Function at 0x415650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x415658
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x416d3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00403ba4
mov eax, dword [ebp - 0x30]
mov edx, 0x416d54
call fcn.00401d20
jne 0x4156a1
push 1
push 0x416d5c
call sub.kernel32.dll_WinExec
call fcn.00401948
lea ecx, [ebp - 0x38]
xor edx, edx
xor eax, eax
call fcn.00414a68
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00403fdc
mov eax, dword [ebp - 0x34]
call fcn.00404058
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00403ba4
mov eax, dword [ebp - 0x3c]
call fcn.00409384
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffde
call fcn.00409288
mov edx, 0x41984c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409280
mov edx, 0x419854
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409280
mov edx, 0x41985c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409280
mov edx, 0x419864
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409280
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409280
lea edx, [ebp - 0x29]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409280
cmp byte [ebp - 0x29], 0xf1
je 0x41575f
mov eax, dword [ebp - 0x10]
call fcn.004085bc
call fcn.00414c9c
mov eax, dword [0x41984c]
mov edx, dword [0x419850]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x415779
call fcn.004013f4
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409288
xor eax, eax
mov al, byte [ebp - 0x2a]
inc eax
push eax
mov eax, 0x419828
mov ecx, 1
mov edx, dword [0x4146dc]
call fcn.004026b4
add esp, 4
xor ebx, ebx
mov bl, byte [ebp - 0x2a]
test ebx, ebx
jl 0x4157dd
inc ebx
xor esi, esi
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x40]
mov eax, dword [0x419828]
test eax, eax
je 0x4157cc
cmp esi, dword [eax - 4]
jb 0x4157d1
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x4157b0
mov eax, 0x62
call fcn.00414a58
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x419844
mov ecx, 1
mov edx, dword [0x4147bc]
call fcn.004026b4
add esp, 4
dec ebx
test ebx, ebx
jl 0x41583c
inc ebx
xor esi, esi
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x44]
mov eax, dword [0x419844]
test eax, eax
je 0x41582b
cmp esi, dword [eax - 4]
jb 0x415830
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x41580f
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415934
inc ebx
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x419844]
test edx, edx
je 0x415862
cmp eax, dword [edx - 4]
jb 0x415867
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00408f58
test eax, eax
jns 0x415878
call fcn.004013f4
mov edx, esi
shl edx, 2
add edx, 2
mov ecx, dword [0x419844]
test ecx, ecx
je 0x41588f
cmp edx, dword [ecx - 4]
jb 0x415894
call fcn.004013f4
mov edx, dword [ecx + edx*4]
push edx
mov edx, esi
shl edx, 2
inc edx
mov ecx, dword [0x419844]
test ecx, ecx
je 0x4158ad
cmp edx, dword [ecx - 4]
jb 0x4158b2
call fcn.004013f4
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.00414d34
mov edx, dword [ebp - 0x48]
mov eax, dword [0x419844]
test eax, eax
je 0x4158cc
cmp esi, dword [eax - 4]
jb 0x4158d1
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
mov eax, dword [0x419844]
test eax, eax
je 0x4158e7
cmp esi, dword [eax - 4]
jb 0x4158ec
call fcn.004013f4
cmp dword [eax + esi*4], 0
jne 0x41592c
mov eax, dword [0x419844]
test eax, eax
je 0x415900
cmp esi, dword [eax - 4]
jb 0x415905
call fcn.004013f4
lea eax, [eax + esi*4]
mov edx, esi
shl edx, 2
add edx, 3
mov ecx, dword [0x419844]
test ecx, ecx
je 0x41591f
cmp edx, dword [ecx - 4]
jb 0x415924
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x41584a
push edi
mov eax, 0x419844
mov ecx, 1
mov edx, dword [0x4147bc]
call fcn.004026b4
