Function at 0x489f70
Capabilities:
Copy file
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x60
push 0
push 0
dec ecx
jne 0x489f78
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
call fcn.00404afc
mov eax, dword [ebp + 0x18]
call fcn.00404afc
xor eax, eax
push ebp
push 0x48b730
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd4]
call fcn.00409b98
mov edx, dword [ebp - 0xd4]
lea eax, [ebp - 0x18]
mov ecx, 0x48b74c
call fcn.00404958
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.00421f60
push dword [ebp - 0x18]
push 0x48b758
push dword [ebp - 8]
push 0x48b764
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004049cc
mov eax, dword [ebp - 0x14]
call fcn.00404b0c
mov edx, eax
lea eax, [ebp - 0xd8]
call fcn.00404844
mov eax, dword [ebp - 0xd8]
call fcn.004097a0
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
lea eax, [ebp - 0xdc]
mov edx, dword [ebp - 0x14]
call fcn.00404eac
mov eax, dword [ebp - 0xdc]
push eax
push dword [ebp - 0xc]
push 0x48b758
push dword [ebp - 8]
push 0x48b774
lea eax, [ebp - 0xe4]
mov edx, 4
call fcn.004049cc
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0xe0]
call fcn.00404eac
mov ecx, dword [ebp - 0xe0]
mov edx, 0x48b784
mov eax, dword [ebp + 0xc]
call fcn.00489c9c
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
mov eax, dword [ebp - 0x14]
call fcn.004094a4
test al, al
je 0x48a145
mov dword [ebp - 0x1c], 1
xor eax, eax
push ebp
push 0x48a139
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xe8]
mov edx, dword [ebp - 0x14]
call fcn.00404eac
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0x20]
call fcn.00482bdc
mov dl, 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, 0x48b7c0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x88]
test al, al
je 0x48a12f
lea ecx, [ebp - 0xf8]
mov edx, 0x48b7c0
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x108]
mov edx, 2
mov cl, 1
call fcn.00414cd4
lea edx, [ebp - 0x108]
pop eax
call fcn.004163a4
jne 0x48a12f
mov dword [ebp - 0x1c], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a14a
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x48a160
sub eax, 2
jb 0x48a2b4
jmp 0x48b118
mov dword [ebp - 0x28], 5
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x110]
call fcn.00404b0c
mov edx, eax
lea eax, [ebp - 0x10c]
call fcn.00404844
mov eax, dword [ebp - 0x10c]
call fcn.004097a0
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x114]
call fcn.004094a4
test al, al
je 0x48a1e0
dec dword [ebp - 0x28]
jne 0x48a167
mov dword [ebp - 0x28], 5
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.004049cc
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.00404eac
mov eax, dword [ebp - 0x118]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.004049cc
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x120]
call fcn.00404eac
mov ecx, dword [ebp - 0x120]
mov edx, 0x48b7e0
mov eax, dword [ebp + 0xc]
call fcn.00489c9c
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x128]
call fcn.004094a4
test al, al
jne 0x48b118
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
dec dword [ebp - 0x28]
jne 0x48a1e7
jmp 0x48b118
lea eax, [ebp - 0x12c]
mov edx, dword [ebp - 0x14]
call fcn.00404eac
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x20]
call fcn.00482bdc
mov dl, 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
lea eax, [ebp - 0x90]
mov edx, 0x48b804
call fcn.004046e4
lea eax, [ebp - 0x94]
mov edx, 0x48b81c
call fcn.004046e4
lea eax, [ebp - 0x98]
mov edx, 0x48b834
call fcn.004046e4
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, 0x48b84c
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x88]
test al, al
je 0x48a45b
lea ecx, [ebp - 0x13c]
mov edx, 0x48b84c
