Function at 0x4ad620
Capabilities:
Create thread
Encode data using base64
Get memory capacity
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2778
call fcn.004c38f0
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
push esi
push edi
mov dword [ebp - 0x25b4], eax
xor esi, esi
xor eax, eax
mov byte [ebp - 0x2585], 0
push 0x200
mov dword [ebp - 0x2604], eax
xor edi, edi
lea eax, [ebp - 0xa90]
mov dword [ebp - 0x2614], 0
push esi
push eax
movsd qword [ebp - 0x25d0], xmm0
movsd qword [ebp - 0x26a0], xmm0
movsd qword [ebp - 0x25f0], xmm0
movsd qword [ebp - 0x2628], xmm0
mov dword [ebp - 0x262c], edi
movsd qword [ebp - 0x2750], xmm0
mov dword [ebp - 0x26ec], esi
movlpd qword [ebp - 0x2638], xmm0
movlpd qword [ebp - 0x2710], xmm0
movlpd qword [ebp - 0x2700], xmm0
call fcn.004c52c0
add esp, 0xc
mov byte [ebp - 0x26a4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2618], esi
mov ecx, 0x550a60
movlpd qword [ebp - 0x2708], xmm0
mov byte [ebp - 0x257d], 0
mov dword [ebp - 0x26dc], esi
mov dword [ebp - 0x26d8], esi
movlpd qword [ebp - 0x2610], xmm0
mov byte [ebp - 0x2575], 0
mov byte [ebp - 0x25bd], 0
call fcn.0047f930
mov ecx, 0x5678b0
call fcn.004a1da0
mov ecx, 0x567918
call fcn.004a1da0
mov ecx, 0x567980
call fcn.004a1da0
movzx eax, byte [0x5512fa]
mov edx, 1
cmp dword [0x567c60], eax
movzx ecx, byte [ebp - 0x2585]
cmovne ecx, edx
mov dword [0x567c60], eax
xor eax, eax
mov dword [ebp - 0x2574], ecx
push 0x50
push eax
mov word [ebp - 0x1690], ax
lea eax, [ebp - 0x1f60]
push eax
call fcn.004c52c0
mov eax, dword [0x55b1d4]
mov edx, dword [0x55b1cc]
mov esi, dword [0x55b1d0]
mov ecx, dword [0x556aec]
mov dword [0x55b1cc], eax
mov eax, dword [0x55b1e0]
mov dword [0x55b1d0], eax
mov eax, dword [0x556ae8]
mov dword [0x55b1d8], eax
mov eax, dword [0x55b1ec]
mov dword [ebp - 0x2590], eax
mov eax, dword [0x55b1e8]
mov dword [ebp - 0x2598], eax
mov eax, dword [0x55b1e4]
push 0x55b1e0
push 0x55b1d4
mov dword [0x55b1dc], ecx
mov dword [0x55b1d4], edx
mov dword [0x55b1e0], esi
mov dword [ebp - 0x2630], eax
call fcn.00491bb0
add esp, 0x14
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0x2630]
mov dword [ebp - 0x25a0], esi
mov dword [ebp - 0x25e4], edi
test eax, eax
je 0x4ad816
push eax
call fcn.0048ce30
add esp, 4
mov eax, dword [ebp - 0x2598]
test eax, eax
je 0x4ad829
push eax
call fcn.0048cf20
add esp, 4
mov eax, dword [ebp - 0x2590]
test eax, eax
je 0x4ad842
push eax
call fcn.0048d010
mov eax, dword [ebp - 0x2590]
add esp, 4
cmp dword [0x567874], 0
je 0x4ad982
test eax, eax
je 0x4ad982
push 0x18
mov dword [ebp - 0x25f4], 0
call fcn.004c3423
mov edi, eax
add esp, 4
mov dword [edi], edi
mov dword [edi + 4], edi
mov dword [edi + 8], edi
mov word [edi + 0xc], 0x101
mov esi, dword [0x55b1cc]
mov dword [ebp - 0x25f8], edi
test esi, esi
je 0x4ad93d
nop
mov eax, dword [esi + 0x44]
lea ecx, [ebp - 0x25f8]
mov dword [ebp - 0x25bc], eax
mov dword [ebp - 0x1e9c], eax
lea eax, [ebp - 0x1e9c]
push eax
lea eax, [ebp - 0x275c]
mov dword [ebp - 0x1e98], esi
push eax
call fcn.0047eec0
mov ecx, dword [eax + 8]
movq xmm0, qword [eax]
movq qword [ebp - 0x26d0], xmm0
cmp byte [ecx + 0xd], 0
jne 0x4ad8de
mov eax, dword [ebp - 0x25bc]
cmp eax, dword [ecx + 0x10]
jae 0x4ad930
cmp dword [ebp - 0x25f4], 0xaaaaaaa
je 0x4b1895
push 0x18
call fcn.004c3423
mov ecx, dword [ebp - 0x25bc]
add esp, 4
mov dword [eax + 0x10], ecx
lea ecx, [ebp - 0x25f8]
push eax
push dword [ebp - 0x26cc]
mov dword [eax + 0x14], esi
push dword [ebp - 0x26d0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov word [eax + 0xc], 0
call int.0042a040
mov edi, dword [ebp - 0x25f8]
mov eax, dword [esi]
test eax, eax
je 0x4ad93d
add esi, eax
jmp 0x4ad890
lea eax, [ebp - 0x2610]
push eax
mov eax, dword [ebp - 0x2590]
push eax
push dword [0x55b1d4]
lea eax, [ebp - 0x25f8]
push eax
call fcn.00492440
add esp, 0x10
mov dword [0x55b1f0], eax
lea ecx, [ebp - 0x25f8]
mov dword [0x55b1f4], edx
call fcn.0047efe0
mov esi, dword [ebp - 0x25a0]
mov edi, dword [ebp - 0x25e4]
mov ecx, dword [0x555f60]
movsd xmm0, qword [0x50d110]
mov dword [0x556ae8], esi
sub esi, dword [0x55b1d8]
mov dword [0x556aec], edi
sbb edi, dword [0x55b1dc]
mov dword [ebp - 0x25a0], esi
mov dword [ebp - 0x25e4], edi
movsd qword [ebp - 0x25f8], xmm0
cmp ecx, 1
jbe 0x4adbdb
mov dword [ebp - 0x25ac], 0
test ecx, ecx
jle 0x4adbdb
mov edx, edi
mov ecx, esi
call fcn.004c3cd0
xor esi, esi
movsd qword [ebp - 0x2610], xmm0
mov dword [ebp - 0x25bc], esi
mov eax, dword [0x55b1e4]
mov edi, dword [esi + eax + 8]
mov ecx, dword [esi + eax]
mov edx, dword [esi + eax + 4]
mov dword [ebp - 0x2584], edi
mov edi, dword [esi + eax + 0xc]
mov dword [ebp - 0x25a4], edi
mov edi, dword [esi + eax + 0x10]
mov eax, dword [esi + eax + 0x14]
sub edi, ecx
sbb eax, edx
add edi, dword [ebp - 0x2584]
mov dword [ebp - 0x2590], edi
mov edi, dword [ebp - 0x25a4]
adc eax, edi
sub dword [ebp - 0x2584], ecx
mov dword [ebp - 0x259c], eax
mov eax, dword [ebp - 0x25a0]
sbb edi, edx
or eax, dword [ebp - 0x25e4]
mov edx, dword [ebp - 0x2590]
mov ecx, dword [ebp - 0x259c]
mov dword [ebp - 0x25a4], edi
mov edi, dword [ebp - 0x25ac]
jne 0x4ada93
mov eax, dword [0x556ac8]
movsd xmm1, qword [ebp - 0x25d0]
movaps xmm0, xmm1
movsd qword [ebp - 0x1ea0], xmm1
movaps xmm2, xmm1
mov eax, dword [eax + edi*4]
mov dword [eax + 0x890], edx
mov dword [eax + 0x894], ecx
jmp 0x4adb5d
mov esi, dword [0x556ac8]
push 0
push 0x64
mov eax, dword [esi + edi*4]
sub edx, dword [eax + 0x890]
sbb ecx, dword [eax + 0x894]
push ecx
push edx
call fcn.004c4060
mov ecx, eax
call fcn.004c3cd0
divsd xmm0, qword [ebp - 0x2610]
mov eax, dword [esi + edi*4]
mov ecx, dword [ebp - 0x2590]
mov edx, dword [ebp - 0x2584]
push 0
mov dword [eax + 0x890], ecx
mov ecx, dword [ebp - 0x259c]
mov dword [eax + 0x894], ecx
mov eax, dword [0x556ac8]
mov ecx, dword [ebp - 0x25a4]
push 0x64
mov eax, dword [eax + edi*4]
sub edx, dword [eax + 0x898]
sbb ecx, dword [eax + 0x89c]
push ecx
push edx
movsd xmm1, qword [ebp - 0x25d0]
maxsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x25f8]
minsd xmm0, xmm1
movsd qword [ebp - 0x1ea0], xmm0
call fcn.004c4060
mov ecx, eax
call fcn.004c3cd0
divsd xmm0, qword [ebp - 0x2610]
mov esi, dword [ebp - 0x25bc]
movsd xmm1, qword [ebp - 0x25d0]
movsd xmm2, qword [ebp - 0x25f8]
maxsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x1ea0]
minsd xmm2, xmm1
mov eax, dword [0x556ac8]
mov ecx, dword [ebp - 0x2584]
push 0
sub esp, 0x10
mov eax, dword [eax + edi*4]
movsd qword [esp + 8], xmm2
mov dword [eax + 0x898], ecx
mov ecx, dword [ebp - 0x25a4]
mov dword [eax + 0x89c], ecx
mov eax, dword [0x556ac8]
movsd qword [esp], xmm0
push dword [0x556aec]
push dword [0x556ae8]
push dword [eax + edi*4]
call fcn.004596e0
mov eax, dword [ebp - 0x25ac]
add esi, 0x30
mov ecx, dword [0x555f60]
inc eax
add esp, 0x20
mov dword [ebp - 0x25ac], eax
mov dword [ebp - 0x25bc], esi
cmp eax, ecx
jl 0x4ad9f0
mov esi, dword [ebp - 0x25a0]
mov edi, dword [ebp - 0x25e4]
jmp 0x4adbeb
movsd xmm0, qword [ebp - 0x1ea0]
movsd qword [ebp - 0x1ea0], xmm0
push edi
push esi
push 0
push ecx
call fcn.004c4060
push 0x208
mov dword [ebp - 0x25d8], eax
lea eax, [ebp - 0x250]
push 0
push eax
mov dword [ebp - 0x25b8], edx
mov byte [ebp - 0x2585], 0
call fcn.004c52c0
add esp, 0xc
mov dword [ebp - 0x26e4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x2630], eax
call fcn.00475690
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x25e0], edi
test al, al
je 0x4adc95
lea eax, [ebp - 0x250]
mov byte [ebp - 0x2585], 1
push 0x104
push eax
call fcn.00475660
add esp, 8
lea eax, [ebp - 0x250]
push eax
push 0x567a58
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4add40
lea eax, [ebp - 0x250]
push eax
push 0x104
push 0x567a58
call fcn.004c905a
add esp, 0xc
jmp 0x4adcab
cmp word [0x567a58], 0
je 0x4add40
xor eax, eax
mov word [0x567a58], ax
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebp - 0x25b4]
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4add2f
lea eax, [ebp - 0x268c]
mov dword [ebp - 0x268c], 4
push eax
push 0
push 0x104b
push dword [ebp - 0x25b4]
mov dword [ebp - 0x2688], esi
mov dword [ebp - 0x2684], 0
call edi
test eax, eax
je 0x4add06
mov eax, dword [ebp - 0x266c]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x26e4], eax
lea eax, [ebp - 0x1f0c]
mov dword [ebp - 0x1efc], 3
push eax
push esi
push 0x102b
push dword [ebp - 0x25b4]
mov dword [ebp - 0x1f00], 0
call edi
push 0
push 0
push 0x1009
push dword [ebp - 0x25b4]
call edi
mov esi, dword [0x550f44]
mov edx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 0x2590], esi
mov dword [ebp - 0x26e8], edx
test esi, esi
je 0x4ae845
mov eax, dword [ebp - 0x2634]
mov dword [ebp - 0x25c4], eax
mov eax, dword [ebp - 0x2638]
mov dword [ebp - 0x25dc], eax
nop dword [eax + eax]
cmp dword [esi + 0xf0], 0xffffffff
lea eax, [esi + 0x24]
mov dword [ebp - 0x25bc], eax
jne 0x4adda1
cmp dword [eax], 0
je 0x4adda1
movsd xmm0, qword [esi + 0x530]
jmp 0x4addaf
movsd xmm0, qword [ebp - 0x25d0]
mov dword [ebp - 0x25bc], eax
movsd qword [esi + 0x530], xmm0
mov edi, dword [eax]
cmp edi, 0xfffffff6
mov ecx, dword [esi + 0x5c0]
mov eax, dword [ebp - 0x26a4]
mov dword [ebp - 0x2644], ecx
mov ecx, 1
movzx eax, al
cmove eax, ecx
cmp byte [ebp - 0x2585], 0
mov dword [ebp - 0x26a4], eax
je 0x4ade06
lea eax, [ebp - 0x250]
push eax
push dword [esi + 0xe4]
call edx
test eax, eax
jne 0x4ade06
mov eax, dword [esi + 0xd0]
or eax, 8
jmp 0x4ade0f
mov eax, dword [esi + 0xd0]
and eax, 0xfffffff7
mov dword [esi + 0xd0], eax
cmp edi, 0xfffffff6
je 0x4ade27
test al, 2
jne 0x4ade27
cmp dword [esi + 0xd4], 0xffffffff
jne 0x4ade2b
test al, 8
je 0x4ade84
push esi
push dword [0x555ecc]
call fcn.0046cc10
add esp, 8
test al, al
je 0x4ae7f3
test byte [esi + 0xd0], 2
jne 0x4ade78
lea eax, [ebp - 0x2575]
mov dword [ebp - 0x266c], esi
