Function at 0x49ed70
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9273
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xab0
mov eax, dword [0x645300]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c8], edx
mov dword [ebp - 0x3c4], ecx
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00546d20
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
mov dword [ebp - 0x348], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x344], 0
movups xmmword [ebp - 0x358], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49ee10
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x358]
call fcn.004060e0
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xorps xmm0, xmm0
mov dword [ebp - 0x2a0], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x29c], 0
movups xmmword [ebp - 0x2b0], xmm0
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49ee80
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2b0]
call fcn.004060e0
mov esi, SysReAllocString
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2a0]
mov eax, esi
sub eax, ecx
cmp eax, 0xe
jb 0x4a0289
cmp dword [ebp - 0x29c], 7
lea eax, [ebp - 0x2b0]
push 0xe
cmova eax, dword [ebp - 0x2b0]
push str.XYlauncher.exe
push ecx
push eax
push ecx
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x2f8]
call fcn.00489790
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x310]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x300], 0
push str.xunyou
movups xmmword [ebp - 0x310], xmm0
mov dword [ebp - 0x2fc], 0
call fcn.004060e0
lea eax, [ebp - 0x2f8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.004a02b0
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.004a02b0
mov byte [ebp - 4], 5
mov edi, dword [ebp - 0x288]
test edi, edi
je 0x4a0094
cmp dword [ebp - 0x318], 0
je 0x4a0094
mov edx, dword [ebp - 0x3c4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov edx, dword [edx]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x3c4], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49efa0
sub ecx, dword [ebp - 0x3c4]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x250]
call fcn.004060e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x250]
cmp dword [ebp - 0x23c], 7
mov edx, dword [ebp - 0x240]
cmova ecx, dword [ebp - 0x250]
push 0x11
push str._startbylauncher
push 0
call fcn.0043e2e0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x49f455
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x45e7b273
mul ecx
lea ecx, [ebp - 0x404]
shr edx, 0xe
call fcn.00479630
mov edi, eax
mov byte [ebp - 4], 7
mov ecx, esi
mov edx, dword [ebp - 0x300]
sub ecx, edx
cmp ecx, 1
jb 0x4a028e
cmp dword [ebp - 0x2fc], 7
lea eax, [ebp - 0x310]
push 1
cmova eax, dword [ebp - 0x310]
push 0x5fd8cc
push edx
push eax
push ecx
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x268]
call fcn.00489790
lea eax, [ebp - 0x328]
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0x268]
lea ecx, [ebp - 0x44c]
call fcn.0043dbc0
add esp, 4
push 0x5fd8cc
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x464]
call fcn.00434120
add esp, 4
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0xa
push ecx
mov edx, eax
lea ecx, [ebp - 0x47c]
call fcn.0043dbc0
add esp, 4
push 0x5fd8cc
mov edx, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x280]
call fcn.00434120
add esp, 4
push edi
push eax
