Function at 0x4bba7c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3d
push 0
push 0
dec ecx
jne 0x4bba84
push ebx
push esi
push edi
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4bdb87
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dl, 1
mov eax, dword [0x419eb8]
call fcn.00403c10
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bbacc
add dword [ebp - 0x4c], 4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x390]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bbae4
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x458]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bbbd9
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3e8]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4bbbd9
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3e8]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x44]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x24]
call fcn.00409dd4
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x28]
call fcn.004091a4
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x24]
call fcn.00409d9c
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x24]
call fcn.00404acc
push dword [0x4c56d4]
push 0x4bdba0
push dword [ebp - 0x24]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00404db4
mov eax, dword [ebp - 0x68]
call fcn.00409c9c
test al, al
je 0x4bbbcd
mov eax, dword [ebp - 0x28]
mov edx, 0x4bdbb0
call fcn.00404e40
je 0x4bbbbf
mov eax, dword [ebp - 0x28]
mov edx, 0x4bdbc0
call fcn.00404e40
je 0x4bbbbf
mov eax, dword [ebp - 0x28]
mov edx, 0x4bdbd0
call fcn.00404e40
jne 0x4bbbcd
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x4c]
inc dword [ebp - 0x44]
dec dword [ebp - 0x5c]
jne 0x4bbb25
push ebp
call fcn.004bb610
pop ecx
test al, al
je 0x4bd8b3
xor eax, eax
push ebp
push 0x4bd8ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, 0x4bdbdc
call fcn.0049ebf8
lea ecx, [ebp - 0x6c]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x6c]
mov edx, 0x4bdbe8
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax]
call dword [ebx + 0x28]
lea edx, [ebp - 0x30]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov ecx, 0x4bdc0c
mov edx, 0x4bdc20
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bdbe8
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x30]
call fcn.004a6130
lea eax, [ebp - 0x30]
call fcn.00406948
lea ecx, [ebp - 0x70]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x70]
mov edx, 0x4bdc3c
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax]
call dword [ebx + 0x28]
lea edx, [ebp - 0x30]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov ecx, 0x4bdc4c
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x330]
call fcn.004787b0
imul dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdc6c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x34]
mov eax, 0x4bdbdc
call fcn.0049ebf8
lea ecx, [ebp - 0x74]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x74]
mov edx, 0x4bdc80
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x28]
lea edx, [ebp - 0x38]
mov eax, 0x4bdbdc
call fcn.0049ebf8
xor ecx, ecx
mov edx, 0x4bdc94
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4bdca4
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4bdcb8
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x330]
call fcn.004787b0
imul dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdccc
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ecx, 0x4bdce4
mov edx, 0x4bdcf8
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bdc80
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x38]
call fcn.004a6130
lea eax, [ebp - 0x38]
call fcn.00406948
lea ecx, [ebp - 0x78]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x78]
mov edx, 0x4bdd0c
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x28]
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x20]
call fcn.00404a34
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4bbde0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x390]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4bbde0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x458]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bc8cf
lea edx, [ebp - 0x3c]
mov eax, 0x4bdbdc
call fcn.0049ebf8
lea eax, [ebp - 0x20]
mov edx, 0x4bdd28
call fcn.00404cfc
mov eax, dword [ebp - 0x48]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bdd40