push eax
push esi
lea eax, [ebp - 0x268c]
mov dword [ebp - 0x2688], 0xffffffff
push eax
push dword [ebp - 0x25b4]
call fcn.004a7650
add esp, 0x10
mov byte [ebp - 0x2574], 1
jmp 0x4ae7f3
cmp edi, 0xfffffff6
jne 0x4ae7ad
lea eax, [ebp - 0x2728]
mov dword [ebp - 0x2728], 1
push eax
push 0xffffffffffffffff
push 0x1053
push dword [0x555ecc]
mov dword [ebp - 0x2720], esi
call dword [ebp - 0x25e0]
mov dword [ebp - 0x2688], eax
cmp eax, 0xffffffff
jne 0x4adee1
test byte [esi + 0xd0], 2
je 0x4adee1
lea eax, [ebp - 0x250]
push eax
push esi
push dword [0x555ecc]
call fcn.0046c4d0
add esp, 0xc
mov ecx, dword [0x555f60]
xorps xmm0, xmm0
xor edx, edx
mov dword [ebp - 0x266c], esi
movlpd qword [ebp - 0x2638], xmm0
movlpd qword [ebp - 0x2610], xmm0
movlpd qword [ebp - 0x26d0], xmm0
movlpd qword [ebp - 0x1ea0], xmm0
test ecx, ecx
jle 0x4ae11e
cmp ecx, 4
jb 0x4ae11e
mov eax, ecx
and eax, 0x80000003
jns 0x4adf31
dec eax
or eax, 0xfffffffc
inc eax
mov edi, dword [0x55b1ec]
sub ecx, eax
mov eax, dword [0x55b1e4]
xorps xmm3, xmm3
mov dword [ebp - 0x2598], ecx
add edi, 0x10
mov ecx, dword [0x55b1e8]
xorps xmm7, xmm7
add ecx, 0x1c
movaps xmmword [ebp - 0x1eb0], xmm3
movaps xmmword [ebp - 0x2640], xmm3
xorps xmm5, xmm5
movaps xmmword [ebp - 0x2760], xmm3
xorps xmm4, xmm4
xorps xmm6, xmm6
add eax, 0x58
nop word [eax + eax]
movd xmm0, dword [eax]
lea eax, [eax + 0xc0]
movd xmm2, dword [eax - 0xf0]
lea ecx, [ecx + 0x60]
movd xmm1, dword [ecx - 0x78]
lea edi, [edi + 0x20]
punpckldq xmm2, xmm0
add edx, 4
movd xmm0, dword [ecx - 0x60]
punpckldq xmm1, xmm0
xorps xmm0, xmm0
paddd xmm2, xmm1
movq xmm1, qword [eax - 0x100]
movhpd xmm1, qword [eax - 0xd0]
punpckldq xmm2, xmm0
paddq xmm6, xmm2
movq xmm0, qword [eax - 0xf8]
movhpd xmm0, qword [eax - 0xc8]
paddq xmm1, xmm0
movq xmm0, qword [edi - 0x30]
paddq xmm5, xmm1
movhpd xmm0, qword [edi - 0x28]
paddq xmm3, xmm0
movd xmm0, dword [eax - 0x60]
paddq xmm4, xmm1
movd xmm2, dword [eax - 0x90]
movd xmm1, dword [ecx - 0x48]
punpckldq xmm2, xmm0
movd xmm0, dword [ecx - 0x30]
punpckldq xmm1, xmm0
xorps xmm0, xmm0
paddd xmm2, xmm1
movq xmm1, qword [eax - 0x98]
movhpd xmm1, qword [eax - 0x68]
punpckldq xmm2, xmm0
movq xmm0, qword [eax - 0xa0]
movhpd xmm0, qword [eax - 0x70]
paddq xmm1, xmm0
paddq xmm2, xmmword [ebp - 0x2760]
movq xmm0, qword [edi - 0x20]
movhpd xmm0, qword [edi - 0x18]
paddq xmm7, xmm0
movaps xmmword [ebp - 0x2760], xmm2
movaps xmm2, xmm1
paddq xmm1, xmmword [ebp - 0x2640]
paddq xmm2, xmmword [ebp - 0x1eb0]
movaps xmmword [ebp - 0x1eb0], xmm2
movups xmmword [ebp - 0x2640], xmm1
cmp edx, dword [ebp - 0x2598]
jl 0x4adf80
paddq xmm6, xmmword [ebp - 0x2760]
paddq xmm4, xmm1
movaps xmm0, xmm6
paddq xmm5, xmm2
psrldq xmm0, 8
paddq xmm3, xmm7
paddq xmm6, xmm0
movaps xmm0, xmm4
psrldq xmm0, 8
paddq xmm4, xmm0
movd dword [ebp - 0x25b0], xmm6
movaps xmm0, xmm5
movd dword [ebp - 0x25ac], xmm4
psrldq xmm0, 8
paddq xmm5, xmm0
psrldq xmm6, 4
movaps xmm0, xmm3
movd dword [ebp - 0x259c], xmm5
psrldq xmm0, 8
paddq xmm3, xmm0
psrldq xmm4, 4
movd dword [ebp - 0x25d4], xmm3
psrldq xmm5, 4
psrldq xmm3, 4
movd ecx, xmm6
movd dword [ebp - 0x257c], xmm4
movd dword [ebp - 0x2584], xmm5
movd dword [ebp - 0x25a0], xmm3
jmp 0x4ae178
mov eax, dword [ebp - 0x1e9c]
mov ecx, dword [ebp - 0x26cc]
mov dword [ebp - 0x25a0], eax
mov eax, dword [ebp - 0x1ea0]
mov dword [ebp - 0x25d4], eax
mov eax, dword [ebp - 0x2634]
mov dword [ebp - 0x2584], eax
mov eax, dword [ebp - 0x2638]
mov dword [ebp - 0x259c], eax
mov eax, dword [ebp - 0x260c]
mov dword [ebp - 0x257c], eax
mov eax, dword [ebp - 0x2610]
mov dword [ebp - 0x25ac], eax
mov eax, dword [ebp - 0x26d0]
mov dword [ebp - 0x25b0], eax
mov dword [ebp - 0x25a4], ecx
cmp edx, dword [0x555f60]
jge 0x4ae228
mov edi, dword [0x55b1e4]
lea eax, [edx + edx*2]
mov esi, dword [0x55b1e8]
add edi, 0x20
shl eax, 4
add edi, eax
lea eax, [edx + edx*2]
lea esi, [esi + eax*8]
add esi, 4
nop word [eax + eax]
mov eax, dword [edi + 8]
lea esi, [esi + 0x18]
add eax, dword [esi - 0x18]
add dword [ebp - 0x25b0], eax
mov eax, dword [edi - 4]
adc ecx, 0
mov dword [ebp - 0x25a4], ecx
mov ecx, dword [edi - 8]
add ecx, dword [edi]
adc eax, dword [edi + 4]
lea edi, [edi + 0x30]
add dword [ebp - 0x259c], ecx
adc dword [ebp - 0x2584], eax
add dword [ebp - 0x25ac], ecx
mov ecx, dword [0x55b1ec]
adc dword [ebp - 0x257c], eax
mov eax, dword [ebp - 0x25d4]
add eax, dword [ecx + edx*8]
mov dword [ebp - 0x25d4], eax
mov eax, dword [ebp - 0x25a0]
adc eax, dword [ecx + edx*8 + 4]
inc edx
mov ecx, dword [ebp - 0x25a4]
mov dword [ebp - 0x25a0], eax
cmp edx, dword [0x555f60]
jl 0x4ae1b0
mov esi, dword [ebp - 0x2590]
mov eax, dword [0x555ecc]
mov edi, dword [ebp - 0x25a4]
mov ecx, edi
mov dword [ebp - 0x2598], eax
mov eax, dword [ebp - 0x25b0]
sub eax, dword [esi + 0x550]
sbb ecx, dword [esi + 0x554]
js 0x4ae255
jg 0x4ae26c
test eax, eax
jne 0x4ae26c
xorps xmm0, xmm0
movlpd qword [ebp - 0x1ea0], xmm0
mov ecx, dword [ebp - 0x1e9c]
mov eax, dword [ebp - 0x1ea0]
cmp eax, dword [esi + 0x548]
jne 0x4ae280
cmp ecx, dword [esi + 0x54c]
jne 0x4ae280
xor edx, edx
jmp 0x4ae285
mov edx, 1
mov dword [esi + 0x548], eax
mov dword [esi + 0x54c], ecx
push dword [ebp - 0x2688]
push 0x444
push dword [ebp - 0x2598]
push edx
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
mov eax, dword [ebp - 0x25b0]
mov edx, dword [0x555ecc]
cmp eax, dword [esi + 0x550]
jne 0x4ae2d1
cmp edi, dword [esi + 0x554]
jne 0x4ae2d1
xor ecx, ecx
jmp 0x4ae2d6
mov ecx, 1
mov dword [esi + 0x550], eax
mov dword [esi + 0x554], edi
push dword [ebp - 0x2688]
push 0x443
push edx
push ecx
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
mov eax, dword [0x555ecc]
mov ecx, dword [ebp - 0x25d4]
sub ecx, dword [esi + 0x560]
mov edi, dword [ebp - 0x25a0]
mov dword [ebp - 0x2598], eax
mov eax, edi
sbb eax, dword [esi + 0x564]
cmp ecx, dword [esi + 0x558]
jne 0x4ae336
cmp eax, dword [esi + 0x55c]
jne 0x4ae336
xor edx, edx
jmp 0x4ae33b
mov edx, 1
mov dword [esi + 0x558], ecx
mov dword [esi + 0x55c], eax
push dword [ebp - 0x2688]
push 0x4b0
push dword [ebp - 0x2598]
push edx
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
mov eax, dword [ebp - 0x25d4]
mov edx, dword [0x555ecc]
cmp eax, dword [esi + 0x560]
jne 0x4ae387
cmp edi, dword [esi + 0x564]
jne 0x4ae387
xor ecx, ecx
jmp 0x4ae38c
mov ecx, 1
mov dword [esi + 0x560], eax
mov dword [esi + 0x564], edi
push dword [ebp - 0x2688]
push 0x4ab
push edx
push ecx
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
mov ecx, dword [ebp - 0x25d8]
mov eax, ecx
mov edx, dword [ebp - 0x25b8]
or eax, edx
jne 0x4ae40c
mov eax, dword [ebp - 0x25ac]
add dword [ebp - 0x25dc], eax
mov edi, dword [ebp - 0x25c4]
movsd xmm1, qword [ebp - 0x25d0]
mov ecx, dword [ebp - 0x257c]
movaps xmm0, xmm1
adc edi, ecx
movsd qword [ebp - 0x1ea0], xmm1
mov dword [esi + 0x540], eax
movaps xmm2, xmm1
mov dword [esi + 0x544], ecx
mov dword [ebp - 0x25c4], edi
jmp 0x4ae4ed
call fcn.004c3cd0
mov ecx, dword [ebp - 0x259c]
sub ecx, dword [esi + 0x538]
mov eax, dword [ebp - 0x2584]
sbb eax, dword [esi + 0x53c]
push 0
push 0x64
push eax
push ecx
movsd qword [ebp - 0x2638], xmm0
call fcn.004c4060
mov ecx, eax
call fcn.004c3cd0
divsd xmm0, qword [ebp - 0x2638]
mov ecx, dword [esi + 0x544]
mov edi, dword [ebp - 0x25ac]
mov edx, dword [ebp - 0x257c]
mov eax, dword [esi + 0x540]
mov dword [esi + 0x544], edx
mov edx, edi
sub edx, eax
mov eax, dword [ebp - 0x257c]
push 0
sbb eax, ecx
add dword [ebp - 0x25dc], edi
mov ecx, dword [ebp - 0x25c4]
adc ecx, dword [ebp - 0x257c]
push 0x64
push eax
push edx
mov dword [esi + 0x540], edi
mov dword [ebp - 0x25c4], ecx
movsd xmm1, qword [ebp - 0x25d0]
maxsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x25f8]
minsd xmm0, xmm1
movsd qword [ebp - 0x1ea0], xmm0
call fcn.004c4060
mov ecx, eax
call fcn.004c3cd0
divsd xmm0, qword [ebp - 0x2638]
movsd xmm1, qword [ebp - 0x25d0]
movsd xmm2, qword [ebp - 0x25f8]
maxsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x1ea0]
minsd xmm2, xmm1
push 0
sub esp, 0x10
movsd qword [esp + 8], xmm2
movsd qword [esp], xmm0
push dword [0x556aec]
push dword [0x556ae8]
push dword [esi + 0x56c]
call fcn.004596e0
movsd xmm0, qword [ebp - 0x25d0]
add esp, 0x20
unpcklpd xmm0, xmm0
push 0
sub esp, 0x10
movups xmmword [esp], xmm0
push dword [0x556aec]
push dword [0x556ae8]
push dword [esi + 0x398]
call fcn.004596e0
mov eax, dword [esi + 0x438]
add esp, 0x20
test eax, eax
je 0x4ae57a
movsd xmm0, qword [ebp - 0x25d0]
push 0
sub esp, 0x10
unpcklpd xmm0, xmm0
movups xmmword [esp], xmm0
push dword [0x556aec]
push dword [0x556ae8]
push eax
call fcn.004596e0
add esp, 0x20
test byte [esi + 0xd0], 0x40
movsd xmm1, qword [ebp - 0x1ea0]
je 0x4ae59e
movaps xmm0, xmm1
addsd xmm0, qword [ebp - 0x25f0]
movsd qword [ebp - 0x25f0], xmm0
mov eax, dword [ebp - 0x25bc]
cmp dword [eax], 0
je 0x4ae5bc
movaps xmm0, xmm1
addsd xmm0, qword [ebp - 0x26a0]
movsd qword [ebp - 0x26a0], xmm0
comisd xmm1, xmmword [ebp - 0x2628]
jbe 0x4ae5d4
movsd qword [ebp - 0x2628], xmm1
mov dword [ebp - 0x262c], esi
mov ecx, dword [ebp - 0x259c]
mov edi, dword [0x555ecc]
mov eax, dword [ebp - 0x2584]
cmp ecx, dword [esi + 0x538]
jne 0x4ae5fa
cmp eax, dword [esi + 0x53c]
jne 0x4ae5fa
xor edx, edx
jmp 0x4ae5ff
mov edx, 1
mov dword [esi + 0x538], ecx
mov dword [esi + 0x53c], eax
push dword [ebp - 0x2688]
push 0x43f
push edi
push edx
call fcn.00473c50
or byte [ebp - 0x2574], al
mov eax, dword [ebp - 0x266c]
mov dword [eax + 0xc], 0
push dword [ebp - 0x2688]
push 0x4a7
push dword [0x555ecc]
push 1
call fcn.00473c50
push dword [ebp - 0x2688]
mov ecx, dword [ebp - 0x2574]
test al, al
push 0x4a9
push dword [0x555ecc]
movzx ecx, cl
mov edi, 1
cmovne ecx, edi
push edi
mov dword [ebp - 0x2598], ecx
call fcn.00473c50
push dword [ebp - 0x2688]
mov ecx, dword [ebp - 0x2598]
test al, al
