Function at 0x4cd964
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1d
push 0
push 0
dec ecx
jne 0x4cd96d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404028
xor eax, eax
push ebp
push 0x4ce6e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0xc]
call fcn.00409644
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.00408f00
mov edx, dword [ebp - 0x4c]
mov eax, 0x4ce6fc
call fcn.00404160
test eax, eax
jg 0x4cd9e8
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc]
call fcn.00409644
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00408f00
mov edx, dword [ebp - 0x54]
mov eax, 0x4ce70c
call fcn.00404160
test eax, eax
jle 0x4cd9fd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x72c]
xor ecx, ecx
mov edx, 3
call fcn.00472088
xor edx, edx
push ebp
push 0x4ce4e6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4e1304]
mov byte [eax], 2
xor eax, eax
push ebp
push 0x4cda58
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4fe6c]
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.0040634e
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov edx, 1
call fcn.00406885
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cda8e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xabe0]
test ebx, ebx
je 0x4cdba0
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa6a8]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00409644
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x18]
call fcn.00408f00
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce71c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce72c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce73c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce74c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce75c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce6fc
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce70c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce76c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce77c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce78c
call fcn.00403f84
je 0x4cdb75
mov eax, dword [ebp - 0x18]
mov edx, 0x4ce79c
call fcn.00403f84
jne 0x4cdb91
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa6a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabe0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x4cdbf0
lea eax, [ebp - 0x14]
mov edx, 0x4ce7ac
call fcn.00403c8c
jmp 0x4cdbf0
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0xc]
call fcn.00408f00
mov edx, dword [ebp - 0x64]
mov eax, 0x4ce7c0
call fcn.00404160
test eax, eax
jg 0x4cdbd6
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 0xc]
call fcn.00408f00
mov eax, dword [ebp - 0x68]
mov edx, 0x4ce7d0
call fcn.00403f84
jne 0x4cdbe5
lea eax, [ebp - 0x14]
mov edx, 0x4ce7ac
call fcn.00403c8c
jmp 0x4cdbf0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00403c8c
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fe84]
inc edx
mov dword [eax + ebx*8 + 0xb804], edx
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb813], 1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + ebx*8 + 0xb80c], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + ebx*8 + 0xb808], edx
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb811], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + ebx*8 + 0xb828], edx
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00408f00
mov eax, dword [ebp - 0x6c]
mov edx, 0x4ce76c
call fcn.00403f84
jne 0x4cdc7d
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 1
jmp 0x4cdf09
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.00408f00
mov edx, dword [ebp - 0x74]
mov eax, 0x4ce6fc
call fcn.00404160
test eax, eax
jle 0x4cdcb4
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 2
jmp 0x4cdf09
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00408f00
mov edx, dword [ebp - 0x7c]
mov eax, 0x4ce70c
call fcn.00404160
test eax, eax
jle 0x4cdceb
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 3
jmp 0x4cdf09
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.00408f00
mov edx, dword [ebp - 0x84]
mov eax, 0x4ce77c
call fcn.00404160
test eax, eax
jle 0x4cdd2e
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 4
jmp 0x4cdf09
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.00408f00
mov edx, dword [ebp - 0x8c]
mov eax, 0x4ce78c
call fcn.00404160
test eax, eax
jle 0x4cdd71
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 5
jmp 0x4cdf09
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.00408f00
mov edx, dword [ebp - 0x94]
mov eax, 0x4ce79c
call fcn.00404160
test eax, eax
jle 0x4cddb4
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 6
jmp 0x4cdf09
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x9c]
call fcn.00408f00
mov edx, dword [ebp - 0x9c]
mov eax, 0x4ce75c
call fcn.00404160
test eax, eax
jle 0x4cddf7