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x36c]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd50
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x364]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x374]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd6c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x37c]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd7c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bdd90
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x33c]
mov edx, dword [eax]
call dword [edx + 0xcc]
lea edx, [ebp - 0x80]
call fcn.00409788
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
call fcn.004052e0
mov ecx, dword [ebp - 0x7c]
mov edx, 0x4bdda4
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x330]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bddbc
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
mov edx, 0x4bddd4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bddec
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bde08
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bde28
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
mov edx, 0x4bde44
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x84]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x84]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x28]
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bc106
mov edx, dword [0x4c56ec]
mov eax, 0x4bde78
call fcn.00405038
test eax, eax
jg 0x4bc106
mov edx, dword [0x4c56f0]
mov eax, 0x4bde78
call fcn.00405038
test eax, eax
jg 0x4bc106
push 0
lea eax, [ebp - 0x88]
mov ecx, 0x4bde84
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0x88]
call fcn.00404ef4
push eax
lea eax, [ebp - 0x8c]
mov ecx, 0x4bde9c
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0x8c]
call fcn.00404ef4
push eax
call sub.kernel32.dll_CopyFileA
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x40]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov ecx, 0x4bdeac
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x90]
mov ecx, 0x4bde84
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0x90]
call fcn.004bb96c
push edx
push eax
mov edx, 0x4bdec0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4bded4
push dword [0x4c56d8]
push 0x4bdee4
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.00404db4
mov edx, dword [ebp - 0x98]
lea eax, [ebp - 0x94]
call fcn.004052e0
mov ecx, dword [ebp - 0x94]
mov edx, 0x4bdef4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x40]
call fcn.004a6130
lea eax, [ebp - 0x40]
call fcn.00406948
push 1
push 0x4bdf04
push dword [0x4c56d4]
push 0x4bde84
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.00404db4
mov ecx, dword [ebp - 0x9c]
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bc295
mov edx, dword [0x4c56fc]
mov eax, 0x4bde78
call fcn.00405038
test eax, eax
jg 0x4bc295
mov edx, dword [0x4c5700]
mov eax, 0x4bde78
call fcn.00405038
test eax, eax
jg 0x4bc295
push 0
lea eax, [ebp - 0xa0]
mov ecx, 0x4bdf1c
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xa0]
call fcn.00404ef4
push eax
lea eax, [ebp - 0xa4]
mov ecx, 0x4bdf34
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xa4]
call fcn.00404ef4
push eax
call sub.kernel32.dll_CopyFileA
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x40]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov ecx, 0x4bdf44
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xa8]
mov ecx, 0x4bdf1c
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xa8]
call fcn.004bb96c
push edx
push eax
mov edx, 0x4bdec0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4bded4
push dword [0x4c56d8]
push 0x4bdf5c
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.00404db4
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
call fcn.004052e0
mov ecx, dword [ebp - 0xac]
mov edx, 0x4bdef4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x40]
call fcn.004a6130
lea eax, [ebp - 0x40]
call fcn.00406948
push 1
push 0x4bdf70
push dword [0x4c56d4]
push 0x4bdf1c
lea eax, [ebp - 0xb4]
mov edx, 3
call fcn.00404db4
mov ecx, dword [ebp - 0xb4]
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bc424
mov edx, dword [0x4c570c]
mov eax, 0x4bde78
call fcn.00405038
test eax, eax
jg 0x4bc424
mov edx, dword [0x4c5710]
mov eax, 0x4bde78
call fcn.00405038
test eax, eax
jg 0x4bc424