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0xc
call fcn.004361f0
lea ecx, [ebp - 0x280]
call fcn.00405d20
lea ecx, [ebp - 0x47c]
call fcn.00405d20
lea ecx, [ebp - 0x464]
call fcn.00405d20
lea ecx, [ebp - 0x44c]
call fcn.00405d20
lea ecx, [ebp - 0x268]
call fcn.00405d20
lea ecx, [ebp - 0x404]
mov byte [ebp - 4], 0x13
call fcn.00405d20
cmp dword [ebp - 0x32c], 7
lea eax, [ebp - 0x340]
lea ecx, [ebp - 0x504]
cmova eax, dword [ebp - 0x340]
push 3
mov dword [ebp - 0x508], ecx
lea ecx, [ebp - 0x508]
push eax
call fcn.00403fd0
xorps xmm0, xmm0
mov byte [ebp - 4], 0x14
movups xmmword [ebp - 0x3ec], xmm0
mov edx, dword [ebp - 0x508]
mov ecx, edx
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x3d8], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49f181
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x3ec]
call fcn.00406ff0
push ecx
lea edx, [ebp - 0x3ec]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x434]
call fcn.00440500
add esp, 4
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 0xf
jbe 0x49f1bc
mov eax, dword [eax]
lea ecx, [ebp - 0x7a4]
push 3
mov dword [ebp - 0x7a8], ecx
lea ecx, [ebp - 0x7a8]
push eax
call fcn.00413b10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x41c]
push dword [ebp - 0x7a8]
call fcn.004160c0
push eax
mov edx, 0x5fd8d0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x280]
call fcn.00435be0
add esp, 4
lea ecx, [ebp - 0x41c]
call fcn.00405d20
mov eax, dword [ebp - 0x7a8]
lea ecx, [ebp - 0x7a4]
cmp eax, ecx
je 0x49f227
push eax
call fcn.00560701
add esp, 4
lea ecx, [ebp - 0x434]
call fcn.00406930
lea ecx, [ebp - 0x3ec]
call fcn.00406930
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x504]
mov eax, dword [ebp - 0x508]
cmp eax, ecx
je 0x49f25a
push eax
call fcn.00560701
add esp, 4
mov ecx, dword [ebp - 0x2e8]
sub esi, ecx
cmp esi, 1
jb 0x4a0293
cmp dword [ebp - 0x2e4], 7
lea eax, [ebp - 0x2f8]
push ecx
cmova eax, dword [ebp - 0x2f8]
push eax
push 1
push 0x5ede1c
push ecx
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x268]
call fcn.00489790
push 0x5fd8ec
lea edx, [ebp - 0x268]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x464]
call fcn.00434120
add esp, 4
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x20
push ecx
mov edx, eax
lea ecx, [ebp - 0x44c]
call fcn.0043dbc0
add esp, 4
push 0x5fd8e8
mov edx, eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x404]
call fcn.00434120
add esp, 4
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x22
push ecx
mov edx, eax
lea ecx, [ebp - 0x370]
call fcn.0043dbc0
add esp, 4
lea ecx, [ebp - 0x404]
call fcn.00405d20
lea ecx, [ebp - 0x44c]
call fcn.00405d20
lea ecx, [ebp - 0x464]
call fcn.00405d20
lea ecx, [ebp - 0x268]
call fcn.00405d20
xorps xmm0, xmm0
mov dword [ebp - 0x3b8], 0x44
xor eax, eax
movlpd qword [ebp - 0x3b4], xmm0
cmp dword [ebp - 0x2a0], 0
mov word [ebp - 0x376], ax
mov eax, 5
movlpd qword [ebp - 0x3ac], xmm0
movlpd qword [ebp - 0x3a4], xmm0
movlpd qword [ebp - 0x39c], xmm0
movlpd qword [ebp - 0x394], xmm0
movlpd qword [ebp - 0x386], xmm0
movlpd qword [ebp - 0x37e], xmm0
mov dword [ebp - 0x38c], 1
mov word [ebp - 0x388], ax
jne 0x49f3a3
xor ecx, ecx
jmp 0x49f3b7
cmp dword [ebp - 0x29c], 7
lea ecx, [ebp - 0x2b0]
cmova ecx, dword [ebp - 0x2b0]
cmp dword [ebp - 0x35c], 7
lea edx, [ebp - 0x260]
push edx
lea edx, [ebp - 0x3b8]
push edx
