Function at 0x533e70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x76
push 0
push 0
dec ecx
jne 0x533e78
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x535877
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x54773c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x535890
call fcn.00496044
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x5358a4
call fcn.00496044
lea edx, [ebp - 0x64]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x5358b8
call fcn.00496044
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x5358cc
call fcn.00496044
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x5358e0
call fcn.00496044
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x5358f4
call fcn.00496044
lea edx, [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x535908
call fcn.00496044
lea edx, [ebp - 0x234]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x3c]
call fcn.00409a64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x53591c
call fcn.00496044
mov edx, dword [eax]
call dword [edx + 0x58]
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x535930
call fcn.00496044
lea edx, [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x535944
call fcn.00496044
lea edx, [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x535958
call fcn.00496044
lea edx, [ebp - 0x48]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x53596c
call fcn.00496044
lea edx, [ebp - 0x4c]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x535980
call fcn.00496044
lea edx, [ebp - 0x54]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x535994
call fcn.00496044
lea edx, [ebp - 0x50]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, 0x5359a8
call fcn.00496044
lea edx, [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 4]
mov dword [eax + 0x3d4], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
xor edx, edx
call fcn.00439e40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.004969dc
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x384]
mov eax, esi
call fcn.004977f8
mov edx, 0x5359bc
mov eax, esi
call fcn.00496044
mov edx, 0x5359d0
mov ecx, dword [eax]
call dword [ecx + 0xb0]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x24c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34c]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.004969bc
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x20]
call fcn.0040d47c
lea eax, [ebp - 0x24]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x238]
call fcn.0040d494
mov eax, dword [ebp - 0x238]
mov ecx, 5
mov edx, 1
call fcn.00404fc0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, 0x5359e4
call fcn.0044ffac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov edx, dword [eax]
call dword [edx + 0xe0]
push dword [ebp - 0x20]
push 0x5359fc
push dword [ebp - 0x24]
push 0x535a08
lea eax, [ebp - 0x23c]
mov edx, 4
call fcn.00404e1c
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 0x20]
push 0x5359fc
push dword [ebp - 0x24]
push 0x535a1c
push dword [ebp - 0x14]
lea eax, [ebp - 0x240]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 0x20]
push 0x5359fc
push dword [ebp - 0x24]
push 0x535a30
lea eax, [ebp - 0x244]
mov edx, 4
call fcn.00404e1c
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
call fcn.004504e8
mov eax, dword [ebp - 0x3c]
mov edx, 0x535a4c
call fcn.00404ea8
jne 0x5342f7
mov al, byte [0x535a50]
push eax
lea eax, [ebp - 0x254]
mov edx, dword [ebp - 0x50]
call fcn.00416c64
lea ecx, [ebp - 0x254]
mov eax, dword [0x547650]
mov eax, dword [eax + 0x384]
mov edx, 0x535890
mov esi, dword [eax]
call dword [esi + 0x244]
mov eax, dword [0x547650]
mov eax, dword [eax + 0x384]
mov edx, 0x535890
call fcn.00496044
lea edx, [ebp - 0x58]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x50]
call fcn.00404ea8
je 0x53425f
mov eax, dword [ebp - 4]
add eax, 0x3d8
mov edx, 0x535a5c
call fcn.00404ae0
jmp 0x5342c5
mov eax, dword [0x547650]
mov eax, dword [eax + 0x384]
mov edx, 0x535980
call fcn.00496044
lea edx, [ebp - 0x258]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x258]
mov eax, dword [ebp - 4]
add eax, 0x3d8
call fcn.00404ae0
mov eax, dword [0x547650]
mov eax, dword [eax + 0x384]
mov edx, 0x5359a8
call fcn.00496044
