Function at 0x48bdc0
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa8
push 0
push 0
dec ecx
jne 0x48bdc8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48ce6f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.0047626c
mov eax, dword [ebx + 0x2fc]
mov edx, dword [eax]
call dword [edx + 0xe0]
lea edx, [ebp - 0x414]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x414]
lea edx, [ebp - 0x410]
call fcn.00408d50
cmp dword [ebp - 0x410], 0
je 0x48be72
lea edx, [ebp - 0x41c]
mov eax, dword [ebx + 0x304]
call fcn.0043b7a4
mov eax, dword [ebp - 0x41c]
lea edx, [ebp - 0x418]
call fcn.00408d50
cmp dword [ebp - 0x418], 0
je 0x48be72
lea edx, [ebp - 0x420]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x420]
mov edx, 0x48ce88
call fcn.00404e4c
jne 0x48bea3
cmp byte [0x492fb4], 0
je 0x48be89
mov cl, 1
mov dl, 1
mov eax, 0x48ceac
call fcn.00475674
push 0
mov cx, word [0x48cec4]
mov dl, 1
mov eax, 0x48ced0
call fcn.0042d904
jmp 0x48ccd3
push 1
push 0x48cf00
lea edx, [ebp - 0x428]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
push dword [ebp - 0x428]
push 0x48cf1c
lea eax, [ebp - 0x424]
mov edx, 3
call fcn.00404dc0
mov edx, dword [ebp - 0x424]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
push 0
lea edx, [ebp - 0x42c]
mov eax, 0x48cf28
call fcn.00475978
mov edx, dword [ebp - 0x42c]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
lea edx, [ebp - 0x430]
mov eax, 0x48cf4c
call fcn.004765f0
mov eax, dword [ebp - 0x430]
mov dx, 0x2d
call fcn.0048b0c4
test al, al
je 0x48bf47
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48bf68
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48cf80
mov eax, ebx
call fcn.0048ae68
jmp 0x48ccd3
call fcn.0048bb14
test al, al
je 0x48bfe6
lea edx, [ebp - 0x434]
mov eax, 0x48cf98
call fcn.004758e4
mov eax, dword [ebp - 0x434]
call fcn.0040925c
push eax
lea edx, [ebp - 0x438]
mov eax, 0x48cfa4
call fcn.004758e4
mov eax, dword [ebp - 0x438]
call fcn.0040925c
push eax
lea edx, [ebp - 0x43c]
mov eax, 0x48cfb0
call fcn.004758e4
mov eax, dword [ebp - 0x43c]
call fcn.0040925c
pop edx
pop ecx
call fcn.0040ad84
fstp qword [ebp - 0x444]
wait
call fcn.0040af48
fcomp qword [ebp - 0x444]
fnstsw ax
sahf
ja 0x48ccd3
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
lea eax, [ebp - 0x448]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x48cfc0
call fcn.00404d4c
mov edx, dword [ebp - 0x448]
mov eax, ebx
call fcn.0048ae68
push 0
lea edx, [ebp - 0x44c]
mov eax, 0x48cfd8
call fcn.00475978
mov edx, dword [ebp - 0x44c]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
push dword [0x492fb8]
push 0x48cffc
call fcn.0040af74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x450]
mov eax, 0x48d008
call fcn.0040bbc0
push dword [ebp - 0x450]
push 0x48d020
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404dc0
push 0x48d030
lea edx, [ebp - 0x45c]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x45c]
lea edx, [ebp - 0x458]
call fcn.00408d50
push dword [ebp - 0x458]
push 0x48d064
lea edx, [ebp - 0x464]
mov eax, dword [ebx + 0x304]
call fcn.0043b7a4
mov eax, dword [ebp - 0x464]
lea edx, [ebp - 0x460]
call fcn.00408d50
push dword [ebp - 0x460]
lea eax, [ebp - 0x454]
mov edx, 4
call fcn.00404dc0
mov eax, dword [ebp - 0x454]
mov edx, dword [ebp - 8]
call fcn.00475d50
mov eax, dword [ebp - 8]
call fcn.00476018
cmp eax, 5
jle 0x48c126
cmp byte [0x492fb4], 0
jne 0x48c114