add esp, 4
mov eax, 0x6e
call fcn.00414a30
mov byte [0x418618], al
call fcn.00403cb0
mov ebx, eax
test ebx, ebx
jle 0x415b2c
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00403ba4
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00408f8c
mov eax, dword [ebp - 8]
mov edx, 0x416d70
call fcn.00401d20
jne 0x41599b
mov byte [0x418618], 1
mov eax, dword [ebp - 8]
mov edx, 0x416d7c
call fcn.00401d20
jne 0x4159b1
mov byte [0x41861c], 1
mov eax, dword [ebp - 8]
mov edx, 0x416d88
call fcn.00401d20
jne 0x4159e6
mov eax, 0x6b
mov edx, dword [0x419828]
test edx, edx
je 0x4159d4
cmp eax, dword [edx - 4]
jb 0x4159d9
call fcn.004013f4
lea eax, [edx + eax*4]
mov edx, 0x416d94
call fcn.00401aa4
mov eax, dword [ebp - 8]
mov edx, 0x416da0
call fcn.00401d20
jne 0x415a1b
mov eax, 0x3f
mov edx, dword [0x419828]
test edx, edx
je 0x415a09
cmp eax, dword [edx - 4]
jb 0x415a0e
call fcn.004013f4
lea eax, [edx + eax*4]
mov edx, 0x416d94
call fcn.00401aa4
lea eax, [ebp - 0x4c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x4c]
mov edx, 0x416dac
call fcn.00401d20
jne 0x415a8a
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00403d00
mov edx, dword [ebp - 0x50]
mov eax, 0x3a
mov ecx, dword [0x419828]
test ecx, ecx
je 0x415a7d
cmp eax, dword [ecx - 4]
jb 0x415a82
call fcn.004013f4
lea eax, [ecx + eax*4]
call fcn.00401aa4
lea eax, [ebp - 0x58]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x58]
mov edx, 0x416db8
call fcn.00401d20
jne 0x415ae3
mov eax, 0x6a
mov edx, dword [0x419828]
test edx, edx
je 0x415ac3
cmp eax, dword [edx - 4]
jb 0x415ac8
call fcn.004013f4
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
lea eax, [ebp - 0x5c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x5c]
mov edx, 0x416dc4
call fcn.00401d20
jne 0x415b24
push 0x41986c
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
inc esi
dec ebx
jne 0x415970
cmp byte [0x418618], 0
je 0x415b5e
mov eax, 0x1d
mov edx, dword [0x419828]
test edx, edx
je 0x415b49
cmp eax, dword [edx - 4]
jb 0x415b4e
call fcn.004013f4
cmp dword [edx + eax*4], 0
je 0x415b5e
call fcn.00414b2c
call fcn.00401948
mov eax, 0x41
mov edx, dword [0x419828]
test edx, edx
je 0x415b72
cmp eax, dword [edx - 4]
jb 0x415b77
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x60]
xor edx, edx
call fcn.00410128
mov edx, dword [ebp - 0x60]
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.0040a6e4
lea edx, [ebp - 0x64]
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.00405e68
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a6e4
cmp byte [0x418618], 0
jne 0x415bcd
push 5
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
jmp 0x415bdb
mov eax, dword [0x418684]
mov eax, dword [eax]
xor edx, edx
call fcn.00405eb0
mov eax, 0x32
call fcn.00414a58
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x41981c
mov ecx, 1
mov edx, dword [0x41467c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415c3c
inc ebx
xor esi, esi
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x68]
mov eax, dword [0x41981c]
test eax, eax
je 0x415c2b
cmp esi, dword [eax - 4]
jb 0x415c30
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415c0f
mov eax, 0x60
call fcn.00414a58
lea edi, [eax + eax*2]
push edi
mov eax, 0x419840
mov ecx, 1
mov edx, dword [0x41479c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415c99
inc ebx
xor esi, esi
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x419840]
test eax, eax
je 0x415c88
cmp esi, dword [eax - 4]
jb 0x415c8d
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415c6c
mov eax, 0x1f
call fcn.00414a58
mov edi, eax
add edi, edi
push edi
mov eax, 0x419848
mov ecx, 1
mov edx, dword [0x4147dc]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415cf7
inc ebx
xor esi, esi