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 7
jmp 0x4cdf09
lea edx, [ebp - 0xa8]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0xa4]
call fcn.00408f00
mov edx, dword [ebp - 0xa4]
mov eax, 0x4ce74c
call fcn.00404160
test eax, eax
jle 0x4cde3a
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 0xb
jmp 0x4cdf09
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.00408f00
mov edx, dword [ebp - 0xac]
mov eax, 0x4ce73c
call fcn.00404160
test eax, eax
jle 0x4cde7d
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 0xc
jmp 0x4cdf09
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00408f00
mov edx, dword [ebp - 0xb4]
mov eax, 0x4ce72c
call fcn.00404160
test eax, eax
jle 0x4cdecb
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 0
mov eax, dword [ebp - 4]
mov dword [eax + ebx*8 + 0xb808], 0xffffffff
jmp 0x4cdf09
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 0x14]
call fcn.00409644
mov eax, dword [ebp - 0xc0]
lea edx, [ebp - 0xbc]
call fcn.00408f00
mov edx, dword [ebp - 0xbc]
mov eax, 0x4ce71c
call fcn.00404160
test eax, eax
jle 0x4cdf09
mov eax, dword [ebp - 4]
mov byte [eax + ebx*8 + 0xb812], 0xd
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004068bc
call fcn.00402864
push 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov ecx, 4
call fcn.00406454
call fcn.00402864
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0x14]
call fcn.00408f00
mov edx, dword [ebp - 0xc4]
mov eax, 0x4ce77c
call fcn.00404160
test eax, eax
jg 0x4cdfba
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0x14]
call fcn.00408f00
mov edx, dword [ebp - 0xc8]
mov eax, 0x4ce78c
call fcn.00404160
test eax, eax
jg 0x4cdfba
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 0x14]
call fcn.00408f00
mov edx, dword [ebp - 0xcc]
mov eax, 0x4ce79c
call fcn.00404160
test eax, eax
jle 0x4ce0a4
call fcn.0040a4dc
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x1c]
mov eax, 0x4ce7e4
call fcn.0040b0d8
mov eax, dword [ebp - 0x1c]
call fcn.00403e74
mov ebx, eax
test ebx, ebx
jle 0x4cdff7
mov esi, 1
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x1c]
mov dl, byte [edx + esi - 1]
mov byte [eax], dl
inc esi
inc eax
dec ebx
jne 0x4cdfe9
push 0
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov ecx, 0x1e
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
add dword [eax + 0x4fe84], 0x1e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabe0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0xa6a8]
jne 0x4ce0a4
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 0x14]
call fcn.00408f00
mov edx, dword [ebp - 0xd0]
mov eax, 0x4ce77c
call fcn.00404160
test eax, eax
jle 0x4ce0a4
push 0
mov eax, dword [ebp - 4]
push dword [eax + 0x50244]
mov eax, dword [ebp - 4]
push dword [eax + 0x50294]
push 0x4ce7fc
push dword [ebp - 0x1c]
push 0x4ce77c
lea eax, [ebp - 0xd4]
mov edx, 5
call fcn.00403f34
mov eax, dword [ebp - 0xd4]
call fcn.00404038
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404038
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4fe6c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004d5820
mov ebx, eax
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + eax*8 + 0xb814], ebx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add ebx, dword [eax + 0x4fe84]
add ebx, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x4fe84], ebx
mov eax, dword [0x4e1304]
mov byte [eax], 2
xor eax, eax
push ebp
push 0x4ce17f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4fe6c]
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.0040634e
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov edx, 1
call fcn.00406885
call fcn.00402864
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004068bc
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ce1b5
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb812], 2
jne 0x4ce1e4
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa6b5], 0
jne 0x4ce1e4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x50eca], 0
je 0x4ce24c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb812], 1
jne 0x4ce45a
mov eax, dword [ebp - 4]
cmp dword [eax + 0xabe0], 0
je 0x4ce21e
mov eax, dword [ebp - 0x14]
mov edx, 0x4ce7ac
call fcn.00403f84
jne 0x4ce45a
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov bl, byte [edx + eax*8 + 0xb82c]
test bl, bl
je 0x4ce24c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp bl, 3
jne 0x4ce45a
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb812], 1
jne 0x4ce331
xor eax, eax
push ebp
push 0x4ce2fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xdc]
call fcn.004042b8
push eax
lea eax, [ebp - 0xe0]
call fcn.0040602c
push eax
lea ecx, [ebp - 0xe4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x72c]
mov edx, 0xcb
call fcn.0046d0c8
