Function at 0x43f830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe54
push esi
push edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], eax
mov eax, 0x53371c
call fcn.00508d0c
mov word [ebp - 0x58], 8
lea eax, [ebp - 4]
call fcn.00401d10
inc dword [ebp - 0x4c]
xor edx, edx
mov word [ebp - 0x58], 0x14
mov dword [ebp - 0xa0], edx
mov ecx, dword [ebp - 0x70]
cmp ecx, 0x42
ja case.default.0x43f879
jmp dword [ecx*4 + 0x43f880]
mov byte [0x54352c], 0
mov edx, dword [ebp - 0x74]
add edx, 5
mov eax, dword [ebp - 0x6c]
call fcn.004237a8
mov ecx, dword [0x547b38]
dec ecx
je 0x43f9b2
dec ecx
je 0x43f9e0
jmp 0x43fab8
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x2fb0], 3
je 0x43f9d1
mov edx, dword [ebp - 0x6c]
cmp dword [edx + 0x28e3c], 0
jne 0x43f9d1
cmp dword [0x54351c], 0
mov dword [ebp - 0xa0], 1
jmp 0x43fab8
mov byte [0x547138], 0
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x2f8]
mov eax, dword [eax + 0x160]
call fcn.004c27f0
push eax
push 0x258
push 0x320
push 0
push 0
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx + 0x3e0]
call fcn.004c6d94
call fcn.004c27f0
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [0x543010]
push 1
mov ecx, 0x5334c1
mov edx, 0x5334aa
mov eax, dword [eax]
call fcn.00514524
dec eax
jne 0x43fa4e
mov byte [0x54855c], 1
push 0xcc0020
push 0
push 0
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx + 0x3e0]
call fcn.004c6d94
call fcn.004c27f0
push eax
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x2f8]
mov eax, dword [eax + 0x160]
call fcn.004c27f0
push eax
call sub.gdi32.dll_BitBlt
mov dword [ebp - 0xa0], 1
mov byte [0x547138], 1
xor edx, edx
mov dword [0x547b38], edx
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x74]
add ecx, 7
push ecx
call fcn.00408748
pop ecx
mov edx, eax
mov eax, dword [ebp - 0x6c]
call fcn.00439cc8
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x74]
xor eax, eax
add ecx, 4
lea esi, [ebp - 0xec]
mov edi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x2fc8], 0
je 0x43fb90
xor eax, eax
lea edi, [ebp - 0xec]
or ecx, 0xffffffff
lea esi, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x12c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x5334c6
push eax
call fcn.005089a0
add esp, 8
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 0x6c]
call fcn.00439b14
test al, al
je 0x43fb90
xor eax, eax
lea edi, [ebp - 0x12c]
or ecx, 0xffffffff
lea esi, [ebp - 0xec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xec]
push eax
mov edx, dword [ebp - 0x6c]
add edx, 0x26270
push edx
call fcn.005089a0
add esp, 8
push 0x5334c8
mov ecx, dword [ebp - 0x6c]
add ecx, 0x26270
push ecx
call fcn.005089a0
add esp, 8
lea edx, [ebp - 0xec]
mov eax, dword [ebp - 0x6c]
call fcn.00439a38
xor eax, eax
lea edi, [ebp - 0xec]
or ecx, 0xffffffff
mov esi, 0x547a48
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 0x5437c4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x547134]
lea edi, [ebp - 0xec]
mov byte [eax + 0x5437c4], 0x40
inc dword [0x547134]
xor eax, eax
add edx, dword [0x547134]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0xec]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.005089dc
pop ecx
add eax, dword [0x547134]
mov dword [0x547134], eax
mov eax, dword [ebp - 0x6c]
call fcn.0043e50c
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 4
call fcn.0043e4d8
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 6
call fcn.004245d8
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.0043a860
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
cmp dword [0x547b28], 3
jne 0x43fcba
mov eax, dword [ebp - 0x6c]
call fcn.00432570
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.00426bf4
mov edx, dword [ebp - 0x6c]
mov byte [edx + 0x6b78], 0
mov byte [0x547139], 1
mov eax, dword [ebp - 0x6c]
call fcn.004335b4
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.0043a860
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 0xa
call fcn.00434a48
mov eax, dword [ebp - 0x6c]
call fcn.004351b8
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
cmp byte [edx + 7], 0
je 0x43fd28
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 8
call fcn.004359fc
jmp 0x43fd36
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 7
call fcn.004359fc
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov byte [ebp - 0x1ac], 0
mov dword [ebp - 0x7c], 8
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov dword [0x5432b8], ecx
lea edx, [eax + 8]