push ecx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x370]
cmova eax, dword [ebp - 0x370]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x49f409
push dword [ebp - 0x25c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x260]
call esi
jmp 0x49f41d
push 0x10
push 0x5fcbbc
push 0x5fd8f4
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x370]
call fcn.00405d20
lea ecx, [ebp - 0x280]
call fcn.00405d20
lea ecx, [ebp - 0x340]
call fcn.00405d20
lea ecx, [ebp - 0x250]
mov byte [ebp - 0x3b9], 0
call fcn.00405d20
jmp 0x4a00af
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x258], 0
push 0x5e1c70
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x254], 0
movups xmmword [ebp - 0x268], xmm0
call fcn.004060e0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2e0]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
push 0x5e1c70
movups xmmword [ebp - 0x2e0], xmm0
mov dword [ebp - 0x2cc], 0
call fcn.004060e0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x2c8]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x2b8], 0
push 0x5e1c70
movups xmmword [ebp - 0x2c8], xmm0
mov dword [ebp - 0x2b4], 0
call fcn.004060e0
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
xor eax, eax
mov dword [ebp - 0x224], 7
movups xmmword [ebp - 0x238], xmm0
mov word [ebp - 0x238], ax
mov edx, dword [ebp - 0x3c8]
mov byte [ebp - 4], 0x26
mov edx, dword [edx]
cmp edx, 1
jb 0x49f763
dec edx
lea ecx, [ebp - 0x44c]
call fcn.004352f0
mov dword [ebp - 0x3c4], eax
mov ecx, esi
mov byte [ebp - 4], 0x27
sub ecx, edi
cmp ecx, 9
jb 0x4a0298
cmp dword [ebp - 0x284], 7
lea eax, [ebp - 0x298]
push edi
cmova eax, dword [ebp - 0x298]
push eax
push 9
push str.launcher_
push ecx
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x340]
call fcn.00489790
push 0x5fd8cc
lea edx, [ebp - 0x340]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x404]
call fcn.00434120
add esp, 4
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x29
push ecx
mov edx, eax
lea ecx, [ebp - 0x41c]
call fcn.0043dbc0
add esp, 4
push 0x5fd8cc
mov edx, eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x434]
call fcn.00434120
add esp, 4
push dword [ebp - 0x3c4]
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x2b
push eax
push dword [ebp - 0x3c0]
call fcn.004361f0
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x238]
call fcn.00489a80
lea ecx, [ebp - 0x280]
call fcn.00405d20
lea ecx, [ebp - 0x434]
call fcn.00405d20
lea ecx, [ebp - 0x41c]
call fcn.00405d20
lea ecx, [ebp - 0x404]
call fcn.00405d20
lea ecx, [ebp - 0x340]
call fcn.00405d20
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0x26
call fcn.00405d20
cmp dword [ebp - 0x224], 7
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x58c]
cmova eax, dword [ebp - 0x238]
push 3
mov dword [ebp - 0x590], ecx
lea ecx, [ebp - 0x590]
push eax
call fcn.00403fd0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x280]
push dword [ebp - 0x590]
call fcn.004070c0
push ecx
lea edx, [ebp - 0x280]
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x404]
call fcn.00440500
add esp, 4
mov byte [ebp - 4], 0x2e
cmp dword [eax + 0x14], 0xf
jbe 0x49f6a8
mov eax, dword [eax]
lea ecx, [ebp - 0x8ac]
push 3
mov dword [ebp - 0x8b0], ecx
lea ecx, [ebp - 0x8b0]
push eax
call fcn.00413b10
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x41c]
push dword [ebp - 0x8b0]