push 0
lea eax, [ebp - 0xb8]
mov ecx, 0x4bdf8c
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xb8]
call fcn.00404ef4
push eax
lea eax, [ebp - 0xbc]
mov ecx, 0x4bdfa4
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xbc]
call fcn.00404ef4
push eax
call sub.kernel32.dll_CopyFileA
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x40]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov ecx, 0x4bdfb4
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xc0]
mov ecx, 0x4bdf8c
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xc0]
call fcn.004bb96c
push edx
push eax
mov edx, 0x4bdec0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4bded4
push dword [0x4c56d8]
push 0x4bdfcc
lea eax, [ebp - 0xc8]
mov edx, 3
call fcn.00404db4
mov edx, dword [ebp - 0xc8]
lea eax, [ebp - 0xc4]
call fcn.004052e0
mov ecx, dword [ebp - 0xc4]
mov edx, 0x4bdef4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x40]
call fcn.004a6130
lea eax, [ebp - 0x40]
call fcn.00406948
push 1
push 0x4bdfe0
push dword [0x4c56d4]
push 0x4bdf8c
lea eax, [ebp - 0xcc]
mov edx, 3
call fcn.00404db4
mov ecx, dword [ebp - 0xcc]
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bc5b3
mov edx, dword [0x4c571c]
mov eax, 0x4bde78
call fcn.00405038
test eax, eax
jg 0x4bc5b3
mov edx, dword [0x4c5720]
mov eax, 0x4bde78
call fcn.00405038
test eax, eax
jg 0x4bc5b3
push 0
lea eax, [ebp - 0xd0]
mov ecx, 0x4bdffc
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xd0]
call fcn.00404ef4
push eax
lea eax, [ebp - 0xd4]
mov ecx, 0x4be014
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xd4]
call fcn.00404ef4
push eax
call sub.kernel32.dll_CopyFileA
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x40]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov ecx, 0x4be024
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xd8]
mov ecx, 0x4bdffc
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xd8]
call fcn.004bb96c
push edx
push eax
mov edx, 0x4bdec0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4bded4
push dword [0x4c56d8]
push 0x4be03c
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.00404db4
mov edx, dword [ebp - 0xe0]
lea eax, [ebp - 0xdc]
call fcn.004052e0
mov ecx, dword [ebp - 0xdc]
mov edx, 0x4bdef4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x40]
call fcn.004a6130
lea eax, [ebp - 0x40]
call fcn.00406948
push 1
push 0x4be050
push dword [0x4c56d4]
push 0x4bdffc
lea eax, [ebp - 0xe4]
mov edx, 3
call fcn.00404db4
mov ecx, dword [ebp - 0xe4]
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x390]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bc71a
mov eax, dword [ebp - 0x1c]
call fcn.004bb208
push 0
lea eax, [ebp - 0xe8]
mov ecx, 0x4be06c
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xe8]
call fcn.00404ef4
push eax
lea eax, [ebp - 0xec]
mov ecx, 0x4be080
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xec]
call fcn.00404ef4
push eax
call sub.kernel32.dll_CopyFileA
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x40]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov ecx, 0x4be090
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xf0]
mov ecx, 0x4be06c
mov edx, dword [0x4c56d4]
call fcn.00404d40
mov eax, dword [ebp - 0xf0]
call fcn.004bb96c
push edx
push eax
mov edx, 0x4bdec0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4bded4
push dword [0x4c56d8]
push 0x4be0a8
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.00404db4
mov edx, dword [ebp - 0xf8]
lea eax, [ebp - 0xf4]
call fcn.004052e0
mov ecx, dword [ebp - 0xf4]
mov edx, 0x4bdef4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x40]
call fcn.004a6130
lea eax, [ebp - 0x40]
call fcn.00406948
push 1
push 0x4be0b8
push dword [0x4c56d4]
push 0x4be06c
lea eax, [ebp - 0xfc]
mov edx, 3
call fcn.00404db4
mov ecx, dword [ebp - 0xfc]
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x458]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bc8b2
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4bc8b2
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x58]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [0x4c56d4]
push 0x4bdba0
push dword [ebp - 0x24]
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.00404db4
mov eax, dword [ebp - 0x100]
call fcn.00409c9c
test al, al
je 0x4bc8a6
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x40]