mov dword [ebp - 0xa4], edx
mov ecx, dword [ebp - 0xa4]
cmp byte [ecx], 0
je 0x43fde2
mov eax, dword [ebp - 0xa4]
movsx edx, byte [eax]
cmp edx, 0x20
jne 0x43fd8b
mov ecx, dword [ebp - 0xa4]
mov byte [ecx], 0
jmp 0x43fde2
mov eax, dword [ebp - 0xa4]
movsx edx, byte [eax]
cmp edx, 0x3a
jne 0x43fdd0
mov ecx, dword [ebp - 0xa4]
lea esi, [ebp - 0x1ac]
mov byte [ecx], 0
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x74]
inc eax
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x43fde2
inc dword [ebp - 0x7c]
inc dword [ebp - 0xa4]
cmp dword [ebp - 0x7c], 0x80
jl 0x43fd67
push 0x1e
mov eax, dword [ebp - 0x74]
add eax, 7
push eax
push 0x547958
call fcn.00508bb8
add esp, 0xc
mov eax, dword [ebp - 0x6c]
call fcn.0041dadc
mov edx, dword [ebp - 0x74]
add edx, 7
mov ecx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00457430
cmp byte [ebp - 0x1ac], 0
je 0x43fe2a
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x6c]
call fcn.0043e4d8
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
cmp byte [0x5485f2], 0
je 0x43fe49
mov byte [0x547b34], 1
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 5
call fcn.00424cf8
mov edx, eax
mov eax, dword [ebp - 0x6c]
call fcn.00426bf4
mov word [ebp - 0x58], 0x20
mov edx, 0x5479b2
lea eax, [ebp - 8]
call fcn.005145e8
mov edx, eax
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x6c]
add eax, 0x2fbdc
call fcn.00514778
dec dword [ebp - 0x4c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00514748
mov eax, dword [ebp - 0x6c]
mov ecx, dword [0x54713c]
mov dword [eax + 0x2fbe0], ecx
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [edx + 0x440]
mov dword [eax + 0x2fbe4], ecx
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 6
call fcn.00436e0c
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 4
call fcn.004372f4
test al, al
je 0x440071
mov dword [ebp - 0x7c], 4
mov edx, dword [ebp - 0x74]
lea ecx, [edx + 4]
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0xa4]
movsx edx, byte [eax]
cmp edx, 0x29
je 0x43ff32
mov ecx, dword [ebp - 0xa4]
cmp byte [ecx], 0
je 0x43ff32
inc dword [ebp - 0x7c]
inc dword [ebp - 0xa4]
cmp dword [ebp - 0x7c], 0xc8
jl 0x43ff07
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], 0xc8
jge 0x440071
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
mov cl, byte [eax + edx]
mov byte [ebp - 0x99], cl
movsx eax, byte [ebp - 0x99]
cmp eax, 0x2a
je 0x43ff79
movsx edx, byte [ebp - 0x99]
cmp edx, 0x40
je 0x43ff79
movsx ecx, byte [ebp - 0x99]
cmp ecx, 0x21
jne 0x440021
xor eax, eax
mov dword [ebp - 0x80], eax
mov edx, dword [ebp - 0x74]
mov ecx, edx
mov dword [ebp - 0xac], ecx
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
lea ecx, [eax + edx]
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp - 0xa8]
mov dl, byte [eax]
mov byte [ebp - 0x99], dl
inc dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xac]
mov al, byte [ebp - 0x99]
mov byte [ecx], al
cmp byte [ebp - 0x99], 0
jne 0x43ffe9
mov eax, 2
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x4c]
call fcn.00514748
pop eax
mov edx, dword [ebp - 0x68]
mov dword fs:[0], edx
jmp 0x4416e2
inc dword [ebp - 0x80]
inc dword [ebp - 0xac]
cmp dword [ebp - 0x80], 0xc8
jl 0x43ff98
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x4c]
call fcn.00514748
pop eax
mov edx, dword [ebp - 0x68]
mov dword fs:[0], edx
jmp 0x4416e2
movsx ecx, byte [ebp - 0x99]
cmp ecx, 0x20
je 0x440061
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, dword [ebp - 0x7c]
call fcn.0043e4d8
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x4c]
call fcn.00514748
pop eax
mov edx, dword [ebp - 0x68]
mov dword fs:[0], edx
jmp 0x4416e2
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], 0xc8
jl 0x43ff42
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 7
call fcn.0042a478
jmp case.default.0x43f879
mov byte [ebp - 0x1ac], 0
mov dword [ebp - 0x7c], 7
mov ecx, dword [ebp - 0x74]
lea eax, [ecx + 7]
mov dword [ebp - 0xa4], eax
mov edx, dword [ebp - 0xa4]
cmp byte [edx], 0
je 0x440125
mov ecx, dword [ebp - 0xa4]
movsx eax, byte [ecx]
cmp eax, 0x20
jne 0x4400d1
mov edx, dword [ebp - 0xa4]
mov byte [edx], 0
jmp 0x440125
mov ecx, dword [ebp - 0xa4]
movsx eax, byte [ecx]
cmp eax, 0x3a
jne 0x440116
mov edx, dword [ebp - 0xa4]
xor eax, eax
lea esi, [ebp - 0x1ac]
mov byte [edx], 0
mov ecx, dword [ebp - 0x7c]
add ecx, dword [ebp - 0x74]
inc ecx
mov edi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x440125
inc dword [ebp - 0x7c]
