Function at 0x49f92c
Capabilities:
Copy file
Create process on windows
Create thread
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x49f934
push ebx
push esi
push edi
mov eax, 0x49de54
call fcn.00407604
xor eax, eax
push ebp
push 0x4a06db
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
call fcn.0048e5e8
mov dl, 1
mov eax, dword [0x49d8a0]
call fcn.0049d934
mov ebx, eax
lea ecx, [ebp - 0x14]
mov edx, 0x4a06f4
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4a4b84]
call fcn.004054c0
lea ecx, [ebp - 0x18]
mov edx, 0x4a0700
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4a5034]
call fcn.004054c0
lea ecx, [ebp - 0x1c]
mov edx, 0x4a0710
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x4a4d04]
call fcn.004054c0
lea ecx, [ebp - 0x20]
mov edx, 0x4a071c
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x20]
mov eax, dword [0x4a4f54]
call fcn.004054c0
lea ecx, [ebp - 0x24]
mov edx, 0x4a072c
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x24]
mov eax, dword [0x4a4ba8]
call fcn.004054c0
lea ecx, [ebp - 0x28]
mov edx, 0x4a073c
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x28]
mov eax, dword [0x4a4f5c]
call fcn.004054c0
lea ecx, [ebp - 0x2c]
mov edx, 0x4a0750
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4a4f40]
call fcn.004054c0
lea ecx, [ebp - 0x30]
mov edx, 0x4a0760
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4a4f8c]
call fcn.004054c0
lea ecx, [ebp - 0x34]
mov edx, 0x4a0770
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x34]
mov eax, dword [0x4a4da4]
call fcn.004054c0
lea ecx, [ebp - 0x38]
mov edx, 0x4a0780
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x38]
mov eax, dword [0x4a4f78]
call fcn.004054c0
lea ecx, [ebp - 0x3c]
mov edx, 0x4a0794
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x4a5168]
call fcn.004054c0
lea ecx, [ebp - 0x40]
mov edx, 0x4a07a4
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x40]
mov eax, dword [0x4a4f04]
call fcn.004054c0
lea ecx, [ebp - 0x44]
mov edx, 0x4a07b4
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x44]
mov eax, dword [0x4a4e14]
call fcn.004054c0
lea ecx, [ebp - 0x48]
mov edx, 0x4a07c8
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x48]
mov eax, dword [0x4a4f80]
call fcn.004054c0
lea ecx, [ebp - 0x4c]
mov edx, 0x4a07d8
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x4a4da0]
call fcn.004054c0
lea ecx, [ebp - 0x50]
mov edx, 0x4a07e8
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x50]
mov eax, dword [0x4a5068]
call fcn.004054c0
lea ecx, [ebp - 0x54]
mov edx, 0x4a07fc
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x54]
mov eax, dword [0x4a4ea8]
call fcn.004054c0
lea ecx, [ebp - 0x58]
mov edx, 0x4a0810
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x58]
mov eax, dword [0x4a4e8c]
call fcn.004054c0
lea ecx, [ebp - 0x5c]
mov edx, 0x4a0820
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x4a5050]
call fcn.004054c0
lea ecx, [ebp - 0x60]
mov edx, 0x4a0830
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x60]
mov eax, dword [0x4a4ec4]
call fcn.004054c0
lea ecx, [ebp - 0x64]
mov edx, 0x4a0844
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x64]
mov eax, dword [0x4a4b6c]
call fcn.004054c0
lea ecx, [ebp - 0x68]
mov edx, 0x4a0854
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x68]
mov eax, dword [0x4a4f28]
call fcn.004054c0
lea ecx, [ebp - 0x6c]
mov edx, 0x4a0864
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x4a4e4c]
call fcn.004054c0
lea ecx, [ebp - 0x70]
mov edx, 0x4a0874
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x70]
mov eax, dword [0x4a4ea4]
call fcn.004054c0
lea ecx, [ebp - 0x74]
mov edx, 0x4a0884
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x74]
mov eax, dword [0x4a4b98]
call fcn.004054c0
lea ecx, [ebp - 0x78]
mov edx, 0x4a0894
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x78]
mov eax, dword [0x4a4b4c]
call fcn.004054c0
lea ecx, [ebp - 0x7c]