mov eax, 0x4bdbdc
call fcn.0049ebf8
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 0x24]
call fcn.004052e0
mov ecx, dword [ebp - 0x104]
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [0x4c56d4]
push 0x4bdba0
push dword [ebp - 0x24]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404db4
mov eax, dword [ebp - 0x108]
call fcn.004bb96c
push edx
push eax
mov edx, 0x4bdec0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4bded4
push dword [0x4c56d8]
push 0x4be0cc
push dword [ebp - 0x24]
lea eax, [ebp - 0x110]
mov edx, 4
call fcn.00404db4
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
call fcn.004052e0
mov ecx, dword [ebp - 0x10c]
mov edx, 0x4bdef4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x40]
call fcn.004a6130
lea eax, [ebp - 0x40]
call fcn.00406948
push 1
push 0x4be0d8
push dword [0x4c56d4]
push 0x4bdba0
push dword [ebp - 0x24]
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00404db4
mov ecx, dword [ebp - 0x114]
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
inc dword [ebp - 0x44]
dec dword [ebp - 0x5c]
jne 0x4bc74f
mov edx, 0x4bdd0c
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x3c]
call fcn.004a6130
lea eax, [ebp - 0x3c]
call fcn.00406948
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x41c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bcc88
inc dword [ebp - 0x48]
lea edx, [ebp - 0x3c]
mov eax, 0x4bdbdc
call fcn.0049ebf8
lea eax, [ebp - 0x20]
mov edx, 0x4be0ec
call fcn.00404cfc
mov eax, dword [ebp - 0x48]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 2
mov edx, 0x4bdd40
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x40c]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd50
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x410]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x414]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd6c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x418]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd7c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 5
mov edx, 0x4bdd90
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ecx, 0x4be0f8
mov edx, 0x4bdda4
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov ecx, 0x4be100
mov edx, 0x4bddbc
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
push 0
push 0
mov edx, 0x4bddd4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bddec
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bde08
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bde28
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ecx, 0x4be100
mov edx, 0x4be108
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov ecx, 0x4be12c
mov edx, 0x4be138
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
lea edx, [ebp - 0x11c]
mov eax, dword [0x4c57d8]
call fcn.00409788
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.004052e0
mov ecx, dword [ebp - 0x118]
mov edx, 0x4be148
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
cmp dword [0x4c57e0], 1
jne 0x4bca8f
mov ecx, 0x4be160
mov edx, 0x4be170
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
jmp 0x4bca9e
xor ecx, ecx
mov edx, 0x4be170
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4be18c
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4be1b0
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4be1c8
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
lea eax, [ebp - 0x120]
mov edx, dword [0x4c57d4]
call fcn.004052e0
mov ecx, dword [ebp - 0x120]
mov edx, 0x4be1e0
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
lea edx, [ebp - 0x128]
mov eax, dword [0x4c57dc]
call fcn.004bb9a4
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x124]
call fcn.004052e0
mov ecx, dword [ebp - 0x124]
mov edx, 0x4be1fc
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x418]
call fcn.004787b0
lea edx, [ebp - 0x130]
call fcn.00409788
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
call fcn.004052e0
mov ecx, dword [ebp - 0x12c]
mov edx, 0x4be214
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4be230
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4be24c
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov ecx, 0x4be100
mov edx, 0x4be264
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov ecx, 0x4be27c
mov edx, 0x4be284
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4be2a0
