Function at 0x49df40
Capabilities:
Create process on windows
Delete file
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0dc4
mov eax, dword fs:[0]
push eax
sub esp, 0xafc
mov eax, dword [0x4df798]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0x18], 0x52e1e4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xae8], eax
cmp dword [ebp - 0xae8], 0xcaca
je 0x49e421
cmp dword [ebp - 0xae8], 0xcadb
je 0x49dfba
jmp 0x49e526
mov dword [0x52fb90], 0
push 0xe
mov ecx, 0x53550c
call fcn.00481790
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2108
call fcn.00433bd4
push 1
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.0048b510
lea ecx, [ebp - 0x1c]
call fcn.00401780
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0xaec], 0
je 0x49e03e
cmp dword [ebp - 0xaec], 1
je 0x49e1e7
cmp dword [ebp - 0xaec], 2
je 0x49e228
jmp 0x49e3fd
movzx ecx, byte [0x4ec0b0]
test ecx, ecx
je 0x49e17e
mov byte [0x4ec0b0], 0
mov byte [0x4ec0b1], 0
mov ecx, dword [ebp - 0xae4]
call fcn.0048b7c0
lea ecx, [ebp - 0x43c]
call fcn.00402460
mov dword [ebp - 0x43c], 0x1a2
mov dword [ebp - 0x438], 0x84
mov dword [ebp - 0x434], 0x1c9
mov dword [ebp - 0x430], 0xde
push 0
lea edx, [ebp - 0x43c]
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
mov byte [ebp - 0x43e], 0xf
mov dword [ebp - 0x444], 0xb
mov eax, 0xa
mov word [ebp - 0x440], ax
mov byte [ebp - 0x424], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x423]
push ecx
call fcn.00451f70
add esp, 0xc
push 7
lea edx, [ebp - 0x444]
push edx
lea eax, [ebp - 0x424]
push eax
call fcn.00451a10
add esp, 0xc
mov dword [ebp - 0x428], 7
mov dword [ebp - 0x42c], 0
push 4
lea ecx, [ebp - 0x42c]
push ecx
mov edx, dword [ebp - 0x428]
lea eax, [ebp + edx - 0x424]
push eax
call fcn.00451a10
add esp, 0xc
mov dword [ebp - 0x448], 0
jmp 0x49e14d
mov ecx, dword [ebp - 0x448]
add ecx, 1
mov dword [ebp - 0x448], ecx
cmp dword [ebp - 0x448], 3
jge 0x49e17c
push 0
mov edx, dword [ebp - 0x444]
push edx
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp - 0x448]
mov edx, dword [ecx*4 + 0x4ec0b4]
push edx
call dword [sym.imp.WSOCK32.dll_send]
jmp 0x49e13e
jmp 0x49e1e2
push 6
mov ecx, 0x53550c
call fcn.00481790
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004015f0
add esp, 8
push 0x40
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040b6f0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.0042f175
cmp dword [0x4ec0a8], 1
jne 0x49e1e2
cmp dword [0x4ec0ac], 1
jne 0x49e1e2
mov ecx, dword [ebp - 0xae4]
call fcn.0048f3a0
mov ecx, dword [ebp - 0xae4]
call fcn.0048b110
jmp 0x49e3fd
push 0x3b
mov ecx, 0x53550c
call fcn.00481790
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004015f0
add esp, 8
push 0x40
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040b6f0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.0042f175
jmp 0x49e3fd
movzx edx, byte [0x4ec0b0]
test edx, edx
je 0x49e3c1
movzx eax, word [0x4e68bc]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
movzx ecx, word [0x4e68b8]
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
movzx edx, word [0x4e68b4]
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
movzx eax, word [0x4e68b0]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2cac
call fcn.004aa2f0
lea ecx, [ebp - 0x864]
call fcn.00402460
mov dword [ebp - 0x864], 0x1a2
mov dword [ebp - 0x860], 0x84
mov dword [ebp - 0x85c], 0x1c9
mov dword [ebp - 0x858], 0xde
push 0
lea ecx, [ebp - 0x864]
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
mov byte [0x4ec0b0], 0
mov byte [0x4ec0b1], 0
mov byte [ebp - 0x866], 0x10
mov dword [ebp - 0x86c], 0xb
mov edx, 0xa
mov word [ebp - 0x868], dx
mov byte [ebp - 0x84c], 0
push 0x3ff
push 0
lea eax, [ebp - 0x84b]
push eax
call fcn.00451f70
add esp, 0xc
push 7
lea ecx, [ebp - 0x86c]
push ecx
lea edx, [ebp - 0x84c]
push edx
call fcn.00451a10
add esp, 0xc
mov dword [ebp - 0x850], 7
mov dword [ebp - 0x854], 0
push 4
lea eax, [ebp - 0x854]
push eax
mov ecx, dword [ebp - 0x850]
lea edx, [ebp + ecx - 0x84c]
push edx
call fcn.00451a10
add esp, 0xc
mov dword [ebp - 0x870], 0
jmp 0x49e390
mov eax, dword [ebp - 0x870]
add eax, 1
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 3
jge 0x49e3bf
push 0
mov ecx, dword [ebp - 0x86c]
push ecx
lea edx, [ebp - 0x84c]
push edx
mov eax, dword [ebp - 0x870]
mov ecx, dword [eax*4 + 0x4ec0b4]
push ecx
call dword [sym.imp.WSOCK32.dll_send]
jmp 0x49e381
jmp 0x49e3fd
push 7
mov ecx, 0x53550c
call fcn.00481790
push eax
lea edx, [ebp - 0x1c]
push edx
call fcn.004015f0
add esp, 8
push 0x10
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040b6f0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.0042f175
mov dword [ebp - 0xadc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401620
mov eax, dword [ebp - 0xadc]
jmp 0x4a0b43
mov dword [0x52fb90], 0
lea ecx, [ebp - 0x874]
call fcn.00401780
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0xaf0], ecx
cmp dword [ebp - 0xaf0], 0
je 0x49e459
jmp 0x49e4ad
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
add eax, 1
push eax
push 0x41
mov ecx, 0x53550c
call fcn.00481790
push eax
lea ecx, [ebp - 0x874]
push ecx
call fcn.004015f0
add esp, 0xc
push 0x40
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
lea ecx, [ebp - 0x874]
