Function at 0x51e364
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x36
push 0
push 0
dec ecx
jne 0x51e36c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404094
xor eax, eax
push ebp
push 0x51fc01
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51fb9c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51fb8b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00408b64
mov eax, dword [ebp - 0x34]
call fcn.00403ee0
test eax, eax
jne 0x51e3d4
call fcn.00403730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fba6
call sub.user32.dll_GetForegroundWindow
mov esi, eax
mov dl, 1
mov eax, dword [0x40feb4]
call fcn.00402ec8
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x40feb4]
call fcn.00402ec8
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x40feb4]
call fcn.00402ec8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x51e439
call fcn.00403730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fba6
lea ecx, [ebp - 0x38]
mov edx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x38]
call fcn.00408eec
mov ebx, eax
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x3c], 0
jne 0x51e476
call fcn.00403730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fba6
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x44]
mov edx, 1
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44]
call fcn.00403ee0
add ebx, eax
push ebx
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x48]
mov edx, 1
pop ecx
call fcn.004040e8
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x4c]
call fcn.00408eec
mov ebx, eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x58]
mov edx, 2
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x58]
call fcn.00403ee0
sub eax, 4
push eax
lea ecx, [ebp - 0x5c]
mov edx, 2
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x5c]
mov edx, 5
pop ecx
call fcn.004040e8
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00408920
cmp dword [ebp - 0x50], 0
je 0x51e59b
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x68]
mov edx, 2
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x68]
call fcn.00403ee0
sub eax, 4
push eax
lea ecx, [ebp - 0x6c]
mov edx, 2
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x6c]
mov edx, 5
pop ecx
call fcn.004040e8
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00408920
mov eax, dword [ebp - 0x60]
push eax
lea edx, [ebp - 0x70]
mov eax, dword [0x553c54]
call fcn.00408920
mov edx, dword [ebp - 0x70]
pop eax
call fcn.00403ff0
je 0x51e59b
cmp ebx, 0x53
je 0x51e59b
call fcn.00403730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fba6
add ebx, 0xfffffff7
cmp ebx, 0x4b
ja case.0x51e5a7.10
jmp dword [ebx*4 + 0x51e5ae]
push 0x10
push 0x51fc10
push 0x51fc1c
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x10
push 0x51fc10
push 0x51fc28
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x10
push 0x51fc10
push 0x51fc34
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x10
push 0x51fc10
push 0x51fc44
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x10
push 0x51fc10
push 0x51fc54
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x10
push 0x51fc10
push 0x51fc64
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x10
push 0x51fc10
push 0x51fc74
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fc84
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
push 0x40
push 0x51fc10
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x74]
call fcn.004040a4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fc94
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x10
push 0x51fc10
push 0x51fca8
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.0044c890
push 0
mov ecx, 0x51fcc0
mov edx, 0x51fcd0
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 8]
test al, al
je case.0x51e5a7.10
mov eax, dword [0x527ef8]
cmp dword [eax], 0
jne 0x51e864
mov ecx, dword [0x527ef8]
mov eax, dword [0x528430]
mov eax, dword [eax]
mov edx, dword [0x518500]
call fcn.0044fa6c
mov eax, dword [0x527ef8]
mov eax, dword [eax]
call fcn.0044ca48
jmp case.0x51e5a7.10
mov eax, dword [0x528430]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.0044c890
push 0x12c
call sub.kernel32.dll_Sleep
call sub.mpdown.dll_FShutdownSystem_1
jmp case.0x51e5a7.10
mov eax, dword [0x528430]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.0044c890
push 0x12c
call sub.kernel32.dll_Sleep
call sub.mpdown.dll_FRebootSystem_1
jmp case.0x51e5a7.10
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x40]
push 0x4004
push 0x84000000
push 0
lea edx, [ebp - 0x78]
mov eax, 0x51fce0