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x30]
lea ecx, [ebp - 0x134]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x134]
mov edx, 0x4be2b4
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x28]
lea edx, [ebp - 0x40]
mov eax, 0x4bdbdc
call fcn.0049ebf8
push 0
push 0
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ecx, 0x4be2cc
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3f4]
call fcn.00454bd0
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.004093b8
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
call fcn.004052e0
mov ecx, dword [ebp - 0x138]
mov edx, 0x4be138
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4be2b4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x40]
call fcn.004a6130
lea eax, [ebp - 0x40]
call fcn.00406948
mov edx, 0x4bdd0c
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x3c]
call fcn.004a6130
lea eax, [ebp - 0x3c]
call fcn.00406948
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x438]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4bcccb
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x43c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4bcccb
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x440]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bceee
inc dword [ebp - 0x48]
lea eax, [ebp - 0x20]
mov edx, 0x4be2dc
call fcn.00404cfc
lea edx, [ebp - 0x3c]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov eax, dword [ebp - 0x48]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 4
mov edx, 0x4bdd40
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x448]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd50
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x44c]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x450]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd6c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x454]
call fcn.004787b0
cdq
push edx
push eax
mov edx, 0x4bdd7c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 4
mov edx, 0x4bdd90
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4be2e8
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x148]
mov eax, dword [0x4c5814]
call fcn.00409788
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
call fcn.004052e0
mov ecx, dword [ebp - 0x144]
mov edx, 0x4be2fc
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
lea edx, [ebp - 0x150]
mov eax, dword [0x4c580c]
call fcn.004bb9a4
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
call fcn.004052e0
mov ecx, dword [ebp - 0x14c]
mov edx, 0x4be1fc
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x438]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bce37
mov ecx, 0x4be100
mov edx, 0x4be31c
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
jmp 0x4bce49
mov ecx, 0x4be27c
mov edx, 0x4be31c
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x43c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bce72
mov ecx, 0x4be100
mov edx, 0x4be334
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
jmp 0x4bce84
mov ecx, 0x4be27c
mov edx, 0x4be334
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x440]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bcead
mov ecx, 0x4be100
mov edx, 0x4be34c
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
jmp 0x4bcebf
mov ecx, 0x4be27c
mov edx, 0x4be34c
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov ecx, 0x4be27c
mov edx, 0x4be364
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bdd0c
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x3c]
call fcn.004a6130
lea eax, [ebp - 0x3c]
call fcn.00406948
mov ecx, dword [ebp - 0x34]
mov edx, 0x4be37c
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x28]
lea eax, [ebp - 0x34]
call fcn.00406948
mov edx, 0x4bdc3c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x30]
call fcn.004a6130
lea eax, [ebp - 0x30]
call fcn.00406948
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
call dword [edx + 0x44]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x458]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4bd17e
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3e8]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4bd17e
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3e8]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x44]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 0x24]
call fcn.00409dd4
