Function at 0x414740
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x414748
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x415dac
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x34]
mov eax, 1
call fcn.00403b04
mov eax, dword [ebp - 0x34]
mov edx, 0x415dc4
call fcn.00401d34
jne 0x414791
push 1
push 0x415dcc
call sub.kernel32.dll_WinExec
call fcn.0040195c
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00413d18
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00403ee8
mov eax, dword [ebp - 0x38]
call fcn.00403f64
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.00403b04
mov eax, dword [ebp - 0x40]
call fcn.00408b68
mov dword [ebp - 0x10], eax
call fcn.00404d58
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffd6
call fcn.00408a68
mov edx, 0x418b98
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00408a60
mov edx, 0x418b88
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00408a60
mov edx, 0x418b9c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00408a60
mov edx, 0x418ba4
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00408a60
mov edx, 0x418bac
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00408a60
mov edx, 0x418bb4
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00408a60
lea edx, [ebp - 0x2e]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00408a60
cmp byte [ebp - 0x2e], 0xf1
je 0x414869
mov eax, dword [ebp - 0x10]
call fcn.00407e7c
call fcn.00413f14
mov eax, dword [0x418bac]
mov edx, dword [0x418bb0]
add eax, dword [0x418bb4]
adc edx, dword [0x418bb8]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x41488f
call fcn.00401408
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00408a68
mov eax, dword [0x418b88]
push eax
mov eax, 0x418b90
mov ecx, 1
mov edx, dword [0x413a6c]
call fcn.0040264c
add esp, 4
mov eax, dword [0x418b88]
mov edx, dword [0x418b8c]
sub eax, 1
sbb edx, 0
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4148da
call fcn.00401408
mov esi, eax
test esi, esi
jl 0x41490a
inc esi
xor ebx, ebx
mov eax, dword [0x418b90]
test eax, eax
je 0x4148f1
cmp ebx, dword [eax - 4]
jb 0x4148f6
call fcn.00401408
lea edx, [eax + ebx*8]
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00408a60
inc ebx
dec esi
jne 0x4148e3
xor eax, eax
mov al, byte [0x418b98]
push eax
mov eax, 0x418b94
mov ecx, 1
mov edx, dword [0x413a8c]
call fcn.0040264c
add esp, 4
movzx esi, byte [0x418b98]
dec esi
test esi, esi
jl 0x414960
inc esi
xor ebx, ebx
mov eax, dword [0x418b94]
test eax, eax
je 0x414947
cmp ebx, dword [eax - 4]
jb 0x41494c
call fcn.00401408
lea edx, [eax + ebx]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00408a60
inc ebx
dec esi
jne 0x414939
mov eax, dword [0x418b9c]
mov edx, dword [0x418ba0]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x41497a
call fcn.00401408
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00408a68
mov eax, dword [0x418ba4]
mov edx, dword [0x418ba8]
test edx, edx
je 0x41499b
call fcn.00401408
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
call fcn.00413e84
mov eax, dword [ebp - 0x24]
xor ecx, ecx
xor edx, edx
call fcn.00408a68
mov eax, dword [0x40c12c]
push eax
mov ecx, dword [ebp - 0x24]
mov dl, 1
mov eax, dword [0x40c0c8]
call fcn.0040c288
mov edi, eax
call fcn.00404d58
mov dword [ebp - 0x2c], eax
mov edx, edi
mov eax, dword [ebp - 0x2c]
call fcn.004146a0
movzx esi, byte [0x418b98]
dec esi
test esi, esi
jle 0x414b19
mov ebx, 1
mov eax, dword [0x418b94]
test eax, eax
je 0x414a00
cmp ebx, dword [eax - 4]
jb 0x414a05
call fcn.00401408
mov al, byte [eax + ebx]
mov byte [ebp - 0x2d], al
call fcn.00404d58
mov dword [ebp - 0x28], eax
mov edx, edi
mov eax, dword [ebp - 0x28]
