Function at 0x4ae560
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4a
push 0
push 0
dec ecx
jne 0x4ae568
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4af32a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x28], 0xa
mov eax, dword [ebp - 4]
call fcn.004b3dac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
xor edx, edx
call fcn.0045ed90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d468
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d468
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4ffd8]
jge 0x4af17a
lea edx, [ebp - 0x1f8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
call fcn.00431df4
mov eax, dword [ebp - 0x1f8]
mov edx, 0x4af340
call fcn.00403f74
jne 0x4ae642
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431d0c
lea eax, [ebp - 0x14]
mov edx, 0x4af34c
call fcn.00403c7c
jmp 0x4ae670
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov dl, 1
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
call fcn.00432038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
xor edx, edx
call fcn.00431d0c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xa944]
test ebx, ebx
je 0x4ae829
lea ecx, [ebp - 0x200]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa57c]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x200]
lea edx, [ebp - 0x1fc]
call fcn.004095f8
mov eax, dword [ebp - 0x1fc]
lea edx, [ebp - 0x1c]
call fcn.00408ee8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af35c
call fcn.00403f74
je 0x4ae734
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af36c
call fcn.00403f74
je 0x4ae734
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af37c
call fcn.00403f74
je 0x4ae734
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af38c
call fcn.00403f74
je 0x4ae734
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af39c
call fcn.00403f74
je 0x4ae734
mov edx, dword [ebp - 0x1c]
mov eax, 0x4af3ac
call fcn.00404150
test eax, eax
jg 0x4ae734
mov edx, dword [ebp - 0x1c]
mov eax, 0x4af3bc
call fcn.00404150
test eax, eax
jg 0x4ae734
mov edx, dword [ebp - 0x1c]
mov eax, 0x4af3cc
call fcn.00404150
test eax, eax
jle 0x4ae75f
lea ecx, [ebp - 0x204]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa57c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa944]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x204]
lea edx, [ebp - 0x14]
call fcn.004095c0
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af3dc
call fcn.00403f74
jne 0x4ae829
lea ecx, [ebp - 0x208]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa57c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa944]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x1f4]
call fcn.0040633e
lea eax, [ebp - 0x1f4]
call fcn.0040675f
call fcn.00402854
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1f4]
call fcn.00404224
lea eax, [ebp - 0x1f4]
call fcn.004066fc
call fcn.00402854
jmp 0x4ae7ee
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1f4]
call fcn.00404224
lea eax, [ebp - 0x1f4]
call fcn.004066fc
call fcn.00402854
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 0x14]
call fcn.00409084
cmp dword [ebp - 0x20c], 0
jne 0x4ae819
lea eax, [ebp - 0x1f4]
call fcn.00406538
call fcn.00402854
test al, al
je 0x4ae7d0
lea eax, [ebp - 0x1f4]
call fcn.004064a8
call fcn.00402854
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
cmp byte [eax + 0x47], 1
jne 0x4ae94b
xor ebx, ebx
xor esi, esi
jmp 0x4ae883
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov edx, esi
call fcn.00469154
lea eax, [eax + esi + 1]
mov esi, eax
lea ecx, [ebp - 0x210]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov eax, dword [eax + 0x23c]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x14]
call fcn.00409084
inc ebx
cmp dword [ebp - 0x14], 0
jne 0x4ae8a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp ebx, eax
jl 0x4ae842
dec esi
test esi, esi
jle 0x4ae94b
xor eax, eax
push ebp
push 0x4ae941
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0xc4]
call fcn.0042ce9c
lea edx, [ebp - 0x24]
call fcn.0042cabc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
call fcn.00428ae0
call fcn.0042ce9c
lea edx, [ebp - 0x214]
call fcn.0042cabc
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x14]
call fcn.00409084
call fcn.0042ce9c
mov edx, dword [ebp - 0x24]
call fcn.0042cb3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ae94b
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 0x14]
call fcn.00409084
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 0x14]
call fcn.00403c7c
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x50
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040406c
mov eax, dword [ebp - 0x14]
call fcn.00403e64
mov esi, eax
test esi, esi
jle 0x4aea72
mov ebx, 1
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0040406c
lea eax, [ebp - 0x20]
push eax
mov ecx, 2
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0040406c
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af3ec
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af3f8
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af404
