Function at 0x4a457c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1412
push 0
push 0
dec ecx
jne 0x4a4585
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a5e4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xaea0], edx
cmp dword [ebp - 0xc], 0
jne 0x4a45c4
mov eax, dword [ebp - 4]
call fcn.004a4484
xor eax, eax
push ebp
push 0x4a45ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.00406408
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a45f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x724]
xor edx, edx
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x724]
xor edx, edx
call fcn.004313b4
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb064], 0
jle 0x4a58f5
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb063], 0
jne 0x4a46ed
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4f6c8]
call fcn.00403c58
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb054]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xa49c]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4f6c8]
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.0040629e
mov eax, dword [0x4c32ec]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa58c
mov edx, 1
call fcn.0040674d
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + ebx*8 + 0xb054]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0xa49c]
dec edx
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.00406784
call fcn.0040284c
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa58c
mov ecx, 4
call fcn.00406340
call fcn.0040284c
jmp 0x4a477f
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4f6bc]
call fcn.00403c58
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb054]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4f6bc]
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.0040629e
mov eax, dword [0x4c32ec]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa58c
mov edx, 1
call fcn.0040674d
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + ebx*8 + 0xb054]
dec edx
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.00406784
call fcn.0040284c
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa58c
mov ecx, 4
call fcn.00406340
call fcn.0040284c
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xb062]
cmp eax, 6
ja case.default.0x4a4793
jmp dword [eax*4 + 0x4a479a]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4fa8c]
lea eax, [ebp - 0x1c]
mov ecx, 0x4a5e64
call fcn.00403e8c
jmp 0x4a55a5
cmp dword [ebp - 0xc], 5
jne 0x4a4862
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb078], 0
jne 0x4a4847
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa584]
call fcn.00409368
mov eax, dword [ebp - 4]
inc dword [eax + 0xa530]
mov eax, dword [ebp - 4]
push dword [eax + 0x4fa8c]
push 0x4a5e74
mov eax, dword [ebp - 4]
push dword [eax + 0x4fae8]
lea edx, [ebp - 0xa034]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa530]
call fcn.004090ac
push dword [ebp - 0xa034]
push 0x4a5e88
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f00
jmp 0x4a55a5
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4fa8c]
lea eax, [ebp - 0x1c]
mov ecx, 0x4a5e98
call fcn.00403e8c
jmp 0x4a55a5
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa588]
call fcn.00408d90
mov edx, dword [ebp - 0xa038]
mov eax, 0x4a5eac
call fcn.0040412c
test eax, eax
jne 0x4a4898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa588]
call fcn.00409368
mov eax, dword [ebp - 4]
inc dword [eax + 0xa530]
mov eax, dword [ebp - 4]
push dword [eax + 0x4fa8c]
push 0x4a5ebc
mov eax, dword [ebp - 4]
push dword [eax + 0x4fae8]
lea edx, [ebp - 0xa03c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa530]
call fcn.004090ac
push dword [ebp - 0xa03c]
push 0x4a5e88
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f00
jmp 0x4a55a5
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa4f8], 1
jne 0x4a4ad3
xor eax, eax
push ebp
push 0x4a4934
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xa040]
mov eax, 0x4a5ecc
call fcn.00461068
mov edx, dword [ebp - 0xa040]
mov eax, dword [ebp - 4]
add eax, 0x51000
call fcn.004051f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4983
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
push dword [eax + 0x4fa8c]
push 0x4a5ee8
lea edx, [ebp - 0xa048]
mov eax, dword [ebp - 0x18]
call fcn.004090ac
push dword [ebp - 0xa048]
mov eax, dword [ebp - 4]
push dword [eax + 0x4fae8]
push 0x4a5ef4
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f00
xor eax, eax
push ebp
push 0x4a4a0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, dword [ebp - 0x1c]
call fcn.0040629e
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, 1
call fcn.00406764
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4a5d
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb07c]
cmp al, 1
je 0x4a4a86
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4a4a98
mov eax, dword [ebp - 4]
add eax, 0xaabc
call fcn.00406408
call fcn.0040284c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4faf0], 0
jne 0x4a4ab0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x4faf0], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4faf0]
cmp eax, dword [ebp - 0x18]
jge 0x4a55a5
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x4faf0], edx
