Function at 0x4b8af4
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf5
push 0
push 0
dec ecx
jne 0x4b8afc
push ecx
push ebx
push esi
push edi
mov ebx, 0x4cbf1c
mov esi, 0x4cbf48
xor eax, eax
push ebp
push 0x4badbf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4bad2e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4cbe54], 0
je 0x4b8b43
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bad38
mov byte [0x4cbe54], 1
lea eax, [ebp - 0x430]
push eax
push 0
lea eax, [ebp - 0x434]
push eax
mov ecx, 0x4badd8
mov edx, 0x4bade8
mov eax, 0x80000002
call fcn.0044c504
mov eax, dword [ebp - 0x434]
mov ecx, 4
mov edx, 1
call fcn.00405778
mov eax, dword [ebp - 0x430]
mov edx, 0x4bae18
call fcn.004056a8
setne byte [0x4cbe58]
lea eax, [ebp - 0x438]
push eax
push 0
lea eax, [ebp - 0x43c]
push eax
mov ecx, 0x4badd8
mov edx, 0x4bade8
mov eax, 0x80000002
call fcn.0044c504
mov eax, dword [ebp - 0x43c]
mov ecx, 1
mov edx, 1
call fcn.00405778
mov eax, dword [ebp - 0x438]
mov edx, 0x4bae28
call fcn.004056a8
setae byte [0x4cbe5c]
lea eax, [ebp - 0x440]
push eax
push 0
lea eax, [ebp - 0x444]
push eax
mov ecx, 0x4badd8
mov edx, 0x4bade8
mov eax, 0x80000002
call fcn.0044c504
mov eax, dword [ebp - 0x444]
mov ecx, 1
mov edx, 1
call fcn.00405778
mov eax, dword [ebp - 0x440]
mov edx, 6
call fcn.00409b20
mov dword [0x4cbe60], eax
cmp byte [0x4cbe5c], 0
je 0x4b8c52
mov eax, 0x4cbf20
mov edx, 0x4bae34
call fcn.004052d4
jmp 0x4b8c61
mov eax, 0x4cbf20
mov edx, 0x4bae48
call fcn.004052d4
push 0x4bae54
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x4cc014], eax
push 0x4bae64
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x4cc018], eax
push 0x4bae70
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x4cc01c], eax
push 0x4bae7c
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x4cc020], eax
push 0x4bae88
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x4cc024], eax
push 0x401
lea eax, [ebp - 0x429]
push eax
mov eax, dword [0x4cf7f8]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
mov eax, 0x4cbe70
lea edx, [ebp - 0x429]
mov ecx, 0x401
call fcn.004054f0
push 0x4baea4
lea edx, [ebp - 0x44c]
mov eax, dword [0x4cbe70]
call fcn.004396dc
mov eax, dword [ebp - 0x44c]
lea edx, [ebp - 0x448]
call fcn.004397e4
push dword [ebp - 0x448]
lea edx, [ebp - 0x450]
mov eax, dword [0x4cbe70]
call fcn.004396ac
push dword [ebp - 0x450]
push 0x4baeb4
mov eax, 0x4cbeac
mov edx, 4
call fcn.00405614
lea edx, [ebp - 0x454]
mov eax, dword [0x4cbe70]
call fcn.004396dc
mov edi, dword [ebp - 0x454]
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x458], edi
mov eax, dword [ebp - 0x458]
call fcn.0040e69c
mov eax, 0x4cbf44
mov ecx, 0x4baec0
mov edx, dword [ebp - 0x1c]
call fcn.00405598
push 0
lea eax, [ebp - 0x45c]
push eax
mov ecx, 0x4baed0
mov edx, dword [0x4cbe78]
mov eax, 0x80000001
call fcn.0044c504
cmp dword [ebp - 0x45c], 0
sete byte [0x4cbf50]
lea edx, [ebp - 0x460]
mov eax, dword [0x4cbe70]
call fcn.004396dc
mov edi, dword [ebp - 0x460]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x458], edi
mov eax, dword [ebp - 0x458]
call fcn.0040e69c
mov eax, 0x4cbfb4
mov ecx, 0x4baee4
mov edx, dword [ebp - 0x20]
call fcn.00405598
push 0
lea eax, [ebp - 0x464]
push eax
mov ecx, 0x4baef8
mov edx, dword [0x4cbe78]
mov eax, 0x80000001
call fcn.0044c504
mov edx, dword [ebp - 0x464]
mov eax, 0x4cbfb8
call fcn.004052d4
mov dl, 1
mov eax, dword [0x41d250]
call fcn.00404258
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bac5b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x468]
xor edx, edx
mov eax, 0x4baf0c
call fcn.004b76a0
mov edx, dword [ebp - 0x468]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x46c]
mov edx, 0x4baf1c
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov edx, dword [ebp - 0x46c]
mov eax, 0x4cbeb0
call fcn.004052d4
lea ecx, [ebp - 0x470]
mov edx, 0x4baf38
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov edx, dword [ebp - 0x470]
mov eax, 0x4cbeb4
call fcn.004052d4
lea ecx, [ebp - 0x474]
mov edx, 0x4baf54
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov edx, dword [ebp - 0x474]
mov eax, 0x4cbeb8
call fcn.004052d4
lea ecx, [ebp - 0x478]
mov edx, 0x4baf70
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov edx, dword [ebp - 0x478]
mov eax, 0x4cbebc
call fcn.004052d4
lea ecx, [ebp - 0x47c]
mov edx, 0x4baf8c
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov edx, dword [ebp - 0x47c]
mov eax, 0x4cbec0
call fcn.004052d4
lea ecx, [ebp - 0x480]
mov edx, 0x4bafa4
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov edx, dword [ebp - 0x480]
mov eax, 0x4cbec4
call fcn.004052d4
lea ecx, [ebp - 0x488]