mov eax, dword [ebp - 8]
call fcn.0040965c
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48c15c
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d070
mov eax, ebx
call fcn.0048ae68
cmp byte [0x492fb4], 0
jne 0x48ccd3
mov eax, dword [ebp - 8]
call fcn.0040965c
jmp 0x48ccd3
push 0
lea edx, [ebp - 0x468]
mov eax, 0x48d084
call fcn.00475978
mov edx, dword [ebp - 0x468]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
call fcn.0048af4c
test al, al
je 0x48c1a7
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48c2c9
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d0b0
mov eax, ebx
call fcn.0048ae68
cmp byte [0x492fb4], 0
je 0x48c1da
mov cl, 1
mov dl, 1
mov eax, 0x48d0c4
call fcn.00475674
push 0x30
lea edx, [ebp - 0x46c]
mov eax, dword [0x492fb0]
call fcn.0043b7a4
mov eax, dword [ebp - 0x46c]
call fcn.00404f00
push eax
push 0x48d0d0
mov eax, ebx
call fcn.00441f8c
push eax
call sub.user32.dll_MessageBoxA_1
lea eax, [ebp - 0x14]
call fcn.00404a40
cmp byte [0x492fb4], 0
je 0x48c228
lea eax, [ebp - 0x14]
mov edx, 0x48d118
call fcn.00404ad8
push 1
push 0
push 0x48d124
lea edx, [ebp - 0x474]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
push dword [ebp - 0x474]
push 0x48d138
lea edx, [ebp - 0x478]
mov eax, dword [ebx + 0x304]
call fcn.0043b7a4
push dword [ebp - 0x478]
push 0x48d14c
lea eax, [ebp - 0x47c]
call fcn.0048b02c
push dword [ebp - 0x47c]
push dword [ebp - 0x14]
lea eax, [ebp - 0x470]
mov edx, 7
call fcn.00404dc0
mov eax, dword [ebp - 0x470]
call fcn.00404f00
push eax
lea edx, [ebp - 0x480]
xor eax, eax
call fcn.00402ac0
mov eax, dword [ebp - 0x480]
call fcn.00404f00
push eax
push 0x48d158
mov eax, ebx
call fcn.00441f8c
push eax
call sub.shell32.dll_ShellExecuteA
call fcn.004048cc
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, ebx
call fcn.00441f8c
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x48c2fe
lea eax, [ebp - 0x40b]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x40b]
call fcn.00409ad8
lea eax, [ebp - 0x484]
call fcn.0048b02c
mov eax, dword [ebp - 0x484]
mov edx, dword [0x492fbc]
call fcn.00404e4c
je 0x48c35f
cmp dword [0x492fbc], 0
je 0x48c35f
mov al, byte [0x48d160]
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x48c]
call fcn.0048b02c
mov edx, dword [ebp - 0x48c]
mov ecx, dword [0x492fbc]
mov eax, dword [ebp - 0x18]
call fcn.0040e20c
mov edx, dword [ebp - 0x488]
lea eax, [ebp - 0x18]
call fcn.00404ad8
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0x18]
mov eax, 0x48d16c
call fcn.004096c8
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f60
lea eax, [ebp - 0x490]
mov ecx, 0x48d178
mov edx, dword [ebp - 0xc]
call fcn.00404d4c
mov eax, dword [ebp - 0x490]
call fcn.004098d0
lea eax, [ebp - 0x494]
mov ecx, 0x48d188
mov edx, dword [ebp - 0xc]
call fcn.00404d4c
mov eax, dword [ebp - 0x494]
call fcn.004098d0
push dword [ebp - 0xc]
push 0x48d188
push 0x48d16c
lea edx, [ebp - 0x49c]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x49c]
lea edx, [ebp - 0x498]
call fcn.00408d50
push dword [ebp - 0x498]
push 0x48d1a0
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00404dc0
push 0x48d1b0
lea edx, [ebp - 0x4a4]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x4a4]
lea edx, [ebp - 0x4a0]
call fcn.00408d50
push dword [ebp - 0x4a0]
push 0x48d1a0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404dc0
cmp byte [0x492fb4], 0
je 0x48c481