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x70]
mov eax, dword [0x419848]
test eax, eax
je 0x415ce6
cmp esi, dword [eax - 4]
jb 0x415ceb
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415cca
mov eax, 0x36
call fcn.00414a58
mov edi, eax
shl edi, 3
push edi
mov eax, 0x419818
mov ecx, 1
mov edx, dword [0x41465c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415d56
inc ebx
xor esi, esi
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x74]
mov eax, dword [0x419818]
test eax, eax
je 0x415d45
cmp esi, dword [eax - 4]
jb 0x415d4a
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415d29
mov eax, 0x43
call fcn.00414a58
lea edi, [eax + eax*2]
push edi
mov eax, 0x419820
mov ecx, 1
mov edx, dword [0x41469c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415db3
inc ebx
xor esi, esi
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x78]
mov eax, dword [0x419820]
test eax, eax
je 0x415da2
cmp esi, dword [eax - 4]
jb 0x415da7
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415d86
mov eax, 0x5d
call fcn.00414a58
mov edi, eax
add edi, edi
push edi
mov eax, 0x419824
mov ecx, 1
mov edx, dword [0x4146bc]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415e11
inc ebx
xor esi, esi
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x419824]
test eax, eax
je 0x415e00
cmp esi, dword [eax - 4]
jb 0x415e05
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415de4
mov eax, 0x28
call fcn.00414a58
mov ebx, eax
mov eax, 0x19
call fcn.00414a58
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419814
mov ecx, 1
mov edx, dword [0x41463c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415e80
inc ebx
xor esi, esi
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x80]
mov eax, dword [0x419814]
test eax, eax
je 0x415e6f
cmp esi, dword [eax - 4]
jb 0x415e74
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415e53
mov eax, 0x18
call fcn.00414a58
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419834
mov ecx, 1
mov edx, dword [0x41473c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415ee7
inc ebx
xor esi, esi
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x84]
mov eax, dword [0x419834]
test eax, eax
je 0x415ed6
cmp esi, dword [eax - 4]
jb 0x415edb
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415eb4
mov eax, 0x2d
call fcn.00414a58
mov edi, eax
add edi, edi
push edi
mov eax, 0x419838
mov ecx, 1
mov edx, dword [0x41475c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415f4b
inc ebx
xor esi, esi
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x88]
mov eax, dword [0x419838]
test eax, eax
je 0x415f3a
cmp esi, dword [eax - 4]
jb 0x415f3f
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415f18
mov eax, 0x14
call fcn.00414a58
mov edi, eax
add edi, edi
push edi
mov eax, 0x41983c
mov ecx, 1
mov edx, dword [0x41477c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415faf
inc ebx
xor esi, esi
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x41983c]
test eax, eax
je 0x415f9e
cmp esi, dword [eax - 4]
jb 0x415fa3
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415f7c
mov eax, 0x1a
call fcn.00414a58
mov edi, eax
shl edi, 2
push edi
mov eax, 0x419830
mov ecx, 1
mov edx, dword [0x41471c]
call fcn.004026b4
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416014
inc ebx
xor esi, esi
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x90]
mov eax, dword [0x419830]
test eax, eax
je 0x416003
cmp esi, dword [eax - 4]
jb 0x416008
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415fe1
mov eax, 0x1a
call fcn.00414a58
mov edi, eax
mov eax, 0x39
call fcn.00414a58
imul edi, eax
lea eax, [edi + 1]
push eax
mov eax, 0x41982c
mov ecx, 1
mov edx, dword [0x4146fc]
call fcn.004026b4
add esp, 4