mov edx, 0x4bafbc
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x488]
lea edx, [ebp - 0x484]
call fcn.004097bc
mov edx, dword [ebp - 0x484]
mov eax, 0x4cbec8
call fcn.004052d4
mov dl, 1
mov eax, dword [0x4282d4]
call fcn.004283d4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bac3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.004284b0
mov cl, 1
mov edx, dword [0x4cbe78]
mov eax, dword [ebp - 4]
call fcn.00428518
test al, al
jne 0x4b8fab
push 0
push 0x4bafd4
push 0x4bafd4
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.00404c38
call fcn.00404c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bad38
mov dl, 1
mov eax, dword [0x4282d4]
call fcn.004283d4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bac21
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004284b0
mov eax, dword [0x4cc584]
cmp byte [eax], 8
jae 0x4b900f
mov cl, 1
mov edx, dword [0x4cbe78]
mov eax, dword [ebp - 8]
call fcn.00428518
test al, al
jne 0x4b903d
call fcn.00404c38
call fcn.00404c38
call fcn.00404c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bad38
mov edx, dword [0x4cbe78]
mov eax, dword [ebp - 8]
call fcn.0042863c
test al, al
jne 0x4b903d
call fcn.00404c38
call fcn.00404c38
call fcn.00404c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bad38
push ebp
lea ecx, [ebp - 0x48c]
mov edx, dword [0x4cbe84]
mov eax, 0x4bafe4
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x48c]
mov eax, 0x4cbe84
call fcn.004052d4
lea ecx, [ebp - 0x490]
mov edx, 0x4baff4
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov edx, dword [ebp - 0x490]
mov eax, esi
call fcn.004052d4
cmp dword [esi], 0
jne 0x4b9096
mov eax, esi
mov edx, 0x4bb008
call fcn.004052d4
lea edx, [ebp - 0x494]
mov eax, dword [esi]
call fcn.004b8654
mov edx, dword [ebp - 0x494]
mov eax, esi
call fcn.004052d4
movzx eax, byte [0x4bb010]
push eax
lea eax, [ebp - 0x498]
push eax
mov ecx, 0x4bb01c
mov edx, 0x4bb028
mov eax, dword [esi]
call fcn.0040ed1c
mov edx, dword [ebp - 0x498]
mov eax, esi
call fcn.004052d4
mov eax, dword [0x4cc584]
cmp byte [eax], 8
jae 0x4b921b
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b921b
inc eax
mov dword [ebp - 0x28], eax
xor esi, esi
lea ecx, [ebp - 0x4a0]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4a0]
lea edx, [ebp - 0x49c]
call fcn.004097bc
cmp dword [ebp - 0x49c], 0
je 0x4b9211
lea ecx, [ebp - 0x4ac]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041f51c
mov edx, dword [ebp - 0x4ac]
lea ecx, [ebp - 0x4a8]
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x4a8]
lea edx, [ebp - 0x4a4]
call fcn.004097bc
cmp dword [ebp - 0x4a4], 0
je 0x4b9211
lea ecx, [ebp - 0x4b4]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041f51c
mov eax, dword [ebp - 0x4b4]
lea edx, [ebp - 0x4b0]
call fcn.00409438
mov edx, dword [ebp - 0x4b0]
mov eax, dword [ebp - 8]
call fcn.00428f30
test al, al
jne 0x4b9211
lea ecx, [ebp - 0x4c0]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041f51c
mov edx, dword [ebp - 0x4c0]
lea ecx, [ebp - 0x4bc]
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x4bc]
lea edx, [ebp - 0x4b8]
call fcn.004097bc
mov eax, dword [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x4c8]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0041f51c
mov eax, dword [ebp - 0x4c8]
lea edx, [ebp - 0x4c4]
call fcn.00409438
mov edx, dword [ebp - 0x4c4]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00428c3c
inc esi
dec dword [ebp - 0x28]
jne 0x4b9102
push ebp
lea ecx, [ebp - 0x4cc]
mov edx, dword [0x4cbe74]
mov eax, 0x4baf0c
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x4cc]
mov eax, 0x4cbe74
call fcn.004052d4
push ebp
lea edx, [ebp - 0x4d4]
mov eax, dword [0x4cbe8c]
call fcn.00409978
mov edx, dword [ebp - 0x4d4]
lea ecx, [ebp - 0x4d0]
mov eax, 0x4bb034
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x4d0]
xor edx, edx
call fcn.00409b20
mov dword [0x4cbe8c], eax
push ebp
lea ecx, [ebp - 0x4d8]
mov edx, dword [0x4cbe7c]
mov eax, 0x4bb048
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x4d8]
mov eax, 0x4cbe7c
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x4e0]
mov edx, dword [0x4cbe94]
mov eax, 0x4bb058
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x4e0]
lea edx, [ebp - 0x4dc]
call fcn.004b8160
mov edx, dword [ebp - 0x4dc]
mov eax, 0x4cbe94
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x4e4]
mov edx, dword [0x4cbe98]
mov eax, 0x4bb06c
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x4e4]
mov eax, 0x4cbe98
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x4ec]
mov edx, dword [0x4cbea4]
mov eax, 0x4bb084
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x4ec]