lea edx, [ebp - 0x25c]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 4]
add eax, 0x3dc
call fcn.00404ae0
mov al, byte [0x535a50]
push eax
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 8]
call fcn.00416c64
lea ecx, [ebp - 0x26c]
mov eax, dword [0x547650]
mov eax, dword [eax + 0x384]
mov edx, 0x535890
mov esi, dword [eax]
call dword [esi + 0x244]
cmp dword [ebp - 0x44], 0
je 0x534324
mov eax, dword [ebp - 0x44]
call fcn.00404f5c
mov esi, eax
push 1
push 0
push 0x535a50
push esi
push 0x535a68
mov eax, dword [ebp - 4]
call fcn.00456830
push eax
call sub.shell32.dll_ShellExecuteA
push dword [0x547734]
push 0x535a78
push 0x535a88
push dword [ebp - 8]
push 0x535a94
lea eax, [ebp - 0x270]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x270]
lea eax, [ebp - 0x230]
call fcn.00402fcc
lea eax, [ebp - 0x230]
call fcn.00402d5c
call fcn.00402978
push 0x535aa4
lea eax, [ebp - 0x274]
push eax
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x278]
call fcn.0040d47c
mov eax, dword [ebp - 0x278]
mov ecx, 4
mov edx, 7
call fcn.00404fc0
push dword [ebp - 0x274]
lea eax, [ebp - 0x27c]
push eax
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x280]
call fcn.0040d47c
mov eax, dword [ebp - 0x280]
mov ecx, 2
mov edx, 4
call fcn.00404fc0
push dword [ebp - 0x27c]
lea eax, [ebp - 0x284]
push eax
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x288]
call fcn.0040d47c
mov eax, dword [ebp - 0x288]
mov ecx, 2
mov edx, 1
call fcn.00404fc0
push dword [ebp - 0x284]
push 0x535ab0
push 0x535abc
lea eax, [ebp - 0x28c]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d494
mov eax, dword [ebp - 0x290]
mov ecx, 2
mov edx, 1
call fcn.00404fc0
push dword [ebp - 0x28c]
lea eax, [ebp - 0x294]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x298]
call fcn.0040d494
mov eax, dword [ebp - 0x298]
mov ecx, 2
mov edx, 4
call fcn.00404fc0
push dword [ebp - 0x294]
lea eax, [ebp - 0x29c]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2a0]
call fcn.0040d494
mov eax, dword [ebp - 0x2a0]
mov ecx, 2
mov edx, 7
call fcn.00404fc0
push dword [ebp - 0x29c]
lea eax, [ebp - 0x1c]
mov edx, 9
call fcn.00404e1c
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0x535ab0
push dword [ebp - 0xc]
push 0x535ac8
lea eax, [ebp - 0x2a4]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x2a4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
add eax, 0x3c
call fcn.0040539c
mov eax, dword [ebp - 0x38]
mov edx, 0x535ad8
call fcn.00404ea8
jne 0x53453a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
xor edx, edx
call fcn.00506154
jmp 0x53457a
mov eax, dword [ebp - 0x38]
mov edx, 0x535ae8
call fcn.00404ea8
jne 0x53455b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov dl, 2
call fcn.00506154
jmp 0x53457a
mov eax, dword [ebp - 0x38]
mov edx, 0x535af8
call fcn.00404ea8
jne 0x53457a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov dl, 3
call fcn.00506154
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
xor edx, edx
call fcn.00506310
mov eax, dword [ebp - 0x40]
mov edx, 0x535b08
call fcn.00404ea8
jne 0x5345a9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov dl, 1
call fcn.00506310
xor eax, eax
push ebp
push 0x534ffe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x3c]
mov edx, 0x535b14
call fcn.00404ea8
jne 0x5348a9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, dword [eax]
call dword [edx + 0xd8]
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2ac]
call fcn.0040d47c
push dword [ebp - 0x2ac]
push 0x5359fc
lea eax, [ebp - 0x2b0]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2b4]
call fcn.0040d494
mov eax, dword [ebp - 0x2b4]
mov ecx, 5
mov edx, 1
call fcn.00404fc0
push dword [ebp - 0x2b0]
push 0x535b20
push 0x535b2c
lea eax, [ebp - 0x2a8]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x2a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
call fcn.004504e8
jmp 0x5346d7
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x230]
call fcn.004033e0
lea eax, [ebp - 0x230]
call fcn.0040344c
call fcn.00402978
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, dword [ebp - 0x18]
call fcn.0044ffac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
call fcn.004504e8
cmp dword [0x54773c], 1
je 0x5346eb