call fcn.004160c0
push eax
mov edx, 0x5fd8d0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x434]
call fcn.00435be0
add esp, 4
lea ecx, [ebp - 0x268]
push eax
call fcn.00489a80
lea ecx, [ebp - 0x434]
call fcn.00405d20
lea ecx, [ebp - 0x41c]
call fcn.00405d20
mov eax, dword [ebp - 0x8b0]
lea ecx, [ebp - 0x8ac]
cmp eax, ecx
je 0x49f72a
push eax
call fcn.00560701
add esp, 4
lea ecx, [ebp - 0x404]
call fcn.00406930
lea ecx, [ebp - 0x280]
call fcn.00406930
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x58c]
mov eax, dword [ebp - 0x590]
cmp eax, ecx
je 0x49f75d
push eax
call fcn.00560701
add esp, 4
mov edi, dword [ebp - 0x288]
mov edx, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x44c]
mov edx, dword [edx]
call fcn.004352f0
mov dword [ebp - 0x3c4], eax
mov ecx, esi
mov byte [ebp - 4], 0x31
sub ecx, edi
cmp ecx, 9
jb 0x4a029d
cmp dword [ebp - 0x284], 7
lea eax, [ebp - 0x298]
push edi
cmova eax, dword [ebp - 0x298]
push eax
push 9
push str.launcher_
push ecx
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x280]
call fcn.00489790
push 0x5fd8cc
lea edx, [ebp - 0x280]
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x404]
call fcn.00434120
add esp, 4
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x33
push ecx
mov edx, eax
lea ecx, [ebp - 0x41c]
call fcn.0043dbc0
add esp, 4
push 0x5fd8cc
mov edx, eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x434]
call fcn.00434120
add esp, 4
push dword [ebp - 0x3c4]
lea ecx, [ebp - 0x3ec]
mov byte [ebp - 4], 0x35
push eax
push dword [ebp - 0x3c0]
call fcn.004361f0
lea ecx, [ebp - 0x238]
call fcn.00405cc0
movups xmm0, xmmword [ebp - 0x3ec]
xor eax, eax
lea ecx, [ebp - 0x3ec]
mov word [ebp - 0x3ec], ax
movups xmmword [ebp - 0x238], xmm0
movq xmm0, qword [ebp - 0x3dc]
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x3d8], 7
call fcn.00405d20
lea ecx, [ebp - 0x434]
call fcn.00405d20
lea ecx, [ebp - 0x41c]
call fcn.00405d20
lea ecx, [ebp - 0x404]
call fcn.00405d20
lea ecx, [ebp - 0x280]
call fcn.00405d20
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0x26
call fcn.00405d20
cmp dword [ebp - 0x224], 7
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x614]
cmova eax, dword [ebp - 0x238]
push 3
mov dword [ebp - 0x618], ecx
lea ecx, [ebp - 0x618]
push eax
call fcn.00403fd0
mov byte [ebp - 4], 0x36
xorps xmm0, xmm0
mov edx, dword [ebp - 0x618]
mov ecx, edx
movups xmmword [ebp - 0x3ec], xmm0
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x3d8], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49f910
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x3ec]
call fcn.00406ff0
push ecx
lea edx, [ebp - 0x3ec]
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x404]
call fcn.00440500
add esp, 4
mov byte [ebp - 4], 0x38
cmp dword [eax + 0x14], 0xf
jbe 0x49f94b
mov eax, dword [eax]
lea ecx, [ebp - 0x9b4]
push 3
mov dword [ebp - 0x9b8], ecx
lea ecx, [ebp - 0x9b8]
push eax
call fcn.00413b10
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x41c]
push dword [ebp - 0x9b8]
call fcn.004160c0
push eax
mov edx, 0x5fd8d0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x434]
call fcn.00435be0
mov edi, eax
add esp, 4
lea eax, [ebp - 0x2e0]
cmp eax, edi
je 0x49f9cf
mov ecx, eax
call fcn.00405cc0
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [ebp - 0x2e0], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x2d0], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea ecx, [ebp - 0x434]