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x13c]
lea eax, [ebp - 0x90]
call fcn.00413e14
mov edx, 0x48b85c
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x88]
test al, al
je 0x48a45b
lea ecx, [ebp - 0x14c]
mov edx, 0x48b85c
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x14c]
lea eax, [ebp - 0x94]
call fcn.00413e14
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x16c]
push eax
lea eax, [ebp - 0x180]
xor edx, edx
mov cl, 1
call fcn.00414cd4
lea edx, [ebp - 0x180]
lea ecx, [ebp - 0x168]
pop eax
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 0x168]
lea ecx, [ebp - 0x164]
mov edx, 0x48b86c
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x164]
lea eax, [ebp - 0x154]
call fcn.00413e14
mov edx, dword [ebp - 0x154]
lea ecx, [ebp - 0x150]
mov eax, dword [ebp - 0x94]
call fcn.00477034
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x94]
call fcn.004046e4
mov edx, 0x48b87c
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x88]
test al, al
je 0x48a45b
lea ecx, [ebp - 0x190]
mov edx, 0x48b87c
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x190]
lea eax, [ebp - 0x98]
call fcn.00413e14
lea edx, [ebp - 0x198]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x198]
lea edx, [ebp - 0x194]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x194]
mov edx, dword [eax]
call dword [edx + 0xc]
dec eax
test eax, eax
jl 0x48b110
inc eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x28], 0
xor edx, edx
push ebp
push 0x48b0f7
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x2c], 0x33
mov eax, 0x64
call fcn.0040316c
cmp eax, 0xa
jge 0x48a677
xor eax, eax
push ebp
push 0x48a66b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x19c]
mov edx, 0x48b894
mov eax, dword [ebp - 0x94]
call fcn.00477034
mov eax, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x90]
call fcn.00404a58
je 0x48a661
lea ecx, [ebp - 0x1a0]
mov edx, 0x48b8a8
mov eax, dword [ebp - 0x98]
call fcn.00477034
mov eax, dword [ebp - 0x1a0]
call fcn.00466768
fstp qword [ebp - 0xa0]
wait
call fcn.0040b2e4
fld qword [ebp - 0xa0]
fadd dword [0x48b8b4]
fcompp
fnstsw ax
sahf
jb 0x48a553
call fcn.0040b2e4
fcomp qword [ebp - 0xa0]
fnstsw ax
sahf
jae 0x48a661
mov eax, dword [0x490b6c]
cmp dword [eax], 0
jne 0x48a5b8
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4899c0]
call fcn.0043f5dc
mov edx, dword [0x490b6c]
mov dword [edx], eax
mov eax, dword [0x490b6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov edx, 0x48b8c0
call fcn.0045577c
mov eax, dword [0x490b6c]
mov eax, dword [eax]
add eax, 0x2fc
mov edx, dword [ebp - 0x90]
call fcn.004046a0
mov eax, dword [0x490b6c]
mov eax, dword [eax]
add eax, 0x300
mov edx, dword [ebp - 0x94]
call fcn.004046a0
mov eax, dword [0x490b6c]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
jne 0x48a661
mov eax, dword [0x490b6c]
mov eax, dword [eax]
call fcn.00443964
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x490b6c]
mov eax, dword [eax]
call fcn.0045c024
push eax
call sub.user32.dll_SetParent
lea eax, [ebp - 0xb4]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.user32.dll_GetWindowRect
push 0xffffffffffffffff
mov eax, dword [0x490b6c]
mov eax, dword [eax]
mov esi, dword [eax + 0x4c]
push esi
mov eax, dword [0x490b6c]
mov eax, dword [eax]
mov ebx, dword [eax + 0x48]
push ebx
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0xb0]
mov edx, dword [0x490b6c]
sub eax, esi
sub eax, 0xa
push eax
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0xb4]
mov edx, dword [0x490b6c]
sub eax, ebx
sub eax, 0xa
push eax
mov eax, dword [0x490b6c]
mov eax, dword [eax]
call fcn.0045c024
push eax
call sub.user32.dll_MoveWindow
mov eax, dword [0x490b6c]
mov eax, dword [eax]