inc dword [ebp - 0xa4]
cmp dword [ebp - 0x7c], 0x64
jl 0x4400ad
mov eax, dword [0x5432b8]
mov edx, dword [0x547140]
mov edi, 0x547958
mov dword [eax*4 + 0x5434e4], edx
mov ecx, dword [0x5432b8]
xor eax, eax
add ecx, ecx
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
add ecx, 0x5432bc
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x74]
movsx edx, byte [eax + 6]
cmp edx, 0x24
jne 0x4401ef
mov ecx, dword [ebp - 0x74]
movsx eax, byte [ecx + 7]
add eax, 0xffffffd0
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x440194
cmp dword [ebp - 0x78], 9
jle 0x440199
xor edx, edx
mov dword [ebp - 0x78], edx
mov ecx, dword [ebp - 0x78]
xor eax, eax
shl ecx, 6
mov esi, 0x547958
add ecx, 0x543540
mov edi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 0x547958
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00457430
cmp al, 1
jne 0x44023e
mov eax, dword [ebp - 0x6c]
call fcn.0041dadc
inc dword [0x5432b8]
jmp 0x44023e
mov edx, dword [ebp - 0x74]
add edx, 6
mov ecx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00457430
cmp al, 1
jne 0x44023e
mov edx, dword [ebp - 0x74]
xor eax, eax
add edx, 6
or ecx, 0xffffffff
mov edi, edx
mov esi, 0x547958
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x6c]
call fcn.0041dadc
inc dword [0x5432b8]
cmp byte [ebp - 0x1ac], 0
je 0x440255
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x6c]
call fcn.0043e4d8
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
cmp dword [0x5432b8], 0
je 0x4402e7
dec dword [0x5432b8]
mov ecx, 1
mov edx, dword [0x5432b8]
mov eax, dword [ebp - 0x6c]
add edx, edx
lea edx, [edx + edx*2]
lea edx, [edx + edx*4]
add edx, 0x5432bc
call fcn.00457430
mov edx, dword [0x5432b8]
xor eax, eax
add edx, edx
mov esi, 0x547958
lea edx, [edx + edx*2]
lea edx, [edx + edx*4]
add edx, 0x5432bc
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x5432b8]
mov edx, dword [eax*4 + 0x5434e4]
mov dword [0x547140], edx
mov byte [0x547139], 1
jmp 0x44030c
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x28e3c]
dec eax
je 0x4402f8
dec eax
je 0x440302
jmp 0x44030c
mov eax, dword [ebp - 0x6c]
call fcn.00410448
jmp 0x44030c
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.00417724
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
xor edx, edx
mov ecx, dword [ebp - 0x74]
add ecx, 6
mov dword [0x547a68], edx
push ecx
call fcn.00408748
pop ecx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x6c]
xor edx, edx
mov dword [eax + 0x3044], 0xffffff
mov eax, dword [ebp - 0x6c]
call fcn.0041a0c0
mov edx, dword [ebp - 0x6c]
mov ecx, dword [edx + 0x3208]
cmp ecx, dword [ebp - 0x78]
je 0x4403cc
mov eax, dword [ebp - 0x6c]
call fcn.0043d9d8
mov edx, dword [ebp - 0x6c]
cmp dword [edx + 0x3208], 0
jne 0x44039d
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 0x3208], 1
mov eax, dword [ebp - 0x6c]
mov dword [eax + 0x28e40], 2
mov eax, dword [ebp - 0x6c]
call fcn.004248ec
mov edx, 6
mov eax, dword [ebp - 0x6c]
call fcn.00426bf4
jmp 0x4403cc
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov dword [edx + 0x3208], ecx
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.004449e4
mov ecx, dword [ebp - 0x6c]
mov edx, 6
mov dword [ecx + 0x28e40], 1
mov eax, dword [ebp - 0x6c]
call fcn.00426bf4
mov dword [ebp - 0xa0], 1
mov byte [0x547139], 1
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.0043a860
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov edx, dword [ebp - 0x74]
cmp byte [edx + 5], 0
je 0x44044a
mov ecx, dword [ebp - 0x74]
add ecx, 5
push ecx
call fcn.00408748
pop ecx
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x63
jne 0x440454
mov word [ebp - 0x58], 0x2c
mov edx, 0x5334ca
lea eax, [ebp - 0xc]
call fcn.005145e8
inc dword [ebp - 0x4c]
mov edx, dword [eax]
mov ecx, 1
mov eax, dword [ebp - 0x6c]
call fcn.0043af24
dec dword [ebp - 0x4c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00514748
jmp 0x440454
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0042ede0
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov eax, dword [ebp - 0x6c]
lea edx, [eax + 0xff0]
mov dword [ebp - 0xa4], edx
mov ecx, dword [ebp - 0xa4]
mov byte [ecx], 0
inc dword [ebp - 0x7c]
inc dword [ebp - 0xa4]
cmp dword [ebp - 0x7c], 0x80
jl 0x440477
xor eax, eax
mov dword [ebp - 0x7c], eax
mov edx, dword [ebp - 0x6c]
lea ecx, [edx + 0xb0e]
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0xa4]
mov byte [eax], 0
inc dword [ebp - 0x7c]
inc dword [ebp - 0xa4]
cmp dword [ebp - 0x7c], 0x4e2
jl 0x4404a6