call fcn.004146a0
xor eax, eax
mov al, byte [ebp - 0x2d]
add eax, 0xfffffffc
cmp eax, 5
ja case.0x414a2e.6
jmp dword [eax*4 + 0x414a35]
xor edx, edx
xor eax, eax
call fcn.0040ae94
mov edx, dword [0x417650]
mov dword [edx], eax
mov eax, dword [0x417650]
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
call fcn.00407080
jmp 0x414b09
xor edx, edx
xor eax, eax
call fcn.0040ae94
mov dword [0x418b70], eax
mov eax, dword [0x418b70]
mov edx, dword [ebp - 0x28]
call fcn.00407080
jmp 0x414b09
xor edx, edx
xor eax, eax
call fcn.0040ae94
mov dword [0x418b7c], eax
mov eax, dword [0x418b7c]
mov edx, dword [ebp - 0x28]
call fcn.00407080
jmp 0x414b09
xor edx, edx
xor eax, eax
call fcn.0040ae94
mov dword [0x418b80], eax
mov eax, dword [0x418b80]
mov edx, dword [ebp - 0x28]
call fcn.00407080
jmp 0x414b09
xor edx, edx
xor eax, eax
call fcn.0040ae94
mov dword [0x418b84], eax
mov eax, dword [0x418b84]
mov edx, dword [ebp - 0x28]
call fcn.00407080
jmp 0x414b09
mov eax, dword [ebp - 0x28]
call fcn.00408a58
push eax
lea edx, [ebp - 0x44]
xor eax, eax
mov al, byte [ebp - 0x2d]
call fcn.00413d18
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
call fcn.00404be8
mov eax, dword [ebp - 0x28]
call fcn.00407e7c
inc ebx
dec esi
jne 0x4149f2
mov eax, edi
call fcn.00401478
mov eax, dword [ebp - 0x24]
call fcn.00407e7c
mov eax, dword [ebp - 0x10]
call fcn.00407e7c
push 0x79
mov eax, 0x418b4c
mov ecx, 1
mov edx, dword [0x41394c]
call fcn.0040264c
add esp, 4
xor ebx, ebx
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x48]
mov eax, dword [0x418b4c]
test eax, eax
je 0x414b68
cmp ebx, dword [eax - 4]
jb 0x414b6d
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
cmp ebx, 0x79
jne 0x414b4c
mov eax, 0x62
call fcn.00413d08
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x418b68
mov ecx, 1
mov edx, dword [0x413a2c]
call fcn.0040264c
add esp, 4
mov esi, ebx
dec esi
test esi, esi
jl 0x414bdc
inc esi
xor ebx, ebx
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x418b68]
test eax, eax
je 0x414bcb
cmp ebx, dword [eax - 4]
jb 0x414bd0
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x414baf
mov esi, edi
dec esi
test esi, esi
jl 0x414cd4
inc esi
xor ebx, ebx
lea eax, [ebp - 0x50]
push eax
mov eax, ebx
shl eax, 2
mov edx, dword [0x418b68]
test edx, edx
je 0x414c02
cmp eax, dword [edx - 4]
jb 0x414c07
call fcn.00401408
mov eax, dword [edx + eax*4]
call fcn.00408754
test eax, eax
jns 0x414c18
call fcn.00401408
mov edx, ebx
shl edx, 2
add edx, 2
mov ecx, dword [0x418b68]
test ecx, ecx
je 0x414c2f
cmp edx, dword [ecx - 4]
jb 0x414c34
call fcn.00401408
mov edx, dword [ecx + edx*4]
push edx
mov edx, ebx
shl edx, 2
inc edx
mov ecx, dword [0x418b68]
test ecx, ecx
je 0x414c4d
cmp edx, dword [ecx - 4]
jb 0x414c52
call fcn.00401408
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.00413fac
mov edx, dword [ebp - 0x50]
mov eax, dword [0x418b68]
test eax, eax
je 0x414c6c
cmp ebx, dword [eax - 4]
jb 0x414c71
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
mov eax, dword [0x418b68]
test eax, eax
je 0x414c87
cmp ebx, dword [eax - 4]
jb 0x414c8c
call fcn.00401408
cmp dword [eax + ebx*4], 0
jne 0x414ccc
mov eax, dword [0x418b68]
test eax, eax
je 0x414ca0
cmp ebx, dword [eax - 4]
jb 0x414ca5
call fcn.00401408
lea eax, [eax + ebx*4]
mov edx, ebx
shl edx, 2
add edx, 3
mov ecx, dword [0x418b68]
test ecx, ecx
je 0x414cbf
cmp edx, dword [ecx - 4]
jb 0x414cc4
call fcn.00401408
mov edx, dword [ecx + edx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x414bea
push edi
mov eax, 0x418b68
mov ecx, 1
mov edx, dword [0x413a2c]
call fcn.0040264c
add esp, 4
mov eax, 0x6e
call fcn.00413ce0
mov byte [0x4175ec], al