push 0x48d1dc
push dword [ebp - 0x18]
push 0x48d1f0
push dword [ebp - 0xc]
push 0x48d204
push dword [ebp - 0x10]
lea eax, [ebp - 0x4a8]
mov edx, 6
call fcn.00404dc0
mov eax, dword [ebp - 0x4a8]
mov cl, 1
mov dl, 1
call fcn.00475674
mov eax, dword [ebp - 0xc]
call fcn.00409628
test al, al
jne 0x48c49d
mov eax, dword [ebp - 0x10]
call fcn.00409628
test al, al
je 0x48c566
push 0x48d218
lea edx, [ebp - 0x4b4]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x4b4]
lea edx, [ebp - 0x4b0]
call fcn.00408d50
push dword [ebp - 0x4b0]
push 0x48d1a0
lea eax, [ebp - 0x4ac]
mov edx, 3
call fcn.00404dc0
mov eax, dword [ebp - 0x4ac]
mov cl, 1
xor edx, edx
call fcn.00475b7c
push 0
lea edx, [ebp - 0x4b8]
mov eax, 0x48d264
call fcn.00475978
mov edx, dword [ebp - 0x4b8]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
mov eax, dword [ebp - 0xc]
call fcn.0040965c
test al, al
jne 0x48c533
mov eax, dword [ebp - 0x10]
call fcn.0040965c
test al, al
je 0x48c545
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48c566
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d290
mov eax, ebx
call fcn.0048ae68
jmp 0x48ccd3
mov eax, 0x48d2a4
call fcn.00409638
test al, al
jne 0x48c582
mov eax, 0x48d2cc
call fcn.00409638
test al, al
je 0x48c588
mov byte [ebp - 0x21], 1
jmp 0x48c58c
mov byte [ebp - 0x21], 0
cmp byte [ebp - 0x21], 0
je 0x48c5b3
push 1
lea edx, [ebp - 0x4bc]
mov eax, 0x48d2f8
call fcn.00475978
mov edx, dword [ebp - 0x4bc]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov al, byte [ebp - 0x21]
xor al, 1
test al, al
je 0x48c676
push 0
lea edx, [ebp - 0x4c0]
mov eax, 0x48d324
call fcn.00475978
mov edx, dword [ebp - 0x4c0]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
push 1
push 0
push 0
lea eax, [ebp - 0x4c4]
mov ecx, 0x48d348
mov edx, dword [0x492fb8]
call fcn.00404d4c
mov ecx, dword [ebp - 0x4c4]
mov edx, 0x48d368
mov eax, 0x48d374
call fcn.00475aa0
lea eax, [ebp - 0x4c8]
mov ecx, 0x48d348
mov edx, dword [0x492fb8]
call fcn.00404d4c
mov eax, dword [ebp - 0x4c8]
call fcn.00409628
test al, al
je 0x48c655
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48c676
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d388
mov eax, ebx
call fcn.0048ae68
jmp 0x48ccd3
mov al, byte [ebp - 0x21]
xor al, 1
test al, al
je 0x48c756
push 0
lea edx, [ebp - 0x4cc]
mov eax, 0x48d39c
call fcn.00475978
mov edx, dword [ebp - 0x4cc]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
lea ecx, [ebp - 0x4d0]
mov edx, 5
mov eax, dword [ebp - 0x1c]
call fcn.004300b4
mov edx, dword [ebp - 0x4d0]
mov eax, ebx
call fcn.0048b644
test al, al
je 0x48c707
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
lea eax, [ebp - 0x4d4]
mov ecx, 0x48d348
mov edx, dword [0x492fb8]
call fcn.00404d4c
mov eax, dword [ebp - 0x4d4]
call fcn.0040965c
jmp 0x48c756
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d3c0
mov eax, ebx
call fcn.0048ae68
cmp byte [0x492fb4], 0
jne 0x48ccd3
lea eax, [ebp - 0x4d8]
mov ecx, 0x48d348
mov edx, dword [0x492fb8]
call fcn.00404d4c
mov eax, dword [ebp - 0x4d8]
call fcn.0040965c
jmp 0x48ccd3
push 0
lea edx, [ebp - 0x4dc]
mov eax, 0x48d3d4
call fcn.00475978
mov edx, dword [ebp - 0x4dc]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
push 0x48d400
lea edx, [ebp - 0x4e8]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x4e8]
lea edx, [ebp - 0x4e4]
call fcn.00408d50
push dword [ebp - 0x4e4]
push 0x48d1a0