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x28]
call fcn.004091a4
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 0x24]
call fcn.00409d9c
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x24]
call fcn.00404acc
push dword [0x4c56d4]
push 0x4bdba0
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 0x24]
call fcn.00409d9c
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404db4
mov eax, dword [ebp - 0x15c]
call fcn.00409c9c
test al, al
je 0x4bd172
mov eax, dword [ebp - 0x28]
mov edx, 0x4be398
call fcn.00404e40
je 0x4bd065
mov eax, dword [ebp - 0x28]
mov edx, 0x4be3a8
call fcn.00404e40
je 0x4bd065
mov eax, dword [ebp - 0x28]
mov edx, 0x4be3b8
call fcn.00404e40
je 0x4bd065
mov eax, dword [ebp - 0x28]
mov edx, 0x4be3c8
call fcn.00404e40
je 0x4bd065
mov eax, dword [ebp - 0x28]
mov edx, 0x4be3d8
call fcn.00404e40
je 0x4bd065
mov eax, dword [ebp - 0x28]
mov edx, 0x4be3e8
call fcn.00404e40
jne 0x4bd172
xor eax, eax
push ebp
push 0x4bd0cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x45c]
call fcn.004b0ec4
lea ecx, [ebp - 0x168]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3e8]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x44]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 0x164]
call fcn.004052e0
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x45c]
call fcn.004b0a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bd0d7
push 0x32
call sub.kernel32.dll_Sleep_1
lea ecx, [ebp - 0x16c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x45c]
mov edx, 0x4be3f8
call fcn.004b0fb0
mov eax, dword [ebp - 0x16c]
call fcn.0040c83c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x52]
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x4e]
call fcn.0040af18
movzx eax, word [ebp - 0x4e]
imul ebx, eax, 0xe10
movzx eax, word [ebp - 0x50]
imul eax, eax, 0x3c
add ebx, eax
movzx eax, word [ebp - 0x52]
add ebx, eax
push dword [ebp - 0x24]
push 0x4be40c
lea edx, [ebp - 0x174]
mov eax, ebx
call fcn.00409788
push dword [ebp - 0x174]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00404db4
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add dword [ebp - 0x4c], ebx
mov bl, 1
inc dword [ebp - 0x44]
dec dword [ebp - 0x5c]
jne 0x4bcf73
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x458]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, bl
je 0x4bd62b
lea edx, [ebp - 0x30]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov ecx, 0x4be414
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdc6c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x34]
mov eax, 0x4bdbdc
call fcn.0049ebf8
lea ecx, [ebp - 0x178]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x178]
mov edx, 0x4bdc80
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x28]
lea edx, [ebp - 0x38]
mov eax, 0x4bdbdc
call fcn.0049ebf8
xor ecx, ecx
mov edx, 0x4bdc94
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4bdca4
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x50]
xor ecx, ecx
mov edx, 0x4bdcb8
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdccc
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ecx, 0x4bdce4
mov edx, 0x4bdcf8
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov edx, 0x4bdc80
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x38]
call fcn.004a6130
lea eax, [ebp - 0x38]
call fcn.00406948
lea ecx, [ebp - 0x17c]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x17c]
mov edx, 0x4bdd0c
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x28]
inc dword [ebp - 0x48]
lea eax, [ebp - 0x20]
mov edx, 0x4be428
call fcn.00404cfc
lea edx, [ebp - 0x3c]
mov eax, 0x4bdbdc
call fcn.0049ebf8
mov eax, dword [ebp - 0x48]
inc eax
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
mov edx, 0x4bdd40
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
mov edx, 0x4bdd50
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
mov edx, 0x4bdd5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0x240
mov edx, 0x4bdd6c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0x150
mov edx, 0x4bdd7c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 2
mov edx, 0x4bdd90
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x33c]
mov edx, dword [eax]
call dword [edx + 0xcc]
lea edx, [ebp - 0x184]
call fcn.00409788
mov edx, dword [ebp - 0x184]
lea eax, [ebp - 0x180]
call fcn.004052e0
mov ecx, dword [ebp - 0x180]