call fcn.00409b60
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x4001
push 0xc0000000
push 0
lea edx, [ebp - 0x80]
mov eax, 0x51fce0
call fcn.00409b60
push dword [ebp - 0x80]
push 0x51fcec
push dword [0x553c54]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x4001
push 0xa0000000
push 0
lea edx, [ebp - 0x88]
mov eax, 0x51fce0
call fcn.00409b60
push dword [ebp - 0x88]
push 0x51fcec
push dword [0x553d6c]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
call fcn.0052399c
lea edx, [ebp - 0x8c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x94]
call fcn.00403ee0
mov dword [ebp - 0x98], eax
fild dword [ebp - 0x98]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0x90]
mov eax, 0x51fce0
call fcn.00409b60
mov ecx, dword [ebp - 0x90]
mov edx, 1
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x9c]
mov edx, dword [0x553c50]
call fcn.0051ffd0
jmp case.0x51e5a7.10
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x40]
push 0x51fcf8
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x320]
call fcn.0047c1b8
and eax, 0xff
lea edx, [ebp - 0xa4]
call fcn.00408e4c
push dword [ebp - 0xa4]
push 0x51fd10
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x40]
lea eax, [ebp - 0x14]
call fcn.00523160
push 0x4004
push 0x8c000000
push 0
lea edx, [ebp - 0xa8]
mov eax, 0x51fce0
call fcn.00409b60
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x4001
push 0xc0000000
push 0
lea edx, [ebp - 0xb0]
mov eax, 0x51fce0
call fcn.00409b60
push dword [ebp - 0xb0]
push 0x51fcec
push dword [0x553c54]
lea eax, [ebp - 0xac]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x4001
push 0xa0000000
push 0
lea edx, [ebp - 0xb8]
mov eax, 0x51fce0
call fcn.00409b60
push dword [ebp - 0xb8]
push 0x51fcec
push dword [0x553d6c]
lea eax, [ebp - 0xb4]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xc4]
call fcn.00403ee0
mov dword [ebp - 0x98], eax
fild dword [ebp - 0x98]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0xc0]
mov eax, 0x51fce0
call fcn.00409b60
mov ecx, dword [ebp - 0xc0]
mov edx, 1
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xc8]
mov edx, dword [0x553c50]
call fcn.0051ffd0
jmp case.0x51e5a7.10
lea ecx, [ebp - 0x10]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x51fcec
call fcn.004041cc
mov ebx, eax
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 1
call fcn.00404128
mov eax, dword [ebp - 0x10]
call fcn.00523778
jmp case.0x51e5a7.10
call fcn.00523540
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.0044ca48
jmp case.0x51e5a7.10
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x40]
push 0x4005
push 0x80000000
push 0
lea edx, [ebp - 0xcc]
mov eax, 0x51fce0
call fcn.00409b60
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x4001
push 0xc0000000
push 0
lea edx, [ebp - 0xd4]
mov eax, 0x51fce0
call fcn.00409b60
push dword [ebp - 0xd4]
push 0x51fcec
push dword [0x553c54]
lea eax, [ebp - 0xd0]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x4001
push 0xa0000000
push 0
lea edx, [ebp - 0xdc]
mov eax, 0x51fce0
call fcn.00409b60
push dword [ebp - 0xdc]
push 0x51fcec
push dword [0x553d6c]
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xe4]
call fcn.00403ee0
mov dword [ebp - 0x98], eax
fild dword [ebp - 0x98]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0xe0]
mov eax, 0x51fce0
call fcn.00409b60
mov ecx, dword [ebp - 0xe0]
mov edx, 1
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xe8]
mov edx, dword [0x553c50]
call fcn.0051ffd0
jmp case.0x51e5a7.10
cmp byte [0x527e94], 0
je 0x51ed5e
call fcn.00403730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fba6
cmp byte [0x527e70], 0
je 0x51ed79
call fcn.00403730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fba6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x51ede0
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x51ede0
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xf0]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xf0]
lea edx, [ebp - 0xec]
call fcn.00408b64
cmp dword [ebp - 0xec], 0
je 0x51eddc
lea ecx, [ebp - 0xf4]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xf4]
call fcn.00523778
inc ebx
dec esi
jne 0x51ed97
push 0
push 0
call sub.user32.dll_ChangeDisplaySettingsA
push 0x12c
call sub.kernel32.dll_Sleep
call fcn.0052311c
push 0x64
call sub.kernel32.dll_Sleep
call fcn.0052311c
push 0x64
call sub.kernel32.dll_Sleep
call fcn.0052311c
push 0x64
call sub.kernel32.dll_Sleep
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.0044ca48
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.004318e4