push 0x532
push dword [0x555ecc]
movzx ecx, cl
cmovne ecx, edi
push edi
mov dword [ebp - 0x2598], ecx
call fcn.00473c50
mov ecx, dword [ebp - 0x2598]
add esp, 0x40
movsd xmm0, qword [ebp - 0x1ea0]
test al, al
movzx ecx, cl
cmovne ecx, edi
ucomisd xmm0, qword [esi + 0x520]
mov byte [ebp - 0x2574], cl
mov ecx, dword [0x555ecc]
lahf
test ah, 0x44
jnp 0x4ae6da
mov eax, edi
jmp 0x4ae6dc
xor eax, eax
movsd qword [esi + 0x520], xmm0
push dword [ebp - 0x2688]
push 0x41f
push ecx
push eax
call fcn.00473c50
movsd xmm0, qword [ebp - 0x1ea0]
addsd xmm0, qword [esi + 0x530]
movsd qword [esi + 0x530], xmm0
push dword [ebp - 0x2688]
push 0x665
push dword [0x555ecc]
push 1
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x20
lea eax, [esi + 0xf8]
mov dword [ebp - 0x2598], eax
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4ae797
mov esi, dword [ebp - 0x2598]
mov edi, esi
nop dword [eax]
movsd xmm0, qword [ebp - 0x1ea0]
movsd qword [eax + 0x530], xmm0
mov eax, dword [esi]
push dword [eax + 0xd4]
push 0x665
push dword [0x555ecc]
push 1
call fcn.00473c50
mov edi, dword [edi]
add esp, 0x10
or byte [ebp - 0x2574], al
add edi, 0xf8
mov eax, dword [edi]
test eax, eax
jne 0x4ae750
mov esi, dword [ebp - 0x2590]
mov eax, dword [ebp - 0x2604]
dec eax
mov byte [ebp - 0x2575], 1
dec dword [ebp - 0x2688]
jmp 0x4ae802
lea eax, [ebp - 0x2575]
mov dword [ebp - 0x266c], esi
push eax
push esi
lea eax, [ebp - 0x268c]
mov dword [ebp - 0x2688], 0xffffffff
push eax
push dword [ebp - 0x25b4]
call fcn.004a7650
mov ecx, dword [ebp - 0x2574]
add esp, 0x10
test al, al
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov byte [ebp - 0x2574], cl
cmp byte [ebp - 0x2575], 0
je 0x4ae81b
mov eax, dword [ebp - 0x2604]
mov ecx, dword [ebp - 0x2614]
inc eax
mov dword [ebp - 0x2604], eax
mov dword [esi + 0x5bc], ecx
mov dword [ebp - 0x2614], esi
mov eax, dword [ebp - 0x2644]
mov esi, eax
mov edx, dword [ebp - 0x26e8]
mov dword [ebp - 0x2590], eax
test eax, eax
jne 0x4add80
mov ecx, dword [ebp - 0x25c4]
mov edx, dword [ebp - 0x25dc]
jmp 0x4ae85d
mov ecx, dword [ebp - 0x2634]
mov edx, dword [ebp - 0x2638]
mov dword [ebp - 0x25c4], ecx
mov dword [ebp - 0x25dc], edx
mov eax, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x2590], eax
mov eax, dword [sym.imp.USER32.dll_GetMenu]
mov dword [ebp - 0x26e0], eax
mov eax, dword [sym.imp.USER32.dll_IsHungAppWindow]
mov dword [ebp - 0x26f8], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2598], eax
mov eax, dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 0x25bc], eax
mov eax, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov dword [ebp - 0x272c], eax
mov eax, dword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
mov dword [ebp - 0x264c], eax
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x26b8], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x26b4], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x26a8], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x26d4], eax
mov eax, dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x55b1d4]
mov dword [ebp - 0x26f4], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x26f0], eax
mov eax, dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x25b0], eax
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x2730], eax
mov eax, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [ebp - 0x2644], eax
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x273c], eax
mov eax, dword [ebp - 0x270c]
mov dword [ebp - 0x25ac], eax
mov eax, dword [ebp - 0x2710]
mov dword [ebp - 0x259c], eax
mov eax, dword [ebp - 0x26fc]
mov dword [ebp - 0x25d4], eax
mov eax, dword [ebp - 0x2700]
mov dword [ebp - 0x25e4], eax
mov eax, dword [ebp - 0x2704]
mov dword [ebp - 0x25a4], eax
mov eax, dword [ebp - 0x2708]
mov dword [ebp - 0x2584], esi
mov dword [ebp - 0x25a0], eax
nop dword [eax]
inc dword [ebp - 0x1f30]
mov eax, dword [esi + 4]
add dword [ebp - 0x1f28], eax
mov eax, dword [esi + 0x4c]
add dword [ebp - 0x1f20], eax
cmp dword [esi + 0x44], 0
je 0x4ae9a0
add edx, dword [esi + 0x30]
mov dword [ebp - 0x25dc], edx
adc ecx, dword [esi + 0x34]
mov dword [ebp - 0x25c4], ecx
mov edi, dword [0x550f44]
xor eax, eax
mov dword [ebp - 0x258c], eax
mov dword [ebp - 0x26b0], edi
test edi, edi
je 0x4afc8a
nop dword [eax]
mov eax, dword [edi + 0x318]
cmp eax, dword [esi + 0x20]
jne 0x4aea38
mov eax, dword [edi + 0x31c]
cmp eax, dword [esi + 0x24]
jne 0x4aea38
mov eax, dword [edi + 0x24]
cmp eax, dword [esi + 0x44]
jne 0x4aea38
lea eax, [ebp - 0x2728]
mov dword [ebp - 0x2728], 1
push eax
push 0xffffffffffffffff
push 0x1053
push dword [ebp - 0x25b4]
mov dword [ebp - 0x2720], edi
call dword [ebp - 0x25e0]
cmp byte [ebp - 0x2585], 0
mov dword [ebp - 0x2688], eax
mov dword [ebp - 0x258c], 1
je 0x4aea89
lea eax, [ebp - 0x250]
push eax
push dword [edi + 0xe4]
call dword [ebp - 0x26e8]
test eax, eax
jne 0x4aea83
mov eax, dword [edi + 0x5c0]
mov edi, eax
mov dword [ebp - 0x26b0], eax
test eax, eax
jne 0x4ae9c0
mov dword [ebp - 0x26b0], eax
cmp dword [ebp - 0x258c], eax
je 0x4afc8a
mov eax, dword [esi]
test eax, eax
je 0x4b0beb
mov ecx, dword [ebp - 0x25c4]
add esi, eax
mov edx, dword [ebp - 0x25dc]
mov dword [ebp - 0x2584], esi
jmp 0x4ae970
mov eax, dword [ebp - 0x2688]
mov ecx, dword [edi + 0xd0]
test cl, 2
je 0x4aeaf9
cmp eax, 0xffffffff
jne 0x4aeaf9
test cl, 8
jne 0x4aeaf9
lea eax, [ebp - 0x250]
push eax
push edi
push dword [0x555ecc]
call fcn.0046c4d0
mov eax, dword [ebp - 0x26e4]
add esp, 0xc
cmp dword [edi + 0x24], eax
jne 0x4aeb0e
lea eax, [ebp - 0x1f0c]
mov dword [ebp - 0x1efc], 3
push eax
push dword [edi + 0xd4]
mov dword [ebp - 0x1f00], 3
push 0x102b
push dword [ebp - 0x25b4]
call dword [ebp - 0x25e0]
mov dword [ebp - 0x2630], edi
jmp 0x4aeb0e
mov dword [edi + 0xd4], eax
test cl, 8
je 0x4aeb0e
mov dword [edi + 0x5c8], 0
mov eax, dword [esi + 0x44]
push eax
push 0
push 0x2000000
mov dword [ebp - 0x2744], eax
call dword [ebp - 0x26b8]
mov dword [ebp - 0x257c], eax
mov dword [ebp - 0x26c0], eax
test eax, eax
jne 0x4aeb78
call dword [ebp - 0x26b4]
cmp eax, 5
jne 0x4aeb6c
push 0
lea eax, [ebp - 0x26c8]
push eax
push 4
lea eax, [ebp - 0x26c0]
push eax
push 4
lea eax, [ebp - 0x2744]
push eax
push 0x8335003c
push dword [0x53b5e4]
call dword [ebp - 0x26a8]
mov eax, dword [ebp - 0x26c0]
mov dword [ebp - 0x257c], eax
push dword [ebp - 0x2688]
push edi
push dword [0x556aec]
push dword [0x556ae8]
push dword [ebp - 0x25b8]
push dword [ebp - 0x25d8]
push eax
push esi
call fcn.004a0480
or byte [ebp - 0x2574], al
add esp, 0x20
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x25a8], eax
mov dword [ebp - 0x261c], ecx
adc ecx, dword [esi + 0x2c]
sub eax, dword [edi + 0x538]
mov dword [ebp - 0x2594], eax
mov eax, ecx
sbb eax, dword [edi + 0x53c]
cmp dword [0x567874], 0
mov dword [ebp - 0x258c], ecx
mov dword [ebp - 0x2694], eax
jne 0x4aec47
cmp dword [edi + 0x24], 0
jne 0x4aec47
mov edx, dword [ebp - 0x25b8]
mov ecx, dword [ebp - 0x25d8]
mov dword [ebp - 0x2618], edi
call fcn.004c3cd0
mov eax, dword [ebp - 0x25d8]
or eax, dword [ebp - 0x25b8]
movsd qword [ebp - 0x2698], xmm0
movsd xmm0, qword [ebp - 0x1ea0]
movsd qword [ebp - 0x1ea0], xmm0
movsd qword [ebp - 0x1ea0], xmm0
jne 0x4aecce
movsd xmm3, qword [ebp - 0x25d0]
movaps xmm2, xmm3
jmp 0x4aed18
mov ecx, dword [ebp - 0x25d8]
mov eax, ecx
mov edx, dword [ebp - 0x25b8]
or eax, edx
jne 0x4aec71
movsd xmm3, qword [ebp - 0x25d0]
movsd qword [ebp - 0x1ea0], xmm3
movaps xmm2, xmm3
jmp 0x4aed18
call fcn.004c3cd0
push 0
push 0x64
push dword [ebp - 0x2694]
movsd qword [ebp - 0x1ea0], xmm0
push dword [ebp - 0x2594]
call fcn.004c4060
mov ecx, eax
call fcn.004c3cd0
movsd xmm2, qword [ebp - 0x1ea0]
divsd xmm0, xmm2
movsd xmm1, qword [ebp - 0x25d0]
maxsd xmm1, xmm0
movsd qword [ebp - 0x2698], xmm2
movsd xmm0, qword [ebp - 0x25f8]
minsd xmm0, xmm1
movsd qword [ebp - 0x1ea0], xmm0
mov ecx, dword [esi + 0x30]
sub ecx, dword [edi + 0x540]
mov eax, dword [ebp - 0x261c]
sbb eax, dword [edi + 0x544]
push 0
push 0x64
push eax
push ecx
call fcn.004c4060
mov ecx, eax
call fcn.004c3cd0
divsd xmm0, qword [ebp - 0x2698]
movsd xmm3, qword [ebp - 0x25d0]
movsd xmm2, qword [ebp - 0x25f8]
movaps xmm1, xmm3
maxsd xmm1, xmm0
minsd xmm2, xmm1
mov eax, dword [esi + 0x30]
movsd xmm0, qword [edi + 0x578]
comisd xmm0, xmmword [ebp - 0x2750]
mov dword [edi + 0x540], eax
mov eax, dword [ebp - 0x261c]
mov dword [edi + 0x544], eax
jbe 0x4aed54
cvtpd2ps xmm0, xmm0
mov dword [ebp - 0x26ec], edi
cvtps2pd xmm0, xmm0
movsd qword [ebp - 0x2750], xmm0
test byte [edi + 0xd0], 0x40
movsd xmm1, qword [ebp - 0x1ea0]
je 0x4aed78
movaps xmm0, xmm1
addsd xmm0, qword [ebp - 0x25f0]
movsd qword [ebp - 0x25f0], xmm0
cmp dword [edi + 0x24], 0
unpcklpd xmm1, xmm1
push 0
je 0x4aedf2
mov eax, dword [esi + 0x28]
or eax, dword [esi + 0x2c]
jne 0x4aed95
sub esp, 0x10
movups xmmword [esp], xmm1
jmp 0x4aeda3
sub esp, 0x10
movsd qword [esp + 8], xmm2
movsd qword [esp], xmm1
push dword [0x556aec]
push dword [0x556ae8]
push dword [edi + 0x56c]
call fcn.004596e0
movsd xmm1, qword [ebp - 0x1ea0]
add esp, 0x20
comisd xmm1, xmmword [ebp - 0x2628]
movaps xmm0, xmm1
addsd xmm0, qword [ebp - 0x26a0]
movsd qword [ebp - 0x26a0], xmm0
jbe 0x4aee22
movsd qword [ebp - 0x2628], xmm1
mov dword [ebp - 0x262c], edi
jmp 0x4aee22
sub esp, 0x10
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm3
push dword [0x556aec]
push dword [0x556ae8]
push dword [edi + 0x56c]
call fcn.004596e0
movsd xmm1, qword [ebp - 0x1ea0]
add esp, 0x20
ucomisd xmm1, qword [edi + 0x520]
movsd qword [edi + 0x520], xmm1
push dword [ebp - 0x2688]
lahf
xor ecx, ecx
test ah, 0x44
push 0x41f
push dword [0x555ecc]
mov eax, 1
cmovp ecx, eax
push ecx
call fcn.00473c50
movsd xmm0, qword [edi + 0x530]
or byte [ebp - 0x2574], al
movaps xmm1, xmm0
addsd xmm1, qword [ebp - 0x1ea0]
ucomisd xmm1, xmm0