call fcn.0040b6f0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.0042f175
jmp 0x49e4ff
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
add eax, 1
push eax
push 0x40
mov ecx, 0x53550c
call fcn.00481790
push eax
lea ecx, [ebp - 0x874]
push ecx
call fcn.004015f0
add esp, 0xc
push 0x10
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
lea ecx, [ebp - 0x874]
call fcn.0040b6f0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.0042f175
mov dword [ebp - 0xae0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x874]
call fcn.00401620
mov eax, dword [ebp - 0xae0]
jmp 0x4a0b43
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1c68]
cmp eax, dword [ebp - 0x14]
jne 0x49e56f
movzx ecx, byte [0x52fb84]
test ecx, ecx
je 0x49e550
push 0
mov ecx, 0x52e140
call fcn.004a2940
jmp 0x49e55d
mov edx, dword [str.UserSettings.txt]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov ecx, dword [ebp - 0xae4]
call fcn.00433c9f
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x1ec8]
cmp ecx, dword [ebp - 0x14]
je 0x49e5a6
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1f60]
cmp eax, dword [ebp - 0x14]
je 0x49e5a6
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1ff8]
cmp edx, dword [ebp - 0x14]
jne 0x49e660
mov dword [ebp - 0x878], 0
jmp 0x49e5c1
mov eax, dword [ebp - 0x878]
add eax, 1
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 3
jae 0x49e654
mov ecx, dword [ebp - 0x878]
imul ecx, ecx, 0x98
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + ecx + 0x1ec8]
cmp eax, dword [ebp - 0x14]
jne 0x49e62f
movzx ecx, byte [0x4e2b97]
push ecx
mov edx, dword [ebp - 0x878]
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.0049ba60
mov byte [0x4e2b97], 0
push 1
mov eax, dword [ebp - 0x878]
imul eax, eax, 0x98
mov ecx, dword [ebp - 0xae4]
lea ecx, [ecx + eax + 0x1ea8]
call fcn.00406050
jmp 0x49e64f
push 0
mov edx, dword [ebp - 0x878]
imul edx, edx, 0x98
mov eax, dword [ebp - 0xae4]
lea ecx, [eax + edx + 0x1ea8]
call fcn.00406050
jmp 0x49e5b2
xor eax, eax
jmp 0x4a0b43
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x22f0]
cmp edx, dword [ebp - 0x14]
je 0x49e697
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x2388]
cmp ecx, dword [ebp - 0x14]
je 0x49e697
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x2420]
cmp eax, dword [ebp - 0x14]
jne 0x49e78d
mov ecx, dword [ebp - 0xae4]
add ecx, 0x22d0
mov dword [ebp - 0x890], ecx
mov dword [ebp - 0x88c], 1
mov edx, dword [ebp - 0xae4]
add edx, 0x2368
mov dword [ebp - 0x888], edx
mov dword [ebp - 0x884], 3
mov eax, dword [ebp - 0xae4]
add eax, 0x2400
mov dword [ebp - 0x880], eax
mov dword [ebp - 0x87c], 2
mov dword [ebp - 0x894], 0
jmp 0x49e705
mov ecx, dword [ebp - 0x894]
add ecx, 1
mov dword [ebp - 0x894], ecx
cmp dword [ebp - 0x894], 3
jae 0x49e781
mov edx, dword [ebp - 0x894]
mov eax, dword [ebp + edx*8 - 0x890]
mov ecx, dword [eax + 0x20]
cmp ecx, dword [ebp - 0x14]
jne 0x49e768
push 1
push 0
mov edx, dword [ebp - 0x894]
mov eax, dword [ebp + edx*8 - 0x88c]
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.0049ad00
push 1
mov ecx, dword [ebp - 0x894]
mov ecx, dword [ebp + ecx*8 - 0x890]
call fcn.00406050
mov edx, dword [ebp - 0x894]
mov eax, dword [ebp + edx*8 - 0x88c]
mov dword [0x4e68c0], eax
jmp 0x49e77c
push 0
mov ecx, dword [ebp - 0x894]
mov ecx, dword [ebp + ecx*8 - 0x890]
call fcn.00406050
jmp 0x49e6f6
xor eax, eax
jmp 0x4a0b43
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1970]
cmp eax, dword [ebp - 0x14]
je 0x49e7e6
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1a08]
cmp edx, dword [ebp - 0x14]
je 0x49e7e6
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x1aa0]
cmp ecx, dword [ebp - 0x14]
je 0x49e7e6
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1b38]
cmp eax, dword [ebp - 0x14]
je 0x49e7e6
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1bd0]
cmp edx, dword [ebp - 0x14]
jne 0x49e957
push 0x4f
mov ecx, dword [ebp - 0xae4]
call fcn.00404970
movzx eax, byte [0x4e763b]
cmp eax, 1
jne 0x49e8a6
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1970]
cmp edx, dword [ebp - 0x14]
jne 0x49e823
push 1
mov ecx, dword [ebp - 0xae4]
call fcn.0048f760
jmp 0x49e8a1
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x1a08]
cmp ecx, dword [ebp - 0x14]
jne 0x49e843
push 2
mov ecx, dword [ebp - 0xae4]
call fcn.0048f760
jmp 0x49e8a1
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1aa0]
cmp eax, dword [ebp - 0x14]
jne 0x49e863
push 3
mov ecx, dword [ebp - 0xae4]
call fcn.0048f760
jmp 0x49e8a1
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1b38]
cmp edx, dword [ebp - 0x14]
jne 0x49e883
push 4
mov ecx, dword [ebp - 0xae4]
call fcn.0048f760
jmp 0x49e8a1
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x1bd0]
cmp ecx, dword [ebp - 0x14]
jne 0x49e8a1
push 5
mov ecx, dword [ebp - 0xae4]
call fcn.0048f760
jmp 0x49e944
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1970]
cmp eax, dword [ebp - 0x14]
jne 0x49e8c6
push 1
mov ecx, dword [ebp - 0xae4]
call fcn.0049de50
jmp 0x49e944
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1a08]
cmp edx, dword [ebp - 0x14]
jne 0x49e8e6
push 2
mov ecx, dword [ebp - 0xae4]
call fcn.0049de50
jmp 0x49e944
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x1aa0]
