebp - 0x94]
call fcn.00404d40
lea eax, [ebp - 0x90]
mov edx, 0xb
call fcn.00404d64
lea eax, [ebp - 0x38]
mov edx, dword [0x401160]
mov ecx, 2
call fcn.004059a0
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404d64
lea eax, [ebp - 4]
call fcn.004069e4
ret