lea edx, [ebp - 0x4e8]
call fcn.004b8160
mov edx, dword [ebp - 0x4e8]
mov eax, 0x4cbea4
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x4f0]
mov edx, dword [0x4cbea8]
mov eax, 0x4bb098
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x4f0]
mov eax, 0x4cbea8
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x4f8]
mov edx, dword [0x4cbeac]
mov eax, 0x4bb0b4
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x4f8]
lea edx, [ebp - 0x4f4]
call fcn.004b8160
mov edx, dword [ebp - 0x4f4]
mov eax, 0x4cbeac
call fcn.004052d4
push ebp
lea edx, [ebp - 0x500]
movzx eax, byte [0x4cbed8]
call fcn.004380c0
mov edx, dword [ebp - 0x500]
lea ecx, [ebp - 0x4fc]
mov eax, 0x4bb0d0
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x4fc]
call fcn.00437fdc
mov byte [0x4cbed8], al
push ebp
lea edx, [ebp - 0x508]
mov eax, dword [0x4cbfc8]
call fcn.00409978
mov edx, dword [ebp - 0x508]
lea ecx, [ebp - 0x504]
mov eax, 0x4bb0e4
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x504]
mov edx, dword [0x4cbfc8]
call fcn.00409b20
mov dword [0x4cbfc8], eax
cmp dword [0x4cbfc8], 0
jne 0x4b942b
mov dword [0x4cbfc8], 1
push ebp
lea ecx, [ebp - 0x50c]
mov edx, dword [0x4cbfcc]
mov eax, 0x4bb0f8
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x50c]
mov eax, 0x4cbfcc
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x510]
mov edx, dword [0x4cbfd0]
mov eax, 0x4bb10c
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x510]
mov eax, 0x4cbfd0
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x514]
mov edx, dword [0x4cbfd4]
mov eax, 0x4bb124
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x514]
mov eax, 0x4cbfd4
call fcn.004052d4
push ebp
lea edx, [ebp - 0x51c]
movzx eax, byte [0x4cbee0]
call fcn.004380c0
mov edx, dword [ebp - 0x51c]
lea ecx, [ebp - 0x518]
mov eax, 0x4bb138
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x518]
call fcn.00437fdc
mov byte [0x4cbee0], al
push ebp
lea edx, [ebp - 0x524]
movzx eax, byte [0x4cbee4]
call fcn.004380c0
mov edx, dword [ebp - 0x524]
lea ecx, [ebp - 0x520]
mov eax, 0x4bb14c
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x520]
call fcn.00437fdc
mov byte [0x4cbee4], al
push ebp
lea edx, [ebp - 0x52c]
movzx eax, byte [0x4cbee8]
call fcn.004380c0
mov edx, dword [ebp - 0x52c]
lea ecx, [ebp - 0x528]
mov eax, 0x4bb164
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x528]
call fcn.00437fdc
mov byte [0x4cbee8], al
push ebp
lea edx, [ebp - 0x534]
movzx eax, byte [0x4cbf04]
call fcn.004380c0
mov edx, dword [ebp - 0x534]
lea ecx, [ebp - 0x530]
mov eax, 0x4bb17c
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x530]
call fcn.00437fdc
mov byte [0x4cbf04], al
push ebp
lea edx, [ebp - 0x53c]
movzx eax, byte [0x4cbf08]
call fcn.004380c0
mov edx, dword [ebp - 0x53c]
lea ecx, [ebp - 0x538]
mov eax, 0x4bb190
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x538]
call fcn.00437fdc
mov byte [0x4cbf08], al
push ebp
lea edx, [ebp - 0x544]
movzx eax, byte [0x4cbf0c]
call fcn.004380c0
mov edx, dword [ebp - 0x544]
lea ecx, [ebp - 0x540]
mov eax, 0x4bb1a4
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x540]
call fcn.00437fdc
mov byte [0x4cbf0c], al
push ebp
lea edx, [ebp - 0x54c]
mov eax, dword [0x4cbedc]
call fcn.00409978
mov edx, dword [ebp - 0x54c]
lea ecx, [ebp - 0x548]
mov eax, 0x4bb1bc
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x548]
mov edx, dword [0x4cbedc]
call fcn.00409b20
mov dword [0x4cbedc], eax
push ebp
lea edx, [ebp - 0x554]
movzx eax, byte [0x4cbeec]
call fcn.004380c0
mov edx, dword [ebp - 0x554]
lea ecx, [ebp - 0x550]
mov eax, 0x4bb1d4
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x550]
call fcn.00437fdc
mov byte [0x4cbeec], al
push ebp
lea edx, [ebp - 0x55c]
movzx eax, byte [0x4cbef0]
call fcn.004380c0
mov edx, dword [ebp - 0x55c]
lea ecx, [ebp - 0x558]
mov eax, 0x4bb1f0
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x558]
call fcn.00437fdc
mov byte [0x4cbef0], al
push ebp
lea edx, [ebp - 0x564]
mov eax, dword [0x4cbef4]
call fcn.00409978
mov edx, dword [ebp - 0x564]
lea ecx, [ebp - 0x560]
mov eax, 0x4bb204
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x560]
mov edx, dword [0x4cbef4]
call fcn.00409b20
mov dword [0x4cbef4], eax
push ebp
lea edx, [ebp - 0x56c]
mov eax, dword [0x4cbef8]
call fcn.00409978
mov edx, dword [ebp - 0x56c]
lea ecx, [ebp - 0x568]
mov eax, 0x4bb218
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x568]
mov edx, dword [0x4cbef8]
call fcn.00409b20
mov dword [0x4cbef8], eax
push ebp
lea edx, [ebp - 0x574]
movzx eax, byte [0x4cbefc]
call fcn.004380c0
mov edx, dword [ebp - 0x574]
lea ecx, [ebp - 0x570]
mov eax, 0x4bb22c