call fcn.00405d20
lea ecx, [ebp - 0x41c]
call fcn.00405d20
mov eax, dword [ebp - 0x9b8]
lea ecx, [ebp - 0x9b4]
cmp eax, ecx
je 0x49f9fe
push eax
call fcn.00560701
add esp, 4
lea ecx, [ebp - 0x404]
call fcn.00406930
lea ecx, [ebp - 0x3ec]
call fcn.00406930
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x614]
mov eax, dword [ebp - 0x618]
cmp eax, ecx
je 0x49fa31
push eax
call fcn.00560701
add esp, 4
mov eax, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x44c]
mov edx, dword [eax]
inc edx
call fcn.004352f0
mov edi, eax
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x288]
sub esi, ecx
cmp esi, 9
jb 0x4a02a2
cmp dword [ebp - 0x284], 7
lea eax, [ebp - 0x298]
push ecx
cmova eax, dword [ebp - 0x298]
push eax
push 9
push str.launcher_
push ecx
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x280]
call fcn.00489790
push 0x5fd8cc
lea edx, [ebp - 0x280]
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x404]
call fcn.00434120
add esp, 4
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x3d
push ecx
mov edx, eax
lea ecx, [ebp - 0x41c]
call fcn.0043dbc0
add esp, 4
push 0x5fd8cc
mov edx, eax
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x434]
call fcn.00434120
add esp, 4
push edi
push eax
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x3ec]
mov byte [ebp - 4], 0x3f
call fcn.004361f0
lea ecx, [ebp - 0x238]
call fcn.00405cc0
movups xmm0, xmmword [ebp - 0x3ec]
xor eax, eax
lea ecx, [ebp - 0x3ec]
mov word [ebp - 0x3ec], ax
movups xmmword [ebp - 0x238], xmm0
movq xmm0, qword [ebp - 0x3dc]
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x3d8], 7
call fcn.00405d20
lea ecx, [ebp - 0x434]
call fcn.00405d20
lea ecx, [ebp - 0x41c]
call fcn.00405d20
lea ecx, [ebp - 0x404]
call fcn.00405d20
lea ecx, [ebp - 0x280]
call fcn.00405d20
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0x26
call fcn.00405d20
cmp dword [ebp - 0x224], 7
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x69c]
cmova eax, dword [ebp - 0x238]
push 3
mov dword [ebp - 0x6a0], ecx
lea ecx, [ebp - 0x6a0]
push eax
call fcn.00403fd0
mov byte [ebp - 4], 0x40
xorps xmm0, xmm0
mov edx, dword [ebp - 0x6a0]
mov ecx, edx
movups xmmword [ebp - 0x3ec], xmm0
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x3d8], 0
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49fbe0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x3ec]
call fcn.00406ff0
push ecx
lea edx, [ebp - 0x3ec]
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x404]
call fcn.00440500
add esp, 4
mov byte [ebp - 4], 0x42
cmp dword [eax + 0x14], 0xf
jbe 0x49fc1b
mov eax, dword [eax]
lea ecx, [ebp - 0xabc]
push 3
mov dword [ebp - 0xac0], ecx
lea ecx, [ebp - 0xac0]
push eax
call fcn.00413b10
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x41c]
push dword [ebp - 0xac0]
call fcn.004160c0
push eax
mov edx, 0x5fd8d0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x434]
call fcn.00435be0
mov esi, eax
add esp, 4
lea eax, [ebp - 0x2c8]
cmp eax, esi
je 0x49fc9f
mov ecx, eax
call fcn.00405cc0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x2c8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x2b8], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x434]
call fcn.00405d20
lea ecx, [ebp - 0x41c]
call fcn.00405d20