call fcn.004559ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a680
dec dword [ebp - 0x2c]
jne 0x48a4b1
xor eax, eax
push ebp
push 0x48aa35
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x45], 1
lea edx, [ebp - 0x1a8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a4]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1b8]
mov edx, dword [ebp - 0x28]
mov cl, 0xfc
call fcn.00414cd4
lea edx, [ebp - 0x1b8]
lea ecx, [ebp - 0x24]
pop eax
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea edx, [ebp - 0x1bc]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [ebp - 0x1bc]
lea eax, [ebp - 0x30]
call fcn.004048d4
lea ecx, [ebp - 0x1cc]
mov edx, 0x48b86c
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x1cc]
lea eax, [ebp - 0x34]
call fcn.00413e14
lea ecx, [ebp - 0x1dc]
mov edx, 0x48b8d8
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x1dc]
lea eax, [ebp - 0x38]
call fcn.00413e14
lea ecx, [ebp - 0x1ec]
mov edx, 0x48b8f0
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x1ec]
lea eax, [ebp - 0x3c]
call fcn.00413e14
mov edx, 0x48b8fc
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x88]
test al, al
je 0x48a78d
lea ecx, [ebp - 0x1fc]
mov edx, 0x48b8fc
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x1fc]
lea eax, [ebp - 0x44]
call fcn.00413e14
jmp 0x48a795
lea eax, [ebp - 0x44]
call fcn.0040464c
mov al, byte [0x48b904]
push eax
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x48b910
mov edx, 0x48b74c
mov eax, dword [ebp - 0x3c]
call fcn.0040e708
lea ecx, [ebp - 0x20c]
mov edx, 0x48b7c0
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
mov edx, 1
mov cl, 1
call fcn.00414cd4
lea edx, [ebp - 0x21c]
pop eax
call fcn.004163a4
jne 0x48a800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48b101
lea ecx, [ebp - 0x22c]
mov edx, 0x48b7c0
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x23c]
mov edx, 2
mov cl, 1
call fcn.00414cd4
lea edx, [ebp - 0x23c]
pop eax
call fcn.004163a4
jne 0x48a869
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x4c]
call fcn.004094a4
test al, al
je 0x48aa2b
mov byte [ebp - 0x45], 0
jmp 0x48aa2b
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x4c]
call fcn.004094a4
test al, al
je 0x48aa2b
cmp dword [ebp - 0x44], 0
jne 0x48a958
mov eax, dword [ebp - 0x4c]
call fcn.00466b74
mov dword [ebp - 0x240], eax
fild dword [ebp - 0x240]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0x50]
mov eax, 0x48b91c
call fcn.0040ad68
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x68]
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x4c]
call fcn.00466c0c
test al, al
je 0x48a8f5
lea eax, [ebp - 0x68]
call fcn.00466c48
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x54]
mov eax, 0x48b930
call fcn.0040bf5c
jmp 0x48a90e
call fcn.0040b2e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x54]
mov eax, 0x48b930
call fcn.0040bf5c
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x50]
call fcn.00404a58
jne 0x48aa2b
mov eax, dword [ebp - 0x38]
call fcn.00466768
fstp qword [ebp - 0x248]
wait
mov eax, dword [ebp - 0x54]
call fcn.00466768
fsubr qword [ebp - 0x248]
fabs
fld xword [0x48b944]
fcompp
fnstsw ax
sahf
jbe 0x48aa2b
mov byte [ebp - 0x45], 0
jmp 0x48aa2b
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
call fcn.004223dc
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x58]
call fcn.00404a58
jne 0x48a979
mov byte [ebp - 0x45], 0
jmp 0x48aa2b
mov eax, dword [ebp - 0x4c]
call fcn.00466b74
mov dword [ebp - 0x240], eax
fild dword [ebp - 0x240]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0x50]
mov eax, 0x48b91c
call fcn.0040ad68
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x68]
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x4c]
call fcn.00466c0c