call fcn.00403c10
mov esi, eax
test esi, esi
jle 0x414ecc
mov ebx, 1
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00403b04
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00408788
mov eax, dword [ebp - 8]
mov edx, 0x415de0
call fcn.00401d34
jne 0x414d3b
mov byte [0x4175ec], 1
mov eax, dword [ebp - 8]
mov edx, 0x415dec
call fcn.00401d34
jne 0x414d51
mov byte [0x4175f0], 1
mov eax, dword [ebp - 8]
mov edx, 0x415df8
call fcn.00401d34
jne 0x414d86
mov eax, 0x6b
mov edx, dword [0x418b4c]
test edx, edx
je 0x414d74
cmp eax, dword [edx - 4]
jb 0x414d79
call fcn.00401408
lea eax, [edx + eax*4]
mov edx, 0x415e04
call fcn.00401ab8
mov eax, dword [ebp - 8]
mov edx, 0x415e10
call fcn.00401d34
jne 0x414dbb
mov eax, 0x3f
mov edx, dword [0x418b4c]
test edx, edx
je 0x414da9
cmp eax, dword [edx - 4]
jb 0x414dae
call fcn.00401408
lea eax, [edx + eax*4]
mov edx, 0x415e04
call fcn.00401ab8
lea eax, [ebp - 0x54]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e44
mov eax, dword [ebp - 0x54]
mov edx, 0x415e1c
call fcn.00401d34
jne 0x414e2a
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bf0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e44
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.00403c60
mov edx, dword [ebp - 0x58]
mov eax, 0x3a
mov ecx, dword [0x418b4c]
test ecx, ecx
je 0x414e1d
cmp eax, dword [ecx - 4]
jb 0x414e22
call fcn.00401408
lea eax, [ecx + eax*4]
call fcn.00401ab8
lea eax, [ebp - 0x60]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e44
mov eax, dword [ebp - 0x60]
mov edx, 0x415e28
call fcn.00401d34
jne 0x414e83
mov eax, 0x6a
mov edx, dword [0x418b4c]
test edx, edx
je 0x414e63
cmp eax, dword [edx - 4]
jb 0x414e68
call fcn.00401408
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bf0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e44
lea eax, [ebp - 0x64]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e44
mov eax, dword [ebp - 0x64]
mov edx, 0x415e34
call fcn.00401d34
jne 0x414ec4
push 0x418bbc
mov eax, dword [ebp - 8]
call fcn.00401bf0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e44
inc ebx
dec esi
jne 0x414d10
cmp byte [0x4175ec], 0
je 0x414efe
mov eax, 0x1d
mov edx, dword [0x418b4c]
test edx, edx
je 0x414ee9
cmp eax, dword [edx - 4]
jb 0x414eee
call fcn.00401408
cmp dword [edx + eax*4], 0
je 0x414efe
call fcn.00413dac
call fcn.0040195c
mov eax, 0x41
mov edx, dword [0x418b4c]
test edx, edx
je 0x414f12
cmp eax, dword [edx - 4]
jb 0x414f17
call fcn.00401408
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x68]
xor edx, edx
call fcn.0040f01c
mov edx, dword [ebp - 0x68]
mov eax, dword [0x417654]
mov eax, dword [eax]
call fcn.00409ec8
lea edx, [ebp - 0x6c]
mov eax, dword [0x417654]
mov eax, dword [eax]
call fcn.004057fc
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00409ec8
cmp byte [0x4175ec], 0
jne 0x414f6d
push 5
mov eax, dword [0x417654]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
jmp 0x414f7b
mov eax, dword [0x417654]
mov eax, dword [eax]
xor edx, edx
call fcn.00405844
mov eax, 0x32
call fcn.00413d08
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x418b40
mov ecx, 1
mov edx, dword [0x4138ec]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x414fdc
inc esi
xor ebx, ebx
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x70]
mov eax, dword [0x418b40]
test eax, eax
je 0x414fcb
cmp ebx, dword [eax - 4]
jb 0x414fd0
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x414faf
mov eax, 0x60
call fcn.00413d08
lea edi, [eax + eax*2]
push edi
mov eax, 0x418b64
mov ecx, 1
mov edx, dword [0x413a0c]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x415039
inc esi
xor ebx, ebx
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x74]