mov eax, dword [ebp - 0xe4]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.00406128
mov eax, dword [ebp - 0xe0]
push eax
mov eax, dword [eax]
call dword [eax + pe_nt_image_headers32]
call fcn.00406128
mov edx, dword [ebp - 0xdc]
lea eax, [ebp - 0xd8]
call fcn.00403e3c
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
call fcn.00431e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ce304
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x50244]
lea eax, [ebp - 0x20]
mov ecx, 0x4ce808
call fcn.00403ec0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*8 + 0xb812], 2
jne 0x4ce356
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004d84f4
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.004d5ac8
mov edx, dword [ebp - 4]
mov dword [edx + ebx*8 + 0xb828], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb814]
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
add eax, dword [ecx + edx*8 + 0xb828]
add eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + ebx*8 + 0xb814], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb828]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x4fe84]
add eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x4fe84], eax
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004065c0
call fcn.00402864
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004068bc
call fcn.00402864
push 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 0xabf0
mov ecx, 4
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb828], 0
jle 0x4ce452
push 0
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + eax*8 + 0xb828]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa6fc]
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.00406454
call fcn.00402864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa6fc]
call fcn.004027ac
mov eax, dword [ebp - 0x20]
call fcn.00409540
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 0
jne 0x4ce47c
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb82c], 1
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb82c], 3
jne 0x4ce494
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb82c], 4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5024c], 1
jne 0x4ce4aa
mov eax, dword [ebp - 4]
mov byte [eax + 0x5024c], 2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5024c], 3
jne 0x4ce4c0
mov eax, dword [ebp - 4]
mov byte [eax + 0x5024c], 0
mov eax, 0x4ce7ac
call fcn.00409540
mov eax, dword [ebp - 4]
add eax, 0xabf0
call fcn.004064b8
call fcn.00402864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ce50a
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xabe0]
test esi, esi
je 0x4ce67f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0xa6a8]
cmp eax, ebx
jle 0x4ce5c9
lea ecx, [ebp - 0xec]
mov edx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabe0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe8]
call fcn.00409644
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0x18]
call fcn.00408f00
mov edx, dword [ebp - 0x18]
mov eax, 0x4ce7c0
call fcn.00404160
test eax, eax
jle 0x4ce67f
mov eax, dword [ebp - 4]
inc dword [eax + 0xa6a8]
lea ecx, [ebp - 0xf0]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa6a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabe0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 4]
add eax, 0xabec
call fcn.00403c48
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004b5574
jmp 0x4ce67f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xabe0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4ce67f
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xabec]
mov eax, 0x4ce7c0
call fcn.00404160
test eax, eax
jle 0x4ce669
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa6a8], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x63c]
call fcn.0045f054
call fcn.0045cd0c
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xa6e4], ebx
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xa6e0]
sub ebx, esi
jl 0x4ce658
inc ebx
mov eax, esi
shl eax, 3
sub eax, esi
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb814], 0
jne 0x4ce654
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004b8d28
mov eax, dword [ebp - 4]
inc dword [eax + 0xa6a8]
inc esi
dec ebx
jne 0x4ce62d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa6e4]
mov eax, dword [ebp - 4]
call fcn.004b1ba8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xabe0], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa6a8], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce6ea
lea eax, [ebp - 0xf0]
mov edx, 3
call fcn.00403c18
lea eax, [ebp - 0xe4]
call fcn.0040602c
lea eax, [ebp - 0xe0]
call fcn.0040602c
lea eax, [ebp - 0xdc]
call fcn.004042b8
lea eax, [ebp - 0xd8]
mov edx, 0x24
call fcn.00403c18
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403c18
lea eax, [ebp - 0xc]
call fcn.00403bf4
ret