lea eax, [ebp - 0x230]
call fcn.00403238
call fcn.00402978
test al, al
je 0x53467a
lea eax, [ebp - 0x230]
call fcn.00403094
call fcn.00402978
cmp dword [0x54773c], 1
je 0x534f86
cmp dword [0x54773c], 2
je 0x534f86
cmp dword [0x54773c], 3
je 0x534f86
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2bc]
call fcn.0040d47c
push dword [ebp - 0x2bc]
push 0x5359fc
lea eax, [ebp - 0x2c0]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2c4]
call fcn.0040d494
mov eax, dword [ebp - 0x2c4]
mov ecx, 5
mov edx, 1
call fcn.00404fc0
push dword [ebp - 0x2c0]
push 0x535b20
push 0x535b4c
lea eax, [ebp - 0x2b8]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x2b8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, 0x535b6c
call fcn.0044ffac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov dx, 0xffff
call fcn.00511b1c
lea eax, [ebp - 0x2c8]
mov ecx, 0x535b80
mov edx, dword [0x547734]
call fcn.00404da8
mov edx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
add eax, 0x50
call fcn.0040539c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x534f86
inc ebx
xor esi, esi
push 0
lea ecx, [ebp - 0x2d0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov eax, dword [eax + 0x218]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x2d0]
lea eax, [ebp - 0x2cc]
call fcn.0040539c
mov edx, dword [ebp - 0x2cc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov ecx, 0x28bf
call fcn.005120c4
cmp dword [0x54773c], 1
je 0x534f86
cmp dword [0x54773c], 2
je 0x534f86
inc esi
dec ebx
jne 0x53483e
jmp 0x534f86
mov eax, dword [ebp - 0x3c]
mov edx, 0x535b90
call fcn.00404ea8
jne 0x534c18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, dword [eax]
call dword [edx + 0xd8]
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2d8]
call fcn.0040d47c
push dword [ebp - 0x2d8]
push 0x5359fc
lea eax, [ebp - 0x2dc]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2e0]
call fcn.0040d494
mov eax, dword [ebp - 0x2e0]
mov ecx, 5
mov edx, 1
call fcn.00404fc0
push dword [ebp - 0x2dc]
push 0x535b20
push 0x535b2c
lea eax, [ebp - 0x2d4]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x2d4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
call fcn.004504e8
jmp 0x534a42
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x230]
call fcn.004033e0
lea eax, [ebp - 0x230]
call fcn.0040344c
call fcn.00402978
lea eax, [ebp - 0x2e4]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d5c
mov edx, eax
sub edx, 2
mov ecx, 3
mov eax, dword [ebp - 0x18]
call fcn.00404fc0
mov eax, dword [ebp - 0x2e4]
mov edx, 0x535b9c
call fcn.00404ea8
jne 0x5349f5
lea eax, [ebp - 0x2e8]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d5c
mov ecx, eax
sub ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404fc0
mov eax, dword [ebp - 0x2e8]
mov ecx, 0x535b90
mov dl, 1
call fcn.00530874
jmp 0x534a39
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.005304d0
test eax, eax
je 0x534a1a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, dword [ebp - 0x18]
call fcn.0044ffac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
call fcn.004504e8
cmp dword [0x54773c], 1
je 0x534a5a
lea eax, [ebp - 0x230]
call fcn.00403238
call fcn.00402978
test al, al
je 0x53496f
lea eax, [ebp - 0x230]
call fcn.00403094
call fcn.00402978
cmp dword [0x54773c], 1
je 0x534f86
cmp dword [0x54773c], 2
je 0x534f86
cmp dword [0x54773c], 3
je 0x534f86
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2f0]
call fcn.0040d47c
push dword [ebp - 0x2f0]
push 0x5359fc
lea eax, [ebp - 0x2f4]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2f8]
call fcn.0040d494
mov eax, dword [ebp - 0x2f8]
mov ecx, 5
mov edx, 1
call fcn.00404fc0
push dword [ebp - 0x2f4]
push 0x535b20
push 0x535b4c
lea eax, [ebp - 0x2ec]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, 0x535b6c
call fcn.0044ffac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov dx, 0xffff
call fcn.00511b1c
lea eax, [ebp - 0x2fc]
mov ecx, 0x535b80
mov edx, dword [0x547734]
call fcn.00404da8
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
add eax, 0x50
call fcn.0040539c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x534f86
inc ebx
xor esi, esi
push 0