mov eax, dword [ebp - 0xac0]
lea ecx, [ebp - 0xabc]
cmp eax, ecx
je 0x49fcce
push eax
call fcn.00560701
add esp, 4
lea ecx, [ebp - 0x404]
call fcn.00406930
lea ecx, [ebp - 0x3ec]
call fcn.00406930
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x69c]
mov eax, dword [ebp - 0x6a0]
cmp eax, ecx
je 0x49fd01
push eax
call fcn.00560701
add esp, 4
mov edi, dword [ebp - 0x258]
mov eax, dword [ebp - 0x240]
mov byte [ebp - 0x3c8], 0
test edi, edi
je 0x49fe05
cmp dword [ebp - 0x254], 7
lea ecx, [ebp - 0x268]
lea edx, [ebp - 0x250]
cmova ecx, dword [ebp - 0x268]
cmp dword [ebp - 0x23c], 7
mov dword [ebp - 0x3c4], ecx
cmova edx, dword [ebp - 0x250]
mov dword [ebp - 0x3c0], edx
cmp edi, eax
ja 0x49fe05
movzx ecx, word [ecx]
sub eax, edi
inc eax
mov dword [ebp - 0x3d0], ecx
lea eax, [edx + eax*2]
mov dword [ebp - 0x3d4], eax
nop dword [eax]
sub eax, edx
mov esi, 0
sar eax, 1
je 0x49fd90
cmp word [edx], cx
je 0x49fd8e
cmp eax, 1
je 0x49fd90
add edx, 2
dec eax
cmp word [edx], cx
jne 0x49fd80
mov esi, edx
mov edx, esi
test edx, edx
je 0x49fe05
mov ecx, dword [ebp - 0x3c4]
mov esi, ecx
test edi, edi
je 0x49fde3
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x3cc], eax
nop dword [eax]
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x49fdcc
add esi, 2
sub edi, 1
je 0x49fde3
mov eax, dword [ebp - 0x3cc]
jmp 0x49fdb0
mov ecx, dword [ebp - 0x3d0]
add edx, 2
mov edi, dword [ebp - 0x258]
mov eax, dword [ebp - 0x3d4]
jmp 0x49fd70
sub edx, dword [ebp - 0x3c0]
mov ecx, 1
mov eax, dword [ebp - 0x3c8]
sar edx, 1
cmp edx, 0xffffffff
movzx eax, al
cmovne eax, ecx
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x2cc], 7
lea eax, [ebp - 0x2e0]
mov edi, dword [ebp - 0x2d0]
lea edx, [ebp - 0x250]
cmova eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x23c], 7
mov ecx, dword [ebp - 0x240]
cmova edx, dword [ebp - 0x250]
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3c4], edx
cmp edi, ecx
ja 0x49fef7
sub ecx, edi
test edi, edi
je 0x49fef0
inc ecx
lea esi, [edx + ecx*2]
movzx ecx, word [eax]
mov dword [ebp - 0x3cc], esi
mov dword [ebp - 0x3d0], ecx
nop word [eax + eax]
mov eax, esi
mov esi, 0
sub eax, edx
sar eax, 1
je 0x49fe92
cmp word [edx], cx
je 0x49fe90
cmp eax, 1
je 0x49fe92
add edx, 2
dec eax
cmp word [edx], cx
jne 0x49fe82
mov esi, edx
mov edx, esi
test edx, edx
je 0x49fef7
mov ecx, dword [ebp - 0x3c0]
mov esi, ecx
test edi, edi
je 0x49fee3
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x3d4], eax
nop
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x49fecc
add esi, 2
sub edi, 1
je 0x49fee3
mov eax, dword [ebp - 0x3d4]
jmp 0x49feb0
mov ecx, dword [ebp - 0x3d0]
add edx, 2
mov edi, dword [ebp - 0x2d0]
mov esi, dword [ebp - 0x3cc]
jmp 0x49fe70
sub edx, dword [ebp - 0x3c4]
sar edx, 1
cmp edx, 0xffffffff
je 0x49fef7
mov byte [ebp - 0x3c8], 1
cmp dword [ebp - 0x2b4], 7
lea ecx, [ebp - 0x2c8]
mov edi, dword [ebp - 0x2b8]
lea eax, [ebp - 0x250]
cmova ecx, dword [ebp - 0x2c8]
cmp dword [ebp - 0x23c], 7
mov edx, dword [ebp - 0x240]
cmova eax, dword [ebp - 0x250]
mov dword [ebp - 0x3c0], ecx
mov dword [ebp - 0x3c4], eax
cmp edi, edx
ja 0x49ffe0
sub edx, edi
test edi, edi
je 0x49fff7
inc edx
lea esi, [eax + edx*2]
movzx edx, word [ecx]
mov dword [ebp - 0x3cc], esi
mov dword [ebp - 0x3d0], edx
nop dword [eax]
mov ecx, esi
mov esi, 0
sub ecx, eax
sar ecx, 1