lea eax, [ebp - 0x4e0]
mov edx, 3
call fcn.00404dc0
mov eax, dword [ebp - 0x4e0]
mov edx, dword [ebp - 0xc]
call fcn.00475d50
mov eax, dword [ebp - 0xc]
call fcn.00476018
cmp eax, 5
jle 0x48c7f2
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48c813
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d428
mov eax, ebx
call fcn.0048ae68
jmp 0x48ccd3
push 1
lea edx, [ebp - 0x4ec]
mov eax, 0x48d440
call fcn.00475978
mov edx, dword [ebp - 0x4ec]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
mov edx, 0x48d470
mov eax, ebx
call fcn.0048ae68
push 0
lea edx, [ebp - 0x4f0]
mov eax, 0x48d484
call fcn.00475978
mov edx, dword [ebp - 0x4f0]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
xor ecx, ecx
mov dl, 1
mov eax, 0x48d4a4
call fcn.00475b7c
push 0x48d50c
lea edx, [ebp - 0x4fc]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x4fc]
lea edx, [ebp - 0x4f8]
call fcn.00408d50
push dword [ebp - 0x4f8]
push 0x48d1a0
lea eax, [ebp - 0x4f4]
mov edx, 3
call fcn.00404dc0
mov eax, dword [ebp - 0x4f4]
mov cl, 1
xor edx, edx
call fcn.00475b7c
mov byte [ebp - 0x22], al
cmp byte [0x492fb4], 0
je 0x48c917
push 0x48d54c
lea ecx, [ebp - 0x504]
xor edx, edx
mov al, byte [ebp - 0x22]
call fcn.00409458
push dword [ebp - 0x504]
push 0x48d564
lea eax, [ebp - 0x500]
mov edx, 3
call fcn.00404dc0
mov eax, dword [ebp - 0x500]
mov cl, 1
mov dl, 1
call fcn.00475674
cmp byte [ebp - 0x22], 0
je 0x48c92f
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48c950
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d578
mov eax, ebx
call fcn.0048ae68
jmp 0x48ccd3
call fcn.0048a380
xor esi, esi
push 0
push 5
push 0x48d590
lea edx, [ebp - 0x510]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x510]
lea edx, [ebp - 0x50c]
call fcn.00408d50
push dword [ebp - 0x50c]
push 0x48d5ac
lea eax, [ebp - 0x508]
mov edx, 3
call fcn.00404dc0
mov eax, dword [ebp - 0x508]
call fcn.00404f00
push eax
push 0x48d5b8
lea edx, [ebp - 0x51c]
mov eax, dword [ebx + 0x300]
call fcn.0043b7a4
mov eax, dword [ebp - 0x51c]
lea edx, [ebp - 0x518]
call fcn.00408d50
push dword [ebp - 0x518]
push 0x48d5ac
lea eax, [ebp - 0x514]
mov edx, 3
call fcn.00404dc0
mov eax, dword [ebp - 0x514]
call fcn.00404f00
mov edx, eax
mov eax, 0x48d5d0
pop ecx
call fcn.0048b1bc
mov edi, eax
push 0x1f4
call sub.kernel32.dll_Sleep_1
inc esi
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
cmp esi, 0x19
jg 0x48ca2f
push edi
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48ca2f
test edi, edi
jne 0x48ca05
push 0
lea edx, [ebp - 0x520]
mov eax, 0x48d5e0
call fcn.00475978
mov edx, dword [ebp - 0x520]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
mov dx, 0x2d
mov eax, 0x48d60c
call fcn.0048b0c4
test al, al
je 0x48ca80
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48caa1
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d620
mov eax, ebx
call fcn.0048ae68
jmp 0x48ccd3
lea eax, [ebp - 4]
mov edx, 0x48d638
call fcn.00404ad8
mov eax, dword [ebp - 4]
call fcn.00409638
test al, al
je 0x48cb8c
push 0
lea edx, [ebp - 0x524]
mov eax, 0x48d648
call fcn.00475978
mov edx, dword [ebp - 0x524]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
mov eax, 0x48d66c
call fcn.0047642c
test eax, eax
je 0x48cb03
mov eax, 0x48d66c
call fcn.00476574
mov eax, dword [ebp - 4]
call fcn.00475cb0
test al, al
je 0x48cb6b
lea eax, [ebp - 0x528]
mov ecx, 0x48d67c
mov edx, dword [ebp - 0x18]