jmp 0x4a55a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, 0x4a5f04
call fcn.004313b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
call fcn.004315c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
xor edx, edx
call fcn.0043129c
mov eax, dword [ebp - 4]
add eax, 0xa588
call fcn.00403bc0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa50c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xa53c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov edx, 0x4a5f0c
call fcn.0047119c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x724]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x724]
mov edx, 0x4a5f2c
call fcn.004313b4
jmp 0x4a5dce
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa4fc], 1
jne 0x4a4d5e
xor eax, eax
push ebp
push 0x4a4bbf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xa050]
mov eax, 0x4a5f5c
call fcn.00461068
mov edx, dword [ebp - 0xa050]
mov eax, dword [ebp - 4]
add eax, 0x51010
call fcn.004051f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4c0e
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
push dword [eax + 0x4fa8c]
push 0x4a5ee8
lea edx, [ebp - 0xa058]
mov eax, dword [ebp - 0x18]
call fcn.004090ac
push dword [ebp - 0xa058]
mov eax, dword [ebp - 4]
push dword [eax + 0x4fae8]
push 0x4a5f78
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f00
xor eax, eax
push ebp
push 0x4a4c99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, dword [ebp - 0x1c]
call fcn.0040629e
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, 1
call fcn.00406764
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4ce8
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb07c]
cmp al, 1
je 0x4a4d11
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4a4d23
mov eax, dword [ebp - 4]
add eax, 0xaabc
call fcn.00406408
call fcn.0040284c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4faec], 0
jne 0x4a4d3b
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x4faec], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4faec]
cmp eax, dword [ebp - 0x18]
jge 0x4a55a5
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x4faec], edx
jmp 0x4a55a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, 0x4a5f04
call fcn.004313b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
call fcn.004315c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
xor edx, edx
call fcn.0043129c
mov eax, dword [ebp - 4]
add eax, 0xa588
call fcn.00403bc0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa50c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xa53c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov edx, 0x4a5f0c
call fcn.0047119c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x724]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x724]
mov edx, 0x4a5f88
call fcn.004313b4
jmp 0x4a5dce
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa500], 1
jne 0x4a50b6
push 0
lea edx, [ebp - 0xa030]
mov eax, dword [ebp - 4]
add eax, 0xa58c
mov ecx, 0x1e
call fcn.00406340
call fcn.0040284c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb07c]
test al, al
je 0x4a4e57
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 3
jne 0x4a4e72
mov dword [ebp - 0x18], 0x1e
lea eax, [ebp - 0xa030]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec dword [ebp - 0x18]
jne 0x4a4e64
mov dword [ebp - 0x18], 0xf
lea ebx, [ebp - 0xa030]
lea eax, [ebp - 0xa060]
mov dl, byte [ebx]
call fcn.00403d68
mov edx, dword [ebp - 0xa060]
lea eax, [ebp - 0x20]
call fcn.00403e48
inc ebx
dec dword [ebp - 0x18]
jne 0x4a4e7f
mov eax, dword [ebp - 4]
push dword [eax + 0x4fa8c]
push dword [ebp - 0x20]
push 0x4a5fb8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f00
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb07c], 1
je 0x4a4eec
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb07c], 4
jne 0x4a4ef0
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 0x1c]
call fcn.0040931c
test al, al
je 0x4a5058
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, 0x4a5f04
call fcn.004313b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
call fcn.004315c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
xor edx, edx
call fcn.0043129c
mov eax, dword [ebp - 4]
add eax, 0xa588
mov edx, dword [ebp - 0x1c]
call fcn.00403c14
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa50c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xa53c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov edx, 0x4a5f0c
call fcn.0047119c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa4ec], edx
mov dword [ebp - 0x18], 1
lea edx, [ebp - 0xa064]
mov eax, dword [ebp - 0x1c]
call fcn.00409434
mov edx, dword [ebp - 0xa064]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + ecx*4 + 0x4faf4]
call fcn.00403f50
je 0x4a4fc2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x4a4f8e
cmp dword [ebp - 0x18], 0x12d
jne 0x4a5dce
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 0x4faf4], 0
je 0x4a5016
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x4faf4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4fa8c]
lea eax, [ebp - 0xa068]
call fcn.00403e8c
mov eax, dword [ebp - 0xa068]
call fcn.0040931c
test al, al
jne 0x4a5047
lea edx, [ebp - 0xa06c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa588]
call fcn.00409434