jmp case.0x51e5a7.10
mov eax, dword [0x5286dc]
mov eax, dword [eax]
cmp byte [eax + 0x47], 0
je case.0x51e5a7.10
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.0044c890
push 0
mov ecx, 0x51fcc0
mov edx, 0x51fcd0
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 8]
test al, al
je case.0x51e5a7.10
mov eax, dword [0x527ef8]
cmp dword [eax], 0
jne 0x51eeb9
mov ecx, dword [0x527ef8]
mov eax, dword [0x528430]
mov eax, dword [eax]
mov edx, dword [0x518500]
call fcn.0044fa6c
mov eax, dword [0x527ef8]
mov eax, dword [eax]
call fcn.0044ca48
jmp case.0x51e5a7.10
xor ebx, ebx
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc ebx
cmp ebx, 4
jl 0x51eecc
push 0x40
push 0x51fd14
lea edx, [ebp - 0xf8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xf8]
call fcn.004040a4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
lea ecx, [ebp - 0xfc]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xfc]
call fcn.00408eec
call fcn.005233c8
jmp case.0x51e5a7.10
lea ecx, [ebp - 0x100]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x100]
mov eax, 0x51fcec
call fcn.004041cc
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x104]
mov edx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x104]
call fcn.00403ee0
sub eax, ebx
push eax
lea ecx, [ebp - 0x108]
mov edx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x108]
lea edx, [ebx + 1]
pop ecx
call fcn.004040e8
cmp byte [0x527e74], 0
jne 0x51efc1
push 0x1388
push 0x51fd28
mov eax, dword [ebp - 0x10]
push eax
call sub.mpsg.dll_SendMessageBox
add esp, 0xc
jmp case.0x51e5a7.10
push 0x40
push 0x51fd34
mov eax, dword [ebp - 0x10]
call fcn.004040a4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
lea ecx, [ebp - 0x10c]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10c]
call fcn.004040a4
push eax
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
lea ecx, [ebp - 0x110]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x110]
mov eax, 0x51fcec
call fcn.004041cc
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x114]
mov edx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x114]
call fcn.00403ee0
sub eax, ebx
push eax
lea ecx, [ebp - 0x118]
mov edx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x118]
lea edx, [ebx + 1]
pop ecx
call fcn.004040e8
cmp byte [0x527e74], 0
jne 0x51f09e
push 0xbb8
push 0x51fd28
mov eax, dword [ebp - 0x10]
push eax
call sub.mpsg.dll_SendMessageBox
add esp, 0xc
jmp case.0x51e5a7.10
push 0x40
push 0x51fd34
mov eax, dword [ebp - 0x10]
call fcn.004040a4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fd40
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fd50
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fd64
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fd78
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fd8c
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
cmp byte [0x527e74], 0
jne 0x51f16a
push 0xbb8
push 0x51fda8
lea ecx, [ebp - 0x11c]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x11c]
push eax
call sub.mpsg.dll_SendMessageBox
add esp, 0xc
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
lea ecx, [ebp - 0x120]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x120]
call fcn.004040a4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fdb4
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
push 0x40
push 0x51fc10
push 0x51fdd4
push esi
call sub.user32.dll_MessageBoxA_1
jmp case.0x51e5a7.10
xor eax, eax
push ebp
push 0x51f5ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40feb4]
call fcn.00402ec8
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x128]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x128]
call fcn.00408eec
push eax
mov ecx, 0x51fdf8
mov edx, 0x51fe08
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x12c]
mov edx, 1
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x12c]
push eax
mov ecx, 0x51fe18
mov edx, 0x51fe08
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 4]
lea ecx, [ebp - 0x130]
mov edx, 2
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x130]
call fcn.00408eec
push eax
mov ecx, 0x51fe28
mov edx, 0x51fe08
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x134]
mov edx, 3
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x134]
call fcn.00408eec
push eax
mov ecx, 0x51fe38
mov edx, 0x51fe08
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
call fcn.004527bc
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x80000001
call fcn.004527ec
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov cl, 1
mov edx, 0x51fe48
call fcn.00452850