mov edx, 0x4a08a4
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x4a4e0c]
call fcn.004054c0
lea ecx, [ebp - 0x80]
mov edx, 0x4a08b4
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x80]
mov eax, dword [0x4a4fb4]
call fcn.004054c0
lea ecx, [ebp - 0x84]
mov edx, 0x4a08c4
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x84]
mov eax, dword [0x4a500c]
call fcn.004054c0
lea ecx, [ebp - 0x88]
mov edx, 0x4a08d0
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x88]
mov eax, dword [0x4a502c]
call fcn.004054c0
lea ecx, [ebp - 0x8c]
mov edx, 0x4a08dc
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x4a4e08]
call fcn.004054c0
lea ecx, [ebp - 0x90]
mov edx, 0x4a08e8
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x90]
mov eax, dword [0x4a4c64]
call fcn.004054c0
lea ecx, [ebp - 0x94]
mov edx, 0x4a08f4
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x94]
mov eax, dword [0x4a4f34]
call fcn.004054c0
lea ecx, [ebp - 0x98]
mov edx, 0x4a0900
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x98]
mov eax, dword [0x4a4ea0]
call fcn.004054c0
lea ecx, [ebp - 0x9c]
mov edx, 0x4a090c
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x4a4ba4]
call fcn.004054c0
lea ecx, [ebp - 0xa0]
mov edx, 0x4a0918
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xa0]
mov eax, dword [0x4a4c08]
call fcn.004054c0
lea ecx, [ebp - 0xa4]
mov edx, 0x4a0924
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xa4]
mov eax, dword [0x4a4ecc]
call fcn.004054c0
lea ecx, [ebp - 0xa8]
mov edx, 0x4a0930
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xa8]
mov eax, dword [0x4a507c]
call fcn.004054c0
lea ecx, [ebp - 0xac]
mov edx, 0x4a0940
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xac]
mov eax, dword [0x4a4ec0]
call fcn.004054c0
lea ecx, [ebp - 0xb0]
mov edx, 0x4a0950
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xb0]
mov eax, 0x4ad4ac
call fcn.004054c0
lea ecx, [ebp - 0xb4]
mov edx, 0x4a0960
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xb4]
mov eax, 0x4ad4b0
call fcn.004054c0
lea ecx, [ebp - 0xb8]
mov edx, 0x4a0974
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xb8]
mov eax, 0x4ad4b4
call fcn.004054c0
lea ecx, [ebp - 0xbc]
mov edx, 0x4a0984
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xbc]
mov eax, 0x4ad4b8
call fcn.004054c0
lea ecx, [ebp - 0xc0]
mov edx, 0x4a0998
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xc0]
mov eax, dword [0x4a4d18]
call fcn.004054c0
lea ecx, [ebp - 0xc4]
mov edx, 0x4a09ac
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xc4]
mov eax, dword [0x4a4c74]
call fcn.004054c0
lea ecx, [ebp - 0xc8]
mov edx, 0x4a09bc
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xc8]
mov eax, dword [0x4a4f00]
call fcn.004054c0
lea ecx, [ebp - 0xcc]
mov edx, 0x4a09cc
mov eax, ebx
call fcn.0049d9ec
mov edx, dword [ebp - 0xcc]
mov eax, dword [0x4a4be4]
call fcn.004054c0
mov eax, ebx
call fcn.00404640
lea eax, [ebp - 0xd0]
call fcn.0048ed24
mov edx, dword [ebp - 0xd0]
mov eax, dword [0x4a4ce0]
call fcn.004054c0
lea edx, [ebp - 0xd4]
mov eax, dword [0x4a4ea8]
mov eax, dword [eax]
call fcn.00409a78
cmp dword [ebp - 0xd4], 0
jne 0x49ff52
mov eax, dword [0x4a4ea8]
mov edx, 0x4a09d8
call fcn.004054c0
lea edx, [ebp - 0xd8]
mov eax, dword [0x4a5068]
mov eax, dword [eax]
call fcn.00409a78
cmp dword [ebp - 0xd8], 0
jne 0x49ff7c
mov eax, dword [0x4a5068]
mov edx, 0x4a09d8
call fcn.004054c0
lea edx, [ebp - 0xdc]
mov eax, dword [0x4a4f54]
mov eax, dword [eax]
call fcn.00409a78
cmp dword [ebp - 0xdc], 0
je 0x49ffa9
mov eax, dword [0x4a5078]
mov edx, dword [0x4a4f54]
mov edx, dword [edx]
call fcn.004054c0
mov eax, dword [0x4a4d04]
cmp dword [eax], 0
jne 0x49ffc2
mov eax, dword [0x4a4d04]
mov edx, 0x4a09e4
call fcn.004054c0
lea edx, [ebp - 0xe0]
mov eax, dword [0x4a5034]
mov eax, dword [eax]
call fcn.00409a78
cmp dword [ebp - 0xe0], 0
jne 0x49ffec
mov eax, dword [0x4a5034]