test al, al
je 0x48a9d5
lea eax, [ebp - 0x68]
call fcn.00466c48
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x54]
mov eax, 0x48b930
call fcn.0040bf5c
jmp 0x48a9ee
call fcn.0040b2e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x54]
mov eax, 0x48b930
call fcn.0040bf5c
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x50]
call fcn.00404a58
jne 0x48aa2b
mov eax, dword [ebp - 0x38]
call fcn.00466768
fstp qword [ebp - 0x248]
wait
mov eax, dword [ebp - 0x54]
call fcn.00466768
fsubr qword [ebp - 0x248]
fabs
fld xword [0x48b944]
fcompp
fnstsw ax
sahf
jbe 0x48aa2b
mov byte [ebp - 0x45], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48aa3f
cmp byte [ebp - 0x45], 0
je 0x48b0ed
cmp dword [ebp - 0x28], 0
jne 0x48adaf
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b958
lea eax, [ebp - 0x24c]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x24c]
call fcn.004097a0
cmp dword [ebp - 0x1c], 1
jne 0x48aaa7
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x250]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x250]
call fcn.004097a0
jmp 0x48aad3
cmp dword [ebp - 0x1c], 2
jne 0x48aad3
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b964
lea eax, [ebp - 0x254]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x254]
call fcn.004097a0
mov dword [ebp - 0x2c], 5
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b958
lea eax, [ebp - 0x25c]
mov edx, 3
call fcn.004049cc
mov edx, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
call fcn.00404eac
mov eax, dword [ebp - 0x258]
push eax
push dword [ebp - 0xc]
push 0x48b758
push dword [ebp - 8]
push 0x48b910
push dword [ebp - 8]
push 0x48b958
lea eax, [ebp - 0x264]
mov edx, 6
call fcn.004049cc
mov edx, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
call fcn.00404eac
mov eax, dword [ebp - 0x260]
push eax
push 0x48b974
push dword [ebp - 8]
push 0x48b988
lea eax, [ebp - 0x26c]
mov edx, 3
call fcn.004049cc
mov edx, dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
call fcn.00404eac
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp + 0xc]
pop ecx
call fcn.00489c9c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
push 0xa
call sub.kernel32.dll_Sleep_1
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b958
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x270]
call fcn.004094a4
test al, al
jne 0x48abea
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
push 0x64
call sub.kernel32.dll_Sleep_1
dec dword [ebp - 0x2c]
jne 0x48aada
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b958
lea eax, [ebp - 0x274]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x274]
call fcn.004094a4
test al, al
jne 0x48ac54
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b958
lea eax, [ebp - 0x278]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x248], eax
mov byte [ebp - 0x244], 0xb
lea edx, [ebp - 0x248]
xor ecx, ecx
mov eax, 0x48b998
call fcn.00439a94
mov eax, dword [ebp - 0x18]
call fcn.00402d00
call fcn.00402cc4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4763c0]
call fcn.00476a88
mov ebx, eax
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b958
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.004049cc
mov edx, dword [ebp - 0x27c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, ebx
call fcn.004718f0
mov byte [ebx + 0x40], 1
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00470b1c
mov byte [ebx + 0x39], 0
mov byte [ebx + 0x50], 1
mov byte [ebx + 0x5c], 1
mov byte [ebx + 0x3a], 1
lea eax, [ebx + 0x44]
mov edx, 0x48b9c8
call fcn.004046a0
mov eax, ebx
call fcn.00471384
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x280]
call fcn.004094a4
test al, al
je 0x48ad2d
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b958