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x570]
call fcn.00437fdc
mov byte [0x4cbefc], al
push ebp
lea ecx, [ebp - 0x578]
mov edx, dword [0x4cbf10]
mov eax, 0x4bb240
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x578]
mov eax, 0x4cbf10
call fcn.004052d4
push ebp
lea edx, [ebp - 0x580]
movzx eax, byte [0x4cbf14]
call fcn.004380c0
mov edx, dword [ebp - 0x580]
lea ecx, [ebp - 0x57c]
mov eax, 0x4bb254
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x57c]
call fcn.00437fdc
test al, al
je 0x4b97f8
push 0
lea eax, [ebp - 0x584]
push eax
mov ecx, 0x4bb26c
mov edx, dword [0x4cbe78]
mov eax, 0x80000001
call fcn.0044c504
mov eax, dword [ebp - 0x584]
mov edx, 0x4bb27c
call fcn.004056a8
je 0x4b97fc
xor eax, eax
jmp 0x4b97fe
mov al, 1
mov byte [0x4cbf14], al
push ebp
lea edx, [ebp - 0x58c]
movzx eax, byte [0x4cbf18]
call fcn.004380c0
mov edx, dword [ebp - 0x58c]
lea ecx, [ebp - 0x588]
mov eax, 0x4bb288
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x588]
call fcn.00437fdc
mov byte [0x4cbf18], al
push ebp
lea ecx, [ebp - 0x590]
mov edx, dword [0x4cbf10]
mov eax, 0x4bb2a4
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x590]
mov eax, ebx
call fcn.004052d4
movzx eax, byte [0x4bb2b0]
push eax
lea eax, [ebp - 0x594]
push eax
mov ecx, 0x4bb2bc
mov edx, 0x4bb2d4
mov eax, dword [ebx]
call fcn.0040ed1c
mov edx, dword [ebp - 0x594]
mov eax, ebx
call fcn.004052d4
movzx eax, byte [0x4bb2b0]
push eax
lea eax, [ebp - 0x598]
push eax
mov ecx, 0x4bb2bc
mov edx, 0x4bb2e4
mov eax, dword [ebx]
call fcn.0040ed1c
mov edx, dword [ebp - 0x598]
mov eax, ebx
call fcn.004052d4
lea edx, [ebp - 0x59c]
mov eax, dword [ebx]
call fcn.004b8160
mov edx, dword [ebp - 0x59c]
mov eax, ebx
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x5a0]
mov edx, dword [0x4cbf2c]
mov eax, 0x4bb2f0
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x5a0]
mov eax, 0x4cbf2c
call fcn.004052d4
push 0
lea eax, [ebp - 0x5a4]
push eax
mov ecx, 0x4bb304
mov edx, dword [0x4cbe78]
mov eax, 0x80000001
call fcn.0044c504
mov eax, dword [ebp - 0x5a4]
mov edx, 0x4bb27c
call fcn.004056a8
sete byte [0x4cbf28]
push ebp
lea edx, [ebp - 0x5ac]
movzx eax, byte [0x4cbe9c]
call fcn.004380c0
mov edx, dword [ebp - 0x5ac]
lea ecx, [ebp - 0x5a8]
mov eax, 0x4bb314
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5a8]
call fcn.00437fdc
mov byte [0x4cbe9c], al
push ebp
lea edx, [ebp - 0x5b4]
movzx eax, byte [0x4cbfb0]
call fcn.004380c0
mov edx, dword [ebp - 0x5b4]
lea ecx, [ebp - 0x5b0]
mov eax, 0x4bb330
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5b0]
call fcn.00437fdc
mov byte [0x4cbfb0], al
push ebp
lea ecx, [ebp - 0x5b8]
xor edx, edx
mov eax, 0x4bb344
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5b8]
mov edx, dword [0x4cbf30]
call fcn.00409b20
mov dword [0x4cbf30], eax
push ebp
lea ecx, [ebp - 0x5bc]
xor edx, edx
mov eax, 0x4bb35c
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5bc]
mov edx, dword [0x4cbf34]
call fcn.00409b20
mov dword [0x4cbf34], eax
push ebp
lea ecx, [ebp - 0x5c0]
mov edx, dword [0x4cbf38]
mov eax, 0x4bb378
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x5c0]
mov eax, 0x4cbf38
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x5c4]
mov edx, dword [0x4cbf3c]
mov eax, 0x4bb390
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x5c4]
mov eax, 0x4cbf3c
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x5c8]
xor edx, edx
mov eax, 0x4bb3ac
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5c8]
mov edx, dword [0x4cbf58]
call fcn.00409b20
mov dword [0x4cbf58], eax
push ebp
lea edx, [ebp - 0x5d0]
movzx eax, byte [0x4cbf5c]
call fcn.004380c0
mov edx, dword [ebp - 0x5d0]
lea ecx, [ebp - 0x5cc]
mov eax, 0x4bb3c4
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5cc]
call fcn.00437fdc
mov byte [0x4cbf5c], al
push 0
mov ecx, 0x4bb3dc
mov edx, dword [0x4cbe78]
mov eax, 0x80000001
call fcn.0044d06c
cdq
push edx
push eax
call fcn.0040baa4
call fcn.00403438
cmp edx, dword [esp + 4]
jne 0x4b9adc
cmp eax, dword [esp]
setne al
add esp, 8
mov byte [0x4cbf60], al
push 0x4bb3ec
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x5dc]
mov ecx, 0x4bb3f8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x5dc]
mov ecx, 0x4bb410
mov eax, 0x80000001
call fcn.0044c504
mov eax, dword [ebp - 0x5d8]
lea edx, [ebp - 0x5d4]
call fcn.004b8554
mov eax, dword [ebp - 0x5d4]
mov edx, 0x4bb3ec
call fcn.004056a8
jne 0x4b9b7d
push ebp
lea edx, [ebp - 0x5e4]
movzx eax, byte [0x4cbfbc]
call fcn.004380c0
mov edx, dword [ebp - 0x5e4]
lea ecx, [ebp - 0x5e0]
mov eax, 0x4bb410
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5e0]
call fcn.00437fdc