cmp ecx, dword [ebp - 0x14]
jne 0x49e906
push 3
mov ecx, dword [ebp - 0xae4]
call fcn.0049de50
jmp 0x49e944
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1b38]
cmp eax, dword [ebp - 0x14]
jne 0x49e926
push 4
mov ecx, dword [ebp - 0xae4]
call fcn.0049de50
jmp 0x49e944
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1bd0]
cmp edx, dword [ebp - 0x14]
jne 0x49e944
push 5
mov ecx, dword [ebp - 0xae4]
call fcn.0049de50
mov byte [0x4e763b], 0
xor eax, eax
jmp 0x4a0b43
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x4c8]
cmp ecx, dword [ebp - 0x14]
jne 0x49e98f
push 5
push 0
push str.http:__www.galaxytech.com
push str.IExplore.exe
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x4a0b43
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1d00]
cmp eax, dword [ebp - 0x14]
jne 0x49e9b2
push 6
mov ecx, dword [ebp - 0xae4]
call fcn.00433c9f
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x24b8]
cmp edx, dword [ebp - 0x14]
jne 0x49ea63
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x7a64]
imul ecx, ecx, 0x88
mov edx, dword [ebp - 0xae4]
movzx eax, byte [edx + ecx + 0x7ae8]
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x7a64]
imul edx, edx, 0x88
mov ecx, dword [ebp - 0xae4]
mov byte [ecx + edx + 0x7ae8], al
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x7a64]
imul eax, eax, 0x88
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + eax + 0x7ae8]
neg edx
sbb edx, edx
add edx, 0xc9
mov dword [ebp - 0x898], edx
push 0
mov eax, dword [ebp - 0x898]
push eax
mov ecx, dword [ebp - 0x898]
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2498
call fcn.004060d0
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x2550]
cmp eax, dword [ebp - 0x14]
jne 0x49eaf2
push 0
push 0
lea ecx, [ebp - 0x89c]
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2584
call fcn.00406010
xor edx, edx
cmp dword [ebp - 0x89c], 0xcb
setne dl
add edx, 0xca
mov dword [ebp - 0x89c], edx
push 0
mov eax, dword [ebp - 0x89c]
push eax
mov ecx, dword [ebp - 0x89c]
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2530
call fcn.004060d0
xor edx, edx
cmp dword [ebp - 0x89c], 0xca
sete dl
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2cac
call fcn.00433ce1
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x3474]
cmp ecx, dword [ebp - 0x14]
jne 0x49eb80
push 0
push 0
lea edx, [ebp - 0x8a0]
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x34a8
call fcn.00406010
xor eax, eax
cmp dword [ebp - 0x8a0], 0xcb
setne al
add eax, 0xca
mov dword [ebp - 0x8a0], eax
push 0
mov ecx, dword [ebp - 0x8a0]
push ecx
mov edx, dword [ebp - 0x8a0]
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x3454
call fcn.004060d0
xor eax, eax
cmp dword [ebp - 0x8a0], 0xca
sete al
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.00433ce1
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1d98]
cmp edx, dword [ebp - 0x14]
jne 0x49ebc7
push 0
lea ecx, [ebp - 0x91c]
call fcn.00470ab0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x91c]
call fcn.0042cf7b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x91c]
call fcn.00470a90
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x18d8]
cmp ecx, dword [ebp - 0x14]
jne 0x49ec9b
movzx edx, byte [0x4e20ac]
test edx, edx
jne 0x49ec42
mov eax, dword [ebp - 0xae4]
cmp dword [eax + 0x87a8], 0
je 0x49ec42
mov ecx, dword [ebp - 0xae4]
mov ecx, dword [ecx + 0x87a8]
call fcn.00401f20
test eax, eax
je 0x49ec42
push 0
mov edx, dword [ebp - 0xae4]
mov ecx, dword [edx + 0x87a8]
call fcn.00433c9f
movzx eax, byte [0x4e20ac]
neg eax
sbb eax, eax
add eax, 1
mov byte [0x4e20ac], al
mov byte [0x4e7624], 1
mov eax, 1
jmp 0x4a0b43
movzx ecx, byte [0x4e20ac]
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [0x4e20ac], cl
movzx edx, byte [0x4e7624]
test edx, edx
je 0x49ec80
mov byte [0x4e7624], 0
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0x7e8
mov ecx, dword [ebp - 0xae4]
call fcn.00404990
jmp 0x49ec96
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0x7e8
mov ecx, dword [ebp - 0xae4]
call fcn.00404990
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1840]
cmp eax, dword [ebp - 0x14]
jne 0x49edce
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x78
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x244
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0xd4
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a0
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x130
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2fc
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x18c
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x358
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x1e8
call fcn.00433ce1
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x3b4
call fcn.00433ce1
push 0
push 0
push 0x10a
mov ecx, dword [ebp - 0xae4]
add ecx, 0x1820
call fcn.004060d0
push 0
push 0
push 0x109
mov ecx, dword [ebp - 0xae4]
add ecx, 0x1788
call fcn.004060d0
push 1
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00406e80
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x410
call fcn.00433ce1
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x17a8]
cmp ecx, dword [ebp - 0x14]
jne 0x49ef01
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x78