lea ecx, [ebp - 0x304]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov eax, dword [eax + 0x218]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x304]
lea eax, [ebp - 0x300]
call fcn.0040539c
mov edx, dword [ebp - 0x300]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov ecx, 0x28bf
call fcn.005120c4
cmp dword [0x54773c], 1
je 0x534f86
cmp dword [0x54773c], 2
je 0x534f86
inc esi
dec ebx
jne 0x534bad
jmp 0x534f86
mov eax, dword [ebp - 0x3c]
mov edx, 0x535a4c
call fcn.00404ea8
jne 0x534f86
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, dword [eax]
call dword [edx + 0xd8]
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x30c]
call fcn.0040d47c
push dword [ebp - 0x30c]
push 0x5359fc
lea eax, [ebp - 0x310]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x314]
call fcn.0040d494
mov eax, dword [ebp - 0x314]
mov ecx, 5
mov edx, 1
call fcn.00404fc0
push dword [ebp - 0x310]
push 0x535b20
push 0x535b2c
lea eax, [ebp - 0x308]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x308]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
call fcn.004504e8
jmp 0x534dc1
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x230]
call fcn.004033e0
lea eax, [ebp - 0x230]
call fcn.0040344c
call fcn.00402978
lea eax, [ebp - 0x318]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d5c
mov edx, eax
sub edx, 2
mov ecx, 3
mov eax, dword [ebp - 0x18]
call fcn.00404fc0
mov eax, dword [ebp - 0x318]
mov edx, 0x535b9c
call fcn.00404ea8
jne 0x534d64
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d5c
mov ecx, eax
sub ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00404fc0
mov eax, dword [ebp - 0x31c]
mov ecx, 0x535a4c
mov dl, 1
call fcn.00530874
jmp 0x534db8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3dc]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3d8]
mov eax, dword [ebp - 0x18]
call fcn.00530640
test eax, eax
je 0x534d99
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, dword [ebp - 0x18]
call fcn.0044ffac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
call fcn.004504e8
cmp dword [0x54773c], 1
je 0x534dd9
lea eax, [ebp - 0x230]
call fcn.00403238
call fcn.00402978
test al, al
je 0x534cde
lea eax, [ebp - 0x230]
call fcn.00403094
call fcn.00402978
cmp dword [0x54773c], 1
je 0x534f86
cmp dword [0x54773c], 2
je 0x534f86
cmp dword [0x54773c], 3
je 0x534f86
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x324]
call fcn.0040d47c
push dword [ebp - 0x324]
push 0x5359fc
lea eax, [ebp - 0x328]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x32c]
call fcn.0040d494
mov eax, dword [ebp - 0x32c]
mov ecx, 5
mov edx, 1
call fcn.00404fc0
push dword [ebp - 0x328]
push 0x535b20
push 0x535b4c
lea eax, [ebp - 0x320]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x320]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, 0x535b6c
call fcn.0044ffac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov dx, 0xffff
call fcn.00511b1c
lea eax, [ebp - 0x330]
mov ecx, 0x535b80
mov edx, dword [0x547734]
call fcn.00404da8
mov edx, dword [ebp - 0x330]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
add eax, 0x50
call fcn.0040539c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x534f86
inc ebx
xor esi, esi
push 0
lea ecx, [ebp - 0x338]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov eax, dword [eax + 0x218]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 0x334]
call fcn.0040539c
mov edx, dword [ebp - 0x334]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov ecx, 0x28bf
call fcn.005120c4
cmp dword [0x54773c], 1
je 0x534f86
cmp dword [0x54773c], 2
je 0x534f86
inc esi
dec ebx
jne 0x534f28
cmp dword [0x54773c], 1
je 0x534ff4
cmp dword [0x54773c], 2
je 0x534ff4
cmp dword [0x54773c], 3
je 0x534ff4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
call fcn.00506038
lea edx, [ebp - 0x30]
call fcn.00409e7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
call fcn.00506008
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], edx
fild qword [ebp - 0x340]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x34]
call fcn.0040c020
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
call fcn.00511c64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x535012
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x28]
call fcn.0040d47c