lea ecx, [ebp - 0x138]
mov edx, 4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x138], 0
jne 0x51f35e
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x51fe6c
call fcn.00452974
jmp 0x51f3ae
lea ecx, [ebp - 0x150]
mov edx, 4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.005136a8
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x13c]
call fcn.0051371c
mov ecx, dword [ebp - 0x13c]
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x51fe6c
call fcn.00452a0c
lea ecx, [ebp - 0x154]
mov edx, 5
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x154], 0
jne 0x51f3e1
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x51fe7c
call fcn.00452974
jmp 0x51f431
lea ecx, [ebp - 0x15c]
mov edx, 5
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x14c]
call fcn.005136a8
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x158]
call fcn.0051371c
mov ecx, dword [ebp - 0x158]
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x51fe7c
call fcn.00452a0c
lea ecx, [ebp - 0x160]
mov edx, 6
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x160], 0
jne 0x51f464
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x51fe90
call fcn.00452974
jmp 0x51f4b4
lea ecx, [ebp - 0x168]
mov edx, 6
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x14c]
call fcn.005136a8
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x164]
call fcn.0051371c
mov ecx, dword [ebp - 0x164]
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x51fe90
call fcn.00452a0c
lea ecx, [ebp - 0x16c]
mov edx, 7
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x16c], 0
jne 0x51f4e7
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x51fea4
call fcn.00452974
jmp 0x51f537
lea ecx, [ebp - 0x174]
mov edx, 7
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x14c]
call fcn.005136a8
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x170]
call fcn.0051371c
mov ecx, dword [ebp - 0x170]
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x51fea4
call fcn.00452a0c
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
call fcn.004527bc
lea ecx, [ebp - 0x178]
mov edx, 8
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x178]
call fcn.00408eec
cmp eax, 0x4c
jne 0x51f582
push 1
mov ecx, 0x51fcc0
mov edx, 0x51fcd0
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x51f598
push 0
mov ecx, 0x51fcc0
mov edx, 0x51fcd0
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x51e5a7.10
mov eax, dword [ebp - 0x24]
call fcn.00402ef8
ret
mov eax, dword [0x5286dc]
mov eax, dword [eax]
cmp byte [eax + 0x47], 0
je case.0x51e5a7.10
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.0044c890
push 0
mov ecx, 0x51fcc0
mov edx, 0x51fcd0
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 8]
test al, al
je 0x51f61a
mov eax, dword [0x527ef8]
cmp dword [eax], 0
jne 0x51f60e
mov ecx, dword [0x527ef8]
mov eax, dword [0x528430]
mov eax, dword [eax]
mov edx, dword [0x518500]
call fcn.0044fa6c
mov eax, dword [0x527ef8]
mov eax, dword [eax]
call fcn.0044ca48
push 1
mov ecx, 0x51feb4
mov edx, 0x51fcd0
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp case.0x51e5a7.10
cmp byte [0x527e94], 0
je 0x51f650
call fcn.00403730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fba6
cmp byte [0x527e70], 0
je 0x51f66b
call fcn.00403730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fba6
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.00437844
push eax
call sub.user32.dll_SetForegroundWindow
call fcn.0052311c
push 0
push 0
call sub.user32.dll_ChangeDisplaySettingsA
push 0x1f4
call sub.kernel32.dll_Sleep
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x51f724
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x51f724
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x180]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x17c]
call fcn.00408b64
cmp dword [ebp - 0x17c], 0
je 0x51f720
lea ecx, [ebp - 0x184]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x184]
call fcn.00523778
inc ebx
dec esi
jne 0x51f6db
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.0044ca48
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.00437844
push eax
call sub.user32.dll_SetForegroundWindow
push 0
mov ecx, 0x51feb4
mov edx, 0x51fcd0
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp case.0x51e5a7.10
push 1
push 0
push 0
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x188]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x188]
call fcn.004040a4
push eax
push 0x51fec0
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x51e5a7.10
lea ecx, [ebp - 0x18c]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18c]