mov byte [0x4cbfbc], al
jmp 0x4b9bd5
push 0x4bb428
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x5f0]
mov ecx, 0x4bb3f8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x5f0]
mov ecx, 0x4bb410
mov eax, 0x80000001
call fcn.0044c504
mov eax, dword [ebp - 0x5ec]
lea edx, [ebp - 0x5e8]
call fcn.004b8554
mov eax, dword [ebp - 0x5e8]
call fcn.00437fdc
mov byte [0x4cbfbc], al
push ebp
lea edx, [ebp - 0x5f8]
movzx eax, byte [0x4cbf70]
call fcn.004380c0
mov edx, dword [ebp - 0x5f8]
lea ecx, [ebp - 0x5f4]
mov eax, 0x4bb434
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5f4]
call fcn.00437fdc
mov byte [0x4cbf70], al
push ebp
lea edx, [ebp - 0x600]
movzx eax, byte [0x4cbf74]
call fcn.004380c0
mov edx, dword [ebp - 0x600]
lea ecx, [ebp - 0x5fc]
mov eax, 0x4bb458
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x5fc]
call fcn.00437fdc
mov byte [0x4cbf74], al
push ebp
lea edx, [ebp - 0x608]
movzx eax, byte [0x4cbf80]
call fcn.004380c0
mov edx, dword [ebp - 0x608]
lea ecx, [ebp - 0x604]
mov eax, 0x4bb478
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x604]
call fcn.00437fdc
mov byte [0x4cbf80], al
push ebp
lea edx, [ebp - 0x610]
movzx eax, byte [0x4cbf78]
call fcn.004380c0
mov edx, dword [ebp - 0x610]
lea ecx, [ebp - 0x60c]
mov eax, 0x4bb498
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x60c]
call fcn.00437fdc
mov byte [0x4cbf78], al
push ebp
lea edx, [ebp - 0x618]
movzx eax, byte [0x4cbf7c]
call fcn.004380c0
mov edx, dword [ebp - 0x618]
lea ecx, [ebp - 0x614]
mov eax, 0x4bb4bc
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x614]
call fcn.00437fdc
mov byte [0x4cbf7c], al
push ebp
lea edx, [ebp - 0x620]
movzx eax, byte [0x4cbf84]
call fcn.004380c0
mov edx, dword [ebp - 0x620]
lea ecx, [ebp - 0x61c]
mov eax, 0x4bb4e0
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x61c]
call fcn.00437fdc
mov byte [0x4cbf84], al
push ebp
lea edx, [ebp - 0x628]
movzx eax, byte [0x4cbf88]
call fcn.004380c0
mov edx, dword [ebp - 0x628]
lea ecx, [ebp - 0x624]
mov eax, 0x4bb504
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x624]
call fcn.00437fdc
mov byte [0x4cbf88], al
push ebp
lea ecx, [ebp - 0x62c]
mov edx, dword [0x4cbe64]
mov eax, 0x4bb528
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x62c]
mov eax, 0x4cbe64
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x630]
mov edx, dword [0x4cbf8c]
mov eax, 0x4bb538
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x630]
mov eax, 0x4cbf8c
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x634]
mov edx, dword [0x4cbf90]
mov eax, 0x4bb554
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x634]
mov eax, 0x4cbf90
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x638]
mov edx, dword [0x4cbf94]
mov eax, 0x4bb570
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x638]
mov eax, 0x4cbf94
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x63c]
mov edx, dword [0x4cbf98]
mov eax, 0x4bb58c
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x63c]
mov eax, 0x4cbf98
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x640]
mov edx, dword [0x4cbf9c]
mov eax, 0x4bb5a8
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x640]
mov eax, 0x4cbf9c
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x644]
mov edx, dword [0x4cbfa0]
mov eax, 0x4bb5c4
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x644]
mov eax, 0x4cbfa0
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x648]
mov edx, dword [0x4cbfa4]
mov eax, 0x4bb5d8
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x648]
mov eax, 0x4cbfa4
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x64c]
mov edx, dword [0x4cbfa8]
mov eax, 0x4bb5ec
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x64c]
mov eax, 0x4cbfa8
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x650]
mov edx, dword [0x4cbfac]
mov eax, 0x4bb600
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x650]
mov eax, 0x4cbfac
call fcn.004052d4
push ebp
lea edx, [ebp - 0x658]
movzx eax, byte [0x4cbfc0]
call fcn.004380c0
mov edx, dword [ebp - 0x658]
lea ecx, [ebp - 0x654]
mov eax, 0x4bb618
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x654]
call fcn.00437fdc
test al, al
je 0x4b9f64
push 0
lea eax, [ebp - 0x65c]
push eax
mov ecx, 0x4bb628
mov edx, dword [0x4cbe78]
mov eax, 0x80000001
call fcn.0044c504
mov eax, dword [ebp - 0x65c]
mov edx, 0x4bb27c
call fcn.004056a8
je 0x4b9f68
xor eax, eax
jmp 0x4b9f6a
mov al, 1
mov byte [0x4cbfc0], al
push ebp
lea ecx, [ebp - 0x660]
xor edx, edx
mov eax, 0x4bb638
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x660]
mov edx, 1
call fcn.00409b20
mov dword [0x4cbfc4], eax
push ebp
lea edx, [ebp - 0x668]