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af410
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af41c
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af428
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x20]
mov edx, 0x4af434
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x20]
mov edx, 0x4af440
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x20]
mov edx, 0x4af44c
call fcn.00403f74
je 0x4aea54
mov eax, dword [ebp - 0x20]
mov edx, 0x4af458
call fcn.00403f74
jne 0x4aea6a
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040406c
jmp 0x4aea72
inc ebx
dec esi
jne 0x4ae994
mov eax, dword [ebp - 0x14]
mov edx, 0x4af34c
call fcn.00403f74
jne 0x4aebc0
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa950]
call fcn.00408ee8
mov edx, dword [ebp - 0x21c]
mov eax, 0x4af464
call fcn.00404150
test eax, eax
jle 0x4aebc0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa944], 0
je 0x4aebc0
mov ebx, 1
xor esi, esi
lea eax, [ebp - 0x220]
call fcn.004042a8
push eax
lea eax, [ebp - 0x224]
call fcn.0040601c
push eax
lea ecx, [ebp - 0x228]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b8]
mov edx, 0xcb
call fcn.0046d07c
mov eax, dword [ebp - 0x228]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.00406118
mov eax, dword [ebp - 0x224]
push eax
mov eax, dword [eax]
call dword [eax + pe_nt_image_headers32]
call fcn.00406118
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 0x18]
call fcn.00403e2c
lea eax, [ebp - 0x14]
call fcn.00403be4
jmp 0x4aeba3
cmp esi, 1
jne 0x4aeb4c
mov eax, dword [ebp - 0x18]
cmp byte [eax + ebx - 1], 0xd
jne 0x4aeb4c
mov esi, 2
jmp 0x4aeba3
test esi, esi
jne 0x4aeb7d
mov eax, dword [ebp - 0x18]
cmp byte [eax + ebx - 1], 0xa1
je 0x4aeb7d
mov eax, dword [ebp - 0x18]
cmp byte [eax + ebx - 1], 0x20
je 0x4aeb7d
mov eax, dword [ebp - 0x18]
cmp byte [eax + ebx - 1], 0xd
je 0x4aeb7d
mov eax, dword [ebp - 0x18]
cmp byte [eax + ebx - 1], 0xa
je 0x4aeb7d
mov esi, 1
cmp esi, 1
jne 0x4aeba2
lea eax, [ebp - 0x22c]
mov edx, dword [ebp - 0x18]
mov dl, byte [edx + ebx - 1]
call fcn.00403d8c
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x14]
call fcn.00403e6c
inc ebx
cmp esi, 2
jge 0x4aebc0
cmp ebx, 0x2710
jge 0x4aebc0
mov eax, dword [ebp - 0x18]
call fcn.00403e64
cmp ebx, eax
jl 0x4aeb36
cmp dword [ebp - 0x14], 0
jne 0x4aebd3
lea eax, [ebp - 0x14]
mov edx, 0x4af34c
call fcn.00403c7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d468
test eax, eax
jne 0x4aec0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.0045d508
mov dword [ebp - 0xc], eax
jmp 0x4aecac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ffd8]
cmp eax, dword [ebp - 0x10]
jle 0x4aecac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
call fcn.0045f008
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 2
jne 0x4aec6a
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 3
jge 0x4aec4b
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0045c708
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.0045d4ec
mov dword [ebp - 0xc], eax
jmp 0x4aecac
cmp dword [ebp - 8], 1
jne 0x4aec8f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.0045d508
mov dword [ebp - 0xc], eax
jmp 0x4aecac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.0045d590
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0045ccc0
mov edx, dword [ebp - 4]
mov dword [edx + 0xb3b4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov edx, dword [ebp - 0xc]
call fcn.0045f050
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d468
mov ebx, eax
sub ebx, 2
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xb3b4]
sub esi, ebx
jg 0x4aed1d
dec esi
mov eax, ebx
shl eax, 3
sub eax, ebx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
lea esi, [edx + eax*8 + 0xb568]
lea edi, [ecx + eax*8 + 0xb5a0]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
pop esi
dec ebx
inc esi
jne 0x4aecf5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*8 + 0xb594], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*8 + 0xb598], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb59c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*8 + 0xb580], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*8 + 0xb584], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb589], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*8 + 0xb58c], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*8 + 0xb578], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb591], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb574], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*8 + 0xb570], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + eax*8 + 0xb56c], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb575], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb577], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb590], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb588], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + 0x510d5]
add cl, 2
mov byte [edx + eax*8 + 0xb57c], cl