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x244
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0xd4
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a0
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x130
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2fc
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x18c
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x358
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x1e8
call fcn.00433ce1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x3b4
call fcn.00433ce1
push 0
push 0
push 0x109
mov ecx, dword [ebp - 0xae4]
add ecx, 0x1820
call fcn.004060d0
push 0
push 0
push 0x10a
mov ecx, dword [ebp - 0xae4]
add ecx, 0x1788
call fcn.004060d0
push 0
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x7a64]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00406e80
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x410
call fcn.00433ce1
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1e30]
cmp edx, dword [ebp - 0x14]
jne 0x49ef48
push 0xfe
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0
call fcn.00406e60
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 0
jne 0x49ef43
mov ecx, dword [ebp - 0xae4]
call fcn.0049a720
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x2090]
cmp ecx, dword [ebp - 0x14]
jne 0x49ef79
push 0
push 0x1f4
push 0x4f
mov ecx, dword [ebp - 0xae4]
call fcn.00401110
mov byte [0x4e763b], 1
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x2128]
cmp eax, dword [ebp - 0x14]
jne 0x49ef9a
mov ecx, dword [ebp - 0xae4]
call fcn.0048e290
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x21c0]
cmp edx, dword [ebp - 0x14]
jne 0x49efbb
mov ecx, dword [ebp - 0xae4]
call fcn.0049ceb0
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x2258]
cmp ecx, dword [ebp - 0x14]
jne 0x49f06e
mov ecx, dword [ebp - 0x18]
call fcn.004010a0
movzx edx, al
cmp edx, 2
jge 0x49efe7
xor eax, eax
jmp 0x4a0b43
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2238
call fcn.00406070
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 0
je 0x49f039
push 0
push 0xaf
push 0xaf
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2238
call fcn.004060d0
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2238
call fcn.00406050
jmp 0x49f069
push 0
push 0xc1
push 0xc1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2238
call fcn.004060d0
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2238
call fcn.00406050
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x350c]
cmp ecx, dword [ebp - 0x14]
jne 0x49f180
mov edx, dword [ebp - 0xae4]
movzx eax, byte [edx + 0x7a64]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f12f
push 0
push 0
lea ecx, [ebp - 0x928]
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x928], 0xc8
jne 0x49f0fb
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x930], eax
mov edx, dword [ebp - 0x930]
sub edx, 2
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x92c]
sub eax, 1
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
jmp 0x49f161
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.00406130
mov dword [ebp - 0x934], eax
mov ecx, dword [ebp - 0x934]
sub ecx, 1
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.004aa2f0
push 1
mov edx, dword [ebp - 0xae4]
add edx, 0x87b0
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x35a4]
cmp ecx, dword [ebp - 0x14]
jne 0x49f292
mov edx, dword [ebp - 0xae4]
movzx eax, byte [edx + 0x7a64]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f241
push 0
push 0
lea ecx, [ebp - 0x938]
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x938], 0xc8
jne 0x49f20d
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x940], eax
mov edx, dword [ebp - 0x940]
add edx, 2
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x93c], eax
mov eax, dword [ebp - 0x93c]
add eax, 1
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
jmp 0x49f273
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.00406130
mov dword [ebp - 0x944], eax
mov ecx, dword [ebp - 0x944]
add ecx, 1
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.004aa2f0
push 1
mov edx, dword [ebp - 0xae4]
add edx, 0x87b0
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x363c]
cmp ecx, dword [ebp - 0x14]
jne 0x49f3a4
mov edx, dword [ebp - 0xae4]
movzx eax, byte [edx + 0x7a64]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f353
push 0
push 0
lea ecx, [ebp - 0x948]
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x948], 0xc8
jne 0x49f31f
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x950], eax
mov edx, dword [ebp - 0x950]
sub edx, 1
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x94c]
sub eax, 2
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
jmp 0x49f385
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.00406130
mov dword [ebp - 0x954], eax
mov ecx, dword [ebp - 0x954]
sub ecx, 1
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.004aa2f0
push 1
mov edx, dword [ebp - 0xae4]
add edx, 0x87b0
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x36d4]
cmp ecx, dword [ebp - 0x14]
jne 0x49f4b6
mov edx, dword [ebp - 0xae4]
movzx eax, byte [edx + 0x7a64]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f465
push 0
push 0