movzx eax, byte [0x4cbfe4]
call fcn.004380c0
mov edx, dword [ebp - 0x668]
lea ecx, [ebp - 0x664]
mov eax, 0x4bb650
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x664]
call fcn.00437fdc
mov byte [0x4cbfe4], al
push ebp
lea edx, [ebp - 0x670]
movzx eax, byte [0x4cbfe4]
call fcn.004380c0
mov edx, dword [ebp - 0x670]
lea ecx, [ebp - 0x66c]
mov eax, 0x4bb668
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x66c]
call fcn.00437fdc
mov byte [0x4cbfe8], al
push ebp
lea ecx, [ebp - 0x674]
xor edx, edx
mov eax, 0x4bb68c
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x674]
mov edx, dword [0x4cbfec]
call fcn.00409b20
mov dword [0x4cbfec], eax
push ebp
lea ecx, [ebp - 0x678]
mov edx, dword [0x4cbff0]
mov eax, 0x4bb6a8
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x678]
mov eax, 0x4cbff0
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x67c]
mov edx, dword [0x4cbff4]
mov eax, 0x4bb6c4
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x67c]
mov eax, 0x4cbff4
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x680]
mov edx, dword [0x4cbff8]
mov eax, 0x4bb6e4
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x680]
mov eax, 0x4cbff8
call fcn.004052d4
cmp byte [0x4cbfe4], 0
je 0x4ba0fb
lea eax, [ebp - 0x688]
call fcn.0044b8f0
mov eax, dword [ebp - 0x688]
lea edx, [ebp - 0x684]
call fcn.004396dc
lea eax, [ebp - 0x684]
mov edx, 0x4bb700
call fcn.0040554c
mov eax, dword [ebp - 0x684]
call fcn.00439664
test al, al
jne 0x4ba0ff
cmp dword [0x4cbff4], 0
jne 0x4ba0ff
xor eax, eax
jmp 0x4ba101
mov al, 1
mov byte [0x4cbfe4], al
cmp byte [0x4cbfe4], 0
jne 0x4ba116
mov byte [0x4cbfe8], 0
push ebp
lea ecx, [ebp - 0x68c]
mov edx, 0x4bb714
mov eax, 0x4bb720
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x68c]
mov edx, 0x4bb428
call fcn.004056a8
jne 0x4ba184
push ebp
lea ecx, [ebp - 0x690]
mov edx, 0x4bb714
mov eax, 0x4bb738
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x690]
mov edx, 0x4bb428
call fcn.004056a8
jne 0x4ba184
cmp dword [0x4cbfe0], 2
je 0x4ba184
cmp dword [0x4cbfe0], 0
jne 0x4ba184
mov dword [0x4cbfe0], 1
cmp dword [0x4cbfe0], 0
jne 0x4ba197
mov dword [0x4cbfe0], 2
push ebp
lea ecx, [ebp - 0x694]
xor edx, edx
mov eax, 0x4bb754
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x694]
mov edx, dword [0x4cbfd8]
call fcn.00409b20
mov dword [0x4cbfd8], eax
push ebp
lea ecx, [ebp - 0x698]
xor edx, edx
mov eax, 0x4bb76c
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x698]
mov eax, 0x4cbfdc
call fcn.004052d4
mov edx, dword [0x4cbfdc]
mov eax, 0x4bb780
call fcn.0040585c
test eax, eax
jne 0x4ba25b
mov edx, dword [0x4cbfdc]
mov eax, 0x4bb78c
call fcn.0040585c
test eax, eax
jne 0x4ba25b
push 0
lea eax, [ebp - 0x69c]
push eax
mov ecx, 0x4bb798
mov edx, 0x4bb7ac
mov eax, 0x80000001
call fcn.0044c504
mov edx, dword [ebp - 0x69c]
mov eax, 0x4cbfdc
call fcn.004052d4
mov eax, dword [0x4cbfdc]
push eax
push 1
push 0
push 1
mov ecx, 0x4bb76c
mov edx, dword [0x4cbe78]
mov eax, 0x80000001
call fcn.0044c6fc
push ebp
lea edx, [ebp - 0x6a4]
movzx eax, byte [0x4cbffc]
call fcn.004380c0
mov edx, dword [ebp - 0x6a4]
lea ecx, [ebp - 0x6a0]
mov eax, 0x4bb7f8
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x6a0]
call fcn.00437fdc
mov byte [0x4cbffc], al
push ebp
lea edx, [ebp - 0x6ac]
movzx eax, byte [0x4cc000]
call fcn.004380c0
mov edx, dword [ebp - 0x6ac]
lea ecx, [ebp - 0x6a8]
mov eax, 0x4bb810
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x6a8]
call fcn.00437fdc
mov byte [0x4cc000], al
push ebp
lea edx, [ebp - 0x6b4]
movzx eax, byte [0x4cc004]
call fcn.004380c0
mov edx, dword [ebp - 0x6b4]
lea ecx, [ebp - 0x6b0]
mov eax, 0x4bb828
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x6b0]
call fcn.00437fdc
mov byte [0x4cc004], al
push ebp
lea ecx, [ebp - 0x6b8]
mov edx, 0x4bb840
mov eax, 0x4bb84c
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x6b8]
mov edx, dword [0x4cc008]
call fcn.00409b20
mov dword [0x4cc008], eax
push ebp
lea ecx, [ebp - 0x6bc]
xor edx, edx
mov eax, 0x4bb860
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x6bc]
mov eax, 0x4cc00c
call fcn.004052d4
push ebp
lea ecx, [ebp - 0x6c0]
mov edx, dword [0x4cc010]
mov eax, 0x4bb874
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x6c0]
mov eax, 0x4cc010
call fcn.004052d4
push ebp
call fcn.004b8924
pop ecx
push ebp
lea ecx, [ebp - 0x6c4]
xor edx, edx
mov eax, 0x4bb888
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x6c4]
mov eax, 0x4cbf24
call fcn.004052d4
push ebp
lea edx, [ebp - 0x6cc]
movzx eax, byte [0x4cbea0]
call fcn.004380c0
mov edx, dword [ebp - 0x6cc]
lea ecx, [ebp - 0x6c8]
mov eax, 0x4bb8a4