mov edx, dword [ebp - 0xa06c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x4faf4]
call fcn.00403c14
jmp 0x4a5dce
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x4a4fd6
jmp 0x4a5dce
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb07c], 0
je 0x4a508a
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb07c], 3
jne 0x4a55a5
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, dword [ebp - 0x1c]
call fcn.0040629e
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, 1
call fcn.00406764
call fcn.0040284c
jmp 0x4a55a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, 0x4a5f04
call fcn.004313b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
call fcn.004315c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
xor edx, edx
call fcn.0043129c
mov eax, dword [ebp - 4]
add eax, 0xa588
call fcn.00403bc0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa50c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xa53c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov edx, 0x4a5f0c
call fcn.0047119c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x724]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x724]
mov edx, 0x4a5fc8
call fcn.004313b4
jmp 0x4a5dce
push 0
lea edx, [ebp - 0xa030]
mov eax, dword [ebp - 4]
add eax, 0xa58c
mov ecx, 0x1e
call fcn.00406340
call fcn.0040284c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb07c]
test al, al
je 0x4a519f
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 3
jne 0x4a51ba
mov dword [ebp - 0x18], 0x1e
lea eax, [ebp - 0xa030]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec dword [ebp - 0x18]
jne 0x4a51ac
mov dword [ebp - 0x18], 0xf
lea edi, [ebp - 0xa030]
lea eax, [ebp - 0xa070]
mov dl, byte [edi]
call fcn.00403d68
mov edx, dword [ebp - 0xa070]
lea eax, [ebp - 0x20]
call fcn.00403e48
inc edi
dec dword [ebp - 0x18]
jne 0x4a51c7
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov bl, byte [edx + eax*8 + 0xb062]
cmp bl, 5
jne 0x4a521f
mov eax, dword [ebp - 4]
push dword [eax + 0x4fa8c]
push dword [ebp - 0x20]
push 0x4a6008
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f00
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp bl, 6
jne 0x4a524f
mov eax, dword [ebp - 4]
push dword [eax + 0x4fa8c]
push dword [ebp - 0x20]
push 0x4a6018
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f00
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb07c]
cmp al, 1
je 0x4a5278
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4a527c
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 0x1c]
call fcn.0040931c
test al, al
je 0x4a54ed
mov dword [ebp - 0x18], 1
lea edx, [ebp - 0xa074]
mov eax, dword [ebp - 0x1c]
call fcn.00409434
mov edx, dword [ebp - 0xa074]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + ecx*4 + 0x4ffa4]
call fcn.00403f50
jne 0x4a53a7
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ebx, dword [eax + edx*4 + 0x50454]
test ebx, ebx
je 0x4a530d
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
push ebx
call sub.user32.dll_IsWindow
test eax, eax
je 0x4a530d
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x50454]
push eax
call sub.user32.dll_SetForegroundWindow
push 9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x50454]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4a5dce
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4fa8c]
call fcn.00404004
push eax
push 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x4ffa4]
call fcn.00404004
push eax
push 0x4a6020
mov eax, dword [0x4c3254]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4a53b7
lea edx, [ebp - 0xa078]
mov eax, dword [ebp - 0x1c]
call fcn.00409434
mov edx, dword [ebp - 0xa078]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x4ffa4]
call fcn.00403c14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x50908], edx
mov eax, dword [ebp - 4]
call fcn.004b8728
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x5090c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
mov dl, 1
call fcn.00452844
jmp 0x4a5dce
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x4a5293
cmp dword [ebp - 0x18], 0x12d
jne 0x4a5dce
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 0x4ffa4], 0
je 0x4a540f
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x4ffa4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4fa8c]
lea eax, [ebp - 0xa07c]
call fcn.00403e8c
mov eax, dword [ebp - 0xa07c]
call fcn.0040931c
test al, al
jne 0x4a54d8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x50908], edx
lea edx, [ebp - 0xa080]
mov eax, dword [ebp - 0x1c]
call fcn.00409434
mov edx, dword [ebp - 0xa080]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x4ffa4]
call fcn.00403c14
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4fa8c]
call fcn.00404004
push eax
push 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x4ffa4]
call fcn.00404004
push eax
push 0x4a6020
mov eax, dword [0x4c3254]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4a54a9
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x5090c], edx
mov eax, dword [ebp - 4]
call fcn.004b8728
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
mov dl, 1
call fcn.00452844
jmp 0x4a5dce
push 0
mov ecx, 0x4a6028
mov edx, 0x4a6030
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044f9f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4 + 0x4ffa4]