mov edx, 0x4bdda4
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bddbc
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
mov edx, 0x4bddd4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bddec
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bde08
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
mov edx, 0x4bde28
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
mov edx, 0x4bde44
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x188]
lea eax, [ebp - 0x6c]
or edx, 0xffffffff
call fcn.0049ec2c
mov ecx, dword [ebp - 0x188]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x28]
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4bd5d9
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x58]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x24]
mov eax, 0x4be40c
call fcn.00405038
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x24]
call fcn.00404f54
lea eax, [ebp - 0x18c]
push eax
mov edx, dword [ebp - 0x24]
mov eax, 0x4be40c
call fcn.00405038
add eax, 3
push eax
mov eax, dword [ebp - 0x24]
call fcn.00404cf4
mov ecx, eax
mov eax, dword [ebp - 0x24]
pop edx
call fcn.00404f54
mov eax, dword [ebp - 0x18c]
call fcn.004098c4
mov ebx, eax
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x40]
mov eax, 0x4bdbdc
call fcn.0049ebf8
lea eax, [ebp - 0x190]
mov edx, dword [ebp - 0x28]
call fcn.004052e0
mov ecx, dword [ebp - 0x190]
mov edx, 0x4bdc5c
mov eax, dword [ebp - 0x40]
mov esi, dword [eax]
call dword [esi + 0x50]
mov eax, ebx
cdq
push edx
push eax
mov edx, 0x4be434
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x4c]
cdq
push edx
push eax
mov edx, 0x4bdd34
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [0x4c56d4]
push 0x4bdba0
push dword [ebp - 0x28]
lea eax, [ebp - 0x194]
mov edx, 3
call fcn.00404db4
mov eax, dword [ebp - 0x194]
call fcn.004bb96c
push edx
push eax
mov edx, 0x4bdec0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4bded4
push dword [0x4c56d8]
push 0x4be0cc
push dword [ebp - 0x28]
lea eax, [ebp - 0x19c]
mov edx, 4
call fcn.00404db4
mov edx, dword [ebp - 0x19c]
lea eax, [ebp - 0x198]
call fcn.004052e0
mov ecx, dword [ebp - 0x198]
mov edx, 0x4bdef4
mov eax, dword [ebp - 0x40]
mov esi, dword [eax]
call dword [esi + 0x50]
mov edx, 0x4bde5c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x40]
call fcn.004a6130
lea eax, [ebp - 0x40]
call fcn.00406948
push 1
push 0x4be448
push dword [0x4c56d4]
push 0x4bdba0
push dword [ebp - 0x28]
push 0x4be45c
lea edx, [ebp - 0x1a4]
mov eax, ebx
call fcn.00409788
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov edx, 6
call fcn.00404db4
mov ecx, dword [ebp - 0x1a0]
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
inc dword [ebp - 0x44]
dec dword [ebp - 0x5c]
jne 0x4bd424
mov edx, 0x4bdd0c
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x3c]
call fcn.004a6130
lea eax, [ebp - 0x3c]
call fcn.00406948
mov ecx, dword [ebp - 0x34]
mov edx, 0x4be37c
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x28]
lea eax, [ebp - 0x34]
call fcn.00406948
mov edx, 0x4bdc3c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [ebp - 0x30]
call fcn.004a6130
lea eax, [ebp - 0x30]
call fcn.00406948
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x1ac]
lea eax, [ebp - 0x1a8]
call fcn.00404cbc
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x10]
call fcn.00406dbc
lea eax, [ebp - 0x2c]
call fcn.00406948
push 0
lea eax, [ebp - 0x1b0]
push eax
lea edx, [ebp - 0x1bc]
mov eax, dword [ebp - 0x10]
call fcn.00406e0c
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 0x1b4], 0xb
lea edx, [ebp - 0x1b8]
xor ecx, ecx
mov eax, 0x4be46c
call fcn.0040a5cc
mov ecx, dword [ebp - 0x1b0]
mov edx, 2
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x49ab4c]
call fcn.0049b034
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x419eb8]
call fcn.00403c10
mov dword [ebp - 4], eax
mov edx, 0x4be47c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1c0]
mov ecx, dword [ebp - 0x18]
mov edx, 0x4be4a0
call fcn.00404d40
mov edx, dword [ebp - 0x1c0]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1c4]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4be4b4
call fcn.00404d40
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41a248]
call fcn.0041f010
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x4be4cc
mov eax, dword [ebp - 0xc]