call fcn.0040b59c
fstp qword [ebp - 0x30]
wait
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.00522cc4
jmp case.0x51e5a7.10
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea ecx, [ebp - 0x190]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x190]
push eax
mov ecx, 0x51fe18
mov edx, 0x51fe08
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 4]
lea ecx, [ebp - 0x194]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x194]
mov eax, 0x553c50
call fcn.00403cb4
jmp case.0x51e5a7.10
xor eax, eax
push ebp
push 0x51faa5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
mov edx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x18]
mov ecx, 4
mov edx, 1
call fcn.00404128
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x18]
mov eax, 0x51fed0
call fcn.004041cc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.004040e8
mov edx, dword [ebp - 0x18]
mov eax, 0x51fed0
call fcn.004041cc
mov ecx, eax
lea eax, [ebp - 0x18]
mov edx, 1
call fcn.00404128
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x18]
call fcn.00403cf8
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x340]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x20]
call fcn.00408eec
mov edx, eax
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x340]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
push 0xffff
lea edx, [ebp - 0x19c]
xor eax, eax
call fcn.0040294c
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x198]
call fcn.004091a0
lea eax, [ebp - 0x198]
mov edx, 0x51fedc
call fcn.00403ee8
mov ecx, dword [ebp - 0x198]
mov dl, 1
mov eax, dword [0x410088]
call fcn.00413d54
mov ebx, eax
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x334]
mov edx, 0x51fef4
call fcn.004316d0
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x344]
xor edx, edx
call fcn.00496968
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x344]
mov dl, 1
call fcn.004315b8
mov eax, dword [0x52ae4c]
call fcn.0044ca48
push 0x51ff14
push dword [ebp - 0x1c]
push 0x51fed0
push dword [ebp - 0x20]
push 0x51ff24
lea eax, [ebp - 0x1a0]
mov edx, 5
call fcn.00403fa0
mov edx, dword [ebp - 0x1a0]
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x340]
mov ecx, ebx
call fcn.00493310
mov eax, dword [0x52ae4c]
call fcn.0044ca40
mov eax, ebx
call fcn.00402ef8
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
call fcn.004527bc
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov edx, 0x80000001
call fcn.004527ec
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov cl, 1
mov edx, 0x51ff3c
call fcn.00452850
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
mov ecx, 0x51ff64
mov edx, 0x51ff70
call fcn.00452a0c
mov eax, dword [0x52ae4c]
mov eax, dword [eax + 0x37c]
call fcn.004527bc
push 0x7d0
call sub.kernel32.dll_Sleep
mov eax, dword [0x52ae4c]
mov dword [eax + 0xc], 0x3e8
push 1
push 0
push 0
lea edx, [ebp - 0x1a8]
xor eax, eax
call fcn.0040294c
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a4]
call fcn.004091a0
lea eax, [ebp - 0x1a4]
mov edx, 0x51ff80
call fcn.00403ee8
mov eax, dword [ebp - 0x1a4]
call fcn.004040a4
push eax
push 0x51ff90
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x52ae4c]
call fcn.0044c890
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp case.0x51e5a7.10
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea eax, [ebp - 0x1ac]
mov ecx, 0x51ffa0
mov edx, dword [0x553d70]
call fcn.00403f2c
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x64]
lea eax, [ebp - 0x1b0]
mov ecx, 0x51ffa0
mov edx, dword [0x553d70]
call fcn.00403f2c
mov edx, dword [ebp - 0x1b0]
mov eax, dword [0x527e90]
mov ecx, dword [eax]
call dword [ecx + 0x58]
jmp case.0x51e5a7.10
push 0
mov ecx, 0x51ffb8
mov edx, 0x51fe08
mov eax, dword [0x553c60]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test al, al
je case.0x51e5a7.10
cmp dword [0x527e80], 3
jge case.0x51e5a7.10
inc dword [0x527e80]
jmp case.0x51e5a7.10
push 0x10
push 0x51fc10
push 0x51ffc0
push esi
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51fb92
mov eax, dword [ebp - 0xc]
call fcn.00402ef8
mov eax, dword [ebp - 8]
call fcn.00402ef8
mov eax, dword [ebp - 0x14]
call fcn.00402ef8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51fc08
lea eax, [ebp - 0x1b0]
mov edx, 0x19
call fcn.00403c84
lea eax, [ebp - 0x13c]
mov edx, 0x29
call fcn.00403c84
lea eax, [ebp - 0x94]
mov edx, 0x19
call fcn.00403c84
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403c84
lea eax, [ebp - 0x10]
call fcn.00403c60
lea eax, [ebp - 4]
call fcn.00403c60
ret