movsd qword [edi + 0x530], xmm1
push dword [ebp - 0x2688]
lahf
xor ecx, ecx
test ah, 0x44
push 0x665
push dword [0x555ecc]
mov eax, 1
cmovp ecx, eax
push eax
mov dword [ebp - 0x2694], ecx
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x20
lea eax, [edi + 0xf8]
mov dword [ebp - 0x2594], eax
mov eax, dword [eax]
test eax, eax
je 0x4aef26
mov esi, dword [ebp - 0x2594]
nop dword [eax + eax]
movsd xmm0, qword [eax + 0x530]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
addsd xmm0, qword [ebp - 0x1ea0]
movsd qword [eax + 0x530], xmm0
mov eax, dword [esi]
push dword [eax + 0xd4]
push 0x665
push dword [0x555ecc]
push 1
call fcn.00473c50
mov esi, dword [esi]
add esp, 0x10
or byte [ebp - 0x2574], al
add esi, 0xf8
mov eax, dword [esi]
test eax, eax
jne 0x4aeed0
mov esi, dword [ebp - 0x2584]
push dword [ebp - 0x2688]
push 0x4a7
push dword [0x555ecc]
push dword [ebp - 0x2694]
call fcn.00473c50
or byte [ebp - 0x2574], al
dec dword [ebp - 0x2604]
push edi
push dword [ebp - 0x257c]
call fcn.00491030
add esp, 0x18
test al, al
je 0x4aef7f
push 0xffffffffffffffff
push dword [ebp - 0x2688]
push 0x7eb
push dword [0x555ec8]
call dword [ebp - 0x2590]
call fcn.004752a0
mov ecx, dword [edi + 0xd0]
xor edx, edx
mov eax, ecx
shr eax, 7
mov dword [ebp - 0x2694], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x2594], eax
test eax, eax
je 0x4aefb9
add esi, 0xf0
cmp dword [esi - 4], 5
jne 0x4aefb1
cmp dword [esi], 5
jne 0x4aefb1
inc edx
add esi, 0x40
sub eax, 1
jne 0x4aefa5
mov eax, ecx
and ecx, 0xffffff7f
or eax, 0x80
cmp dword [ebp - 0x2594], edx
cmove ecx, eax
mov dword [edi + 0xd0], ecx
shr ecx, 7
xor ecx, dword [ebp - 0x2694]
test cl, 1
je 0x4af001
push 0xffffffffffffffff
push dword [ebp - 0x2688]
push 0x7eb
push dword [0x555ec8]
call dword [ebp - 0x2590]
call fcn.004752a0
mov ecx, dword [edi + 0x33c]
lea eax, [edi + 0x33c]
mov dword [ebp - 0x2594], ecx
test ecx, ecx
je 0x4af021
cmp word [ecx], 0
jne 0x4af194
cmp byte [edi + 0x335], 2
jae 0x4af194
lea ecx, [edi + 0x344]
xorps xmm0, xmm0
lea esi, [edi + 0x340]
movups xmmword [ebp - 0x1ef0], xmm0
movups xmmword [ebp - 0x1ee0], xmm0
test eax, eax
je 0x4af055
mov dword [eax], 0
test esi, esi
je 0x4af05f
mov dword [esi], 0
test ecx, ecx
je 0x4af069
mov dword [ecx], 0
mov eax, dword [ebp - 0x257c]
test eax, eax
je 0x4af14f
lea ecx, [ebp - 0x2740]
mov dword [ebp - 0x1ef0], 0x20
push ecx
push 0x20
lea ecx, [ebp - 0x1ef0]
push ecx
push 0
push eax
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
je 0x4af0c2
lea eax, [ebp - 0x2740]
push eax
push 0x18
lea eax, [ebp - 0x1eec]
push eax
push 0
push dword [ebp - 0x257c]
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jne 0x4af14f
mov edx, dword [ebp - 0x1ee8]
test edx, edx
je 0x4af0ea
lea eax, [edi + 0x344]
push eax
push esi
lea ecx, [edi + 0x33c]
push ecx
push edx
push dword [ebp - 0x257c]
call fcn.0048f6f0
add esp, 0x14
test esi, esi
je 0x4af10a
cmp dword [esi], 0
jne 0x4af101
push 0x4fbd20
call fcn.004c8c20
mov dword [esi], eax
jmp 0x4af107
push esi
call fcn.00490690
add esp, 4
lea eax, [edi + 0x33c]
test eax, eax
je 0x4af12c
cmp dword [eax], 0
jne 0x4af12c
push 0x4fbd20
call fcn.004c8c20
add esp, 4
mov dword [edi + 0x33c], eax
lea esi, [edi + 0x344]
test esi, esi
je 0x4af14f
cmp dword [esi], 0
jne 0x4af14f
push 0x5018bc
call fcn.004c8c20
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 0x2594]
call fcn.004c8c7f
inc byte [edi + 0x335]
add esp, 4
mov eax, dword [edi + 0x33c]
test eax, eax
je 0x4af194
cmp word [eax], 0
je 0x4af194
push dword [ebp - 0x2688]
push 0x408
push dword [0x555ecc]
push 1
call fcn.00473c50
add esp, 0x10
or byte [ebp - 0x2574], al
mov al, byte [edi + 0x334]
cmp al, 2
jb 0x4af1a6
cmp byte [ebx + 0xc], 0
je 0x4af1e7
jmp 0x4af1b4
cmp byte [ebx + 0xc], 0
jne 0x4af1b4
inc al
mov byte [edi + 0x334], al
push 0
push 0
push dword [edi + 0x24]
push dword [ebp - 0x257c]
call fcn.004a0020
mov ecx, dword [edi + 0xd0]
add esp, 0x10
test al, al
je 0x4af1db
or ecx, 0x800
jmp 0x4af1e1
and ecx, 0xfffff7ff
mov dword [edi + 0xd0], ecx
mov ecx, dword [ebp - 0x257c]
test ecx, ecx
je 0x4af26c
mov eax, dword [edi + 0x324]
push ecx
push edi
mov dword [ebp - 0x2738], eax
call fcn.004902e0
lea ecx, [ebp - 0x2738]
mov dword [edi + 0x324], eax
add esp, 8
cmp eax, dword [ecx]
je 0x4af23c
cmp al, byte [ecx]
jne 0x4af240
mov al, byte [edi + 0x325]
cmp al, byte [ecx + 1]
jne 0x4af240
mov al, byte [edi + 0x326]
cmp al, byte [ecx + 2]
jne 0x4af240
mov al, byte [edi + 0x327]
cmp al, byte [ecx + 3]
jne 0x4af240
xor ecx, ecx
jmp 0x4af245
sbb ecx, ecx
or ecx, 1
push dword [ebp - 0x2688]
xor eax, eax
test ecx, ecx
push 0x4af
push dword [0x555ecc]
sete al
push eax
call fcn.00473c50
add esp, 0x10
or byte [ebp - 0x2574], al
cmp dword [edi + 0x514], 0
jne 0x4af2fb
mov al, byte [edi + 0x510]
cmp al, 2
jb 0x4af28b
cmp byte [ebx + 0xc], 0
je 0x4af2f2
jmp 0x4af299
cmp byte [ebx + 0xc], 0
jne 0x4af299
inc al
mov byte [edi + 0x510], al
push dword [edi + 0x24]
call fcn.0047e1e0
push edi
mov dword [edi + 0x514], eax
call fcn.00458f80
add esp, 8
mov byte [edi + 0x518], al
cmp dword [edi + 0x514], 0
je 0x4af301
cmp byte [ebp - 0x257d], 0
jne 0x4af2d4
call fcn.0047ed80
mov byte [ebp - 0x257d], 1
push 0xffffffffffffffff
push dword [ebp - 0x2688]
push 0x7eb
push dword [0x555ec8]
call dword [ebp - 0x2590]
call fcn.004752a0
cmp dword [edi + 0x514], 0
je 0x4af301
inc dword [ebp - 0x1f18]
mov ecx, dword [ebp - 0x2584]
mov eax, dword [0x555ecc]
mov esi, dword [edi + 0x568]
mov ecx, dword [ecx + 0x40]
mov dword [edi + 0x568], ecx
push dword [ebp - 0x2688]
push 5
push eax
xor eax, eax
cmp ecx, esi
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
cmp dword [edi + 0x568], esi
je case.0x4af3c2.16
mov eax, dword [ebp - 0x266c]
mov esi, dword [eax + 0x568]
cmp esi, 4
jne 0x4af3a8
cmp dword [eax + 0x3c8], 0
jne 0x4af3a8
push dword [0x555ec8]
call dword [ebp - 0x26e0]
mov ecx, eax
push 0
push 0x9cbc
push 0x9cc1
push 0x9cbb
push ecx
call dword [ebp - 0x25b0]
mov esi, dword [ebp - 0x25a8]
mov ecx, dword [0x555ecc]
mov edx, dword [ebp - 0x258c]
cmp esi, dword [edi + 0x538]
jne 0x4af405
cmp edx, dword [edi + 0x53c]
jne 0x4af405
xor eax, eax
jmp 0x4af40a
push dword [0x555ec8]
call dword [ebp - 0x26e0]
mov ecx, eax
cmp esi, 0x18
ja case.0x4af3c2.16
movzx eax, byte [esi + 0x4b18c4]
jmp dword [eax*4 + 0x4b18a4]
push 0
push 0x9cc1
jmp 0x4af371
push 0
push 0x9cc0
jmp 0x4af371
push 0
push 0x9cbf
jmp 0x4af371
push 0
push 0x9cbe
jmp 0x4af371
push 0
push 0x9cbd
jmp 0x4af371
push 0
push 0x9cbb
jmp 0x4af371
mov eax, 1
mov dword [edi + 0x538], esi
mov dword [edi + 0x53c], edx
push dword [ebp - 0x2688]
push 0x43f
push ecx
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
mov eax, dword [0x56787c]
test eax, eax
je 0x4af482
lea ecx, [ebp - 0x2734]
push ecx
push dword [ebp - 0x257c]
call eax
mov eax, dword [0x555ecc]
mov edx, dword [edi + 0x32c]
mov ecx, dword [ebp - 0x2734]
mov dword [edi + 0x32c], ecx
push dword [ebp - 0x2688]
push 0x683
push eax
xor eax, eax
cmp ecx, edx
setne al
push eax
call fcn.00473c50
add esp, 0x10
or byte [ebp - 0x2574], al
mov esi, dword [ebp - 0x2584]
mov eax, dword [0x555ecc]
mov ecx, dword [edi + 0x100]
mov edx, dword [esi + 0x4c]
mov dword [edi + 0x100], edx
push dword [ebp - 0x2688]
push 0x12
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
mov edx, dword [esi + 0x60]
mov eax, dword [0x555ecc]
sub edx, dword [edi + 0x37c]
mov ecx, dword [edi + 0x380]
mov dword [edi + 0x380], edx
push dword [ebp - 0x2688]
push 0x49b
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
mov eax, dword [0x555ecc]
mov edx, dword [esi + 0x60]
mov ecx, dword [edi + 0x37c]
mov dword [edi + 0x37c], edx
push dword [ebp - 0x2688]
push 0x423
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
mov eax, dword [0x555ecc]
mov edx, dword [esi + 0x68]
mov ecx, dword [edi + 0x390]
mov dword [edi + 0x390], edx
push dword [ebp - 0x2688]
push 0x427
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x40
mov eax, dword [0x555ecc]
mov edx, dword [esi + 0x64]
mov ecx, dword [edi + 0x394]
mov dword [edi + 0x394], edx
push dword [ebp - 0x2688]
push 0x428
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
mov eax, dword [0x555ecc]
mov edx, dword [esi + 0x70]
mov ecx, dword [edi + 0x3a8]
mov dword [edi + 0x3a8], edx
push dword [ebp - 0x2688]
push 9
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
mov eax, dword [0x555ecc]
mov edx, dword [esi + 0x78]
mov ecx, dword [edi + 0x3ac]
mov dword [edi + 0x3ac], edx
push dword [ebp - 0x2688]
push 0xa
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
mov eax, dword [0x555ecc]
mov edx, dword [esi + 0x80]
mov ecx, dword [edi + 0x38c]
mov dword [edi + 0x38c], edx
push dword [ebp - 0x2688]
push 0x426
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x40
mov edx, dword [esi + 0x7c]
sub edx, dword [edi + 0x384]
mov eax, dword [0x555ecc]
mov ecx, dword [edi + 0x388]
mov dword [edi + 0x388], edx
push dword [ebp - 0x2688]
push 0x4a8
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
mov edx, dword [esi + 0x7c]
xor eax, eax
cmp eax, dword [ebp - 0x25a4]
jb 0x4af685
ja 0x4af679
cmp edx, dword [ebp - 0x25a0]
jbe 0x4af685
mov dword [ebp - 0x25a0], edx
mov dword [ebp - 0x25a4], eax
mov eax, dword [edi + 0x384]
xor ecx, ecx
mov dword [edi + 0x384], edx
cmp edx, eax
push dword [ebp - 0x2688]
setne cl
push 0x424
push dword [0x555ecc]
mov dword [ebp - 0x25a8], ecx
push ecx
call fcn.00473c50
push dword [ebp - 0x2688]
or byte [ebp - 0x2574], al
push 0x4a9
push dword [0x555ecc]
push dword [ebp - 0x25a8]
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x20
mov edx, dword [edi + 0x398]
test edx, edx
je 0x4af738
mov ecx, dword [edi + 0x38c]
shr ecx, 0xa
mov eax, ecx
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x504470]
comisd xmm0, xmmword [edx + 0x30]
jb 0x4af738