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x6c8]
call fcn.00437fdc
mov byte [0x4cbea0], al
cmp byte [0x4cbea0], 0
jne 0x4ba770
push 0
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x6d4]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x6d4]
mov ecx, 0x4bb8c8
mov eax, 0x80000002
call fcn.0044c504
cmp dword [ebp - 0x6d0], 0
jne 0x4ba770
push 0
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x6dc]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x6dc]
mov ecx, 0x4bb8e8
mov eax, 0x80000002
call fcn.0044c504
cmp dword [ebp - 0x6d8], 0
jne 0x4ba770
push ebp
lea ecx, [ebp - 0x6e0]
xor edx, edx
mov eax, 0x4bb908
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x6e0]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x6e4]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x6e4]
mov ecx, 0x4bb91c
mov eax, 0x80000002
call fcn.0044c6fc
mov eax, dword [0x4cbe94]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x6e8]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x6e8]
mov ecx, 0x4bb934
mov eax, 0x80000002
call fcn.0044c6fc
mov eax, dword [0x4cbe98]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x6ec]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x6ec]
mov ecx, 0x4bb94c
mov eax, 0x80000002
call fcn.0044c6fc
mov eax, dword [0x4cbea8]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x6f0]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x6f0]
mov ecx, 0x4bb8e8
mov eax, 0x80000002
call fcn.0044c6fc
push ebp
lea ecx, [ebp - 0x6f4]
xor edx, edx
mov eax, 0x4bb968
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x6f4]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x6f8]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x6f8]
mov ecx, 0x4bb8c8
mov eax, 0x80000002
call fcn.0044c6fc
push ebp
lea ecx, [ebp - 0x6fc]
xor edx, edx
mov eax, 0x4bb984
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x6fc]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x700]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x700]
mov ecx, 0x4bb99c
mov eax, 0x80000002
call fcn.0044c6fc
push ebp
lea ecx, [ebp - 0x704]
xor edx, edx
mov eax, 0x4bb9b8
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x704]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x708]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x708]
mov ecx, 0x4bb9d4
mov eax, 0x80000002
call fcn.0044c6fc
push ebp
lea ecx, [ebp - 0x70c]
xor edx, edx
mov eax, 0x4bb9f4
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x70c]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x710]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x710]
mov ecx, 0x4bba14
mov eax, 0x80000002
call fcn.0044c6fc
push ebp
lea ecx, [ebp - 0x714]
xor edx, edx
mov eax, 0x4bb478
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x714]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x718]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x718]
mov ecx, 0x4bba38
mov eax, 0x80000002
call fcn.0044c6fc
cmp byte [0x4cbf80], 0
je 0x4ba724
push 0x4bb714
push 1
push 0
push 1
lea eax, [ebp - 0x71c]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x71c]
mov ecx, 0x4bba54
mov eax, 0x80000002
call fcn.0044c6fc
jmp 0x4ba770
push ebp
lea ecx, [ebp - 0x720]
xor edx, edx
mov eax, 0x4bba70
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x720]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0x724]
mov ecx, 0x4bb8b8
mov edx, dword [0x4cbe78]
call fcn.00405598
mov edx, dword [ebp - 0x724]
mov ecx, 0x4bba54
mov eax, 0x80000002
call fcn.0044c6fc
cmp byte [0x4cbea0], 0
je 0x4ba783
cmp dword [ebx], 0
je 0x4ba783
call fcn.004bbb78
movzx eax, byte [0x4bb010]
push eax
lea eax, [ebp - 0x10]
push eax
push ebp
lea ecx, [ebp - 0x728]
xor edx, edx
mov eax, 0x4bba88
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x728]
mov ecx, 0x4bbaa0
mov edx, 0x4bbaac
call fcn.0040ed1c
movzx eax, byte [0x4bb010]
push eax
lea eax, [ebp - 0x730]
push eax
push ebp
lea ecx, [ebp - 0x734]
xor edx, edx
mov eax, 0x4bbab8
call fcn.004b86ec
pop ecx
mov eax, dword [ebp - 0x734]
mov ecx, 0x4bbaa0
mov edx, 0x4bbaac
call fcn.0040ed1c
mov eax, dword [ebp - 0x730]
lea edx, [ebp - 0x72c]
call fcn.004094c0
mov edx, dword [ebp - 0x72c]
mov eax, 0x4cbf64
call fcn.004052d4
push 0x401
lea eax, [ebp - 0x429]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x738]
lea eax, [ebp - 0x429]
call fcn.0040a8c4
mov edx, dword [ebp - 0x738]
mov eax, 0x4cbe88
call fcn.004052d4
lea ecx, [ebp - 0x73c]
xor edx, edx
mov eax, 0x4bbad0
call fcn.004b76a0
mov edx, dword [ebp - 0x73c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x740]
mov edx, 0x4bbae0
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x740]
xor edx, edx