mov eax, dword [0x418b64]
test eax, eax
je 0x415028
cmp ebx, dword [eax - 4]
jb 0x41502d
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x41500c
mov eax, 0x1f
call fcn.00413d08
mov edi, eax
add edi, edi
push edi
mov eax, 0x418b6c
mov ecx, 1
mov edx, dword [0x413a4c]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x415097
inc esi
xor ebx, ebx
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x78]
mov eax, dword [0x418b6c]
test eax, eax
je 0x415086
cmp ebx, dword [eax - 4]
jb 0x41508b
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x41506a
mov eax, 0x36
call fcn.00413d08
mov edi, eax
shl edi, 3
push edi
mov eax, 0x418b3c
mov ecx, 1
mov edx, dword [0x4138cc]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x4150f6
inc esi
xor ebx, ebx
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x418b3c]
test eax, eax
je 0x4150e5
cmp ebx, dword [eax - 4]
jb 0x4150ea
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x4150c9
mov eax, 0x43
call fcn.00413d08
lea edi, [eax + eax*4]
push edi
mov eax, 0x418b44
mov ecx, 1
mov edx, dword [0x41390c]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x415153
inc esi
xor ebx, ebx
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x80]
mov eax, dword [0x418b44]
test eax, eax
je 0x415142
cmp ebx, dword [eax - 4]
jb 0x415147
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x415126
mov eax, 0x5d
call fcn.00413d08
mov edi, eax
add edi, edi
push edi
mov eax, 0x418b48
mov ecx, 1
mov edx, dword [0x41392c]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x4151b7
inc esi
xor ebx, ebx
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x84]
mov eax, dword [0x418b48]
test eax, eax
je 0x4151a6
cmp ebx, dword [eax - 4]
jb 0x4151ab
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x415184
mov eax, 0x28
call fcn.00413d08
mov ebx, eax
mov eax, 0x19
call fcn.00413d08
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x418b38
mov ecx, 1
mov edx, dword [0x4138ac]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x41522c
inc esi
xor ebx, ebx
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x88]
mov eax, dword [0x418b38]
test eax, eax
je 0x41521b
cmp ebx, dword [eax - 4]
jb 0x415220
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x4151f9
mov eax, 0x18
call fcn.00413d08
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x418b58
mov ecx, 1
mov edx, dword [0x4139ac]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x415293
inc esi
xor ebx, ebx
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x418b58]
test eax, eax
je 0x415282
cmp ebx, dword [eax - 4]
jb 0x415287
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x415260
mov eax, 0x2d
call fcn.00413d08
mov edi, eax
add edi, edi
push edi
mov eax, 0x418b5c
mov ecx, 1
mov edx, dword [0x4139cc]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x4152f7
inc esi
xor ebx, ebx
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x90]
mov eax, dword [0x418b5c]
test eax, eax
je 0x4152e6
cmp ebx, dword [eax - 4]
jb 0x4152eb
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x4152c4
mov eax, 0x14
call fcn.00413d08
mov edi, eax
add edi, edi
push edi
mov eax, 0x418b60
mov ecx, 1
mov edx, dword [0x4139ec]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x41535b
inc esi
xor ebx, ebx
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x94]
mov eax, dword [0x418b60]
test eax, eax
je 0x41534a
cmp ebx, dword [eax - 4]
jb 0x41534f
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x415328
mov eax, 0x1a
call fcn.00413d08
mov edi, eax
shl edi, 2
push edi
mov eax, 0x418b54
mov ecx, 1
mov edx, dword [0x41398c]
call fcn.0040264c