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x504470]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x50d438]
cvtps2pd xmm0, xmm0
movsd qword [edx + 0x30], xmm0
mov eax, dword [edi + 0x384]
movsd xmm0, qword [ebp - 0x25d0]
push 0
sub esp, 0x10
movsd qword [esp + 8], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x504470]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x50f108]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [0x556aec]
push dword [0x556ae8]
push dword [edi + 0x398]
call fcn.004596e0
mov eax, dword [0x555ecc]
mov edx, dword [esi + 0x5c]
mov ecx, dword [edi + 0x378]
mov dword [edi + 0x378], edx
push dword [ebp - 0x2688]
push 0x45a
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x30
mov ecx, dword [0x5512fc]
xor eax, eax
test ecx, ecx
jle 0x4af9a0
cmp dword [eax*4 + 0x5513c0], 0x23
je 0x4af807
inc eax
cmp eax, ecx
jl 0x4af7d6
xor eax, eax
nop word [eax + eax]
cmp dword [eax*4 + 0x5513c0], 0x4ac
je 0x4af807
inc eax
cmp eax, ecx
jl 0x4af7f0
jmp 0x4af9a0
mov eax, dword [esi + 0x44]
push 0x4fbd20
mov dword [ebp - 0x25a8], eax
lea eax, [ebp - 0x450]
push 0x100
push eax
call fcn.004c905a
add esp, 0xc
mov dword [0x556ab0], 0
call dword [ebp - 0x26d4]
mov ecx, dword [ebp - 0x25a8]
cmp ecx, eax
je 0x4af86d
push ecx
lea eax, [ebp - 0x450]
mov byte [0x556aac], 0
push 0x4a7330
mov dword [0x556aa4], eax
mov dword [0x556aa8], 0x100
call dword [ebp - 0x26f4]
jmp 0x4af889
mov eax, dword [0x555ec8]
push 0x100
push dword [0x556aa4]
mov dword [0x556ab0], eax
push eax
call dword [ebp - 0x26f0]
mov al, byte [edi + 0x310]
mov ecx, dword [0x5512fc]
mov edx, dword [0x556ab0]
mov byte [ebp - 0x2575], al
xor eax, eax
mov dword [ebp - 0x25a8], edx
test ecx, ecx
jle 0x4af8d5
nop dword [eax]
cmp dword [eax*4 + 0x5513c0], 0x4ac
je 0x4af8c4
inc eax
cmp eax, ecx
jl 0x4af8b0
jmp 0x4af8d5
test edx, edx
je 0x4af8d5
push edx
call dword [ebp - 0x26f8]
mov byte [ebp - 0x2575], al
lea edx, [edi + 0x10c]
lea ecx, [ebp - 0x450]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4af907
test ax, ax
je 0x4af903
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4af907
add ecx, 4
add edx, 4
test ax, ax
jne 0x4af8e1
xor eax, eax
jmp 0x4af90c
sbb eax, eax
or eax, 1
test eax, eax
mov al, byte [ebp - 0x2575]
jne 0x4af928
mov dword [ebp - 0x2584], 0
cmp al, byte [edi + 0x310]
je 0x4af932
mov dword [ebp - 0x2584], 1
mov byte [edi + 0x310], al
lea eax, [ebp - 0x450]
push eax
lea eax, [edi + 0x10c]
push 0x100
push eax
call fcn.004c905a
mov eax, dword [ebp - 0x25a8]
mov dword [edi + 0x30c], eax
push dword [ebp - 0x2688]
push 0x23
push dword [0x555ecc]
push dword [ebp - 0x2584]
call fcn.00473c50
push dword [ebp - 0x2688]
or byte [ebp - 0x2574], al
push 0x4ac
push dword [0x555ecc]
push dword [ebp - 0x2584]
call fcn.00473c50
add esp, 0x2c
or byte [ebp - 0x2574], al
mov eax, dword [0x555ecc]
mov edx, dword [esi + 4]
mov ecx, dword [edi + 0x104]
mov dword [edi + 0x104], edx
push dword [ebp - 0x2688]
push 0x429
push eax
xor eax, eax
cmp edx, ecx
setne al
push eax
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
cmp dword [edi + 0x438], 0
je 0x4afa65
mov eax, dword [edi + 0x428]
add eax, dword [edi + 0x408]
mov ecx, dword [edi + 0x42c]
adc ecx, dword [edi + 0x40c]
add eax, dword [edi + 0x3e8]
mov dword [ebp - 0x2594], eax
adc ecx, dword [edi + 0x3ec]
mov dword [ebp - 0x25a8], ecx
mov edx, ecx
mov ecx, eax
call fcn.004c3cd0
mov eax, dword [edi + 0x438]
comisd xmm0, xmmword [eax + 0x30]
jb 0x4afa65
mov edx, dword [ebp - 0x25a8]
mov ecx, dword [ebp - 0x2594]
call fcn.004c3cd0
mov eax, dword [edi + 0x438]
cvtsd2ss xmm0, xmm0
mulss xmm0, dword [0x50d438]
cvtss2sd xmm0, xmm0
movsd qword [eax + 0x30], xmm0
mov eax, dword [edi + 0x438]
movsd xmm0, qword [eax + 0x30]
movsd qword [eax + 0x48], xmm0
mov edx, dword [edi + 0x40c]
mov ecx, dword [edi + 0x408]
call fcn.004c3cd0
mov edx, dword [edi + 0x3ec]
mov ecx, dword [edi + 0x3e8]
cvtsd2ss xmm0, xmm0
push 0
sub esp, 8
movss dword [ebp - 0x25a8], xmm0
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.004c3cd0
mov edx, dword [edi + 0x42c]
mov ecx, dword [edi + 0x428]
cvtsd2ss xmm0, xmm0
addss xmm0, dword [ebp - 0x25a8]
movss dword [ebp - 0x25a8], xmm0
call fcn.004c3cd0
movss xmm1, dword [ebp - 0x25a8]
sub esp, 8
cvtsd2ss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push dword [0x556aec]
push dword [0x556ae8]
push dword [edi + 0x438]
call fcn.004596e0
add esp, 0x20
lea eax, [edi + 0x3d0]
mov ecx, 0x5678b0
push eax
push edi
call fcn.0045cdf0
lea eax, [edi + 0x440]
mov ecx, 0x567918
push eax
push edi
call fcn.0045cdf0
lea eax, [edi + 0x4a8]
mov ecx, 0x567980
push eax
push edi
call fcn.0045cdf0
push dword [ebp - 0x2688]
push 0x532
push dword [0x555ecc]
push 1
call fcn.00473c50
or byte [ebp - 0x2574], al
add esp, 0x10
cmp dword [edi + 0x514], 0
je 0x4afb70
cmp byte [ebp - 0x257d], 0
jne 0x4afb70
call fcn.0047ed80
mov byte [ebp - 0x257d], 1
push dword [ebp - 0x2688]
push edi
call fcn.0047edc0
or byte [ebp - 0x2574], al
add esp, 8
test byte [edi + 0xd0], 0x40
je 0x4afbe1
mov eax, dword [ebp - 0x259c]
add eax, dword [esi + 0x7c]
mov dword [ebp - 0x259c], eax
adc dword [ebp - 0x25ac], 0
mov eax, dword [ebp - 0x25e4]
add eax, dword [esi + 0x68]
mov dword [ebp - 0x25e4], eax
adc dword [ebp - 0x25d4], 0
inc dword [ebp - 0x1f2c]
mov eax, dword [esi + 4]
add dword [ebp - 0x1f24], eax
mov eax, dword [esi + 0x4c]
add dword [ebp - 0x1f1c], eax
cmp dword [edi + 0x514], 0
je 0x4afbe1
inc dword [ebp - 0x1f14]
push dword [ebp - 0x2688]
push 0x4a9
push dword [0x555ecc]
push 1
call fcn.00473c50
push dword [ebp - 0x2688]
push 0x532
push dword [0x555ecc]
push 1
call fcn.00473c50
push dword [ebp - 0x2688]
push 0x4a7
push dword [0x555ecc]
push 1
call fcn.00473c50
xor dl, dl
add esp, 0x30
cmp byte [edi + 0x14], dl
je 0x4afc50
mov eax, dword [edi + 0x18]
cmp eax, dword [0x5510ec]
jge 0x4afc4a
mov dword [edi + 0x10], eax
mov dword [edi + 0xc], 2
jmp 0x4afc70
mov dl, 1
mov byte [edi + 0x14], 0
mov ecx, dword [ebp - 0x2574]
test dl, dl
movzx eax, cl
mov ecx, 1
cmovne eax, ecx
mov dword [edi + 0xc], 0
mov byte [ebp - 0x2574], al
mov eax, dword [ebp - 0x257c]
test eax, eax
je 0x4aea60
push eax
call dword [ebp - 0x2598]
jmp 0x4aea60
mov eax, dword [esi + 0x44]
push eax
push 0
push 0x410
mov dword [ebp - 0x25a8], eax
call dword [ebp - 0x26b8]
mov edi, eax
mov dword [ebp - 0x257c], edi
mov dword [ebp - 0x26bc], edi
test edi, edi
jne 0x4afd67
call dword [ebp - 0x26b4]
cmp eax, 5
jne 0x4afced
push edi
lea eax, [ebp - 0x260c]
push eax
push 4
lea eax, [ebp - 0x26bc]
push eax
push 4
lea eax, [ebp - 0x25a8]
push eax
push 0x8335003c
push dword [0x53b5e4]
call dword [ebp - 0x26a8]
mov edi, dword [ebp - 0x26bc]
mov dword [ebp - 0x257c], edi
test edi, edi
jne 0x4afd67
mov eax, dword [esi + 0x44]
push eax
push edi
push 0x1000
mov dword [ebp - 0x2704], eax
call dword [ebp - 0x26b8]
mov edi, eax
mov dword [ebp - 0x257c], edi
mov dword [ebp - 0x26ac], edi
test edi, edi
jne 0x4afd67
call dword [ebp - 0x26b4]
cmp eax, 5
jne 0x4afd5b
push edi
lea eax, [ebp - 0x2634]
push eax
push 4
lea eax, [ebp - 0x26ac]
push eax
push 4
lea eax, [ebp - 0x2704]
push eax
push 0x8335003c
push dword [0x53b5e4]
call dword [ebp - 0x26a8]
mov edi, dword [ebp - 0x26ac]
mov dword [ebp - 0x257c], edi
push 0x5d0
lea eax, [ebp - 0x2570]
push 0
push eax
call fcn.004c52c0
mov eax, dword [esi + 0x44]
add esp, 0xc
mov dword [ebp - 0x254c], eax
movzx eax, word [esi + 0x38]
test ax, ax
je 0x4afdab
shr eax, 1
push eax
push dword [esi + 0x3c]
lea eax, [ebp - 0xc90]
push 0x100
push eax
call fcn.004c927f
add esp, 0x10
jmp 0x4afdc4
push 0x5133e0
lea eax, [ebp - 0xc90]
push 0x100
push eax
call fcn.004c905a
add esp, 0xc
lea ecx, [ebp - 0x26d8]
push ecx
lea ecx, [ebp - 0x26dc]
push ecx
lea ecx, [ebp - 0x25f9]
push ecx
lea ecx, [ebp - 0x26fc]
push ecx
push 0x100
lea ecx, [ebp - 0xa90]
push ecx
push 0x100
lea ecx, [ebp - 0x890]
push ecx
push 0x100
lea ecx, [ebp - 0xe90]
push ecx
lea eax, [esi + 0x20]
push eax
push dword [esi + 0x44]
push edi
call fcn.004aa5d0
add esp, 0x34
cmp word [ebp - 0x890], 0
je 0x4afe2d
cmp word [ebp - 0xe90], 0
mov eax, 0x4fbdfc
jne 0x4afe32
mov eax, 0x4fbd20
lea ecx, [ebp - 0xe90]
push ecx
push eax
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x1e90]
push 0x50e8cc
push eax
call fcn.0044c5f0
lea eax, [ebp - 0xa90]
push eax
call fcn.004c8c20
mov dword [ebp - 0x2224], eax
add esp, 0x18
cmp dword [ebp - 0x26dc], 0
mov eax, dword [ebp - 0x26fc]
mov dword [ebp - 0x2220], eax
mov al, byte [ebp - 0x25f9]
mov byte [ebp - 0x221c], al
mov eax, dword [ebp - 0x24a0]
je 0x4afe99
or eax, 0x200
mov dword [ebp - 0x24a0], eax
cmp dword [ebp - 0x26d8], 0
je 0x4afead
or eax, 0x2000
mov dword [ebp - 0x24a0], eax
lea eax, [ebp - 0x276c]
push eax
push 1
lea eax, [ebp - 0x223f]
push eax
push 0x3d
push edi
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [0x556af8], 0
je 0x4affe4
mov eax, dword [0x556afc]
test eax, eax
je 0x4affce
push 0
lea ecx, [ebp - 0x2600]
mov dword [ebp - 0x2600], 0
push ecx
push edi
call eax
cmp eax, 0x7a
jne 0x4aff48
mov eax, dword [ebp - 0x2600]
add eax, eax
push eax
call fcn.004c8c9a
mov ecx, dword [0x556afc]
add esp, 4
mov dword [ebp - 0x258c], eax
push eax
lea eax, [ebp - 0x2600]
push eax
push edi
call ecx
test eax, eax
jne 0x4aff3a
push dword [ebp - 0x258c]
call fcn.004c8c20
add esp, 4
mov dword [ebp - 0x2218], eax
push dword [ebp - 0x258c]
call fcn.004c8c7f
add esp, 4
mov ecx, dword [0x55b1c8]
test ecx, ecx
je 0x4affce
mov eax, dword [ebp - 0x2218]
test eax, eax
je 0x4affce
push 0
lea edx, [ebp - 0x2600]
mov dword [ebp - 0x2600], 0
push edx
push eax
call ecx
cmp eax, 0x7a
jne 0x4affce
mov eax, dword [ebp - 0x2600]
add eax, eax
push eax
call fcn.004c8c9a
mov ecx, dword [0x55b1c8]
add esp, 4
mov dword [ebp - 0x258c], eax
push eax
lea eax, [ebp - 0x2600]
push eax