mov edx, 0x4a09f4
call fcn.004054c0
lea ecx, [ebp - 0xe4]
mov edx, dword [0x4a4f40]
mov edx, dword [edx]
mov eax, dword [0x4a4f5c]
mov eax, dword [eax]
call fcn.004863d8
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x4a4c50]
call fcn.004054c0
lea edx, [ebp - 0xf0]
xor eax, eax
call fcn.0040f130
mov eax, dword [ebp - 0xf0]
lea edx, [ebp - 0xec]
call fcn.004096d8
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe8]
call fcn.00409a78
mov eax, dword [ebp - 0xe8]
push eax
lea edx, [ebp - 0xf8]
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.004096d8
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.00409a78
mov edx, dword [ebp - 0xf4]
pop eax
call fcn.00405894
je 0x4a0494
call fcn.0044d20c
test al, al
jne 0x4a0494
xor eax, eax
push ebp
push 0x4a012e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040bb94
fstp qword [0x4ad4bc]
wait
push dword [0x4ad4c0]
push dword [0x4ad4bc]
mov edx, dword [0x4a4d44]
mov edx, dword [edx]
mov eax, 0x4ad4c4
call fcn.0040c7f4
call fcn.0040bbc0
fstp qword [0x4ad4c8]
wait
push dword [0x4ad4cc]
push dword [0x4ad4c8]
mov edx, dword [0x4a4ee8]
mov edx, dword [edx]
mov eax, 0x4ad4d0
call fcn.0040c7f4
push dword [0x4ad4c4]
push 0x4a0a08
push dword [0x4ad4d0]
lea eax, [ebp - 0xfc]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0xfc]
mov edx, dword [0x4a4ce0]
mov edx, dword [edx]
call fcn.0048f6a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0138
mov eax, dword [0x4a4ba8]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0201
lea edx, [ebp - 0x100]
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.0040a49c
mov eax, dword [ebp - 0x100]
call fcn.0040a18c
test al, al
jne 0x4a018d
lea edx, [ebp - 0x104]
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.0040a49c
mov eax, dword [ebp - 0x104]
call fcn.0040a1b0
push 0
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.004058fc
push eax
lea edx, [ebp - 0x108]
xor eax, eax
call fcn.0040f130
mov eax, dword [ebp - 0x108]
call fcn.004058fc
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [0x4a4c50]
mov edx, dword [edx]
mov eax, dword [0x4a4f8c]
mov eax, dword [eax]
call fcn.0048601c
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.00486114
mov eax, dword [0x4a4f78]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0201
mov edx, dword [0x4a5168]
mov edx, dword [edx]
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.0048f908
mov eax, dword [0x4a4f04]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0242
mov eax, dword [0x4a4da0]
mov eax, dword [eax]
call fcn.00409dd8
push eax
mov eax, dword [0x4a4e14]
mov eax, dword [eax]
call fcn.004058fc
push eax
mov eax, dword [0x4a4f80]
mov eax, dword [eax]
call fcn.004058fc
push eax
push 0
call sub.user32.dll_MessageBoxA_1
lea edx, [ebp - 0x10c]
mov eax, dword [0x4a5050]
mov eax, dword [eax]
call fcn.00409a78
cmp dword [ebp - 0x10c], 0
je 0x4a0294
mov eax, dword [0x4a4e8c]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0283
mov eax, dword [0x4a5050]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.0048114c
jmp 0x4a0294
mov eax, dword [0x4a5050]
mov eax, dword [eax]
mov edx, 0x4a09d8
call fcn.0048114c
mov eax, dword [0x4a4ea8]
mov eax, dword [eax]
call fcn.00409dd8
mov edx, eax
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.00481094
mov eax, dword [0x4a5068]
mov eax, dword [eax]
call fcn.00409dd8
mov edx, eax
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.004810e4
mov eax, dword [0x4a4c74]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0313
push 0x4a0a24
lea edx, [ebp - 0x114]
xor eax, eax
call fcn.0040f130
push dword [ebp - 0x114]
push 0x4a0a38
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x110]
call fcn.0048b0c8
mov eax, dword [0x4a4f00]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a03c6
lea edx, [ebp - 0x11c]
xor eax, eax
call fcn.0040f130
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040a49c