mov ebx, edi
test ebx, ebx
jle 0x416087
mov esi, 1
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x10]
call fcn.00405284
mov edx, dword [ebp - 0x94]
mov eax, dword [0x41982c]
test eax, eax
je 0x416076
cmp esi, dword [eax - 4]
jb 0x41607b
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416054
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 2
call fcn.00414a68
mov eax, dword [ebp - 8]
call fcn.004093ac
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, 0x416dd0
call fcn.0040521c
mov eax, dword [0x41985c]
mov edx, dword [0x419860]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4160c8
call fcn.004013f4
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409288
mov eax, dword [0x419854]
mov edx, dword [0x419858]
test edx, edx
je 0x4160e9
call fcn.004013f4
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00414c0c
mov eax, dword [ebp - 0x14]
call fcn.004085bc
mov eax, dword [ebp - 0x10]
call fcn.004085bc
mov dl, 1
mov eax, dword [0x40c838]
call fcn.0040cc08
mov ebx, eax
lea eax, [ebp - 0x98]
call fcn.0040426c
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040d0b8
mov eax, ebx
call fcn.00401464
cmp dword [0x41986c], 0
je 0x4161d6
mov byte [0x418614], 0xff
mov eax, 0x1a
call fcn.00414a58
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4161c3
inc ebx
xor esi, esi
mov eax, esi
shl eax, 2
mov edx, dword [0x419830]
test edx, edx
je 0x416172
cmp eax, dword [edx - 4]
jb 0x416177
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0x9c]
call fcn.00408f8c
mov eax, dword [ebp - 0x9c]
push eax
lea edx, [ebp - 0xa0]
mov eax, dword [0x41986c]
call fcn.00408f8c
mov eax, dword [ebp - 0xa0]
pop edx
call fcn.00401eb8
test eax, eax
jle 0x4161bf
mov eax, esi
cmp eax, 0xff
jbe 0x4161ba
call fcn.004013f4
mov byte [0x418614], al
inc esi
dec ebx
jne 0x41615e
cmp byte [0x418614], 0xff
jne 0x4161d6
mov eax, 0x41986c
call fcn.00401a50
mov eax, 0x1a
call fcn.00414a58
dec eax
jle 0x41622b
cmp dword [0x41986c], 0
jne 0x41622b
mov edx, dword [0x418684]
mov edx, dword [edx]
mov eax, dword [0x418638]
call fcn.0040db34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405ec0
mov eax, dword [0x418638]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00406f10
cmp byte [0x418620], 0
jne 0x41622b
call fcn.00414b2c
call fcn.00401948
mov eax, 0x1a
call fcn.00414a58
dec eax
jle 0x4162d8
cmp byte [0x418614], 0
jbe 0x4162d8
mov eax, 0x41986c
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
mov ecx, dword [0x419830]
test ecx, ecx
je 0x416268
cmp edx, dword [ecx - 4]
jb 0x41626d
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
mov eax, 0x39
call fcn.00414a58
mov ebx, eax
test ebx, ebx
jle 0x4162fb
mov esi, 1
mov eax, 0x39
call fcn.00414a58
xor edx, edx
mov dl, byte [0x418614]
imul edx
add eax, esi
mov edx, dword [0x41982c]
test edx, edx
je 0x4162af
cmp eax, dword [edx - 4]
jb 0x4162b4
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, dword [0x41982c]
test eax, eax
je 0x4162c5
cmp esi, dword [eax - 4]
jb 0x4162ca
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x41628a
jmp 0x4162fb
mov eax, 0x41986c
xor edx, edx
mov ecx, dword [0x419830]
test ecx, ecx
je 0x4162ee
cmp edx, dword [ecx - 4]
jb 0x4162f3
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
add edx, 2
mov ecx, dword [0x419830]
test ecx, ecx
je 0x41631b
cmp edx, dword [ecx - 4]
jb 0x416320
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
cmp dword [ebp - 8], 0
je 0x41634c
mov eax, dword [ebp - 8]
call fcn.00408f58
cmp eax, 0xff
jbe 0x416342
call fcn.004013f4
mov edx, dword [0x418654]
mov byte [edx], al
jmp 0x416354
mov eax, dword [0x418654]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
add edx, 3
mov ecx, dword [0x419830]
test ecx, ecx
je 0x416374