push dword [ebp - 0x2218]
call ecx
test eax, eax
jne 0x4affc0
push dword [ebp - 0x258c]
call fcn.004c8c20
add esp, 4
mov dword [ebp - 0x24b8], eax
push dword [ebp - 0x258c]
call fcn.004c8c7f
add esp, 4
mov eax, dword [0x556af8]
push edi
call eax
test eax, eax
je 0x4affe4
or dword [ebp - 0x24a0], 0x1000
push 0xffffffffffffffff
lea eax, [ebp - 0x2570]
mov dword [ebp - 0x21fc], 0xffffffff
push eax
push dword [0x556aec]
mov dword [ebp - 0x21a8], 0xffffffff
push dword [0x556ae8]
push dword [ebp - 0x25b8]
push dword [ebp - 0x25d8]
push edi
push esi
call fcn.004a0480
mov eax, dword [esi + 0x48]
add esp, 0x20
test eax, eax
jne 0x4b0040
lea eax, [ebp - 0x690]
push 0x50c388
push eax
call fcn.0048d4d0
add esp, 8
jmp 0x4b007f
push 0x120
lea ecx, [ebp - 0x690]
push ecx
lea ecx, [esi + 0x20]
push ecx
push eax
call fcn.004aa530
push dword [esi + 0x48]
lea eax, [ebp - 0x48]
push 0x5140ac
push eax
call fcn.0048d500
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x690]
push 0x120
push eax
call fcn.004d6277
add esp, 0x28
mov dword [ebp - 0x2234], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2230], 0
mov dword [ebp - 0x222c], 0
movups xmmword [ebp - 0x1eb4], xmm0
movups xmmword [ebp - 0x1ea4], xmm0
test edi, edi
je 0x4b01ad
lea eax, [ebp - 0x270c]
mov dword [ebp - 0x1eb4], 0x20
push eax
push 0x20
lea eax, [ebp - 0x1eb4]
push eax
push 0
push edi
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
je 0x4b00fc
lea eax, [ebp - 0x270c]
push eax
push 0x18
lea eax, [ebp - 0x1eb0]
push eax
push 0
push edi
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jne 0x4b01ad
mov al, byte [ebp - 0x1e98]
and al, 1
mov byte [ebp - 0x2575], al
mov eax, dword [ebp - 0x1eac]
test eax, eax
je 0x4b0133
lea ecx, [ebp - 0x222c]
push ecx
lea ecx, [ebp - 0x2230]
push ecx
lea ecx, [ebp - 0x2234]
push ecx
push eax
push edi
call fcn.0048f6f0
add esp, 0x14
cmp dword [ebp - 0x2230], 0
jne 0x4b014e
push 0x4fbd20
call fcn.004c8c20
mov dword [ebp - 0x2230], eax
jmp 0x4b015a
lea eax, [ebp - 0x2230]
push eax
call fcn.00490690
add esp, 4
cmp dword [ebp - 0x2234], 0
jne 0x4b0179
push 0x4fbd20
call fcn.004c8c20
add esp, 4
mov dword [ebp - 0x2234], eax
cmp dword [ebp - 0x222c], 0
jne 0x4b019a
push 0x5018bc
call fcn.004c8c20
add esp, 4
mov dword [ebp - 0x222c], eax
xor ecx, ecx
mov word [eax], cx
cmp byte [ebp - 0x2575], 0
je 0x4b01ad
or dword [ebp - 0x24a0], 0x400
mov eax, dword [esi + 0x44]
push 0x4fbd20
mov dword [ebp - 0x2594], eax
lea eax, [ebp - 0x450]
push 0x100
push eax
call fcn.004c905a
add esp, 0xc
mov dword [0x556ab0], 0
call dword [ebp - 0x26d4]
mov ecx, dword [ebp - 0x2594]
cmp ecx, eax
je 0x4b0213
push ecx
lea eax, [ebp - 0x450]
mov byte [0x556aac], 0
push 0x4a7330
mov dword [0x556aa4], eax
mov dword [0x556aa8], 0x100
call dword [ebp - 0x26f4]
jmp 0x4b022f
mov eax, dword [0x555ec8]
push 0x100
push dword [0x556aa4]
mov dword [0x556ab0], eax
push eax
call dword [ebp - 0x26f0]
mov eax, dword [0x556ab0]
mov dword [ebp - 0x2264], eax
test eax, eax
je 0x4b024b
push eax
call dword [ebp - 0x26f8]
mov byte [ebp - 0x2260], al
cmp byte [ebp - 0x25bd], 0
jne 0x4b0260
call fcn.00491c50
mov byte [ebp - 0x25bd], 1
cmp dword [esi + 0x44], 0
je 0x4b0299
mov edx, dword [0x56786c]
xor ecx, ecx
test edx, edx
je 0x4b0299
mov eax, dword [0x567868]
add eax, 0x24
nop word [eax + eax]
mov edi, dword [esi + 0x44]
cmp dword [eax], edi
mov edi, dword [ebp - 0x257c]
je 0x4b03c5
inc ecx
add eax, 0x2c
cmp ecx, edx
jb 0x4b0280
and dword [ebp - 0x24a0], 0xffffffdf
push 0x4fbd20
lea eax, [ebp - 0x2548]
push 0x41
push eax
call fcn.004c905a
lea eax, [ebp - 0xc90]
push eax
call fcn.004c8c20
mov dword [ebp - 0x248c], eax
lea eax, [ebp - 0x2570]
push eax
push edi
call fcn.00491030
add esp, 0x18
test al, al
jne 0x4b05f7
push 1
push dword [ebp - 0x24bc]
call fcn.00490f00
push 0
push dword [ebp - 0x24bc]
mov dword [ebp - 0x2494], eax
call fcn.00490f00
add esp, 0x10
mov dword [ebp - 0x261c], eax
test eax, eax
je 0x4b05f7
push 0x556604
call dword [ebp - 0x2730]
mov dword [ebp - 0x25e8], 0
xor ecx, ecx
cmp dword [ecx*8 + 0x556458], 0xffffffff
jne 0x4b033f
cmp dword [ecx*8 + 0x55645c], 0xffffffff
jne 0x4b033f
inc ecx
cmp ecx, 0x35
jb 0x4b0325
mov esi, dword [ecx*8 + 0x556458]
mov eax, esi
mov edx, dword [ecx*8 + 0x55645c]
and eax, 1
or eax, 0
je 0x4b037d
mov edi, dword [ebp - 0x25e8]
nop dword [eax]
shrd esi, edx, 1
inc edi
mov eax, esi
shr edx, 1
and eax, 1
or eax, 0
jne 0x4b0360
mov dword [ebp - 0x25e8], edi
mov edi, dword [ebp - 0x257c]
mov esi, dword [ebp - 0x261c]
shl ecx, 6
add ecx, dword [ebp - 0x25e8]
push esi
push ecx
push dword [0x556450]
call dword [ebp - 0x2644]
mov dword [ebp - 0x25e8], eax
cmp eax, 0xffffffff
jne 0x4b03d1
push esi
push eax
push dword [0x556450]
call dword [ebp - 0x2644]
mov dword [ebp - 0x25e8], eax
cmp eax, 0xffffffff
jne 0x4b03d1
xor esi, esi
jmp 0x4b043e
or dword [ebp - 0x24a0], 0x20
jmp 0x4b02a0
mov edx, eax
xor edi, edi
shr edx, 6
and eax, 0x3f
mov ecx, dword [edx*8 + 0x55645c]
mov esi, dword [edx*8 + 0x556458]
mov dword [ebp - 0x258c], ecx
xor ecx, ecx
bts ecx, eax
cmp eax, 0x20
cmovae edi, ecx
xor ecx, edi
mov dword [ebp - 0x2594], edi
cmp eax, 0x40
mov eax, edi
mov edi, dword [ebp - 0x257c]
cmovae eax, ecx
or ecx, esi
or eax, dword [ebp - 0x258c]
mov dword [edx*8 + 0x556458], ecx
mov dword [edx*8 + 0x55645c], eax
cmp esi, ecx
jne 0x4b0432
cmp dword [ebp - 0x258c], eax
je 0x4b0438
inc dword [0x556600]
mov esi, dword [ebp - 0x25e8]
push 0x556604
call dword [ebp - 0x273c]
mov ecx, dword [ebp - 0x24bc]
xorps xmm0, xmm0
mov dword [ebp - 0x2490], esi
mov esi, ecx
mov dword [ebp - 0x2594], ecx
movups xmmword [ebp - 0x1eac], xmm0
mov dword [ebp - 0x1e9c], 0
mov dword [ebp - 0x1e98], 0
lea edx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4b0480
sub esi, edx
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x4b189f
mov dword [ebp - 0x1e98], 7
cmp esi, 8
jae 0x4b04cf
mov dword [ebp - 0x1e9c], esi
lea eax, [ebp - 0x1eac]
add esi, esi
push esi
push ecx
push eax
call fcn.004c4d40
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x1eac], ax
jmp 0x4b0538
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x4b04e2
mov eax, CreateSecurityPage
jmp 0x4b04ed
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x258c], eax
lea ecx, [ebp - 0x1eac]
inc eax
push eax
call fcn.00442940
mov dword [ebp - 0x1e9c], esi
mov edi, eax
mov eax, dword [ebp - 0x258c]
add esi, esi
push esi
push dword [ebp - 0x2594]
mov dword [ebp - 0x1eac], edi
push edi
mov dword [ebp - 0x1e98], eax
call fcn.004c4d40
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
mov edi, dword [ebp - 0x257c]
lea eax, [ebp - 0x1eac]
mov ecx, 0x5567f8
push eax
lea eax, [ebp - 0x275c]
push eax
call fcn.0048d140
mov esi, dword [ebp - 0x2754]
cmp byte [esi + 0xd], 0
jne 0x4b0590
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
jb 0x4b0567
mov ecx, dword [ecx]
cmp dword [ebp - 0x1e98], 8
lea eax, [ebp - 0x1eac]
push ecx
cmovae eax, dword [ebp - 0x1eac]
push eax
call fcn.004c9380
add esp, 8
test eax, eax
js 0x4b0590
mov eax, dword [0x5567f8]
jmp 0x4b0597
mov eax, dword [0x5567f8]
mov esi, eax
mov ecx, dword [ebp - 0x1e98]
mov dword [ebp - 0x258c], eax
cmp ecx, 8
jb 0x4b05dd
mov edx, dword [ebp - 0x1eac]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4b05d3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b189a
push ecx
push edx
call fcn.004c3279
add esp, 8
cmp esi, dword [ebp - 0x258c]
jne 0x4b05f1
push dword [ebp - 0x261c]
call dword [ebp - 0x25bc]
mov esi, dword [ebp - 0x2584]
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x2008], eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4b0632
mov ecx, dword [ebp - 0x254c]
test ecx, ecx
je 0x4b0632
mov dword [0x557138], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [0x557140], eax
or eax, 0xffffffff
mov dword [0x557144], ecx
mov dword [esi + 0x48], 0xffffffff
mov dword [ebp - 0x2480], eax
mov dword [ebp - 0x2478], 0
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0x2470], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
push esi
mov dword [ebp - 0x2258], eax
mov dword [ebp - 0x2254], ecx
call fcn.0048e3f0
mov dword [ebp - 0x2020], eax
add esp, 4
mov dword [ebp - 0x201c], edx
xor ecx, ecx
mov dword [ebp - 0x1fb4], 0
mov edx, dword [esi + 4]
test edx, edx
je 0x4b06a7
lea eax, [esi + 0xf0]
nop dword [eax + eax]
cmp dword [eax - 4], 5
jne 0x4b069c
cmp dword [eax], 5
jne 0x4b069c
inc ecx
add eax, 0x40
sub edx, 1
jne 0x4b0690
mov edx, dword [esi + 4]
cmp edx, ecx
jne 0x4b06b5
or dword [ebp - 0x24a0], 0x80
push 0
push 0
push dword [ebp - 0x254c]
push edi
call fcn.004a0020
add esp, 0x10
test al, al
je 0x4b06d8
or dword [ebp - 0x24a0], 0x800
jmp 0x4b06e2
and dword [ebp - 0x24a0], 0xfffff7ff
lea eax, [ebp - 0x2570]
push edi
push eax
call fcn.004902e0
mov dword [ebp - 0x224c], eax
add esp, 8
mov dword [ebp - 0x247c], 0
mov ecx, dword [esi + 0x30]
add ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x34]
adc eax, dword [esi + 0x2c]
mov dword [ebp - 0x2034], eax
mov dword [ebp - 0x2038], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x2030], eax
mov dword [ebp - 0x202c], ecx
mov dword [ebp - 0x2468], 0
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x21f4], eax
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x21ec], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x21f8], eax
mov eax, dword [esi + 0x80]
mov dword [ebp - 0x21e4], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x21e0], eax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x21dc], eax
mov eax, dword [0x56787c]
mov dword [ebp - 0x2244], 0xffffffff
test eax, eax
je 0x4b078c
lea ecx, [ebp - 0x2244]
push ecx
push edi
call eax
mov eax, dword [esi + 0x7c]
xor ecx, ecx
cmp ecx, dword [ebp - 0x25a4]
jb 0x4b07af
ja 0x4b07a3
cmp eax, dword [ebp - 0x25a0]
jbe 0x4b07af
mov dword [ebp - 0x25a0], eax