call fcn.00404d4c
mov eax, dword [ebp - 0x528]
call fcn.00409628
test al, al
je 0x48cb4f
lea eax, [ebp - 0x52c]
mov ecx, 0x48d67c
mov edx, dword [ebp - 0x18]
call fcn.00404d4c
mov eax, dword [ebp - 0x52c]
call fcn.0040965c
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
push 0x1f4
call sub.kernel32.dll_Sleep_1
jmp 0x48cb8c
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d690
mov eax, ebx
call fcn.0048ae68
jmp 0x48ccd3
push 0
lea edx, [ebp - 0x530]
mov eax, 0x48d6a4
call fcn.00475978
mov edx, dword [ebp - 0x530]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
xor ecx, ecx
mov dl, 1
mov eax, 0x48d6c4
call fcn.00475b7c
lea eax, [ebp - 0x534]
mov ecx, 0x48d6e0
mov edx, dword [ebp - 0x18]
call fcn.00404d4c
mov eax, dword [ebp - 0x534]
call fcn.00409628
test al, al
je 0x48cbfb
lea eax, [ebp - 0x538]
mov ecx, 0x48d6e0
mov edx, dword [ebp - 0x18]
call fcn.00404d4c
mov eax, dword [ebp - 0x538]
call fcn.0040965c
lea eax, [ebp - 0x53c]
mov ecx, 0x48d6f8
mov edx, dword [ebp - 0x18]
call fcn.00404d4c
mov eax, dword [ebp - 0x53c]
call fcn.00409628
test al, al
je 0x48cc3b
lea eax, [ebp - 0x540]
mov ecx, 0x48d6f8
mov edx, dword [ebp - 0x18]
call fcn.00404d4c
mov eax, dword [ebp - 0x540]
call fcn.0040965c
xor ecx, ecx
mov dl, 1
mov eax, 0x48d710
call fcn.00475b7c
test al, al
je 0x48cc5f
push 1
xor ecx, ecx
mov edx, 0x48cf64
mov eax, ebx
call fcn.0048a86c
jmp 0x48cc7d
push 1
xor ecx, ecx
mov edx, 0x48cf70
mov eax, ebx
call fcn.0048a86c
mov edx, 0x48d72c
mov eax, ebx
call fcn.0048ae68
jmp 0x48ccd3
push 1
lea edx, [ebp - 0x544]
mov eax, 0x48d740
call fcn.00475978
mov edx, dword [ebp - 0x544]
mov cl, 1
mov eax, ebx
call fcn.0048a86c
mov eax, dword [0x49142c]
mov eax, dword [eax]
call fcn.0045ace4
mov edx, 0x48d768
mov eax, ebx
call fcn.0048ae68
push 0x1b58
call sub.kernel32.dll_Sleep_1
cmp byte [0x492fb4], 0
jne 0x48ccd3
mov eax, dword [0x492fb0]
call fcn.004577e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ce79
lea eax, [ebp - 0x544]
mov edx, 0xa
call fcn.00404a64
lea eax, [ebp - 0x51c]
call fcn.00404a40
lea eax, [ebp - 0x518]
mov edx, 2
call fcn.00404a64
lea eax, [ebp - 0x510]
call fcn.00404a40
lea eax, [ebp - 0x50c]
mov edx, 4
call fcn.00404a64
lea eax, [ebp - 0x4fc]
call fcn.00404a40
lea eax, [ebp - 0x4f8]
mov edx, 4
call fcn.00404a64
lea eax, [ebp - 0x4e8]
call fcn.00404a40
lea eax, [ebp - 0x4e4]
mov edx, 0xc
call fcn.00404a64
lea eax, [ebp - 0x4b4]
call fcn.00404a40
lea eax, [ebp - 0x4b0]
mov edx, 3
call fcn.00404a64
lea eax, [ebp - 0x4a4]
call fcn.00404a40
lea eax, [ebp - 0x4a0]
call fcn.00404a40
lea eax, [ebp - 0x49c]
call fcn.00404a40
lea eax, [ebp - 0x498]
mov edx, 8
call fcn.00404a64
lea eax, [ebp - 0x478]
mov edx, 2
call fcn.00404a64
lea eax, [ebp - 0x470]
call fcn.00404a40
lea eax, [ebp - 0x46c]
call fcn.00404a40
lea eax, [ebp - 0x468]
call fcn.00404a40
lea eax, [ebp - 0x464]
call fcn.00404a40
lea eax, [ebp - 0x460]
call fcn.00404a40
lea eax, [ebp - 0x45c]
call fcn.00404a40
lea eax, [ebp - 0x458]
mov edx, 5
call fcn.00404a64
lea eax, [ebp - 0x43c]
mov edx, 5
call fcn.00404a64
lea eax, [ebp - 0x428]
call fcn.00404a40
lea eax, [ebp - 0x424]
call fcn.00404a40
lea eax, [ebp - 0x420]
mov edx, 2
call fcn.00404a64
lea eax, [ebp - 0x418]
call fcn.00404a40
lea eax, [ebp - 0x414]
call fcn.00404a40
lea eax, [ebp - 0x410]
call fcn.00404a40
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404a64
ret