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x344]
call fcn.0040d494
mov eax, dword [ebp - 0x344]
mov ecx, 8
mov edx, 1
call fcn.00404fc0
cmp dword [0x54773c], 0
jne 0x5352b9
push dword [ebp - 0x28]
push 0x5359fc
push dword [ebp - 0x2c]
push 0x535ba8
push 0x5359fc
push dword [ebp - 0x1c]
push 0x535ab0
push dword [ebp - 0xc]
push 0x535ac8
push 0x535bb4
lea eax, [ebp - 0x348]
mov edx, 0xa
call fcn.00404e1c
mov edx, dword [ebp - 0x348]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 0x28]
push 0x5359fc
push dword [ebp - 0x2c]
push 0x535ba8
push 0x5359fc
push dword [ebp - 0x1c]
push 0x535ab0
push dword [ebp - 0xc]
push 0x535a94
push 0x535bc8
lea eax, [ebp - 0x34c]
mov edx, 0xa
call fcn.00404e1c
mov edx, dword [ebp - 0x34c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 0x28]
push 0x5359fc
push dword [ebp - 0x2c]
push 0x535ba8
push 0x5359fc
push 0x535bd8
push dword [ebp - 0x30]
lea eax, [ebp - 0x350]
mov edx, 7
call fcn.00404e1c
mov edx, dword [ebp - 0x350]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 0x28]
push 0x5359fc
push dword [ebp - 0x2c]
push 0x535ba8
push 0x5359fc
push 0x535bf4
push dword [ebp - 0x34]
push 0x535c10
mov eax, dword [ebp - 0x34]
call fcn.0040a110
push edx
push eax
lea eax, [ebp - 0x358]
call fcn.0052fddc
push dword [ebp - 0x358]
push 0x535c1c
lea eax, [ebp - 0x354]
mov edx, 0xa
call fcn.00404e1c
mov edx, dword [ebp - 0x354]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 0x28]
push 0x5359fc
push dword [ebp - 0x2c]
push 0x535ba8
push 0x5359fc
push 0x535c28
push dword [ebp - 0x20]
push 0x5359fc
push dword [ebp - 0x24]
lea eax, [ebp - 0x364]
mov edx, 3
call fcn.00404e1c
mov eax, dword [ebp - 0x364]
call fcn.0040dd9c
fstp qword [ebp - 0x340]
wait
call fcn.0040c844
fsub qword [ebp - 0x340]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x360]
mov eax, 0x535c44
call fcn.0040d4c0
push dword [ebp - 0x360]
lea eax, [ebp - 0x35c]
mov edx, 7
call fcn.00404e1c
mov edx, dword [ebp - 0x35c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 0x28]
push 0x5359fc
push dword [ebp - 0x2c]
push 0x535ba8
push 0x5359fc
push 0x535c58
lea eax, [ebp - 0x368]
mov edx, 6
call fcn.00404e1c
mov edx, dword [ebp - 0x368]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov edx, 0x5359fc
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x535363
cmp dword [0x54773c], 1
jne 0x53530f
push dword [ebp - 0x28]
push 0x5359fc
push dword [ebp - 0x2c]
push 0x535ba8
push 0x5359fc
push 0x535c80
lea eax, [ebp - 0x36c]
mov edx, 6
call fcn.00404e1c
mov edx, dword [ebp - 0x36c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
mov dword [0x54773c], eax
jmp 0x535363
cmp dword [0x54773c], 2
jne 0x535363
push dword [ebp - 0x28]
push 0x5359fc
push dword [ebp - 0x2c]
push 0x535ba8
push 0x5359fc
push 0x535c94
lea eax, [ebp - 0x370]
mov edx, 6
call fcn.00404e1c
mov edx, dword [ebp - 0x370]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
mov dword [0x54773c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
xor edx, edx
call fcn.0044ffac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x338]
xor edx, edx
call fcn.004e523c
push dword [0x547734]
push 0x535cac
push dword [ebp - 0x1c]
push 0x535ab0
push dword [ebp - 0xc]
push 0x535a94
lea eax, [ebp - 0x374]
mov edx, 6
call fcn.00404e1c
mov edx, dword [ebp - 0x374]
lea eax, [ebp - 0x230]
call fcn.00402fcc
lea eax, [ebp - 0x230]
call fcn.00402d68
call fcn.00402978
lea edx, [ebp - 0x378]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x378]
lea eax, [ebp - 0x230]
call fcn.0040517c
call fcn.004036d0
call fcn.00402978
lea eax, [ebp - 0x230]
call fcn.00403094
call fcn.00402978
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.004969dc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x384]
mov eax, ebx
call fcn.004977f8
mov edx, 0x5359bc
mov eax, ebx
call fcn.00496044
mov edx, 0x535cbc
mov ecx, dword [eax]
call dword [ecx + 0xb0]
mov edx, 0x535980
mov eax, ebx
call fcn.00496044
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0xb0]
mov edx, 0x5359a8
mov eax, ebx
call fcn.00496044
mov edx, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0xb0]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34c]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.004969bc