cmp edx, dword [ecx - 4]
jb 0x416379
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
cmp dword [ebp - 8], 0
je 0x4163a5
mov eax, dword [ebp - 8]
call fcn.00408f58
cmp eax, 0xff
jbe 0x41639b
call fcn.004013f4
mov edx, dword [0x4186b8]
mov byte [edx], al
jmp 0x4163ad
mov eax, dword [0x4186b8]
mov byte [eax], 0x10
mov eax, 0x5e
call fcn.00414a30
test al, al
je 0x416470
mov eax, 0x3d
call fcn.00414a58
call fcn.00407f4c
test al, al
jne 0x416470
cmp byte [0x418618], 0
jne 0x416466
push 0x30
mov eax, 0x41
mov edx, dword [0x419828]
test edx, edx
je 0x4163f9
cmp eax, dword [edx - 4]
jb 0x4163fe
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
mov eax, 0x3e
mov edx, dword [0x419828]
test edx, edx
je 0x41641b
cmp eax, dword [edx - 4]
jb 0x416420
call fcn.004013f4
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x41982c]
test edx, edx
je 0x416437
cmp eax, dword [edx - 4]
jb 0x41643c
call fcn.004013f4
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xa4]
call fcn.00401c28
mov eax, dword [ebp - 0xa4]
call fcn.00401dd4
push eax
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00414b2c
call fcn.00401948
mov eax, 0x63
call fcn.00414a30
test al, al
je 0x4164e3
call fcn.00414f0c
test al, al
jne 0x4164e3
push 0x30
lea edx, [ebp - 0xa8]
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.00405e68
mov eax, dword [ebp - 0xa8]
call fcn.00401dd4
push eax
mov eax, 0x55
mov edx, dword [0x41982c]
test edx, edx
je 0x4164bb
cmp eax, dword [edx - 4]
jb 0x4164c0
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00414b2c
call fcn.00401948
mov eax, 0x64
call fcn.00414a30
test al, al
je 0x41664d
mov eax, 0x64
mov edx, dword [0x419828]
test edx, edx
je 0x416509
cmp eax, dword [edx - 4]
jb 0x41650e
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.004037a0
fstp qword [ebp - 0x20]
wait
call fcn.00414d94
fstp qword [ebp - 0x28]
wait
mov eax, 0x55
call fcn.00414a30
test al, al
je 0x41653c
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jb 0x41655d
mov eax, 0x55
call fcn.00414a30
test al, al
jne 0x41664d
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
je 0x41664d
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x41982c]
test ecx, ecx
je 0x416574
cmp edx, dword [ecx - 4]
jb 0x416579
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
mov eax, 2
call fcn.00414a30
test al, al
je 0x4165c7
mov esi, 4
push dword [ebp - 8]
push 0x416de0
mov eax, 0x57
mov edx, dword [0x41982c]
test edx, edx
je 0x4165b0
cmp eax, dword [edx - 4]
jb 0x4165b5
call fcn.004013f4
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401c9c
jmp 0x4165c9
xor esi, esi
or esi, 0x30
test esi, esi
jns 0x4165d5
call fcn.004013f4
push esi
lea edx, [ebp - 0xac]
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.00405e68
mov eax, dword [ebp - 0xac]
call fcn.00401dd4
push eax
mov eax, dword [ebp - 8]
call fcn.00401dd4
push eax
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x416643
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x419828]
test edx, edx
je 0x41662c
cmp eax, dword [edx - 4]
jb 0x416631
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00414b2c
call fcn.00401948
mov eax, 0x67
call fcn.00414a30
test al, al
je 0x416727
lea eax, [ebp - 8]
mov edx, 0x68
mov ecx, dword [0x419828]
test ecx, ecx
je 0x416676
cmp edx, dword [ecx - 4]
jb 0x41667b
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
mov eax, 0x69
call fcn.00414a58
cmp eax, 2
jge 0x416701
mov ebx, 1
xor esi, esi
jmp 0x4166f7
mov esi, ebx
mov eax, 0x69
call fcn.00414a58
sub eax, 1
jb 0x4166b0
je 0x4166c4
jmp 0x4166ce
mov eax, dword [ebp - 8]
call fcn.00401dd4
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
jmp 0x4166ce
mov eax, dword [ebp - 8]
call fcn.004152e0
mov ebx, eax
test ebx, ebx