call fcn.00409b20
mov esi, eax
push esi
mov eax, 0x4d2630
mov ecx, 1
mov edx, dword [0x4b6580]
call fcn.00406900
add esp, 4
or ebx, 0xffffffff
test esi, esi
jle 0x4bab4c
mov dword [ebp - 0x28], esi
mov esi, 1
lea edx, [ebp - 0x74c]
mov eax, esi
call fcn.00409978
mov ecx, dword [ebp - 0x74c]
lea eax, [ebp - 0x748]
mov edx, 0x4bbaf0
call fcn.00405598
mov edx, dword [ebp - 0x748]
lea ecx, [ebp - 0x744]
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x744]
lea edx, [ebp - 0x18]
call fcn.004097bc
cmp dword [ebp - 0x18], 0
je 0x4bab42
inc ebx
lea edx, [ebp - 0x75c]
mov eax, esi
call fcn.00409978
mov ecx, dword [ebp - 0x75c]
lea eax, [ebp - 0x758]
mov edx, 0x4bbaf0
call fcn.00405598
mov edx, dword [ebp - 0x758]
lea ecx, [ebp - 0x754]
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x754]
lea edx, [ebp - 0x750]
call fcn.004097bc
mov eax, dword [ebp - 0x750]
lea edx, [ebp - 0x18]
call fcn.004096a8
imul edi, ebx, 0xd
mov eax, dword [0x4d2630]
add eax, edi
mov edx, dword [ebp - 0x18]
call fcn.004052d4
lea edx, [ebp - 0x76c]
mov eax, esi
call fcn.00409978
mov ecx, dword [ebp - 0x76c]
lea eax, [ebp - 0x768]
mov edx, 0x4bbb00
call fcn.00405598
mov edx, dword [ebp - 0x768]
lea ecx, [ebp - 0x764]
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x764]
lea edx, [ebp - 0x760]
call fcn.004097bc
mov eax, dword [ebp - 0x760]
lea edx, [ebp - 0x18]
call fcn.004096a8
mov eax, dword [0x4d2630]
lea eax, [eax + edi + 4]
mov edx, dword [ebp - 0x18]
call fcn.004052d4
lea edx, [ebp - 0x77c]
mov eax, esi
call fcn.00409978
mov ecx, dword [ebp - 0x77c]
lea eax, [ebp - 0x778]
mov edx, 0x4bbb10
call fcn.00405598
mov edx, dword [ebp - 0x778]
lea ecx, [ebp - 0x774]
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x774]
lea edx, [ebp - 0x770]
call fcn.004097bc
mov edx, dword [ebp - 0x770]
lea eax, [ebp - 0x18]
mov ecx, 0x4bbb20
call fcn.00405598
lea edx, [ebp - 0x78c]
mov eax, esi
call fcn.00409978
mov ecx, dword [ebp - 0x78c]
lea eax, [ebp - 0x788]
mov edx, 0x4bbb2c
call fcn.00405598
mov edx, dword [ebp - 0x788]
lea ecx, [ebp - 0x784]
mov eax, dword [ebp - 0xc]
call fcn.0041f70c
mov eax, dword [ebp - 0x784]
lea edx, [ebp - 0x780]
call fcn.004097bc
mov eax, dword [ebp - 0x780]
mov edx, 0x4bb428
call fcn.004056a8
sete al
mov edx, dword [0x4d2630]
mov byte [edx + edi + 0xc], al
jmp 0x4bab38
lea eax, [ebp - 0x794]
push eax
mov edx, dword [ebp - 0x18]
mov eax, 0x4bbb20
call fcn.0040585c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00405778
mov eax, dword [ebp - 0x794]
lea edx, [ebp - 0x790]
call fcn.004097bc
mov eax, dword [ebp - 0x790]
lea edx, [ebp - 0x14]
call fcn.004096a8
mov edx, dword [ebp - 0x18]
mov eax, 0x4bbb20
call fcn.0040585c
mov ecx, eax
lea eax, [ebp - 0x18]
mov edx, 1
call fcn.004057b8
cmp dword [ebp - 0x14], 0
je 0x4bab38
imul eax, ebx, 0xd
mov edx, dword [0x4d2630]
cmp dword [edx + eax + 8], 0
jne 0x4bab23
mov dl, 1
mov eax, dword [0x41d250]
call fcn.00404258
imul edx, ebx, 0xd
mov ecx, dword [0x4d2630]
mov dword [ecx + edx + 8], eax
imul eax, ebx, 0xd
mov edx, dword [0x4d2630]
mov eax, dword [edx + eax + 8]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [ebp - 0x18], 0
jne 0x4baa95
inc esi
dec dword [ebp - 0x28]
jne 0x4ba8b1
inc ebx
push ebx
mov eax, 0x4d2630
mov ecx, 1
mov edx, dword [0x4b6580]
call fcn.00406900
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x4bab74
mov eax, dword [ebp - 0x10]
call fcn.004bedf8
xor eax, eax
push ebp
push 0x4bac01
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea ecx, [ebp - 0x798]
xor edx, edx
mov eax, 0x4bbb38
call fcn.004b86ec
pop ecx
mov edx, dword [ebp - 0x798]
mov eax, 0x4cbf54
call fcn.004052d4
cmp dword [0x4cbf54], 0
jne 0x4babf7
lea eax, [ebp - 0x79c]
call fcn.004b6744
mov eax, dword [ebp - 0x79c]
push eax
push 1
push 0
push 1
mov ecx, 0x4bbb38
mov edx, dword [0x4cbe78]
mov eax, 0x80000002
call fcn.0044c6fc
lea eax, [ebp - 0x7a0]
call fcn.004b6744
mov edx, dword [ebp - 0x7a0]
mov eax, 0x4cbf54
call fcn.004052d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bac0b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bac28
mov eax, dword [ebp - 0xc]
call fcn.00404288
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4badc9
lea eax, [ebp - 0x7a4]
mov edx, 0x63
call fcn.004052a4
lea eax, [ebp - 0x614]
call fcn.00405280
lea eax, [ebp - 0x618]
call fcn.00405280
lea eax, [ebp - 0x610]
mov edx, 0x62
call fcn.004052a4
lea eax, [ebp - 0x484]
call fcn.00405280
lea eax, [ebp - 0x488]
call fcn.00405280
lea eax, [ebp - 0x480]
mov edx, 0xa
call fcn.004052a4
lea eax, [ebp - 0x454]
mov edx, 0xa
call fcn.004052a4
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.004052a4
ret