call fcn.0049b358
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
call fcn.00406d18
mov edx, dword [ebp - 0x1c8]
lea eax, [ebp - 0x10]
call fcn.00404cbc
lea eax, [ebp - 0x1cc]
mov edx, dword [ebp - 0x10]
call fcn.004052e0
mov eax, dword [ebp - 0x1cc]
lea edx, [ebp - 0x14]
call fcn.0049ebf8
lea ecx, [ebp - 0x1d4]
mov edx, 0x4be514
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d0]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov eax, dword [ebp - 0x1d0]
mov edx, 0x4be528
call fcn.004053b4
jne 0x4bd82b
push 1
push 0x4be538
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x20]
call fcn.004093b8
push dword [ebp - 0x1dc]
push 0x4be548
lea eax, [ebp - 0x1d8]
mov edx, 3
call fcn.00404db4
mov ecx, dword [ebp - 0x1d8]
mov edx, 2
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
call fcn.0040b318
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x1e0]
mov eax, 0x4be558
call fcn.0040bfc8
mov edx, dword [ebp - 0x1e0]
mov eax, 0x4c56dc
call fcn.00404a88
jmp 0x4bd86e
push 1
push 0x4be538
lea edx, [ebp - 0x1e8]
mov eax, dword [ebp - 0x20]
call fcn.004093b8
push dword [ebp - 0x1e8]
push 0x4be564
lea eax, [ebp - 0x1e4]
mov edx, 3
call fcn.00404db4
mov ecx, dword [ebp - 0x1e4]
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004b72fc
lea eax, [ebp - 0x14]
call fcn.00406948
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd8b3
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x58]
mov eax, dword [ebp - 0xc]
call fcn.00403c40
lea eax, [ebp - 4]
call fcn.0040ed44
lea eax, [ebp - 8]
call fcn.0040ed44
lea eax, [ebp - 0x58]
call fcn.0040ed44
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bdb91
lea eax, [ebp - 0x1e8]
mov edx, 5
call fcn.00404a58
lea eax, [ebp - 0x1d4]
call fcn.00406948
lea eax, [ebp - 0x1d0]
mov edx, 3
call fcn.00405180
lea eax, [ebp - 0x1c4]
mov edx, 3
call fcn.00404a58
lea eax, [ebp - 0x1b0]
call fcn.00404a34
lea eax, [ebp - 0x1ac]
call fcn.00405168
lea eax, [ebp - 0x1a8]
mov edx, 4
call fcn.00404a58
lea eax, [ebp - 0x198]
call fcn.00405168
lea eax, [ebp - 0x194]
call fcn.00404a34
lea eax, [ebp - 0x190]
call fcn.00405168
lea eax, [ebp - 0x18c]
call fcn.00404a34
lea eax, [ebp - 0x188]
call fcn.00406948
lea eax, [ebp - 0x184]
call fcn.00404a34
lea eax, [ebp - 0x180]
call fcn.00405168
lea eax, [ebp - 0x17c]
mov edx, dword [0x49e128]
mov ecx, 2
call fcn.004056e4
lea eax, [ebp - 0x174]
mov edx, 4
call fcn.00404a58
lea eax, [ebp - 0x164]
call fcn.00405168
lea eax, [ebp - 0x160]
mov edx, 5
call fcn.00404a58
lea eax, [ebp - 0x14c]
call fcn.00405168
lea eax, [ebp - 0x148]
call fcn.00404a34
lea eax, [ebp - 0x144]
call fcn.00405168
lea eax, [ebp - 0x140]
call fcn.00404a34
lea eax, [ebp - 0x13c]
call fcn.00404a34
lea eax, [ebp - 0x138]
call fcn.00405168
lea eax, [ebp - 0x134]
call fcn.00406948
lea eax, [ebp - 0x130]
call fcn.00404a34
lea eax, [ebp - 0x12c]
call fcn.00405168
lea eax, [ebp - 0x128]
call fcn.00404a34
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.00405180
lea eax, [ebp - 0x11c]
call fcn.00404a34
lea eax, [ebp - 0x118]
call fcn.00405168
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404a58
lea eax, [ebp - 0x10c]
call fcn.00405168
lea eax, [ebp - 0x108]
call fcn.00404a34
lea eax, [ebp - 0x104]
call fcn.00405168
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.00404a58
lea eax, [ebp - 0xf4]
call fcn.00405168
lea eax, [ebp - 0xf0]
mov edx, 5
call fcn.00404a58
lea eax, [ebp - 0xdc]
call fcn.00405168
lea eax, [ebp - 0xd8]
mov edx, 5
call fcn.00404a58
lea eax, [ebp - 0xc4]
call fcn.00405168
lea eax, [ebp - 0xc0]
mov edx, 5
call fcn.00404a58
lea eax, [ebp - 0xac]
call fcn.00405168
lea eax, [ebp - 0xa8]
mov edx, 5
call fcn.00404a58
lea eax, [ebp - 0x94]
call fcn.00405168
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.00404a58
lea eax, [ebp - 0x84]
call fcn.00406948
lea eax, [ebp - 0x80]
call fcn.00404a34
lea eax, [ebp - 0x7c]
call fcn.00405168
lea eax, [ebp - 0x78]
mov edx, dword [0x49e128]
mov ecx, 4
call fcn.004056e4
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00404a58
lea eax, [ebp - 0x20]
call fcn.00404a34
lea eax, [ebp - 0x18]
call fcn.00404a34
lea eax, [ebp - 0x10]
call fcn.00404a34
lea eax, [ebp - 0x40]
mov edx, dword [0x49e128]
mov ecx, 6
call fcn.004056e4
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404a58
lea eax, [ebp - 0x14]
call fcn.00406948
ret