xor edx, edx
mov dword [ebp - 0x7c], edx
mov ecx, dword [ebp - 0x6c]
lea eax, [ecx + 0x1070]
mov dword [ebp - 0xa4], eax
mov edx, dword [ebp - 0xa4]
xor ecx, ecx
mov dword [edx], ecx
inc dword [ebp - 0x7c]
add dword [ebp - 0xa4], 4
cmp dword [ebp - 0x7c], 0x3e8
jl 0x4404d5
mov edx, 0x5334e3
mov eax, dword [ebp - 0x6c]
call fcn.0044b520
jmp case.default.0x43f879
mov byte [0x54352c], 1
mov edx, dword [ebp - 0x74]
add edx, 5
mov eax, dword [ebp - 0x6c]
call fcn.004237a8
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x3208], 0
jne case.default.0x43f879
cmp byte [0x543508], 0
je case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.00438b40
jmp case.default.0x43f879
cmp dword [0x547b28], 0
je 0x44056c
mov edx, dword [ebp - 0x6c]
cmp dword [edx + 0x27d28], 0
je 0x44056c
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 9
call fcn.004375b8
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov word [ebp - 0x58], 0x38
mov edx, 0x5334e8
lea eax, [ebp - 0x10]
call fcn.005145e8
inc dword [ebp - 0x4c]
mov ecx, dword [eax]
mov dl, 1
mov eax, dword [0x484bcc]
call fcn.004852b4
mov ecx, dword [ebp - 0x6c]
mov edx, 2
mov dword [ecx + 0x698], eax
lea eax, [ebp - 0x10]
dec dword [ebp - 0x4c]
call fcn.00514748
push 0
mov edx, 0x5334ff
lea eax, [ebp - 0x18]
call fcn.005145e8
inc dword [ebp - 0x4c]
mov edx, 0x5334fa
mov ecx, dword [eax]
lea eax, [ebp - 0x14]
push ecx
mov word [ebp - 0x58], 0x44
call fcn.005145e8
inc dword [ebp - 0x4c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x698]
pop ecx
call fcn.004854c4
mov dword [0x548564], eax
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00514748
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00514748
inc dword [0x548564]
mov edx, 0x53350a
mov ecx, dword [0x548564]
lea eax, [ebp - 0x20]
push ecx
call fcn.005145e8
inc dword [ebp - 0x4c]
mov edx, 0x533505
mov ecx, dword [eax]
lea eax, [ebp - 0x1c]
push ecx
mov word [ebp - 0x58], 0x50
call fcn.005145e8
inc dword [ebp - 0x4c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x698]
pop ecx
call fcn.004855c4
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00514748
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00514748
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x698]
call fcn.0049a780
mov edx, dword [0x548564]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 0x3140], edx
mov edx, 0x3e7
mov eax, dword [ebp - 0x6c]
call fcn.004360b4
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.00432698
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 0xb
call fcn.0042a2e8
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 7
call fcn.00439dfc
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x74]
add ecx, 6
push ecx
call fcn.00408748
pop ecx
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl case.default.0x43f879
cmp dword [ebp - 0x78], 0x13880
jg case.default.0x43f879
mov ecx, dword [ebp - 0x78]
mov eax, 1
and ecx, 7
mov edx, dword [ebp - 0x78]
shl eax, cl
sar edx, 3
mov ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx + edx + 0x3f78]
and eax, edx
je 0x440742
mov byte [0x54352e], 1
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x78]
mov al, 1
and ecx, 7
mov edx, dword [ebp - 0x78]
shl al, cl
sar edx, 3
mov ecx, dword [ebp - 0x6c]
or byte [ecx + edx + 0x3f78], al
mov eax, dword [ebp - 0x6c]
cmp byte [eax + 0x26370], 0
je case.default.0x43f879
mov byte [0x54352e], 0
xor edx, edx
mov dword [0x547b28], edx
mov eax, dword [ebp - 0x6c]
xor edx, edx
mov dword [eax + 0x30a0], edx
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.004449e4
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 4
call fcn.00424140
jmp case.default.0x43f879
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x2f8]
mov eax, dword [eax + 0x160]
call fcn.004c27f0
push eax
push 0x258
push 0x320
push 0
push 0
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx + 0x3d8]
call fcn.004c6d94
call fcn.004c27f0
push eax
call sub.gdi32.dll_BitBlt
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov dword [edx + 0x300c], ecx
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x3d8]
call fcn.004c6d94
call fcn.004c27f0
push eax
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x3dc]
call fcn.004c6d94
call fcn.004c27f0
push eax
call sub.gdi32.dll_BitBlt
jmp case.default.0x43f879
cmp dword [0x547b28], 0
jne case.default.0x43f879
mov edx, dword [ebp - 0x6c]
cmp dword [edx + 0x3018], 0
jne case.default.0x43f879
mov ecx, dword [ebp - 0x74]