lea ecx, [ebp - 0x958]
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x958], 0xc8
jne 0x49f431
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x960], eax
mov edx, dword [ebp - 0x960]
add edx, 1
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x95c]
add eax, 2
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
jmp 0x49f497
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.00406130
mov dword [ebp - 0x964], eax
mov ecx, dword [ebp - 0x964]
add ecx, 1
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.004aa2f0
push 1
mov edx, dword [ebp - 0xae4]
add edx, 0x87b0
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x376c]
cmp ecx, dword [ebp - 0x14]
jne 0x49f569
mov edx, dword [ebp - 0xae4]
movzx eax, byte [edx + 0x7a64]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f519
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.00406130
mov dword [ebp - 0x968], eax
mov ecx, dword [ebp - 0x968]
sub ecx, 1
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
jmp 0x49f54b
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.00406130
mov dword [ebp - 0x96c], eax
mov edx, dword [ebp - 0x96c]
sub edx, 1
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.004aa2f0
push 1
mov eax, dword [ebp - 0xae4]
add eax, 0x87c0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x3804]
cmp edx, dword [ebp - 0x14]
jne 0x49f61d
mov eax, dword [ebp - 0xae4]
movzx ecx, byte [eax + 0x7a64]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f5cc
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.00406130
mov dword [ebp - 0x970], eax
mov edx, dword [ebp - 0x970]
add edx, 1
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
jmp 0x49f5fe
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.00406130
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x974]
add eax, 1
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.004aa2f0
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x87c0
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1088]
cmp eax, dword [ebp - 0x14]
jne 0x49f72f
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f6de
push 0
push 0
lea eax, [ebp - 0x978]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x978], 0xc8
jne 0x49f6aa
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x980], eax
mov ecx, dword [ebp - 0x980]
sub ecx, 0x14
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x97c], eax
mov edx, dword [ebp - 0x97c]
sub edx, 0xa
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
jmp 0x49f710
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.00406130
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x984]
sub eax, 0xa
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.004aa2f0
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x87b0
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1120]
cmp eax, dword [ebp - 0x14]
jne 0x49f841
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f7f0
push 0
push 0
lea eax, [ebp - 0x988]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x988], 0xc8
jne 0x49f7bc
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x990], eax
mov ecx, dword [ebp - 0x990]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x98c], eax
mov edx, dword [ebp - 0x98c]
add edx, 0xa
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
jmp 0x49f822
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.00406130
mov dword [ebp - 0x994], eax
mov eax, dword [ebp - 0x994]
add eax, 0xa
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.004aa2f0
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x87b0
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x11b8]
cmp eax, dword [ebp - 0x14]
jne 0x49f953
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49f902
push 0
push 0
lea eax, [ebp - 0x998]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x998], 0xc8
jne 0x49f8ce
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x9a0], eax
mov ecx, dword [ebp - 0x9a0]
sub ecx, 5
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x99c], eax
mov edx, dword [ebp - 0x99c]
sub edx, 0xa
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
jmp 0x49f934
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.00406130
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x9a4]
sub eax, 0xa
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.004aa2f0
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x87b0
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1250]
cmp eax, dword [ebp - 0x14]
jne 0x49fa65
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49fa14
push 0
push 0
lea eax, [ebp - 0x9a8]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x9a8], 0xc8
jne 0x49f9e0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x9b0], eax
mov ecx, dword [ebp - 0x9b0]
add ecx, 5
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x9ac], eax
mov edx, dword [ebp - 0x9ac]
add edx, 0xa
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
jmp 0x49fa46
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.00406130
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x9b4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.004aa2f0
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x87b0
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x12e8]
cmp eax, dword [ebp - 0x14]