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xb3b4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d8d0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xb3b4]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx*8 + 0xb57c]
call fcn.0045c708
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
cmp byte [eax + 0x2c], 0
jne 0x4aef62
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb589], 0xa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
cmp byte [eax + 0x47], 1
jne 0x4aefc4
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa513], 0
jne 0x4aef93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x678]
mov eax, dword [eax + 0x23c]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
mov byte [eax + 0xa513], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4c4], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb576], 0
jmp 0x4aefdf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb3b4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov byte [edx + eax*8 + 0xb576], 1
xor ecx, ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004b3dec
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xa944]
test ebx, ebx
jne 0x4af055
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa589], 0
jne 0x4af012
mov eax, dword [ebp - 4]
add eax, 0xa950
call fcn.00403be4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xb3b4]
mov eax, dword [ebp - 4]
call fcn.004af9e0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa589], 0
jne 0x4af157
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
cmp byte [eax + 0x47], 0
jne 0x4af157
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae1d8
jmp 0x4af157
lea ecx, [ebp - 0x234]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa57c]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.004095f8
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x1c]
call fcn.00408ee8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af3dc
call fcn.00403f74
je 0x4af12a
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af35c
call fcn.00403f74
je 0x4af12a
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af36c
call fcn.00403f74
je 0x4af12a
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af38c
call fcn.00403f74
je 0x4af12a
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af37c
call fcn.00403f74
je 0x4af12a
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af474
call fcn.00403f74
je 0x4af12a
mov eax, dword [ebp - 0x1c]
mov edx, 0x4af39c
call fcn.00403f74
je 0x4af12a
mov edx, dword [ebp - 0x1c]
mov eax, 0x4af3ac
call fcn.00404150
test eax, eax
jg 0x4af12a
mov edx, dword [ebp - 0x1c]
mov eax, 0x4af3cc
call fcn.00404150
test eax, eax
jg 0x4af12a
mov edx, dword [ebp - 0x1c]
mov eax, 0x4af3bc
call fcn.00404150
test eax, eax
jle 0x4af146
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa950]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xb3b4]
mov eax, dword [ebp - 4]
call fcn.004c1364
jmp 0x4af157
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xb3b4]
mov eax, dword [ebp - 4]
call fcn.004af9e0
mov eax, dword [ebp - 4]
call fcn.004b3dac
mov eax, dword [ebp - 4]
call fcn.004ab6d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x684]
call fcn.0045f008
call fcn.0045d0ec
xor ecx, ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004b3dec
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x4ffd8]
cmp ebx, dword [ebp - 0x10]
jl 0x4af19e
cmp ebx, dword [ebp - 0x10]
jne 0x4af2c3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4ffd4], 0xb
jne 0x4af271
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa944], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x770]
mov dl, 1
call fcn.004532dc
mov eax, dword [ebp - 4]
mov byte [eax + 0xa940], 7
push 9
lea edx, [ebp - 0x23c]
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.004507d8
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.0040958c
mov eax, dword [ebp - 0x238]
call fcn.00404028
push eax
mov eax, dword [0x4d23b8]
mov edx, dword [eax + 0x4ffa8]
lea eax, [ebp - 0x240]
mov ecx, 0x4af484
call fcn.00403eb0
mov eax, dword [ebp - 0x240]
call fcn.00404028
push eax
lea edx, [ebp - 0x248]
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.004507d8
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.004095c0
mov eax, dword [ebp - 0x244]
call fcn.00404028
push eax
push 0x4af4a0
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4af2c3
push 0
push 0x4af4b0
lea edx, [ebp - 0x250]
mov eax, ebx
call fcn.00409238
push dword [ebp - 0x250]
push 0x4af3f8
push 0x4af4cc
lea eax, [ebp - 0x24c]
mov edx, 4
call fcn.00403f24
mov eax, dword [ebp - 0x24c]
call fcn.00404028
mov edx, eax
mov ecx, 0x4af4dc
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.00450468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af331
lea eax, [ebp - 0x250]
mov edx, 0xa
call fcn.00403c08
lea eax, [ebp - 0x228]
call fcn.0040601c
lea eax, [ebp - 0x224]
call fcn.0040601c
lea eax, [ebp - 0x220]
call fcn.004042a8
lea eax, [ebp - 0x21c]
mov edx, 9
call fcn.00403c08
lea eax, [ebp - 0x1f8]
call fcn.00403be4
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00403c08
ret