add ecx, 7
push ecx
call fcn.00408748
pop ecx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov ecx, 0x1e
cdq
idiv ecx
mov edx, dword [ebp - 0x6c]
mov dword [edx + 0x28e50], eax
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x28e50], 0
jne 0x4408b2
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 0x28e50], 0xffffffff
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.0043a860
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov edx, dword [ebp - 0x74]
add edx, 9
push edx
call fcn.00408748
pop ecx
mov edx, eax
mov eax, dword [ebp - 0x6c]
call fcn.0043c9c0
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x74]
add ecx, 8
push ecx
call fcn.00408748
pop ecx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
shl eax, 6
add edx, 0xa
add eax, 0x543540
mov edi, edx
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 8
call fcn.0042a65c
jmp case.default.0x43f879
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov ecx, dword [ebp - 0x74]
cmp byte [ecx + 5], 0
je 0x44098e
mov eax, dword [ebp - 0x74]
add eax, 5
push eax
call fcn.00408748
pop ecx
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x63
jne 0x44099b
xor ecx, ecx
mov edx, 0x63
mov eax, dword [ebp - 0x6c]
call fcn.004310d4
jmp 0x44099b
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.0042ede0
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.0043e464
mov dl, 1
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.00438d58
jmp case.default.0x43f879
xor edx, edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0xac], 0x543780
mov ecx, dword [ebp - 0x74]
lea eax, [ecx + 7]
mov dword [ebp - 0xa4], eax
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xac]
mov cl, byte [edx]
mov byte [eax], cl
mov edx, dword [ebp - 0xa4]
cmp byte [edx], 0
je 0x440a23
inc dword [ebp - 0x7c]
inc dword [ebp - 0xac]
inc dword [ebp - 0xa4]
cmp dword [ebp - 0x7c], 0x3f
jl 0x4409f3
mov ecx, dword [ebp - 0x7c]
mov byte [ecx + 0x543780], 0
jmp case.default.0x43f879
mov eax, dword [0x54713c]
mov edx, dword [ebp - 0x6c]
mov dword [edx + 0x2fd8], eax
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 5
call fcn.0044fd1c
mov eax, dword [ebp - 0x6c]
call fcn.0043a860
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 9
call fcn.004498f0
jmp case.default.0x43f879
mov dl, 1
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov edx, dword [ebp - 0x74]
add edx, 6
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
call fcn.004465e8
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
movsx ecx, byte [edx + 5]
cmp ecx, 0x71
jne 0x440acc
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 7
call fcn.004087dc
jmp 0x440adc
mov edx, dword [ebp - 0x74]
add edx, 6
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
call fcn.00407994
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
cmp dword [0x547b28], 0
je 0x440b0f
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x27d28], 0
je 0x440b0f
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [sym.mbl.exe__Form1]
mov ecx, dword [edx]
mov edx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx + 0x44]
mov dword [ebp - 0x98], eax
mov ecx, dword [edx]
mov eax, dword [ecx + 0x40]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x8c], 0x14
mov dword [ebp - 0x90], 0x32
mov dword [ebp - 0x7c], 7
mov edx, dword [ebp - 0x74]
add edx, 7
push edx
call fcn.00408748
pop ecx
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x74]
lea eax, [ecx + 7]
mov dword [ebp - 0xac], eax
mov edx, dword [ebp - 0xac]
cmp byte [edx], 0
je 0x440bb1
mov ecx, dword [ebp - 0xac]
movsx eax, byte [ecx]
cmp eax, 0x2c
jne 0x440ba2
inc dword [ebp - 0xac]
inc dword [ebp - 0x7c]
mov edx, dword [ebp - 0x7c]
add edx, dword [ebp - 0x74]
push edx
call fcn.00408748
pop ecx
mov dword [ebp - 0x8c], eax
jmp 0x440bb1
inc dword [ebp - 0x7c]
inc dword [ebp - 0xac]
cmp dword [ebp - 0x7c], 0x32
jl 0x440b6b
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x7c]
lea edx, [ecx + eax]
mov dword [ebp - 0xac], edx
cmp dword [ebp - 0x7c], 0x32
jge 0x440c0c
mov ecx, dword [ebp - 0xac]
cmp byte [ecx], 0
je 0x440c0c
mov eax, dword [ebp - 0xac]
movsx edx, byte [eax]
cmp edx, 0x2c
jne 0x440bfd
inc dword [ebp - 0xac]
inc dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x7c]
add ecx, dword [ebp - 0x74]
push ecx
call fcn.00408748
pop ecx
mov dword [ebp - 0x90], eax
jmp 0x440c0c
inc dword [ebp - 0x7c]
inc dword [ebp - 0xac]
cmp dword [ebp - 0x7c], 0x32
jl 0x440bc6
mov eax, dword [ebp - 0x6c]