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x284]
call fcn.004097a0
jmp 0x48ad6d
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x248], eax
mov byte [ebp - 0x244], 0xb
lea edx, [ebp - 0x248]
xor ecx, ecx
mov eax, 0x48b9dc
call fcn.00439a94
cmp dword [ebp - 0x44], 0
jne 0x48b0ed
mov eax, dword [ebp - 0x38]
call fcn.00466768
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x28c]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x28c]
call fcn.0046692c
jmp 0x48b0ed
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x290]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x290]
call fcn.004094a4
test al, al
je 0x48adfb
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x294]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x294]
call fcn.004097a0
lea eax, [ebp - 0x298]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
call fcn.00404958
mov eax, dword [ebp - 0x298]
call fcn.004094b4
test al, al
jne 0x48ae37
lea eax, [ebp - 0x29c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
call fcn.00404958
mov eax, dword [ebp - 0x29c]
call fcn.004669b0
push dword [ebp - 0xc]
push 0x48b758
push dword [ebp - 8]
push 0x48b910
push dword [ebp - 0x40]
push 0x48ba0c
lea edx, [ebp - 0x2a0]
mov eax, dword [ebp - 0x28]
call fcn.00408eb8
push dword [ebp - 0x2a0]
push 0x48ba18
lea eax, [ebp - 0x74]
mov edx, 8
call fcn.004049cc
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
push 0x48ba0c
lea edx, [ebp - 0x2a4]
mov eax, dword [ebp - 0x28]
call fcn.00408eb8
push dword [ebp - 0x2a4]
push 0x48ba18
lea eax, [ebp - 0x78]
mov edx, 5
call fcn.004049cc
mov dword [ebp - 0x2c], 5
lea eax, [ebp - 0x2a8]
mov edx, dword [ebp - 0x78]
call fcn.00404eac
mov eax, dword [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2b0]
push eax
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 0x2c4], 0
lea edx, [ebp - 0x2d0]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x2d0]
lea edx, [ebp - 0x2cc]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x2cc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 0x2b4], 0xb
lea edx, [ebp - 0x2c8]
mov ecx, 2
mov eax, 0x48ba28
call fcn.0040a2e0
mov edx, dword [ebp - 0x2b0]
lea eax, [ebp - 0x2ac]
call fcn.00404eac
mov eax, dword [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x2d4]
mov edx, dword [ebp - 0x74]
call fcn.00404eac
mov ecx, dword [ebp - 0x2d4]
mov eax, dword [ebp + 0xc]
pop edx
call fcn.00489c9c
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
mov eax, dword [ebp - 0x78]
call fcn.004094a4
test al, al
jne 0x48af9f
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
dec dword [ebp - 0x2c]
jne 0x48aead
mov eax, dword [ebp - 0x18]
call fcn.00402d00
call fcn.00402cc4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4763c0]
call fcn.00476a88
mov ebx, eax
mov edx, dword [ebp - 0x78]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, ebx
call fcn.004718f0
mov byte [ebx + 0x40], 1
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00470b1c
mov byte [ebx + 0x39], 0
mov byte [ebx + 0x50], 1
mov byte [ebx + 0x5c], 1
mov byte [ebx + 0x3a], 1
lea edx, [ebp - 0x2d8]
mov eax, dword [ebp - 0x28]
add eax, 0x94ee
call fcn.00408eb8
mov ecx, dword [ebp - 0x2d8]
lea eax, [ebx + 0x44]
mov edx, 0x48ba4c
call fcn.00404958
mov eax, ebx
call fcn.00471384
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
lea eax, [ebp - 0x2dc]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
call fcn.00404958
mov eax, dword [ebp - 0x2dc]
call fcn.004094a4
test al, al
je 0x48b0b4
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x2e0]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x2e0]
call fcn.00404b0c
push eax
lea eax, [ebp - 0x2e4]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