mov dword [ebp - 0x25a4], ecx
lea eax, [ebp - 0x2468]
push eax
push dword [esi + 0x44]
call dword [ebp - 0x272c]
mov ecx, dword [ebp - 0x2468]
test eax, eax
mov eax, 0xffffffff
cmove ecx, eax
cmp dword [0x53b5ec], 0
mov dword [ebp - 0x2468], ecx
je 0x4b07fb
movsd xmm0, qword [ebp - 0x25d0]
movsd qword [ebp - 0x2050], xmm0
movsd qword [ebp - 0x1ea0], xmm0
jmp 0x4b08b6
mov edi, dword [ebp - 0x25d8]
mov eax, edi
or eax, dword [ebp - 0x25b8]
jne 0x4b0815
movsd xmm0, qword [ebp - 0x25d0]
jmp 0x4b086c
mov ecx, dword [esi + 0x28]
add ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
adc eax, dword [esi + 0x34]
push 0
push 0x64
push eax
push ecx
call fcn.004c4060
mov ecx, eax
call fcn.004c3cd0
mov edx, dword [ebp - 0x25b8]
mov ecx, edi
movsd qword [ebp - 0x1ea0], xmm0
call fcn.004c3cd0
movsd xmm2, qword [ebp - 0x1ea0]
divsd xmm2, xmm0
movsd xmm1, qword [ebp - 0x25d0]
movsd xmm0, qword [ebp - 0x25f8]
maxsd xmm1, xmm2
minsd xmm0, xmm1
test byte [ebp - 0x24a0], 0x40
movsd qword [ebp - 0x1ea0], xmm0
movsd qword [ebp - 0x2050], xmm0
je 0x4b089d
addsd xmm0, qword [ebp - 0x25f0]
movsd qword [ebp - 0x25f0], xmm0
movsd xmm0, qword [ebp - 0x1ea0]
cmp dword [ebp - 0x254c], 0
je 0x4b08b6
addsd xmm0, qword [ebp - 0x26a0]
movsd qword [ebp - 0x26a0], xmm0
lea eax, [ebp - 0x690]
push eax
call fcn.004c8c20
mov dword [ebp - 0x2484], eax
lea eax, [ebp - 0x1e90]
push eax
call fcn.004c8c20
or dword [ebp - 0x24a0], 4
push 0x555cb8
push eax
mov dword [ebp - 0x2474], eax
call fcn.004c9380
add esp, 0x10
test eax, eax
mov eax, dword [ebp - 0x24a0]
jne 0x4b0902
or eax, 0x40
mov dword [ebp - 0x24a0], eax
cmp byte [0x55528b], 0
jne 0x4b0919
test byte [ebp - 0x24a0], 0x40
jne 0x4b0919
and eax, 0xfffffffd
jmp 0x4b091c
or eax, 2
mov dword [ebp - 0x24a0], eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x2464]
push 0x100
push eax
call fcn.004c905a
add esp, 0xc
cmp dword [0x53b5ec], 0
je 0x4b0952
mov dword [ebp - 0x2564], 0
jmp 0x4b09a5
mov eax, dword [0x55b1dc]
cmp eax, dword [ebp - 0x2254]
jl 0x4b098a
jg 0x4b096e
mov eax, dword [0x55b1d8]
cmp eax, dword [ebp - 0x2258]
jbe 0x4b098a
movsd xmm0, qword [ebp - 0x25d0]
mov dword [ebp - 0x2564], 0
movsd qword [ebp - 0x2050], xmm0
jmp 0x4b0994
mov dword [ebp - 0x2564], 2
mov dword [ebp - 0x2560], 0
mov byte [ebp - 0x255c], 0
push dword [ebp - 0x254c]
mov byte [ebp - 0x2060], 0
call fcn.0047e1e0
mov dword [ebp - 0x205c], eax
lea eax, [ebp - 0x2570]
push eax
call fcn.00458f80
mov byte [ebp - 0x2058], al
add esp, 8
mov eax, dword [ebp - 0x205c]
test eax, eax
je 0x4b0a01
cmp byte [ebp - 0x257d], 0
jne 0x4b09f7
call fcn.0047ed80
mov eax, dword [ebp - 0x205c]
mov byte [ebp - 0x257d], 1
test eax, eax
je 0x4b0a01
inc dword [ebp - 0x1f18]
lea eax, [ebp - 0x2570]
push 0xffffffffffffffff
push eax
call fcn.0047edc0
add esp, 8
mov dword [ebp - 0x1ffc], 0
lea eax, [ebp - 0x2570]
mov dword [ebp - 0x2000], 0
xor ecx, ecx
mov dword [ebp - 0x2560], 0
push eax
mov eax, dword [0x538dd8]
cmp eax, dword [esi + 0x44]
sete cl
push ecx
push 0x7ee
push dword [0x555ec8]
call dword [ebp - 0x25e0]
push 0x5140b8
push dword [ebp - 0x248c]
mov edi, eax
call fcn.004c9380
add esp, 8
test eax, eax
jne 0x4b0a7c
push eax
push edi
push 0x48ce10
call dword [ebp - 0x264c]
push 0xffffffffffffffff
push edi
push dword [0x556aec]
push dword [0x556ae8]
push dword [ebp - 0x25b8]
push dword [ebp - 0x25d8]
push dword [ebp - 0x257c]
push esi
call fcn.004a0480
mov ecx, dword [edi + 0x554]
add esp, 0x20
mov eax, dword [edi + 0x550]
mov dword [edi + 0x54c], ecx
mov ecx, dword [edi + 0x564]
mov dword [edi + 0x548], eax
mov eax, dword [edi + 0x560]
mov dword [edi + 0x55c], ecx
mov ecx, dword [ebp - 0x2614]
mov dword [edi + 0x558], eax
mov dword [edi + 0x5bc], ecx
mov eax, dword [ebp - 0x24bc]
mov dword [ebp - 0x2614], edi
mov byte [ebp - 0x2574], 1
test eax, eax
je 0x4b0b4f
cmp word [eax], 0x5b
je 0x4b0b4f
cmp byte [0x555291], 0
je 0x4b0b1c
lock inc dword [edi + 0x20]
push edi
push 0
push 0x4b2d70
call fcn.004d5fba
add esp, 0xc
push dword [edi + 0xb4]
push dword [edi + 0xfc]
call fcn.00454d90
mov dword [edi + 0xbc], eax
xor ecx, ecx
cmp byte [0x5552a0], cl
mov eax, 2
cmovne eax, ecx
push eax
push 1
push edi
call fcn.004bbb40
add esp, 0x14
cmp dword [edi + 0x24], 0
je 0x4b0b75
movsd xmm0, qword [ebp - 0x1ea0]
comisd xmm0, xmmword [ebp - 0x2628]
jbe 0x4b0b75
movsd qword [ebp - 0x2628], xmm0
mov dword [ebp - 0x262c], edi
test byte [ebp - 0x24a0], 0x40
je 0x4b0bd1
mov edi, dword [ebp - 0x259c]
add edi, dword [esi + 0x7c]
mov dword [ebp - 0x259c], edi
adc dword [ebp - 0x25ac], 0
mov edi, dword [ebp - 0x25e4]
add edi, dword [esi + 0x68]
mov dword [ebp - 0x25e4], edi
adc dword [ebp - 0x25d4], 0
inc dword [ebp - 0x1f2c]
mov eax, dword [esi + 4]
add dword [ebp - 0x1f24], eax
mov eax, dword [esi + 0x4c]
add dword [ebp - 0x1f1c], eax
cmp dword [ebp - 0x205c], 0
je 0x4b0bd1
inc dword [ebp - 0x1f14]
mov eax, dword [ebp - 0x257c]
test eax, eax
je 0x4aea60
push eax
call dword [ebp - 0x2598]
jmp 0x4aea60
mov eax, dword [ebp - 0x2630]
mov edi, dword [ebp - 0x25e0]
test eax, eax
je 0x4b0c2d
mov esi, dword [ebp - 0x25b4]
mov dword [ebp - 0x2720], eax
lea eax, [ebp - 0x2728]
push eax
push 0xffffffffffffffff
push 0x1053
push esi
mov dword [ebp - 0x2728], 1
call edi
push 0
push eax
push 0x1013
push esi
call edi
cmp byte [ebp - 0x26a4], 0
jne 0x4b0dc3
cmp byte [0x55528b], 0
je 0x4b0dc3
push 0x5d0
lea eax, [ebp - 0x2570]
push 0
push eax
call fcn.004c52c0
or dword [ebp - 0x24a0], 6
xor esi, esi
add esp, 0xc
mov byte [ebp - 0x224c], 0xff
mov dword [ebp - 0x205c], 0
mov dword [ebp - 0x21a8], 0xffffffff
mov dword [ebp - 0x21fc], 0xffffffff
mov dword [ebp - 0x1fb4], 0
mov dword [ebp - 0x2564], 0
mov dword [ebp - 0x254c], 0xfffffff6
cmp dword [0x555f60], esi
jle 0x4b0d42
mov edx, dword [0x55b1e4]
mov edi, dword [0x55b1e8]
add edx, 0x20
add edi, 4
mov eax, dword [edx + 8]
lea edi, [edi + 0x18]
add eax, dword [edi - 0x18]
add dword [ebp - 0x2020], eax
adc dword [ebp - 0x201c], 0
mov eax, dword [edx - 8]
add eax, dword [edx]
mov ecx, dword [edx - 4]
adc ecx, dword [edx + 4]
add dword [ebp - 0x2038], eax
adc dword [ebp - 0x2034], ecx
mov eax, dword [edx - 8]
add eax, dword [edx]
mov ecx, dword [edx - 4]
adc ecx, dword [edx + 4]
lea edx, [edx + 0x30]
add dword [ebp - 0x2030], eax
mov eax, dword [ebp - 0x2010]
adc dword [ebp - 0x202c], ecx
mov ecx, dword [0x55b1ec]
add eax, dword [ecx + esi*8]
mov dword [ebp - 0x2010], eax
mov eax, dword [ebp - 0x200c]
adc eax, dword [ecx + esi*8 + 4]
inc esi
mov dword [ebp - 0x200c], eax
cmp esi, dword [0x555f60]
jl 0x4b0cc7
mov edi, dword [ebp - 0x25e0]
push 0x5133a4
call fcn.004c8c20
push 0x5140d4
mov dword [ebp - 0x24c4], eax
call fcn.004c8c20
mov ecx, dword [0x557144]
mov dword [ebp - 0x248c], eax
mov eax, dword [0x557140]
mov dword [ebp - 0x2258], eax
mov eax, dword [0x557138]
push 0x4fc9dc
mov dword [ebp - 0x2254], ecx
mov dword [ebp - 0x2480], eax
call fcn.004c8c20
add esp, 0xc
mov dword [ebp - 0x2484], eax
lea eax, [ebp - 0x2570]
push eax
xor eax, eax
cmp dword [0x538dd8], eax
sete al
push eax
push 0x7ee
push dword [0x555ec8]
call edi
mov ecx, dword [ebp - 0x2614]
mov dword [eax + 0x5bc], ecx
cmp dword [0x567c60], 0
jne 0x4b0e9e
mov eax, dword [0x551540]
cmp eax, 0x3e8
je 0x4b0e9e
cmp byte [ebp - 0x2574], 0
jne 0x4b0e9e
cmp dword [eax*4 + 0x5513c0], 0x41f
jne 0x4b0e9e
lea eax, [ebp - 0x268c]
mov dword [ebp - 0x268c], 4
push eax
push 0
push 0x104b
push dword [ebp - 0x25b4]
mov dword [ebp - 0x2688], 1
mov dword [ebp - 0x2684], 0
call edi
test eax, eax
je 0x4b0e9e
mov esi, dword [ebp - 0x26b0]
nop dword [eax]
mov eax, esi
test esi, esi
mov esi, dword [ebp - 0x266c]
je 0x4b0e75
cmp byte [0x551544], 0
movsd xmm1, qword [eax + 0x520]
je 0x4b0e67
comisd xmm1, xmmword [esi + 0x520]
jmp 0x4b0e73
movsd xmm0, qword [esi + 0x520]
comisd xmm0, xmm1
ja 0x4b0e97
inc dword [ebp - 0x2688]
lea eax, [ebp - 0x268c]
push eax
push 0
push 0x104b
push dword [ebp - 0x25b4]
call edi
test eax, eax
jne 0x4b0e40
jmp 0x4b0e9e
mov byte [ebp - 0x2574], 1
mov eax, dword [ebp - 0x25d8]
or eax, dword [ebp - 0x25b8]
mov esi, dword [ebp - 0x25c4]
je 0x4b0f02
mov ecx, dword [ebp - 0x25dc]
mov edx, esi
sub ecx, dword [0x567c68]
sbb edx, dword [0x567c6c]
call fcn.004c3cd0
mov edx, dword [ebp - 0x25b8]
mov ecx, dword [ebp - 0x25d8]
cvtsd2ss xmm0, xmm0
mulss xmm0, dword [0x50d43c]
movss dword [ebp - 0x264c], xmm0
call fcn.004c3cd0
movss xmm1, dword [ebp - 0x264c]
cvtsd2ss xmm0, xmm0
divss xmm1, xmm0
jmp 0x4b0f05
xorps xmm1, xmm1
mov eax, dword [ebp - 0x25dc]
movsd xmm4, qword [ebp - 0x25f0]
cvtps2pd xmm0, xmm1
mov dword [0x567c68], eax
lea eax, [ebp - 0x1ef0]
push eax
mov dword [0x567c6c], esi
mov dword [ebp - 0x1ef0], 0x20
movsd qword [ebp - 0x1f58], xmm4
movsd qword [ebp - 0x2650], xmm0
movsd xmm0, qword [ebp - 0x25d0]
movsd qword [ebp - 0x26d0], xmm0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x2638]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x1fa0]
mov dword [ebp - 0x1fa0], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x259c]
mov eax, ecx
mov edx, dword [ebp - 0x25ac]
or eax, edx
je 0x4b0fc8
call fcn.004c3cd0
mov edx, dword [ebp - 0x1f84]
movaps xmm1, xmm0
mov ecx, dword [ebp - 0x1f88]
movsd qword [ebp - 0x25f0], xmm1
call fcn.004c3cd0
movsd xmm1, qword [ebp - 0x25f0]
divsd xmm1, xmm0
mulsd xmm1, qword [ebp - 0x25f8]
jmp 0x4b1176
mov edx, dword [ebp - 0x1f84]
mov ecx, dword [ebp - 0x1f88]
call fcn.004c3cd0
movsd xmm1, qword [0x50d0f0]
mov eax, dword [0x556ad0]
mulsd xmm0, xmm1
movsd qword [ebp - 0x2610], xmm1
movsd qword [eax + 0x30], xmm0
mov edx, dword [ebp - 0x1f94]
mov ecx, dword [ebp - 0x1f98]
call fcn.004c3cd0
mulsd xmm0, qword [ebp - 0x2610]
mov eax, dword [0x556ae4]
movsd qword [eax + 0x30], xmm0
mov ecx, dword [ebp - 0x1f98]
sub ecx, dword [ebp - 0x1f90]
mov edx, dword [ebp - 0x1f94]