call fcn.00426f38
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x7c], edx
cmp dword [ebp - 0x7c], 0
jle 0x440e75
mov ecx, dword [ebp - 0x88]
sub ecx, 1
jb 0x440c3c
je 0x440c77
dec ecx
je 0x440cb3
jmp case.default.0x440cc4
test byte [ebp - 0x7c], 2
je 0x440c5c
mov edx, dword [ebp - 0x98]
add edx, dword [ebp - 0x7c]
mov eax, dword [sym.mbl.exe__Form1]
mov eax, dword [eax]
call fcn.004e1638
jmp case.default.0x440cc4
mov edx, dword [ebp - 0x98]
sub edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1638
jmp case.default.0x440cc4
test byte [ebp - 0x7c], 2
je 0x440c98
mov edx, dword [ebp - 0x94]
add edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1614
jmp case.default.0x440cc4
mov edx, dword [ebp - 0x94]
sub edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1614
jmp case.default.0x440cc4
call fcn.0050d6d4
and eax, 7
cmp eax, 7
ja case.default.0x440cc4
jmp dword [eax*4 + 0x440ccb]
mov edx, dword [ebp - 0x98]
sub edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1638
mov edx, dword [sym.mbl.exe__Form1]
mov eax, dword [edx]
mov edx, dword [ebp - 0x94]
call fcn.004e1614
jmp case.default.0x440cc4
mov edx, dword [ebp - 0x98]
sub edx, dword [ebp - 0x7c]
mov eax, dword [sym.mbl.exe__Form1]
mov eax, dword [eax]
call fcn.004e1638
mov edx, dword [ebp - 0x94]
add edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1614
jmp case.default.0x440cc4
mov edx, dword [sym.mbl.exe__Form1]
mov eax, dword [edx]
mov edx, dword [ebp - 0x98]
call fcn.004e1638
mov edx, dword [ebp - 0x94]
add edx, dword [ebp - 0x7c]
mov eax, dword [sym.mbl.exe__Form1]
mov eax, dword [eax]
call fcn.004e1614
jmp case.default.0x440cc4
mov edx, dword [ebp - 0x98]
add edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1638
mov edx, dword [ebp - 0x94]
add edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1614
jmp case.default.0x440cc4
mov edx, dword [ebp - 0x98]
add edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1638
mov edx, dword [sym.mbl.exe__Form1]
mov eax, dword [edx]
mov edx, dword [ebp - 0x94]
call fcn.004e1614
jmp case.default.0x440cc4
mov edx, dword [ebp - 0x98]
add edx, dword [ebp - 0x7c]
mov eax, dword [sym.mbl.exe__Form1]
mov eax, dword [eax]
call fcn.004e1638
mov edx, dword [ebp - 0x94]
sub edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1614
jmp case.default.0x440cc4
mov edx, dword [sym.mbl.exe__Form1]
mov eax, dword [edx]
mov edx, dword [ebp - 0x98]
call fcn.004e1638
mov edx, dword [ebp - 0x94]
sub edx, dword [ebp - 0x7c]
mov eax, dword [sym.mbl.exe__Form1]
mov eax, dword [eax]
call fcn.004e1614
jmp case.default.0x440cc4
mov edx, dword [ebp - 0x98]
sub edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1638
mov edx, dword [ebp - 0x94]
sub edx, dword [ebp - 0x7c]
mov ecx, dword [sym.mbl.exe__Form1]
mov eax, dword [ecx]
call fcn.004e1614
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x6c]
call fcn.00426f4c
add eax, eax
sub dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x440c27
mov edx, dword [sym.mbl.exe__Form1]
mov eax, dword [edx]
mov edx, dword [ebp - 0x98]
call fcn.004e1638
mov ecx, dword [sym.mbl.exe__Form1]
mov edx, dword [ebp - 0x94]
mov eax, dword [ecx]
call fcn.004e1614
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x2fc8]
mov dword [ebp - 0x78], eax
mov edx, dword [ebp - 0x74]
cmp byte [edx + 5], 0
je 0x440ef3
mov word [ebp - 0x58], 0x5c
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x24]
add edx, 6
call fcn.005145e8
inc dword [ebp - 0x4c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
call fcn.00436498
mov dword [ebp - 0x78], eax
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00514748
mov ecx, dword [0x547140]
mov edx, dword [0x547140]
mov dword [ebp - 0x88], ecx
mov cl, 0x7d
mov eax, dword [ebp - 0x6c]
call fcn.004416e8
add eax, 2
mov dword [ebp - 0x84], eax
xor eax, eax
mov dword [ebp - 0x7c], eax
mov edx, dword [ebp - 0x7c]
cmp edx, dword [ebp - 0x78]
jg 0x440f7a
mov cl, 0x7b
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x6c]
call fcn.004416e8
add eax, 2
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
cmp ecx, dword [ebp - 0x84]
jle 0x440f59
mov eax, dword [ebp - 0x84]
mov dword [0x547140], eax
jmp 0x440f7a
mov edx, dword [ebp - 0x7c]
cmp edx, dword [ebp - 0x78]
jne 0x440f6f
mov ecx, dword [ebp - 0x88]
mov dword [0x547140], ecx
jmp 0x440f7a
inc dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x78]
jle 0x440f25
mov byte [0x547139], 1
xor edx, edx
mov dword [ebp - 0xa0], edx