je 0x4166f7
mov eax, dword [0x418684]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x28]
je 0x4166f7
mov eax, dword [0x419810]
mov eax, dword [eax + 0x18]
cmp ebx, dword [eax + 0x28]
je 0x4166f7
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
je 0x416727
cmp ebx, esi
jne 0x41669b
jmp 0x416727
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00408f8c
call fcn.0040c704
cmp al, 3
jbe 0x41671f
mov eax, dword [ebp - 0xc]
call fcn.004154e0
jmp 0x416727
mov eax, dword [ebp - 0xc]
call fcn.004153d0
mov eax, 1
call fcn.00414a30
test al, al
je 0x416b8d
cmp byte [0x418618], 0
jne 0x416b8d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040acf8
xor edx, edx
call fcn.004035e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.00407f68
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040ac58
call fcn.0040a878
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab30
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab08
pop edx
call fcn.0040b668
mov edx, dword [0x418680]
mov dword [edx], eax
mov eax, 3
call fcn.00414a30
test al, al
je 0x41682e
mov eax, 6
call fcn.00414a30
xor al, 1
push eax
mov eax, 4
call fcn.00414a58
push eax
mov eax, 5
call fcn.00414a58
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab30
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab08
push eax
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040ba9c
call fcn.00408d98
pop edx
pop ecx
call fcn.00414ff4
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.00407204
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040acf8
pop edx
call fcn.004035e8
jmp 0x4169b4
xor edx, edx
xor eax, eax
call fcn.0040b668
mov edx, dword [0x418658]
mov dword [edx], eax
lea ecx, [ebp - 0xb0]
xor edx, edx
mov eax, 6
call fcn.00414a68
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x418658]
mov eax, dword [eax]
call fcn.0040bb3c
mov eax, 7
call fcn.00414a58
sub eax, 1
jb 0x416880
je 0x4168a3
dec eax
je 0x4168fe
jmp 0x4169b4
mov eax, dword [0x418658]
mov eax, dword [eax]
call fcn.00407204
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040acf8
pop edx
call fcn.004035e8
jmp 0x4169b4
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a8d4
lea eax, [ebp - 0xc0]
push eax
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040ba9c
call fcn.00408d98
mov edx, eax
mov eax, dword [0x418658]
mov eax, dword [eax]
pop ecx
call fcn.0040b840
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.00407204
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040acf8
pop edx
call fcn.004035e8
jmp 0x4169b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab30
mov edx, dword [0x418658]
mov edx, dword [edx]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xc4], eax
fild dword [ebp - 0xc4]
fdiv dword [0x416de4]
call fcn.00401298
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416939
call fcn.004013f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab08
mov edx, dword [0x418658]
mov edx, dword [edx]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xc8], eax
fild dword [ebp - 0xc8]
fdiv dword [0x416de4]
call fcn.00401298
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416975
call fcn.004013f4
push eax
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040ba9c
call fcn.00408d98
mov edx, eax
mov eax, dword [0x418658]
mov eax, dword [eax]
pop ecx
call fcn.0040b790
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.00407204
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040acf8
pop edx
call fcn.004035e8
mov eax, 8
mov edx, dword [0x419828]
test edx, edx
je 0x4169c8
cmp eax, dword [edx - 4]
jb 0x4169cd
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xcc]
xor edx, edx
call fcn.00410128
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040a6e4
mov eax, 9
mov edx, dword [0x419828]
test edx, edx
je 0x416a02
cmp eax, dword [edx - 4]
jb 0x416a07
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd0]
xor edx, edx
call fcn.00410128
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a6e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040acc0
mov ebx, eax
mov eax, 0xa
call fcn.00414a58
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408950
mov eax, 0xb
mov edx, dword [0x419828]
test edx, edx
je 0x416a61
cmp eax, dword [edx - 4]
jb 0x416a66
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403638
mov eax, 0xc
call fcn.00414a58
mov edx, eax
mov eax, ebx
call fcn.004035c8
mov eax, 0xd
call fcn.00414a58
mov edx, eax
cmp edx, 0xff
jbe 0x416a9c
call fcn.004013f4
mov eax, ebx
call fcn.00403628
mov eax, 0xe
call fcn.00414a58
mov edx, eax
mov eax, ebx
call fcn.00408984
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040acc0
mov ebx, eax
mov eax, 0xf
call fcn.00414a58
mov edx, eax
mov eax, ebx
call fcn.00408984
mov eax, 0x10
call fcn.00414a58
mov edx, eax
mov eax, ebx
call fcn.004035c8
mov eax, 0x11
call fcn.00414a58
mov edx, eax
cmp edx, 0xff
jbe 0x416b02
call fcn.004013f4
mov eax, ebx
call fcn.00403628
mov eax, 0x12
call fcn.00414a58
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408950
mov eax, 0x13
mov edx, dword [0x419828]
test edx, edx
je 0x416b35
cmp eax, dword [edx - 4]
jb 0x416b3a
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403638
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab30
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ab30
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab08
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ab08
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.00407f68
jmp 0x416b98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405ec0
mov eax, 0x31
call fcn.00414a30
test al, al
je 0x416bdb
xor edx, edx
xor eax, eax
call fcn.0040b668
mov edx, dword [0x41867c]
mov dword [edx], eax
lea ecx, [ebp - 0xd4]
xor edx, edx
mov eax, 4
call fcn.00414a68
mov edx, dword [ebp - 0xd4]
mov eax, dword [0x41867c]
mov eax, dword [eax]
call fcn.0040bb3c
mov eax, 0x3f
call fcn.00414a30
test al, al
je 0x416c1e
xor edx, edx
xor eax, eax
call fcn.0040b668
mov edx, dword [0x418660]
mov dword [edx], eax
lea ecx, [ebp - 0xd8]
xor edx, edx
mov eax, 5
call fcn.00414a68
mov edx, dword [ebp - 0xd8]
mov eax, dword [0x418660]
mov eax, dword [eax]
call fcn.0040bb3c
mov eax, 0x70
call fcn.00414a30
test al, al
je 0x416c61
xor edx, edx
xor eax, eax
call fcn.0040b668
mov edx, dword [0x418668]
mov dword [edx], eax
lea ecx, [ebp - 0xdc]
xor edx, edx
mov eax, 7
call fcn.00414a68
mov edx, dword [ebp - 0xdc]
mov eax, dword [0x418668]
mov eax, dword [eax]
call fcn.0040bb3c
mov eax, 0x58
call fcn.00414a30
test al, al
jne 0x416c8b
mov eax, 0x59
call fcn.00414a30
test al, al
jne 0x416c8b
mov eax, 0x5a
call fcn.00414a30
test al, al
je 0x416cc0
xor edx, edx
xor eax, eax
call fcn.0040b668
mov edx, dword [0x418694]
mov dword [edx], eax
lea ecx, [ebp - 0xe0]
xor edx, edx
mov eax, 8
call fcn.00414a68
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x418694]
mov eax, dword [eax]
call fcn.0040bb3c
mov eax, 0x1d
call fcn.00414a30
test al, al
je 0x416d03
xor edx, edx
xor eax, eax
call fcn.0040b668
mov edx, dword [0x4186c0]
mov dword [edx], eax
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, 9
call fcn.00414a68
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x4186c0]
mov eax, dword [eax]
call fcn.0040bb3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416d45
lea eax, [ebp - 0xe4]
mov edx, 7
call fcn.00401a74
lea eax, [ebp - 0xb0]
mov edx, 0x21
call fcn.00401a74
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401a74
ret