call fcn.00403bc0
jmp 0x4a5dce
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x4a53cb
jmp 0x4a5dce
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb07c], 0
je 0x4a551f
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb07c], 3
jne 0x4a55a5
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, dword [ebp - 0x1c]
call fcn.0040629e
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, 1
call fcn.00406764
call fcn.0040284c
jmp 0x4a55a5
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4f6f1
call fcn.00403de4
push 0
push 0x4a6058
push dword [ebp - 0x20]
push 0x4a6088
push 0x4a6098
push 0x4a60ac
lea eax, [ebp - 0xa084]
mov edx, 5
call fcn.00403f00
mov eax, dword [ebp - 0xa084]
call fcn.00404004
mov edx, eax
mov ecx, 0x4a6028
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044f9f8
jmp 0x4a5dce
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb07c]
cmp al, 1
je 0x4a55d2
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4a56c3
xor eax, eax
push ebp
push 0x4a55fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.00406408
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a5606
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb064]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*8 + 0xb062]
test dl, dl
je 0x4a5644
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 1
jne 0x4a5691
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb078], 0
jle 0x4a5691
cmp dword [ebp - 0xc], 0
jne 0x4a5663
mov edx, dword [ebp - 4]
sub esi, dword [edx + eax*8 + 0xb078]
jmp 0x4a5691
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*8 + 0xb064]
add edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
sub edx, dword [ecx + eax*8 + 0xb078]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb078]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb062], 0
jne 0x4a56b0
lea eax, [ebp - 0x1c]
call fcn.00403bc0
mov eax, dword [ebp - 0x30]
push eax
push esi
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004bee48
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb07c]
test al, al
je 0x4a56f0
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 3
jne 0x4a58f5
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb062]
test al, al
je 0x4a5719
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
jne 0x4a5740
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, dword [ebp - 0x1c]
call fcn.0040629e
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov edx, 1
call fcn.00406764
call fcn.0040284c
mov eax, dword [ebp - 4]
mov esi, dword [eax + ebx*8 + 0xb064]
mov edi, dword [ebp - 8]
mov eax, edi
shl edi, 3
sub edi, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + edi*8 + 0xb062]
test al, al
je 0x4a5777
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 1
jne 0x4a57fd
mov eax, dword [ebp - 4]
cmp dword [eax + edi*8 + 0xb078], 0
jle 0x4a57fd
cmp dword [ebp - 0xc], 0
jne 0x4a5796
mov eax, dword [ebp - 4]
sub esi, dword [eax + edi*8 + 0xb078]
jmp 0x4a57fd
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.00406444
call fcn.0040284c
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + edi*8 + 0xb064]
add edx, ebx
mov eax, dword [ebp - 4]
sub edx, dword [eax + edi*8 + 0xb078]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.00406784
call fcn.0040284c
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa58c
mov ecx, 4
call fcn.00406340
call fcn.0040284c
mov eax, dword [ebp - 4]
mov esi, dword [eax + edi*8 + 0xb078]
mov dword [ebp - 0x10], 0xa000
xor ebx, ebx
jmp 0x4a58d2
mov eax, esi
sub eax, ebx
cmp eax, 0xa000
jle 0x4a5839
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xa030]
mov eax, dword [ebp - 4]
add eax, 0xa58c
mov ecx, 0xa000
call fcn.00406340
call fcn.0040284c
jmp 0x4a5857
lea edx, [ebp - 0x10]
push edx
mov ecx, eax
lea edx, [ebp - 0xa030]
mov eax, dword [ebp - 4]
add eax, 0xa58c
call fcn.00406340
call fcn.0040284c
cmp dword [ebp - 0x14], 0
jle 0x4a58b2
cmp dword [ebp - 0x14], 0x3c
jge 0x4a589c
mov eax, dword [ebp - 0x14]
add eax, 0x400
test eax, eax
jle 0x4a58b2
mov dword [ebp - 0x18], 1
lea edi, [ebp - 0xa030]
mov dl, byte [ebp - 0x14]
sub byte [edi], dl
mov dl, byte [ebp - 0x14]
mov ecx, 0x2800
sub ecx, dword [ebp - 0x18]
sub byte [ebp + ecx - 0xa031], dl
inc dword [ebp - 0x18]
inc edi
dec eax
jne 0x4a587c
jmp 0x4a58b2
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x4a58b2
lea edi, [ebp - 0xa030]
mov dl, byte [ebp - 0x14]
sub byte [edi], dl
inc edi
dec eax
jne 0x4a58a9
push 0
lea edx, [ebp - 0xa030]
mov eax, dword [ebp - 4]
add eax, 0xaabc
mov ecx, dword [ebp - 0x10]
call fcn.004063a4
call fcn.0040284c
add ebx, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa000
jne 0x4a58e3
cmp esi, ebx
jg 0x4a580b
mov eax, dword [ebp - 4]
add eax, 0xaabc
call fcn.00406408
call fcn.0040284c
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb062]
sub al, 1
jb 0x4a5a4a
sub al, 4
jb 0x4a5bb5
sub al, 2
jae 0x4a5d76
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 0x4ffa4], 0
je 0x4a596c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x4ffa4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4fa8c]
lea eax, [ebp - 0xa088]
call fcn.00403e8c
mov eax, dword [ebp - 0xa088]
call fcn.0040931c
test al, al
jne 0x4a5a35