sbb edx, dword [ebp - 0x1f8c]
call fcn.004c3c70
mulsd xmm0, qword [ebp - 0x2610]
mov ecx, dword [ebp - 0x1f88]
sub ecx, dword [ebp - 0x1f80]
mov edx, dword [ebp - 0x1f84]
sbb edx, dword [ebp - 0x1f7c]
movsd qword [ebp - 0x26d0], xmm0
call fcn.004c3cd0
mov edx, dword [ebp - 0x1f84]
mov ecx, dword [ebp - 0x1f88]
movsd qword [ebp - 0x1ea0], xmm0
mulsd xmm0, qword [ebp - 0x25f8]
movsd qword [ebp - 0x25f0], xmm0
call fcn.004c3cd0
movsd xmm1, qword [ebp - 0x25f0]
divsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x1ea0]
mulsd xmm0, qword [ebp - 0x2610]
movsd xmm2, qword [ebp - 0x25d0]
movsd qword [ebp - 0x25f0], xmm1
comisd xmm2, xmm0
movsd qword [ebp - 0x1ea0], xmm0
jbe 0x4b10fc
mov eax, dword [ebp - 0x1ee0]
movsd xmm1, qword [ebp - 0x25f8]
shr eax, 0xa
movsd qword [ebp - 0x25f0], xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x504470]
movsd qword [ebp - 0x1ea0], xmm0
movsd xmm0, qword [ebp - 0x26d0]
push 0
sub esp, 0x10
movsd qword [esp + 8], xmm2
movsd qword [esp], xmm0
push dword [ebp - 0x2634]
push dword [ebp - 0x2638]
push dword [0x556ae4]
call fcn.004596e0
movsd xmm0, qword [ebp - 0x25d0]
add esp, 0x20
push 0
sub esp, 0x10
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x1ea0]
movsd qword [esp], xmm0
push dword [ebp - 0x2634]
push dword [ebp - 0x2638]
push dword [0x556ad0]
call fcn.004596e0
movsd xmm1, qword [ebp - 0x25f0]
add esp, 0x20
mov edi, dword [ebp - 0x25e0]
mov eax, dword [0x556ae4]
movsd xmm0, qword [ebp - 0x26d0]
push 0
movsd qword [ebp - 0x2768], xmm0
movsd xmm0, qword [eax + 0x30]
mov eax, dword [ebp - 0x25d4]
push 0x400
push eax
mov eax, dword [ebp - 0x25e4]
push eax
movsd qword [ebp - 0x25f0], xmm0
movsd qword [ebp - 0x1f48], xmm1
call fcn.004c3d20
mov ecx, eax
call fcn.004c3cd0
divsd xmm0, qword [ebp - 0x25f0]
mov eax, dword [ebp - 0x25a0]
mov esi, dword [ebp - 0x2618]
mov dword [0x556af0], eax
mov eax, dword [ebp - 0x25a4]
mov dword [0x556af4], eax
movsd xmm1, qword [ebp - 0x25f8]
mulsd xmm0, xmm1
movsd qword [ebp - 0x1f38], xmm0
test esi, esi
je 0x4b1340
movaps xmm0, xmm1
mov dword [ebp - 0x2728], 1
subsd xmm0, qword [ebp - 0x26a0]
movsd xmm1, qword [ebp - 0x25d0]
lea eax, [ebp - 0x2728]
push eax
push 0xffffffffffffffff
push 0x1053
push dword [ebp - 0x25b4]
maxsd xmm1, xmm0
mov dword [ebp - 0x2720], esi
movsd qword [ebp - 0x25f0], xmm1
call edi
movsd xmm0, qword [ebp - 0x25f0]
mov dword [ebp - 0x2688], eax
ucomisd xmm0, qword [esi + 0x520]
movsd qword [esi + 0x520], xmm0
push dword [ebp - 0x2688]
lahf
xor ecx, ecx
test ah, 0x44
push 0x41f
push dword [0x555ecc]
mov eax, 1
cmovp ecx, eax
push ecx
call fcn.00473c50
movsd xmm0, qword [esi + 0x530]
or byte [ebp - 0x2574], al
movaps xmm1, xmm0
addsd xmm1, qword [ebp - 0x25f0]
ucomisd xmm1, xmm0
lahf
xor esi, esi
test ah, 0x44
mov eax, 1
cmovp esi, eax
mov eax, dword [ebp - 0x2618]
movsd qword [eax + 0x530], xmm1
push dword [ebp - 0x2688]
push 0x665
push dword [0x555ecc]
push 1
call fcn.00473c50
push dword [ebp - 0x2688]
or byte [ebp - 0x2574], al
push 0x4a7
push dword [0x555ecc]
push esi
call fcn.00473c50
movsd xmm0, qword [ebp - 0x25f0]
add esp, 0x30
or byte [ebp - 0x2574], al
mov eax, dword [ebp - 0x2618]
push 0
sub esp, 0x10
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x25d0]
movsd qword [esp], xmm0
push dword [0x556aec]
push dword [0x556ae8]
push dword [eax + 0x56c]
call fcn.004596e0
add esp, 0x20
cmp byte [ebp - 0x2574], 0
jne 0x4b1389
cmp dword [ebp - 0x2604], 0
je 0x4b1389
push 0
push 0
push 0x1004
push dword [0x555ecc]
call edi
mov edi, eax
xor esi, esi
test edi, edi
jle 0x4b1389
nop dword [eax + eax]
push 0xffffffffffffffff
push esi
push 0x7eb
push dword [0x555ec8]
call dword [ebp - 0x2590]
inc esi
cmp esi, edi
jl 0x4b1370
movsd xmm0, qword [ebp - 0x25f8]
lea eax, [ebp - 0x2768]
minsd xmm0, qword [ebp - 0x26a0]
push eax
lea eax, [ebp - 0x2778]
push eax
lea eax, [ebp - 0x1f60]
push eax
push dword [0x555ed8]
movsd qword [ebp - 0x1f60], xmm0
call fcn.004ba4e0
mov edi, dword [ebp - 0x262c]
add esp, 0x10
test edi, edi
je 0x4b1461
cmp byte [0x555281], 0
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0xe4]
movsd xmm0, qword [ebp - 0x2628]
je 0x4b1420
test eax, eax
jle 0x4b1410
push eax
push ecx
sub esp, 8
lea eax, [ebp - 0x1690]
movsd qword [esp], xmm0
push 0x50d398
push eax
call fcn.0044c5f0
add esp, 0x18
jmp 0x4b1461
push ecx
sub esp, 8
movsd qword [esp], xmm0
push 0x5140ec
jmp 0x4b1452
test eax, eax
jle 0x4b1444
push eax
push ecx
sub esp, 8
lea eax, [ebp - 0x1690]
movsd qword [esp], xmm0
push 0x50d3b8
push eax
call fcn.0044c5f0
add esp, 0x18
jmp 0x4b1461
push ecx
sub esp, 8
movsd qword [esp], xmm0
push 0x514108
lea eax, [ebp - 0x1690]
push eax
call fcn.0044c5f0
add esp, 0x14
movsd xmm0, qword [ebp - 0x2650]
lea eax, [ebp - 0x1690]
push eax
sub esp, 0x10
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x1f60]
movsd qword [esp], xmm0
push dword [0x556aec]
push dword [0x556ae8]
push dword [0x556ad4]
call fcn.004596e0
add esp, 0x20
cmp dword [0x5509d0], 0
je 0x4b1530
push dword [0x556ae0]
mov esi, dword [ebp - 0x26ec]
push dword [0x556adc]
push dword [0x556acc]
push esi
push dword [0x556ad8]
push 0
push dword [0x555f60]
push dword [ebp - 0x25b8]
push dword [ebp - 0x25d8]
call fcn.004c3d20
push edx
push eax
push dword [0x556aec]
push dword [0x556ae8]
call fcn.0045bed0
movsd xmm0, qword [ebp - 0x2750]
add esp, 0x1c
fstp dword [ebp - 0x264c]
movsd qword [esp], xmm0
movss xmm0, dword [ebp - 0x264c]
cvtps2pd xmm0, xmm0
push esi
sub esp, 8
movsd qword [esp], xmm0
push dword [0x556ad8]
call fcn.004b9cc0
add esp, 0x18
cmp dword [0x5679ec], 0
je 0x4b1548
push 0x5678b0
mov ecx, 0x5679e8
call fcn.0045ca90
cmp dword [0x567a04], 0
je 0x4b1560
push 0x567918
mov ecx, 0x567a00
call fcn.0045ca90
cmp dword [0x567a1c], 0
je 0x4b1578
push 0x567980
mov ecx, 0x567a18
call fcn.0045ca90
push 0xfffffffffffffffe
push 0x41f
push dword [0x555ecc]
push 1
call fcn.00473c50
push 0xfffffffffffffffe
push 0x424
push dword [0x555ecc]
push 1
call fcn.00473c50
push 0xfffffffffffffffe
push 0x427
push dword [0x555ecc]
push 1
call fcn.00473c50
push 0xfffffffffffffffe
push 0x672
push dword [0x555ecc]
push 1
call fcn.00473c50
movsd xmm0, qword [ebp - 0x2628]
add esp, 0x38
movsd qword [esp], xmm0
movsd xmm0, qword [ebp - 0x1f60]
push edi
sub esp, 8
movsd qword [esp], xmm0
push dword [0x556ad4]
call fcn.004b9cc0
movsd xmm0, qword [ebp - 0x2778]
add esp, 0x10
movsd qword [esp], xmm0
push dword [0x556ad0]
call fcn.004b9c10
movsd xmm0, qword [ebp - 0x2768]
add esp, 4
movsd qword [esp], xmm0
push dword [0x556ae4]
call fcn.004ba430
mov eax, dword [ebp - 0x2574]
add esp, 0xc
cmp byte [ebx + 0xc], 0
mov ecx, 1
movzx eax, al
cmovne eax, ecx
cmp dword [0x53b5ec], 0
mov dword [ebp - 0x264c], eax
je 0x4b1767
cmp dword [0x538604], 0xffffffff
je 0x4b172f
mov esi, dword [ebp - 0x25e0]
push 0
push 0
push 0x1004
push dword [0x555ecc]
mov dword [ebp - 0x1f08], 0
mov dword [ebp - 0x1f0c], 4
mov dword [ebp - 0x1f04], 0
call esi
cmp dword [ebp - 0x1f08], eax
jge 0x4b175d
lea eax, [ebp - 0x1f0c]
push eax
push 0
push 0x104b
push dword [0x555ecc]
call esi
mov eax, dword [ebp - 0x1eec]
mov eax, dword [eax + 0x24]
cmp eax, dword [0x538604]
je 0x4b16ff
inc dword [ebp - 0x1f08]
push 0
push 0
push 0x1004
push dword [0x555ecc]
mov dword [ebp - 0x1f0c], 4
mov dword [ebp - 0x1f04], 0
call esi
cmp dword [ebp - 0x1f08], eax
jl 0x4b16a3
jmp 0x4b175d
lea eax, [ebp - 0x1ed0]
mov dword [ebp - 0x1ec0], 3
push eax
push dword [ebp - 0x1f08]
mov dword [ebp - 0x1ec4], 3
push 0x102b
push dword [0x555ecc]
call esi
jmp 0x4b175d
lea eax, [ebp - 0x1f0c]
mov dword [ebp - 0x1efc], 3
push eax
push 0
push 0x102b
push dword [0x555ecc]
mov dword [ebp - 0x1f00], 3
call dword [ebp - 0x25e0]
mov dword [0x53b5ec], 0
mov edi, dword [0x5567f0]
mov esi, dword [edi]
cmp byte [esi + 0xd], 0
jne 0x4b17c8
push dword [esi + 0x28]
call dword [ebp - 0x25bc]
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4b17a4
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4b17a0
cmp esi, dword [eax + 8]
jne 0x4b17a0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4b1790
mov esi, eax
jmp 0x4b17bc
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4b17bc
nop
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4b17b0
cmp byte [esi + 0xd], 0
je 0x4b1775
mov edi, dword [0x5567f0]
push dword [edi + 4]
mov ecx, 0x5567f0
push 0x5567f0
call fcn.00487f50
mov dword [edi + 4], edi
mov dword [edi], edi
mov dword [edi + 8], edi
mov edi, dword [0x5567f8]
mov dword [0x5567f4], 0
mov esi, dword [edi]
cmp byte [esi + 0xd], 0
jne 0x4b1858
nop word [eax + eax]
push dword [esi + 0x28]
call dword [ebp - 0x25bc]
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4b1834
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4b1830
nop dword [eax + eax]
cmp esi, dword [eax + 8]
jne 0x4b1830
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4b1820
mov esi, eax
jmp 0x4b184c
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4b184c
nop
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4b1840
cmp byte [esi + 0xd], 0
je 0x4b1800
mov edi, dword [0x5567f8]
push dword [edi + 4]
mov ecx, 0x5567f8
push 0x5567f8
call fcn.00487f50
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x264c]
xor ecx, ebp
mov dword [edi + 4], edi
mov dword [edi], edi
mov dword [edi + 8], edi
pop edi
mov dword [0x5567fc], 0
pop esi
call fcn.004c3287
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00413ca0
call fcn.004c8bcf
call fcn.00413cb0
push 0xfffffffffffffff3
dec edx
add cl, bh
dec edx
add ch, ch
dec edx
add ah, ah
dec edx
add bl, bl
dec edx
add dl, dl
dec edx
add cl, cl
dec edx
add byte [edx + 0x4af3], al
add dword [ecx], eax
add dword [ecx], eax
add al, byte [edx]
add eax, dword [ebx]
add eax, dword [esp + eax]
add eax, 117769477
pop es
pop es
pop es
pop es
pop es
pop es
pop es
push es
int3