call fcn.00404958
mov eax, dword [ebp - 0x2e4]
call fcn.00404b0c
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0x78]
call fcn.004097a0
cmp dword [ebp - 0x3c], 0
je 0x48b0b4
lea eax, [ebp - 0x2e8]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
call fcn.00404958
mov eax, dword [ebp - 0x2e8]
call fcn.004097a0
cmp dword [ebp - 0x44], 0
jne 0x48b0ed
mov eax, dword [ebp - 0x38]
call fcn.00466768
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x18]
push dword [ebp - 0x3c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x2ec]
mov edx, 3
call fcn.004049cc
mov eax, dword [ebp - 0x2ec]
call fcn.0046692c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48b101
inc dword [ebp - 0x28]
dec dword [ebp - 0xa4]
jne 0x48a49c
lea eax, [ebp - 0x20]
call fcn.00406280
lea eax, [ebp - 0x2f0]
mov ecx, 0x48ba5c
mov edx, dword [ebp - 0x18]
call fcn.00404958
mov eax, dword [ebp - 0x2f0]
call fcn.004094a4
test al, al
je 0x48b1c5
lea eax, [ebp - 0x2f4]
mov ecx, 0x48ba5c
mov edx, dword [ebp - 0x18]
call fcn.00404958
mov eax, dword [ebp - 0x2f4]
call fcn.00404b0c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x20
jbe 0x48b1d4
push 0x48ba68
mov eax, dword [ebp - 0x88]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov ebx, eax
mov dword [ebp - 0x8c], ebx
test ebx, ebx
je 0x48b1bb
xor eax, eax
push ebp
push 0x48b1b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x14]
push eax
call dword [ebp - 0x8c]
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48b1bb
xor eax, eax
mov dword [ebp - 0x8c], eax
jmp 0x48b1d4
mov eax, 0x48ba7c
call fcn.00439a88
jmp 0x48b490
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x48b7d4
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.004049cc
mov dword [ebp - 0x28], 0xa
mov eax, dword [ebp - 0x7c]
call fcn.004094a4
test al, al
jne 0x48b24c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
push 0xa
call sub.kernel32.dll_Sleep_1
push 0
push 0
push 0
lea eax, [ebp - 0xd0]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
je 0x48b247
lea eax, [ebp - 0xd0]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0xd0]
push eax
call sub.user32.dll_DispatchMessageA
dec dword [ebp - 0x28]
jne 0x48b1f3
mov eax, dword [ebp - 0x7c]
call fcn.004094a4
test al, al
jne 0x48b28d
push 0x48baac
push dword [ebp + 0x10]
push 0x48badc
push 0x48bae8
push dword [ebp - 0x7c]
lea eax, [ebp - 0x2f8]
mov edx, 5
call fcn.004049cc
mov eax, dword [ebp - 0x2f8]
call fcn.00439a88
jmp 0x48b490
mov eax, dword [ebp - 0x1c]
sub eax, 2
jae 0x48b425
mov dword [ebp - 0x28], 5
mov eax, dword [ebp - 0x7c]
call fcn.00404b0c
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
cmp ebx, 0x20
jae 0x48b2d4
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4909c8]
mov eax, dword [eax]
call fcn.00446d20
push 0xa
call sub.kernel32.dll_Sleep_1
dec dword [ebp - 0x28]
jne 0x48b2a0
cmp ebx, 0x20
jae 0x48b2e8
mov eax, 0x48baf8
call fcn.00439a88
jmp 0x48b490
push 0x48bb18
push ebx
call sub.kernel32.dll_GetProcAddress_2
mov esi, eax
mov dword [ebp - 0x80], esi
test esi, esi
jne 0x48b30a
push 0x48bb28
push ebx
call sub.kernel32.dll_GetProcAddress_2
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jne 0x48b31f
mov eax, 0x48bb44
call fcn.00439a88
jmp 0x48b490
mov eax, dword [ebp + 0x10]
call fcn.0040490c
inc eax
call fcn.00408ae8
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0x10]
call fcn.00404b0c
mov dword [ebp - 0x84], eax
xor eax, eax
push ebp
push 0x48b37c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x48bb68
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x80]
add esp, 0x14
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48b39a
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.user32.dll_SetParent