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x120], eax
mov ebx, dword [ebp - 0x120]
test ebx, ebx
je 0x4a0363
sub ebx, 4
mov ebx, dword [ebx]
push 0x4a0a24
lea eax, [ebp - 0x128]
push eax
lea edx, [ebp - 0x130]
xor eax, eax
call fcn.0040f130
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.0040a49c
mov eax, dword [ebp - 0x12c]
mov ecx, ebx
dec ecx
mov edx, 1
call fcn.00405964
push dword [ebp - 0x128]
push 0x4a0a38
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x124]
call fcn.0048b0c8
mov eax, dword [0x4ad4ac]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a03e6
call fcn.0048f4e4
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4ad4b4]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a03fc
call fcn.0048fbd0
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.0040a168
test al, al
je 0x4a0494
mov eax, dword [0x4a4ba8]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0494
mov eax, dword [0x4a4da4]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a046e
push 0x4a0a48
lea edx, [ebp - 0x138]
xor eax, eax
call fcn.0040f130
push dword [ebp - 0x138]
push 0x4a0a6c
lea eax, [ebp - 0x134]
mov edx, 3
call fcn.00405800
mov eax, dword [ebp - 0x134]
call fcn.0048b0c8
push 5
push 0
push 0
mov eax, dword [0x4a4c50]
mov eax, dword [eax]
call fcn.004058fc
push eax
push 0x4a0a70
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, dword [0x4a4d18]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a04bf
mov eax, dword [0x4a5094]
push eax
push 0
push 0
push 0x49ddd4
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, dword [0x4a500c]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a04ea
mov eax, dword [0x4a5094]
push eax
push 0
push 0
push 0x49dd50
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, dword [0x4a4e08]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0507
mov eax, 1
call fcn.0048019c
mov eax, dword [0x4a4c64]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0524
mov eax, 1
call fcn.004802dc
mov eax, dword [0x4a4f34]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0545
xor eax, eax
call fcn.0048064c
xor eax, eax
call fcn.004807bc
mov eax, dword [0x4a4ea0]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a055d
call fcn.00480424
mov eax, dword [0x4a4ba4]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0575
call fcn.0048055c
mov eax, dword [0x4a4c08]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a058d
call fcn.00480a24
mov eax, dword [0x4a4ecc]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a05a5
call fcn.00480934
mov eax, dword [0x4a507c]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a05bd
call fcn.00480b14
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [0x4a5034]
mov eax, dword [eax]
call fcn.004058fc
push eax
push 0
push 0
call fcn.004078a8
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x4a05ed
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, dword [0x4ad4b0]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a061e
mov eax, dword [0x4ad4ac]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a061e
call fcn.0048f4e4
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4ad4b8]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0645
mov eax, dword [0x4ad4b4]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a0645
call fcn.0048fbd0
mov eax, dword [0x4a4be4]
mov eax, dword [eax]
mov edx, 0x4a0a18
call fcn.00405894
jne 0x4a065d
call fcn.0044d2c4
lea edx, [ebp - 0x13c]
mov eax, dword [0x4a4fb4]
mov eax, dword [eax]
call fcn.0048e7f8
mov edx, dword [ebp - 0x13c]
mov eax, 0x4ad4a8
call fcn.004054c0
lea edx, [ebp - 0x140]
mov eax, dword [0x4ad4a8]
call fcn.00409a78
cmp dword [ebp - 0x140], 0
je 0x4a06a8
mov eax, dword [0x4a4d04]
mov edx, dword [0x4ad4a8]
call fcn.004054c0
call fcn.0049d2f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a06e2
lea eax, [ebp - 0x140]
mov edx, 8
call fcn.00405490
lea eax, [ebp - 0x11c]
mov edx, 0x43
call fcn.00405490
ret