jmp case.default.0x43f879
mov byte [0x547b35], 1
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov ecx, dword [sym.mbl.exe__Form2]
mov eax, dword [ecx]
mov edx, dword [eax]
call dword [edx + 0xe8]
mov eax, dword [ebp - 0x6c]
add eax, 0x28bfc
call fcn.00403b04
mov edx, eax
mov eax, 0x543540
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x441020
test cl, cl
je 0x440fdf
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x441020
add eax, 2
add edx, 2
test cl, cl
jne 0x440fc3
jne 0x441020
mov eax, dword [ebp - 0x6c]
add eax, 0x28c00
call fcn.00403b04
mov edx, eax
mov eax, 0x543580
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x441020
test cl, cl
je 0x441011
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x441020
add eax, 2
add edx, 2
test cl, cl
jne 0x440ff5
jne 0x441020
mov edx, dword [ebp - 0x6c]
xor eax, eax
mov dword [edx + 0x2fc8], eax
jmp 0x44102d
mov edx, dword [ebp - 0x6c]
mov dword [edx + 0x2fc8], 1
mov dword [ebp - 0xa0], 1
mov byte [0x547b35], 0
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 5
call fcn.00426978
mov dword [ebp - 0xa0], 1
mov byte [0x543508], 0
jmp case.default.0x43f879
mov dl, 1
mov eax, dword [ebp - 0x6c]
call fcn.0043a80c
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 8
call fcn.0040a1d4
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
cmp dword [0x547b28], 0
je 0x4410b0
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x27d28], 0
je 0x4410b0
xor eax, eax
mov dword [ebp - 0xa0], eax
jmp case.default.0x43f879
mov word [ebp - 0x58], 0x68
lea eax, [ebp - 0x2c]
call fcn.00401d10
push eax
lea eax, [ebp - 0x28]
inc dword [ebp - 0x4c]
mov edx, dword [ebp - 0x74]
add edx, 4
call fcn.005145e8
inc dword [ebp - 0x4c]
pop edx
call fcn.005149c0
lea edx, [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00514778
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00514748
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00514748
mov word [ebp - 0x58], 0x74
lea eax, [ebp - 0x30]
call fcn.00401d10
push eax
lea eax, [ebp - 4]
inc dword [ebp - 0x4c]
mov ecx, 3
mov edx, 1
call fcn.00514a48
lea eax, [ebp - 0x30]
push eax
mov edx, 0x533510
lea eax, [ebp - 0x34]
call fcn.005145e8
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x34]
pop eax
call fcn.0051482c
push eax
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00514748
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00514748
pop ecx
test cl, cl
je 0x44120e
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404da0
mov cl, byte [eax]
add cl, 0xd0
mov byte [ebp - 0x99], cl
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x263cc], 0
jne 0x4411a0
cmp byte [ebp - 0x99], 0
je case.default.0x43f879
mov edx, dword [ebp - 0x6c]
cmp dword [edx + 0x263d0], 0
jne 0x4411ba
movsx ecx, byte [ebp - 0x99]
dec ecx
je case.default.0x43f879
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x263d4], 0
jne 0x4411d6
movsx edx, byte [ebp - 0x99]
cmp edx, 2
je case.default.0x43f879
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x263d8], 0
jne 0x4411f2
movsx eax, byte [ebp - 0x99]
cmp eax, 3
je case.default.0x43f879
mov edx, dword [ebp - 0x6c]
cmp dword [edx + 0x263dc], 0
jne 0x44120e
movsx ecx, byte [ebp - 0x99]
cmp ecx, 4
je case.default.0x43f879
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x6c]
call fcn.00410b7c
jmp case.default.0x43f879
mov word [ebp - 0x58], 0x80
lea eax, [ebp - 0x3c]
call fcn.00401d10
push eax
lea eax, [ebp - 0x38]
inc dword [ebp - 0x4c]
mov edx, dword [ebp - 0x74]
add edx, 8
call fcn.005145e8
inc dword [ebp - 0x4c]
pop edx
call fcn.005149c0
lea edx, [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.00514778
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00514748
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00514748
mov word [ebp - 0x58], 0x8c
lea eax, [ebp - 0x40]
call fcn.00401d10
push eax
lea eax, [ebp - 4]
inc dword [ebp - 0x4c]
mov ecx, 3
mov edx, 1
call fcn.00514a48
lea eax, [ebp - 0x40]
push eax
mov edx, 0x533514
lea eax, [ebp - 0x44]
call fcn.005145e8
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x44]
pop eax
call fcn.0051482c
push eax
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00514748
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00514748
pop ecx
test cl, cl
je 0x441381
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404da0
mov cl, byte [eax]
add cl, 0xd0
mov byte [ebp - 0x99], cl
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x263cc], 0