je 0x49ff82
cmp word [eax], dx
je 0x49ff80
cmp ecx, 1
je 0x49ff82
add eax, 2
dec ecx
cmp word [eax], dx
jne 0x49ff72
mov esi, eax
mov eax, esi
test eax, eax
je 0x49ffe0
mov edx, dword [ebp - 0x3c0]
mov esi, edx
test edi, edi
je 0x49ffd3
mov ecx, eax
sub ecx, edx
mov dword [ebp - 0x3d4], ecx
nop
movzx edx, word [esi + ecx]
movzx ecx, word [esi]
cmp dx, cx
jne 0x49ffbc
add esi, 2
sub edi, 1
je 0x49ffd3
mov ecx, dword [ebp - 0x3d4]
jmp 0x49ffa0
mov edx, dword [ebp - 0x3d0]
add eax, 2
mov edi, dword [ebp - 0x2b8]
mov esi, dword [ebp - 0x3cc]
jmp 0x49ff60
sub eax, dword [ebp - 0x3c4]
sar eax, 1
cmp eax, 0xffffffff
jne 0x49fff7
cmp byte [ebp - 0x3c8], 0
jne 0x49fff7
push 0x10
push 0x5fcbbc
push 0x5fd928
jmp 0x4a000c
call fcn.004a0490
test al, al
jne 0x4a0054
push 0x10
push 0x5fcbbc
push 0x5fd948
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x238]
call fcn.00405d20
lea ecx, [ebp - 0x2c8]
call fcn.00405d20
lea ecx, [ebp - 0x2e0]
call fcn.00405d20
lea ecx, [ebp - 0x268]
call fcn.00405d20
lea ecx, [ebp - 0x250]
mov byte [ebp - 0x3b9], 0
call fcn.00405d20
jmp 0x4a00af
lea ecx, [ebp - 0x238]
call fcn.00405d20
lea ecx, [ebp - 0x2c8]
call fcn.00405d20
lea ecx, [ebp - 0x2e0]
call fcn.00405d20
lea ecx, [ebp - 0x268]
call fcn.00405d20
lea ecx, [ebp - 0x250]
mov byte [ebp - 0x3b9], 1
call fcn.00405d20
jmp 0x4a00af
push 0x10
push 0x5fcbbc
push str._N1Y
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x3b9], 0
mov ecx, dword [ebp - 0x314]
cmp ecx, 7
jbe 0x4a00ef
mov edx, dword [ebp - 0x328]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4a00e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a02a7
push ecx
push edx
call fcn.00543bbf
add esp, 8
mov ecx, dword [ebp - 0x284]
cmp ecx, 7
jbe 0x4a012f
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4a0125
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a02a7
push ecx
push edx
call fcn.00543bbf
add esp, 8
mov ecx, dword [ebp - 0x2fc]
cmp ecx, 7
jbe 0x4a016f
mov edx, dword [ebp - 0x310]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4a0165
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a02a7
push ecx
push edx
call fcn.00543bbf
add esp, 8
mov ecx, dword [ebp - 0x2e4]
cmp ecx, 7
jbe 0x4a01af
mov edx, dword [ebp - 0x2f8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4a01a5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a02a7
push ecx
push edx
call fcn.00543bbf
add esp, 8
mov ecx, dword [ebp - 0x29c]
xor eax, eax
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e4], 7
mov word [ebp - 0x2f8], ax
cmp ecx, 7
jbe 0x4a020c
mov edx, dword [ebp - 0x2b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4a0202
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a02a7
push ecx
push edx
call fcn.00543bbf
add esp, 8
mov ecx, dword [ebp - 0x344]
xor eax, eax
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 7
mov word [ebp - 0x2b0], ax
cmp ecx, 7
jbe 0x4a0265
mov edx, dword [ebp - 0x358]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4a025b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a02a7
push ecx
push edx
call fcn.00543bbf
add esp, 8
mov al, byte [ebp - 0x3b9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00543bb1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00406a10
call fcn.00406a10
call fcn.00406a10
call fcn.00406a10
call fcn.00406a10
call fcn.00406a10
call fcn.00560663
int3