jne 0x49fb19
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49fac8
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.00406130
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0x9b8]
sub eax, 0xa
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
jmp 0x49fafa
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.00406130
mov dword [ebp - 0x9bc], eax
mov ecx, dword [ebp - 0x9bc]
sub ecx, 0xa
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.004aa2f0
push 1
mov edx, dword [ebp - 0xae4]
add edx, 0x87c0
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x1380]
cmp ecx, dword [ebp - 0x14]
jne 0x49fbcc
mov edx, dword [ebp - 0xae4]
movzx eax, byte [edx + 0x7a64]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49fb7c
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.00406130
mov dword [ebp - 0x9c0], eax
mov ecx, dword [ebp - 0x9c0]
add ecx, 0xa
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
jmp 0x49fbae
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.00406130
mov dword [ebp - 0x9c4], eax
mov edx, dword [ebp - 0x9c4]
add edx, 0xa
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.004aa2f0
push 1
mov eax, dword [ebp - 0xae4]
add eax, 0x87c0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1418]
cmp edx, dword [ebp - 0x14]
jne 0x49fcdd
mov eax, dword [ebp - 0xae4]
movzx ecx, byte [eax + 0x7a64]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49fc8d
push 0
push 0
lea edx, [ebp - 0x9c8]
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x9c8], 0xc8
jne 0x49fc59
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x9d0]
sub eax, 0x28
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x9cc], eax
mov ecx, dword [ebp - 0x9cc]
sub ecx, 0x14
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
jmp 0x49fcbf
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.00406130
mov dword [ebp - 0x9d4], eax
mov edx, dword [ebp - 0x9d4]
sub edx, 0x14
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.004aa2f0
push 1
mov eax, dword [ebp - 0xae4]
add eax, 0x87b0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x14b0]
cmp edx, dword [ebp - 0x14]
jne 0x49fdee
mov eax, dword [ebp - 0xae4]
movzx ecx, byte [eax + 0x7a64]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49fd9e
push 0
push 0
lea edx, [ebp - 0x9d8]
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x9d8], 0xc8
jne 0x49fd6a
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x9e0]
add eax, 0x28
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x9dc], eax
mov ecx, dword [ebp - 0x9dc]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
jmp 0x49fdd0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.00406130
mov dword [ebp - 0x9e4], eax
mov edx, dword [ebp - 0x9e4]
add edx, 0x14
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2ff4
call fcn.004aa2f0
push 1
mov eax, dword [ebp - 0xae4]
add eax, 0x87b0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1548]
cmp edx, dword [ebp - 0x14]
jne 0x49feff
mov eax, dword [ebp - 0xae4]
movzx ecx, byte [eax + 0x7a64]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49feaf
push 0
push 0
lea edx, [ebp - 0x9e8]
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x9e8], 0xc8
jne 0x49fe7b
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0x9f0], eax
mov eax, dword [ebp - 0x9f0]
sub eax, 0xa
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x9ec], eax
mov ecx, dword [ebp - 0x9ec]
sub ecx, 0x14
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
jmp 0x49fee1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.00406130
mov dword [ebp - 0x9f4], eax
mov edx, dword [ebp - 0x9f4]
sub edx, 0x14
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.004aa2f0
push 1
mov eax, dword [ebp - 0xae4]
add eax, 0x87b0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x15e0]
cmp edx, dword [ebp - 0x14]
jne 0x4a0010
mov eax, dword [ebp - 0xae4]
movzx ecx, byte [eax + 0x7a64]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x49ffc0
push 0
push 0
lea edx, [ebp - 0x9f8]
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x24ec
call fcn.00406010
cmp dword [ebp - 0x9f8], 0xc8
jne 0x49ff8c
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.00406130
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0xa00]
add eax, 0xa
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.00406130
mov dword [ebp - 0x9fc], eax
mov ecx, dword [ebp - 0x9fc]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
jmp 0x49fff2
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.00406130
mov dword [ebp - 0xa04], eax
mov edx, dword [ebp - 0xa04]
add edx, 0x14
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x310c
call fcn.004aa2f0
push 1
mov eax, dword [ebp - 0xae4]
add eax, 0x87b0
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x1678]
cmp edx, dword [ebp - 0x14]
jne 0x4a00c4
mov eax, dword [ebp - 0xae4]
movzx ecx, byte [eax + 0x7a64]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x4a0073
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.00406130
mov dword [ebp - 0xa08], eax
mov edx, dword [ebp - 0xa08]
sub edx, 0x14
push edx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
jmp 0x4a00a5
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.00406130
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0xa0c]
sub eax, 0x14
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.004aa2f0
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x87c0
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + 0x1710]
cmp eax, dword [ebp - 0x14]
jne 0x4a0178
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00406f50
test eax, eax
jne 0x4a0127
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.00406130
mov dword [ebp - 0xa10], eax
mov eax, dword [ebp - 0xa10]
add eax, 0x14
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
jmp 0x4a0159
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.00406130
mov dword [ebp - 0xa14], eax
mov ecx, dword [ebp - 0xa14]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0xae4]
add ecx, 0x333c
call fcn.004aa2f0
push 1
mov edx, dword [ebp - 0xae4]
add edx, 0x87c0
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x430]
cmp ecx, dword [ebp - 0x14]
jne 0x4a0482
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x78
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov dword [ebp - 0xa18], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0xd4
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov dword [ebp - 0xa28], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x130
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov dword [ebp - 0xa1c], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x18c
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov dword [ebp - 0xa20], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x1e8
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov dword [ebp - 0xa24], eax
mov edx, dword [ebp - 0xa24]
cmp edx, dword [ebp - 0xa20]
jl 0x4a0469
mov eax, dword [ebp - 0xa20]
cmp eax, dword [ebp - 0xa1c]
jl 0x4a0469
mov ecx, dword [ebp - 0xa1c]
cmp ecx, dword [ebp - 0xa28]
jl 0x4a0469
mov edx, dword [ebp - 0xa28]
cmp edx, dword [ebp - 0xa18]
jl 0x4a0469
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x78
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov ecx, dword [ebp - 0xae4]
mov dword [ecx + 0x799c], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x244
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov edx, dword [ebp - 0xae4]
mov dword [edx + 0x79a0], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0xd4
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov ecx, dword [ebp - 0xae4]
mov dword [ecx + 0x79a4], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a0
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov edx, dword [ebp - 0xae4]
mov dword [edx + 0x79a8], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x130
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov ecx, dword [ebp - 0xae4]
mov dword [ecx + 0x79ac], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2fc
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov edx, dword [ebp - 0xae4]
mov dword [edx + 0x79b0], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x18c
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov ecx, dword [ebp - 0xae4]
mov dword [ecx + 0x79b4], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x358
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov edx, dword [ebp - 0xae4]
mov dword [edx + 0x79b8], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x1e8
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov ecx, dword [ebp - 0xae4]
mov dword [ecx + 0x79bc], eax
push 1
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x3b4
call fcn.00433c1b
push eax
mov ecx, dword [ebp - 0xae4]
call fcn.00433a90
mov edx, dword [ebp - 0xae4]
mov dword [edx + 0x79c0], eax
push 1
mov ecx, dword [ebp - 0xae4]
add ecx, 0x3908
call fcn.004010c0
jmp 0x4a047d
push 0
push 0
push str.Please_reset_the_relationship_between_temperature_and_fan_speed_
mov ecx, dword [ebp - 0xae4]
call fcn.0042f175
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x690]
cmp ecx, dword [ebp - 0x14]
jne 0x4a0828
mov dword [ebp - 0xa6c], 0
push 0x38
push 0
lea edx, [ebp - 0xa68]
push edx
call fcn.00451f70
add esp, 0xc
mov dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x7a64]
imul ecx, ecx, 0x88
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + ecx + 0x7aec]
mov dword [ebp - 0xa30], eax
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x7a64]
imul edx, edx, 0x88
mov eax, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0xa30]
mov dword [eax + edx + 0x7aec], ecx
mov edx, dword [ebp - 0xa30]
push edx
lea eax, [ebp - 0xa6c]
push eax
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00479940
mov eax, dword [ebp - 0xae4]
movzx ecx, byte [eax + 0x7a64]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00403f20
mov dword [ebp - 0xa80], eax
movzx edx, byte [0x4e7639]
neg edx
sbb edx, edx
add edx, 1
mov byte [0x4e7639], dl
push 0
push 0
lea eax, [ebp - 0xa2c]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x6c4
call fcn.00406010
xor ecx, ecx
cmp dword [ebp - 0xa2c], 0x102
sete cl
add ecx, 0x102
mov dword [ebp - 0xa2c], ecx
push 0
mov edx, dword [ebp - 0xa2c]
push edx
mov eax, dword [ebp - 0xa2c]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x670
call fcn.004060d0
movzx ecx, byte [0x4e7639]
test ecx, ecx
je 0x4a05d7
push str.Relock_Max
mov ecx, dword [ebp - 0xae4]
add ecx, 0x670
call fcn.00433bd4
jmp 0x4a05f8
push 0xeb
mov ecx, 0x53550c
call fcn.00481790
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x670
call fcn.00433bd4
mov edx, dword [ebp - 0xa80]
cmp dword [edx + 0x18], 0
je 0x4a069d
movzx eax, byte [0x4e7639]
test eax, eax
je 0x4a0659
push 0
mov eax, dword [ebp - 0xa60]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xaf4], 0
fild qword [ebp - 0xaf8]
fmul qword [0x4d0210]
call fcn.004591b0
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa380
jmp 0x4a067c
push 0
mov eax, dword [ebp - 0xa60]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa380
mov eax, dword [ebp - 0xa6c]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
mov edx, dword [ebp - 0xa80]
cmp dword [edx + 0x10], 0
je 0x4a0742
movzx eax, byte [0x4e7639]
test eax, eax
je 0x4a06fe
push 0
mov eax, dword [ebp - 0xa40]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xafc], 0
fild qword [ebp - 0xb00]
fmul qword [0x4d0210]
call fcn.004591b0
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa380
jmp 0x4a0721
push 0
mov eax, dword [ebp - 0xa40]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa380
mov eax, dword [ebp - 0xa4c]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
mov edx, dword [ebp - 0xa80]
cmp dword [edx + 0x14], 0
je 0x4a07e7
movzx eax, byte [0x4e7639]
test eax, eax
je 0x4a07a3
push 0
mov eax, dword [ebp - 0xa50]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb04], 0
fild qword [ebp - 0xb08]
fmul qword [0x4d0210]
call fcn.004591b0
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa380
jmp 0x4a07c6
push 0
mov eax, dword [ebp - 0xa50]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa380
mov eax, dword [ebp - 0xa5c]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
mov dword [ebp - 0xa7c], 0x2d5
mov dword [ebp - 0xa74], 0x316
mov dword [ebp - 0xa78], 0x64
mov dword [ebp - 0xa70], 0x190
push 1
lea edx, [ebp - 0xa7c]
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
jmp 0x4a0b30
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x5f8]
cmp ecx, dword [ebp - 0x14]
jne 0x4a0b30
mov dword [ebp - 0xac4], 0
push 0x38
push 0
lea edx, [ebp - 0xac0]
push edx
call fcn.00451f70
add esp, 0xc
mov dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0xae4]
mov ecx, dword [eax + 0x7a64]
imul ecx, ecx, 0x88
mov edx, dword [ebp - 0xae4]
mov eax, dword [edx + ecx + 0x7aec]
mov dword [ebp - 0xa88], eax
mov ecx, dword [ebp - 0xae4]
mov edx, dword [ecx + 0x7a64]
imul edx, edx, 0x88
mov eax, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0xa88]
mov dword [eax + edx + 0x7aec], ecx
mov edx, dword [ebp - 0xa88]
push edx
lea eax, [ebp - 0xac4]
push eax
mov ecx, dword [ebp - 0xae4]
movzx edx, byte [ecx + 0x7a64]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00479940
mov eax, dword [ebp - 0xae4]
movzx ecx, byte [eax + 0x7a64]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00403f20
mov dword [ebp - 0xad8], eax
movzx edx, byte [0x4e7638]
neg edx
sbb edx, edx
add edx, 1
mov byte [0x4e7638], dl
push 0
push 0
lea eax, [ebp - 0xa84]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x62c
call fcn.00406010
xor ecx, ecx
cmp dword [ebp - 0xa84], 0x102
sete cl
add ecx, 0x102
mov dword [ebp - 0xa84], ecx
push 0
mov edx, dword [ebp - 0xa84]
push edx
mov eax, dword [ebp - 0xa84]
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x5d8
call fcn.004060d0
movzx ecx, byte [0x4e7638]
test ecx, ecx
je 0x4a097d
push str.Relock_Min
mov ecx, dword [ebp - 0xae4]
add ecx, 0x5d8
call fcn.00433bd4
jmp 0x4a099e
push 0xea
mov ecx, 0x53550c
call fcn.00481790
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x5d8
call fcn.00433bd4
mov edx, dword [ebp - 0xad8]
cmp dword [edx + 0x18], 0
je 0x4a0a10
movzx eax, byte [0x4e7638]
test eax, eax
je 0x4a09cc
push 0
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa350
jmp 0x4a09ef
push 0
mov eax, dword [ebp - 0xabc]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa350
mov eax, dword [ebp - 0xac4]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2964
call fcn.004aa2f0
mov edx, dword [ebp - 0xad8]
cmp dword [edx + 0x10], 0
je 0x4a0a82
movzx eax, byte [0x4e7638]
test eax, eax
je 0x4a0a3e
push 0
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa350
jmp 0x4a0a61
push 0
mov eax, dword [ebp - 0xa9c]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa350
mov eax, dword [ebp - 0xaa4]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2a7c
call fcn.004aa2f0
mov edx, dword [ebp - 0xad8]
cmp dword [edx + 0x14], 0
je 0x4a0af4
movzx eax, byte [0x4e7638]
test eax, eax
je 0x4a0ab0
push 0
push 0
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa350
jmp 0x4a0ad3
push 0
mov eax, dword [ebp - 0xaac]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa350
mov eax, dword [ebp - 0xab4]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
mov ecx, dword [ebp - 0xae4]
add ecx, 0x2b94
call fcn.004aa2f0
mov dword [ebp - 0xad4], 0x2d5
mov dword [ebp - 0xacc], 0x316
mov dword [ebp - 0xad0], 0x64
mov dword [ebp - 0xac8], 0x190
push 1
lea edx, [ebp - 0xad4]
push edx
mov ecx, dword [ebp - 0xae4]
call fcn.00406eb0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xae4]
call fcn.00431bd5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00451600
mov esp, ebp
pop ebp
ret 8