jne 0x441313
cmp byte [ebp - 0x99], 0
je case.default.0x43f879
mov edx, dword [ebp - 0x6c]
cmp dword [edx + 0x263d0], 0
jne 0x44132d
movsx ecx, byte [ebp - 0x99]
dec ecx
je case.default.0x43f879
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x263d4], 0
jne 0x441349
movsx edx, byte [ebp - 0x99]
cmp edx, 2
je case.default.0x43f879
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x263d8], 0
jne 0x441365
movsx eax, byte [ebp - 0x99]
cmp eax, 3
je case.default.0x43f879
mov edx, dword [ebp - 0x6c]
cmp dword [edx + 0x263dc], 0
jne 0x441381
movsx ecx, byte [ebp - 0x99]
cmp ecx, 4
je case.default.0x43f879
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x6c]
call fcn.00410b7c
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.00411af4
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.004d1bf0
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
xor edx, edx
mov dword [ebp - 0x7c], edx
mov ecx, dword [ebp - 0x6c]
lea eax, [ecx + 0xff0]
mov dword [ebp - 0xac], eax
mov edx, dword [ebp - 0xac]
mov byte [edx], 0
inc dword [ebp - 0x7c]
inc dword [ebp - 0xac]
cmp dword [ebp - 0x7c], 0x80
jl 0x4413ce
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov eax, dword [ebp - 0x6c]
lea edx, [eax + 0x1070]
mov dword [ebp - 0xac], edx
mov ecx, dword [ebp - 0xac]
xor eax, eax
mov dword [ecx], eax
inc dword [ebp - 0x7c]
add dword [ebp - 0xac], 4
cmp dword [ebp - 0x7c], 0x3e8
jl 0x4413fd
xor eax, eax
or ecx, 0xffffffff
mov edi, 0x547976
mov esi, 0x547a0c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x320c], 2
je 0x441473
mov edx, dword [ebp - 0x6c]
mov dword [edx + 0x320c], 1
mov ecx, dword [ebp - 0x6c]
xor eax, eax
mov dword [ecx + 0x3210], eax
mov edx, dword [ebp - 0x6c]
mov dword [edx + 0x3214], eax
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x6c]
xor eax, eax
mov dword [ecx + 0x3214], eax
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.0043d9d8
mov edx, dword [ebp - 0x74]
add edx, 8
push edx
call fcn.00408748
pop ecx
test eax, eax
je 0x4414a8
mov byte [0x543508], 1
jmp case.default.0x43f879
mov byte [0x543508], 0
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x28e3c]
dec eax
je 0x4414c5
dec eax
je 0x4414cf
jmp 0x4414d9
mov eax, dword [ebp - 0x6c]
call fcn.00410448
jmp 0x4414d9
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.00417724
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 5
call fcn.0042de78
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 7
call fcn.0045f11c
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 8
call fcn.0042aa24
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.0041482c
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.0044f7c0
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
xor edx, edx
mov dword [ebp - 0x7c], edx
jmp 0x441578
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x6c]
call fcn.00436224
inc dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 0x26404]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebp - 0x7c]
jg 0x44156a
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
cmp dword [0x547b28], 0
je 0x4415be
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x27d28], 0
je 0x4415be
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 8
call fcn.00448b88
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x28e3c], 0
je 0x44160c
mov eax, dword [ebp - 0x6c]
mov edx, dword [eax + 0x28e3c]
dec edx
je 0x4415f8
dec edx
je 0x441602
jmp 0x44160c
mov eax, dword [ebp - 0x6c]
call fcn.00410448
jmp 0x44160c
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.00417724
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 7
call fcn.0044ae78
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 7
call fcn.0044b520
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x6c]
add edx, 9
call fcn.0044b950
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x74]
add edx, 9
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ecx + 0x3f0]
call fcn.00443d60
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
mov eax, dword [ebp - 0x6c]
call fcn.00458b60
mov dword [ebp - 0xa0], 1
jmp case.default.0x43f879
push 5
push 0
push 0
mov edx, dword [ebp - 0x74]
add edx, 5
push edx
push 0
mov eax, dword [ebp - 0x6c]
call fcn.004e8610
push eax
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0xa0]
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x4c]
call fcn.00514748
pop eax
mov edx, dword [ebp - 0x68]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret