Function at 0x496000
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x31
push 0
push 0
dec ecx
jne 0x496008
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4971a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x338]
mov edx, dword [eax]
call dword [edx + 0xe0]
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
call fcn.004562f4
mov edx, dword [ebp - 0x6c]
mov eax, 0x49e22c
call fcn.0040489c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov eax, dword [eax + 0x168]
call fcn.00428d50
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00479e90
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
call fcn.004562f4
cmp dword [ebp - 0x70], 0
jne 0x496247
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x496196
cmp byte [0x49e221], 0
jne 0x496247
push 0x49e22c
push dword [0x49e29c]
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.004562f4
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
call fcn.00405104
push dword [ebp - 0x78]
push 0x4971b8
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x36c]
call fcn.004562f4
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
call fcn.00405104
push dword [ebp - 0x80]
lea eax, [ebp - 0x74]
mov edx, 4
call fcn.00405260
mov eax, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x88]
mov ecx, dword [0x49e298]
mov edx, 0x4971c0
call fcn.004051fc
mov edx, dword [ebp - 0x88]
mov eax, 0x4971e4
pop ecx
call fcn.00495cb4
cmp dword [0x49e22c], 0
jne 0x496247
push 0
lea eax, [ebp - 0x8c]
mov edx, dword [0x49e2a0]
call fcn.00404ad0
mov eax, dword [ebp - 0x8c]
mov cx, word [0x4971e8]
mov dl, 3
call fcn.004314ac
cmp eax, 6
jne 0x496189
mov byte [0x49e221], 1
jmp 0x496247
mov eax, dword [ebp - 4]
call fcn.00498d44
jmp 0x496f33
push 0x49e22c
push dword [0x49e2a8]
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.004562f4
mov edx, dword [ebp - 0x98]
lea eax, [ebp - 0x94]
call fcn.00405104
push dword [ebp - 0x94]
push 0x4971b8
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x36c]
call fcn.004562f4
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 0x9c]
call fcn.00405104
push dword [ebp - 0x9c]
lea eax, [ebp - 0x90]
mov edx, 4
call fcn.00405260
mov eax, dword [ebp - 0x90]
push eax
lea eax, [ebp - 0xa4]
mov ecx, dword [0x49e2a4]
mov edx, 0x4971c0
call fcn.004051fc
mov edx, dword [ebp - 0xa4]
mov eax, 0x4971e4
pop ecx
call fcn.00495cb4
cmp dword [0x49e22c], 0
je 0x496f33
mov eax, dword [ebp - 4]
call fcn.004953b0
mov byte [0x49e220], 0
lea eax, [ebp - 0x14]
mov edx, 0x4971f4
call fcn.004048e0
cmp dword [0x49e238], 0
je 0x4962dd
lea eax, [ebp - 0x14]
mov edx, dword [0x49e238]
call fcn.004048e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4962dd
push dword [0x49e2ac]
push 0x497204
lea eax, [ebp - 0xb0]
mov edx, dword [0x49e238]
call fcn.00405104
push dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
mov edx, 3
call fcn.00405260
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
call fcn.00404ad0
mov eax, dword [ebp - 0xa8]
call fcn.00492f90
push dword [0x49e228]
push dword [ebp - 0x14]
push 0x497214
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x36c]
call fcn.004562f4
push dword [ebp - 0xb4]
push 0x497220
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404bc8
lea eax, [ebp - 0x14]
mov edx, 0x49722c
call fcn.004048e0
cmp dword [0x49e234], 0
je 0x49639e
lea eax, [ebp - 0x14]
mov edx, dword [0x49e234]
call fcn.004048e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x49639e
push dword [0x49e2b0]
push 0x497204
lea eax, [ebp - 0xc0]
mov edx, dword [0x49e234]
call fcn.00405104
push dword [ebp - 0xc0]
lea eax, [ebp - 0xbc]
mov edx, 3
call fcn.00405260
mov edx, dword [ebp - 0xbc]
lea eax, [ebp - 0xb8]
call fcn.00404ad0
mov eax, dword [ebp - 0xb8]
call fcn.00492f90
push dword [ebp - 0x10]
push 0x497240
push dword [ebp - 0x14]
push 0x49724c
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x35c]
call fcn.004562f4
push dword [ebp - 0xc4]
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404bc8
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.004562f4
cmp dword [ebp - 0xc8], 0
je 0x496426
push dword [ebp - 0x10]
push 0x49725c
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.004562f4
push dword [ebp - 0xcc]
push 0x497240
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404bc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x496448
lea eax, [ebp - 0x10]
mov edx, 0x49726c
call fcn.00404b10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x496491
push dword [ebp - 0x10]
push 0x497278
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x368]
call fcn.004562f4
push dword [ebp - 0xd0]
push 0x497240
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404bc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x49655f
push dword [0x49e228]
push dword [0x49e244]
push 0x497284
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404bc8
cmp dword [0x49e23c], 0
je 0x496542
lea eax, [ebp - 0x14]
mov edx, dword [0x49e23c]
call fcn.004048e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x496542
push dword [0x49e2b4]
push 0x497204
lea eax, [ebp - 0xdc]
mov edx, dword [0x49e23c]
call fcn.00405104
push dword [ebp - 0xdc]
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.00405260
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
call fcn.00404ad0
mov eax, dword [ebp - 0xd4]
call fcn.00492f90
push dword [ebp - 0x10]
push 0x497298
push dword [ebp - 0x14]
push 0x4972a8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404bc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov eax, dword [eax + 0x230]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x49665d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov eax, dword [eax + 0x230]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
sub esi, 1
jno 0x49659b
call fcn.004039d4
test esi, esi
jl 0x49665d
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov eax, dword [eax + 0x230]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xe0]
xor edx, edx
call fcn.004052a8
je 0x496655
lea eax, [ebp - 0xec]
mov ecx, 0x4972b4
mov edx, dword [ebp - 0x10]
call fcn.00404b54
mov edx, dword [ebp - 0xec]
lea eax, [ebp - 0xe8]
call fcn.00405104
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xf4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov eax, dword [eax + 0x230]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00409224
push dword [ebp - 0xf0]
push 0x4972bc
lea eax, [ebp - 0xe4]
mov edx, 3
call fcn.00405260
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0x10]
call fcn.00404ad0
inc ebx
dec esi
jne 0x4965a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov eax, dword [eax + 0x230]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x49675b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov eax, dword [eax + 0x230]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
sub esi, 1
jno 0x496699
call fcn.004039d4
test esi, esi
jl 0x49675b
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xf8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov eax, dword [eax + 0x230]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xf8]
xor edx, edx
call fcn.004052a8
je 0x496753
lea eax, [ebp - 0x104]
mov ecx, 0x4972c8
mov edx, dword [ebp - 0x10]
call fcn.00404b54
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.00405104
push dword [ebp - 0x100]
lea ecx, [ebp - 0x10c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov eax, dword [eax + 0x230]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.00409224
push dword [ebp - 0x108]
push 0x4972bc
lea eax, [ebp - 0xfc]
mov edx, 3
call fcn.00405260
mov edx, dword [ebp - 0xfc]
lea eax, [ebp - 0x10]
call fcn.00404ad0
inc ebx
dec esi
jne 0x4966a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x49680d
lea eax, [ebp - 0x10]
mov edx, 0x4972d4
call fcn.00404b10
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.004048e0
jmp 0x4967b1
mov edx, dword [ebp - 0x14]
mov eax, dword [0x49e228]
call fcn.00404e4c
push eax
mov eax, dword [0x49e228]
call fcn.00404b08
mov ecx, eax
lea eax, [ebp - 0x14]
pop edx
call fcn.00404da8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x49e228]
call fcn.00404e4c
test eax, eax
jg 0x49678e
push dword [0x49e2b8]
push 0x497204
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 0x14]
call fcn.00405104
push dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00405260
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x110]
call fcn.00404ad0
mov eax, dword [ebp - 0x110]
call fcn.00492f90
cmp byte [0x49e221], 0
je 0x496832
lea eax, [ebp - 0x11c]
mov edx, dword [0x49e2bc]
call fcn.00404ad0
mov eax, dword [ebp - 0x11c]
call fcn.00492f90
xor eax, eax
mov dword [0x49e248], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
mov edx, dword [0x49e2c0]
call fcn.0048ef8c
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
call fcn.0048ef74
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00488450
mov dword [ebp - 0x68], 0xc
mov dword [ebp - 0x60], 0xffffffff
xor eax, eax
mov dword [ebp - 0x64], eax
push 0
lea eax, [ebp - 0x68]
push eax
push 0x49e25c
push 0x49e258
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x496e83
push 0
lea eax, [ebp - 0x68]
push eax
push 0x49e254
push 0x49e250
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x496e83
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.004032bc
mov dword [ebp - 0x5c], 0x44
mov eax, dword [0x49e258]
mov dword [ebp - 0x24], eax
mov eax, dword [0x49e254]
mov dword [ebp - 0x20], eax
mov eax, dword [0x49e254]
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0x101
mov eax, 0x49e260
xor ecx, ecx
mov edx, 0x10
call fcn.004032bc
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [0x49e250]
push eax
call sub.KERNEL32.DLL_PeekNamedPipe
cmp dword [ebp - 0xc], 0
jbe 0x496933
mov eax, dword [ebp - 4]
call fcn.00495ac0
xor ebx, ebx
lea eax, [ebp - 0x124]
mov edx, dword [0x49e2c4]
call fcn.00404ad0
mov eax, dword [ebp - 0x124]
call fcn.00492f90
push dword [0x49e2c8]
push 0x4972bc
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.004562f4
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
call fcn.00405104
push dword [ebp - 0x12c]
push 0x4971b8
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x36c]
call fcn.004562f4
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
call fcn.00405104
push dword [ebp - 0x134]
lea eax, [ebp - 0x128]
mov edx, 5
call fcn.00405260
mov eax, dword [ebp - 0x128]
call fcn.00493c00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4969f3
mov edi, 0x3e8
mov esi, 0xa
jmp 0x4969fd
mov edi, 0x64
mov esi, 0x64
push 0x49e260
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404d08
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x496b58
jmp 0x496b3f
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [0x49e250]
push eax
call sub.KERNEL32.DLL_PeekNamedPipe
cmp dword [ebp - 0xc], 0
jbe 0x496a58
mov eax, dword [ebp - 4]
call fcn.00495ac0
mov eax, dword [0x49cc24]
mov eax, dword [eax]
call fcn.00476ea0
cmp esi, ebx
jle 0x496b3f
add ebx, 1
jno 0x496a76
call fcn.004039d4
cmp esi, ebx
jg 0x496b3f
push dword [0x49e2cc]
push 0x4972bc
lea edx, [ebp - 0x144]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.004562f4
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x140]
call fcn.00405104
push dword [ebp - 0x140]
push 0x4971b8
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x36c]
call fcn.004562f4
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 0x148]
call fcn.00405104
push dword [ebp - 0x148]
lea eax, [ebp - 0x13c]
mov edx, 5
call fcn.00405260
mov eax, dword [ebp - 0x13c]
call fcn.00493c00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov eax, dword [eax + 0x168]
call fcn.00428d50
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00479e90
lea eax, [ebp - 0x150]
mov edx, dword [0x49e2d0]
call fcn.00404ad0
mov eax, dword [ebp - 0x150]
call fcn.00492f90
push edi
mov eax, dword [0x49e260]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
je 0x496a33
jmp 0x496b87
mov byte [0x49e220], 1
mov eax, dword [0x49cc24]
mov eax, dword [eax]
call fcn.00476b24
lea eax, [ebp - 0x154]
mov edx, dword [0x49e2d4]
call fcn.00404ad0
mov eax, dword [ebp - 0x154]
call fcn.0049341c
cmp byte [0x49e220], 0
jne 0x496e57
mov eax, dword [0x49cc24]
mov eax, dword [eax]
call fcn.00476ea0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [0x49e250]
push eax
call sub.KERNEL32.DLL_PeekNamedPipe
cmp dword [ebp - 0xc], 0
jbe 0x496bc5
mov eax, dword [ebp - 4]
call fcn.00495ac0
cmp dword [ebp - 0xc], 0
jne 0x496b94
lea eax, [ebp - 0x158]
mov edx, dword [0x49e2d8]
call fcn.00404ad0
mov eax, dword [ebp - 0x158]
call fcn.00492f90
lea eax, [ebp - 8]
push eax
mov eax, dword [0x49e260]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
cmp dword [ebp - 8], 0
je 0x496e50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x496e1f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x496c35
xor eax, eax
mov dword [0x49e248], eax
cmp dword [0x49e248], 5
jle 0x496c45
mov byte [0x49e220], 1
cmp dword [0x49e248], 5
jg 0x496e57
cmp byte [0x49e220], 0
jne 0x496e57
add dword [0x49e248], 1
jno 0x496c6d
call fcn.004039d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov eax, dword [eax + 0x168]
call fcn.00428d50
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00479e90
push dword [0x49e2dc]
push 0x4972bc
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x398]
call fcn.004562f4
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 0x160]
call fcn.00405104
push dword [ebp - 0x160]
push 0x4972bc
push dword [0x49e2e0]
lea eax, [ebp - 0x15c]
mov edx, 5
call fcn.00405260
mov edx, dword [ebp - 0x15c]
lea eax, [ebp - 0x18]
call fcn.00404ad0
cmp byte [0x49e220], 0
jne 0x496da0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x496da0
lea eax, [ebp - 0x170]
mov ecx, 0x4972e0
mov edx, dword [ebp - 0x18]
call fcn.00404b54
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x16c]
call fcn.00405104
push dword [ebp - 0x16c]
push dword [0x49e2e4]
push 0x497204
lea edx, [ebp - 0x178]
mov eax, dword [0x49e248]
call fcn.004094ec
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x174]
call fcn.00405104
push dword [ebp - 0x174]
push 0x4972bc
push dword [0x49e2e8]
push 0x4972e8
lea eax, [ebp - 0x168]
mov edx, 7
call fcn.00405260
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 0x18]
call fcn.00404ad0
lea eax, [ebp - 0x17c]
mov edx, dword [ebp - 0x18]
call fcn.00405104
mov eax, dword [ebp - 0x17c]
call fcn.00493c00
mov eax, dword [ebp - 0x18]
call fcn.00492f90
xor eax, eax
push ebp
push 0x496e13
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x398]
call fcn.004562f4
mov eax, dword [ebp - 0x180]
call fcn.0040970c
imul eax, eax, 0x3e8
jno 0x496dfb
call fcn.004039d4
test eax, eax
jns 0x496e04
call fcn.004039cc
call fcn.004950f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496e57
mov byte [0x49e220], 1
mov eax, dword [0x49cc24]
mov eax, dword [eax]
call fcn.00476b24
lea eax, [ebp - 0x184]
mov edx, dword [0x49e2ec]
call fcn.00404ad0
mov eax, dword [ebp - 0x184]
call fcn.0049341c
jmp 0x496e57
mov byte [0x49e220], 1
mov eax, dword [0x49e260]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x49e264]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x49e254]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x49e250]
push eax
call sub.KERNEL32.DLL_CloseHandle
cmp byte [0x49e220], 0
je 0x496839
mov eax, 0x49e22c
call fcn.00404848
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov eax, dword [eax + 0x168]
call fcn.00428d50
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00479e90
mov eax, dword [0x49e2f0]
call fcn.00493c00
lea eax, [ebp - 0x188]
mov edx, dword [0x49e2f4]
call fcn.00404ad0
mov eax, dword [ebp - 0x188]
call fcn.00492f90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
mov edx, dword [0x49e2f8]
call fcn.0048ef8c
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
call fcn.0048ef74
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00488450
mov eax, dword [0x49cc24]
mov eax, dword [eax]
call fcn.00476ea0
mov byte [0x49e220], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4971ac
lea eax, [ebp - 0x18c]
call fcn.00404f54
lea eax, [ebp - 0x188]
mov edx, 2
call fcn.0040486c
lea eax, [ebp - 0x180]
call fcn.00404848
lea eax, [ebp - 0x17c]
call fcn.00404f54
lea eax, [ebp - 0x178]
call fcn.00404848
lea eax, [ebp - 0x174]
call fcn.00404f54
lea eax, [ebp - 0x170]
call fcn.00404848
lea eax, [ebp - 0x16c]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0x164]
call fcn.00404848
lea eax, [ebp - 0x160]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.0040486c
lea eax, [ebp - 0x14c]
call fcn.00404848
lea eax, [ebp - 0x148]
call fcn.00404f54
lea eax, [ebp - 0x144]
call fcn.00404848
lea eax, [ebp - 0x140]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0x138]
call fcn.00404848
lea eax, [ebp - 0x134]
call fcn.00404f54
lea eax, [ebp - 0x130]
call fcn.00404848
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0x124]
call fcn.00404848
lea eax, [ebp - 0x120]
call fcn.00404f54
lea eax, [ebp - 0x11c]
call fcn.00404848
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0x110]
call fcn.00404848
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0x104]
call fcn.00404848
lea eax, [ebp - 0x100]
mov edx, 5
call fcn.00404f6c
lea eax, [ebp - 0xec]
call fcn.00404848
lea eax, [ebp - 0xe8]
mov edx, 5
call fcn.00404f6c
lea eax, [ebp - 0xd4]
call fcn.00404848
lea eax, [ebp - 0xd0]
mov edx, 4
call fcn.0040486c
lea eax, [ebp - 0xc0]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0xb8]
call fcn.00404848
lea eax, [ebp - 0xb4]
call fcn.00404848
lea eax, [ebp - 0xb0]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0xa8]
call fcn.00404848
lea eax, [ebp - 0xa4]
call fcn.00404f54
lea eax, [ebp - 0xa0]
call fcn.00404848
lea eax, [ebp - 0x9c]
call fcn.00404f54
lea eax, [ebp - 0x98]
call fcn.00404848
lea eax, [ebp - 0x94]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0x8c]
call fcn.00404848
lea eax, [ebp - 0x88]
call fcn.00404f54
lea eax, [ebp - 0x84]
call fcn.00404848
lea eax, [ebp - 0x80]
call fcn.00404f54
lea eax, [ebp - 0x7c]
call fcn.00404848
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00404f6c
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.0040486c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040486c
ret