mov dl, 1
mov eax, dword [0x41c498]
call fcn.00403be0
mov esi, eax
push dword [0x547734]
push 0x535a78
push 0x535cd0
push dword [ebp - 8]
push 0x535a94
lea eax, [ebp - 0x37c]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x37c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
call fcn.0040c7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x384]
call fcn.0040d47c
mov ecx, dword [ebp - 0x384]
lea eax, [ebp - 0x380]
mov edx, 0x535cdc
call fcn.00404da8
mov ecx, dword [ebp - 0x380]
mov edx, 0xf
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea eax, [ebp - 0x38c]
push eax
call fcn.0040c810
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x390]
call fcn.0040d494
mov eax, dword [ebp - 0x390]
mov ecx, 8
mov edx, 1
call fcn.00404fc0
mov ecx, dword [ebp - 0x38c]
lea eax, [ebp - 0x388]
mov edx, 0x535cf0
call fcn.00404da8
mov ecx, dword [ebp - 0x388]
mov edx, 0x11
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x20]
push dword [0x547734]
push 0x535a78
push 0x535cd0
push dword [ebp - 8]
push 0x535a94
lea eax, [ebp - 0x394]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x394]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, esi
call fcn.00403c10
cmp dword [0x54773c], 0
jne 0x5355ee
cmp dword [ebp - 0x48], 0
je 0x5355ee
mov eax, dword [ebp - 0x48]
call fcn.00404f5c
mov ebx, eax
push 1
push 0
push 0x535a50
push ebx
push 0x535a68
mov eax, dword [ebp - 4]
call fcn.00456830
push eax
call sub.shell32.dll_ShellExecuteA
lea edx, [ebp - 0x398]
mov eax, dword [ebp - 0x4c]
call fcn.00409a64
cmp dword [ebp - 0x398], 0
je 0x53563e
push dword [0x547734]
push 0x535cac
push dword [ebp - 0x1c]
push 0x535ab0
push dword [ebp - 0xc]
push 0x535a94
lea eax, [ebp - 0x39c]
mov edx, 6
call fcn.00404e1c
mov edx, dword [ebp - 0x39c]
mov eax, dword [ebp - 0x4c]
call fcn.005300c0
mov ebx, 1
call fcn.0040c7e4
mov dword [ebp - 0x3a4], ebx
fild dword [ebp - 0x3a4]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x3a0]
call fcn.00530bc4
mov eax, dword [ebp - 0x3a0]
mov edx, dword [ebp - 0x64]
call fcn.004050a4
test eax, eax
jle 0x53569e
call fcn.0040c7e4
mov dword [ebp - 0x3a4], ebx
fild dword [ebp - 0x3a4]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x60]
call fcn.0040d47c
jmp 0x5356a4
inc ebx
cmp ebx, 8
jne 0x535643
mov dl, 1
mov eax, dword [0x41c498]
call fcn.00403be0
mov esi, eax
push dword [0x547734]
push 0x535a78
push 0x535cd0
push dword [ebp - 8]
push 0x535a94
lea eax, [ebp - 0x3a8]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x3a8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea eax, [ebp - 0x3ac]
mov ecx, dword [ebp - 0x60]
mov edx, 0x535d04
call fcn.00404da8
mov ecx, dword [ebp - 0x3ac]
mov edx, 0x12
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x20]
push dword [0x547734]
push 0x535a78
push 0x535cd0
push dword [ebp - 8]
push 0x535a94
lea eax, [ebp - 0x3b0]
mov edx, 5
call fcn.00404e1c
mov edx, dword [ebp - 0x3b0]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, esi
call fcn.00403c10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov si, 0xffeb
call fcn.00403e0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34c]
call fcn.004504e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov dl, 1
call fcn.00439e40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.004969dc
xor eax, eax
mov dword [0x54773c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
xor edx, edx
call fcn.00505fd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535881
lea eax, [ebp - 0x3b0]
mov edx, 3
call fcn.00404ab0
lea eax, [ebp - 0x3a0]
mov edx, 0x18
call fcn.00404ab0
lea eax, [ebp - 0x338]
call fcn.00404a8c
lea eax, [ebp - 0x334]
call fcn.004051d4
lea eax, [ebp - 0x330]
mov edx, 0xc
call fcn.00404ab0
lea eax, [ebp - 0x300]
call fcn.004051d4
lea eax, [ebp - 0x2fc]
mov edx, 0xc
call fcn.00404ab0
lea eax, [ebp - 0x2cc]
call fcn.004051d4
lea eax, [ebp - 0x2c8]
mov edx, 0x17
call fcn.00404ab0
lea eax, [ebp - 0x26c]
call fcn.00412518
lea eax, [ebp - 0x25c]
mov edx, 2
call fcn.00404ab0
lea eax, [ebp - 0x254]
call fcn.00412518
lea eax, [ebp - 0x244]
mov edx, 5
call fcn.00404ab0
lea eax, [ebp - 0x38]
mov edx, 0xd
call fcn.00404ab0
lea eax, [ebp - 0x64]
mov edx, 0xb
call fcn.00404ab0
ret