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x50908], edx
lea edx, [ebp - 0xa08c]
mov eax, dword [ebp - 0x1c]
call fcn.00409434
mov edx, dword [ebp - 0xa08c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x4ffa4]
call fcn.00403c14
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4fa8c]
call fcn.00404004
push eax
push 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x4ffa4]
call fcn.00404004
push eax
push 0x4a6020
mov eax, dword [0x4c3254]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4a5a06
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x5090c], edx
mov eax, dword [ebp - 4]
call fcn.004b8728
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
mov dl, 1
call fcn.00452844
jmp 0x4a5dce
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4 + 0x4ffa4]
call fcn.00403bc0
push 0
mov ecx, 0x4a6028
mov edx, 0x4a6030
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044f9f8
jmp 0x4a5dce
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x4a5928
jmp 0x4a5dce
cmp dword [ebp - 0xc], 0
jne 0x4a5b0b
cmp dword [ebp - 0x1c], 0
jne 0x4a5a79
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa578]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4a5a90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, 0x4a60bc
call fcn.004313b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
call fcn.004315c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
xor edx, edx
call fcn.0043129c
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb075], 0xa
jae 0x4a5af0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
xor edx, edx
call fcn.0044197c
jmp 0x4a5b00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
mov dl, 1
call fcn.0044197c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004b6fdc
cmp dword [ebp - 0xc], 1
jne 0x4a5b4d
cmp dword [ebp - 0x1c], 0
jne 0x4a5b36
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa578]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4a5b4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x688]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0xc], 5
jne 0x4a5b8f
cmp dword [ebp - 0x1c], 0
jne 0x4a5b78
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa578]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x4a5b8f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0x1c], 0
jne 0x4a5ba8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa578]
call fcn.00402f38
jmp 0x4a5dce
mov eax, dword [ebp - 0x1c]
call fcn.00409368
jmp 0x4a5dce
cmp dword [ebp - 0xc], 5
jne 0x4a5c46
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb062], 1
jne 0x4a5c46
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb078], 0
jne 0x4a5c22
mov eax, dword [ebp - 4]
add eax, 0xa584
mov edx, dword [ebp - 0x1c]
call fcn.00403c14
mov eax, dword [ebp - 4]
mov dword [eax + 0xa540], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54c]
mov edx, 0x4a5f0c
call fcn.0047119c
jmp 0x4a5dce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x1c]
call fcn.00409368
jmp 0x4a5dce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x670]
mov edx, 0x4a5f04
call fcn.004313b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
mov dl, 1
call fcn.0043129c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6fc]
call fcn.004315c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6f8]
xor edx, edx
call fcn.0043129c
mov eax, dword [ebp - 4]
add eax, 0xa588
mov edx, dword [ebp - 0x1c]
call fcn.00403c14
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa50c], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb062], 4
jne 0x4a5d3e
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 0x4faf4], 0
je 0x4a5d04
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x4faf4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4fa8c]
lea eax, [ebp - 0xa090]
call fcn.00403e8c
mov eax, dword [ebp - 0xa090]
call fcn.0040931c
test al, al
jne 0x4a5d32
lea edx, [ebp - 0xa094]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa588]
call fcn.00409434
mov edx, dword [ebp - 0xa094]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x4faf4]
call fcn.00403c14
jmp 0x4a5d3e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x4a5cc4
mov eax, dword [ebp - 4]
mov dword [eax + 0xa53c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x728]
mov edx, 0x4a5f0c
call fcn.0047119c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa4ec], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa3f8], edx
jmp 0x4a5dce
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4f6f1
call fcn.00403de4
push 0
push 0x4a6058
push dword [ebp - 0x20]
push 0x4a6088
push 0x4a6098
push 0x4a60ac
lea eax, [ebp - 0xa098]
mov edx, 5
call fcn.00403f00
mov eax, dword [ebp - 0xa098]
call fcn.00404004
mov edx, eax
mov ecx, 0x4a6028
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044f9f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5e54
lea eax, [ebp - 0xa098]
mov edx, 0x11
call fcn.00403be4
lea eax, [ebp - 0xa054]
mov edx, dword [0x4011a0]
mov ecx, 2
call fcn.004045ec
lea eax, [ebp - 0xa04c]
mov edx, 2
call fcn.00403be4
lea eax, [ebp - 0xa044]
mov edx, dword [0x4011a0]
mov ecx, 2
call fcn.004045ec
lea eax, [ebp - 0xa03c]
mov edx, 3
call fcn.00403be4
lea eax, [ebp - 0x2c]
call fcn.00403bc0
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00403be4
ret