lea eax, [ebp - 0xb4]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.user32.dll_GetWindowRect
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0xb0]
push eax
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0xb4]
push eax
push 0
push 0
push ebx
call sub.user32.dll_MoveWindow
push 5
push ebx
call sub.user32.dll_ShowWindow
mov eax, dword [0x490b6c]
cmp dword [eax], 0
je 0x48b490
mov eax, dword [0x490b6c]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x48b490
push ebx
mov eax, dword [0x490b6c]
mov eax, dword [eax]
call fcn.0045c024
push eax
call sub.user32.dll_SetParent
mov eax, dword [0x490b6c]
mov eax, dword [eax]
call fcn.004559ac
jmp 0x48b490
push 0
push dword [ebp - 0x7c]
push 0x48bb90
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x300]
call fcn.00408fa4
push dword [ebp - 0x300]
push 0x48bb90
mov eax, dword [ebp - 0x88]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x304]
call fcn.00408fa4
push dword [ebp - 0x304]
push 0x48bb90
push dword [ebp + 0x10]
lea eax, [ebp - 0x2fc]
mov edx, 7
call fcn.004049cc
mov eax, dword [ebp - 0x2fc]
call fcn.00404b0c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b73a
lea eax, [ebp - 0x304]
mov edx, 0xc
call fcn.00404670
lea eax, [ebp - 0x2d4]
call fcn.00404d58
lea eax, [ebp - 0x2d0]
call fcn.00406280
lea eax, [ebp - 0x2cc]
call fcn.00406280
lea eax, [ebp - 0x2b0]
call fcn.0040464c
lea eax, [ebp - 0x2ac]
mov edx, 2
call fcn.00404d70
lea eax, [ebp - 0x2a4]
mov edx, 0xf
call fcn.00404670
lea eax, [ebp - 0x268]
call fcn.00404d58
lea eax, [ebp - 0x264]
call fcn.0040464c
lea eax, [ebp - 0x260]
call fcn.00404d58
lea eax, [ebp - 0x25c]
call fcn.0040464c
lea eax, [ebp - 0x258]
call fcn.00404d58
lea eax, [ebp - 0x254]
mov edx, 3
call fcn.00404670
lea eax, [ebp - 0x23c]
mov edx, dword [0x4010d8]
mov ecx, 8
call fcn.0040531c
lea eax, [ebp - 0x1bc]
call fcn.00404d58
lea eax, [ebp - 0x1b8]
call fcn.00410b24
lea eax, [ebp - 0x1a8]
call fcn.00406280
lea eax, [ebp - 0x1a4]
call fcn.00406280
lea eax, [ebp - 0x1a0]
mov edx, 2
call fcn.00404670
lea eax, [ebp - 0x198]
call fcn.00406280
lea eax, [ebp - 0x194]
call fcn.00406280
lea eax, [ebp - 0x190]
mov edx, dword [0x4010d8]
mov ecx, 2
call fcn.0040531c
lea eax, [ebp - 0x170]
call fcn.00406280
lea eax, [ebp - 0x16c]
call fcn.00406280
lea eax, [ebp - 0x168]
call fcn.00406280
lea eax, [ebp - 0x164]
call fcn.00410b24
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.00404670
lea eax, [ebp - 0x14c]
mov edx, dword [0x4010d8]
mov ecx, 2
call fcn.0040531c
lea eax, [ebp - 0x12c]
call fcn.00404d58
lea eax, [ebp - 0x128]
mov edx, 2
call fcn.00404670
lea eax, [ebp - 0x120]
call fcn.00404d58
lea eax, [ebp - 0x11c]
call fcn.0040464c
lea eax, [ebp - 0x118]
call fcn.00404d58
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00404670
lea eax, [ebp - 0x108]
mov edx, dword [0x4010d8]
mov ecx, 2
call fcn.0040531c
lea eax, [ebp - 0xe8]
call fcn.00404d58
lea eax, [ebp - 0xe4]
call fcn.0040464c
lea eax, [ebp - 0xe0]
mov edx, 2
call fcn.00404d70
lea eax, [ebp - 0xd8]
mov edx, 2
call fcn.00404670
lea eax, [ebp - 0x4c]
call fcn.0040464c
lea eax, [ebp - 0x44]
mov edx, 6
call fcn.00404670
lea eax, [ebp - 0x24]
call fcn.00406280
lea eax, [ebp - 0x20]
call fcn.00406280
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404670
lea eax, [ebp - 0x10]
mov edx, dword [0x406c88]
call fcn.00405aec
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404670
lea eax, [ebp + 0x10]
call fcn.0040464c
lea eax, [ebp + 0x18]
call fcn.0040464c
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.00404670
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00404670
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.00404670
ret