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x4153c0
inc esi
xor ebx, ebx
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x98]
mov eax, dword [0x418b54]
test eax, eax
je 0x4153af
cmp ebx, dword [eax - 4]
jb 0x4153b4
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x41538d
mov eax, 0x1a
call fcn.00413d08
imul edi, eax, 0x57
lea eax, [edi + 1]
push eax
mov eax, 0x418b50
mov ecx, 1
mov edx, dword [0x41396c]
call fcn.0040264c
add esp, 4
mov esi, edi
test esi, esi
jle 0x415427
mov ebx, 1
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x2c]
call fcn.00404b68
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x418b50]
test eax, eax
je 0x415416
cmp ebx, dword [eax - 4]
jb 0x41541b
call fcn.00401408
lea eax, [eax + ebx*4]
call fcn.00401ab8
inc ebx
dec esi
jne 0x4153f4
cmp dword [0x418bbc], 0
je 0x4154c7
mov byte [0x4175e8], 0xff
mov eax, 0x1a
call fcn.00413d08
mov esi, eax
dec esi
test esi, esi
jl 0x4154b4
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x418b54]
test edx, edx
je 0x415463
cmp eax, dword [edx - 4]
jb 0x415468
call fcn.00401408
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0xa0]
call fcn.00408788
mov eax, dword [ebp - 0xa0]
push eax
lea edx, [ebp - 0xa4]
mov eax, dword [0x418bbc]
call fcn.00408788
mov eax, dword [ebp - 0xa4]
pop edx
call fcn.00401ecc
test eax, eax
jle 0x4154b0
cmp ebx, 0xff
jbe 0x4154aa
call fcn.00401408
mov byte [0x4175e8], bl
inc ebx
dec esi
jne 0x41544f
cmp byte [0x4175e8], 0xff
jne 0x4154c7
mov eax, 0x418bbc
call fcn.00401a64
mov eax, 0x1a
call fcn.00413d08
dec eax
jle 0x41551c
cmp dword [0x418bbc], 0
jne 0x41551c
mov edx, dword [0x417654]
mov edx, dword [edx]
mov eax, dword [0x417610]
call fcn.0040d270
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405854
mov eax, dword [0x417610]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.004067d0
cmp byte [0x4175f4], 0
jne 0x41551c
call fcn.00413dac
call fcn.0040195c
mov eax, 0x1a
call fcn.00413d08
dec eax
jle 0x4155ae
cmp byte [0x4175e8], 0
jbe 0x4155ae
mov eax, 0x418bbc
xor edx, edx
mov dl, byte [0x4175e8]
shl edx, 2
mov ecx, dword [0x418b54]
test ecx, ecx
je 0x415555
cmp edx, dword [ecx - 4]
jb 0x41555a
call fcn.00401408
mov edx, dword [ecx + edx*4]
call fcn.00401ab8
mov ebx, 1
mov eax, dword [0x418b50]
test eax, eax
je 0x415575
cmp ebx, dword [eax - 4]
jb 0x41557a
call fcn.00401408
lea eax, [eax + ebx*4]
xor edx, edx
mov dl, byte [0x4175e8]
imul edx, edx, 0x57
add edx, ebx
mov ecx, dword [0x418b50]
test ecx, ecx
je 0x415599
cmp edx, dword [ecx - 4]
jb 0x41559e
call fcn.00401408
mov edx, dword [ecx + edx*4]
call fcn.00401ab8
inc ebx
cmp ebx, 0x58
jne 0x415567
jmp 0x4155d1
mov eax, 0x418bbc
xor edx, edx
mov ecx, dword [0x418b54]
test ecx, ecx
je 0x4155c4
cmp edx, dword [ecx - 4]
jb 0x4155c9
call fcn.00401408
mov edx, dword [ecx + edx*4]
call fcn.00401ab8
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x4175e8]
shl edx, 2
add edx, 2
mov ecx, dword [0x418b54]
test ecx, ecx
je 0x4155f1
cmp edx, dword [ecx - 4]
jb 0x4155f6
call fcn.00401408
mov edx, dword [ecx + edx*4]
call fcn.00401afc
cmp dword [ebp - 8], 0
je 0x415622
mov eax, dword [ebp - 8]
call fcn.00408754
cmp eax, 0xff
jbe 0x415618
call fcn.00401408
mov edx, dword [0x41762c]
mov byte [edx], al
jmp 0x41562a
mov eax, dword [0x41762c]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x4175e8]
shl edx, 2
add edx, 3
mov ecx, dword [0x418b54]
test ecx, ecx
je 0x41564a
cmp edx, dword [ecx - 4]
jb 0x41564f
call fcn.00401408
mov edx, dword [ecx + edx*4]
call fcn.00401afc
cmp dword [ebp - 8], 0
je 0x41567b
mov eax, dword [ebp - 8]
call fcn.00408754
cmp eax, 0xff
jbe 0x415671
call fcn.00401408
mov edx, dword [0x417678]
mov byte [edx], al
jmp 0x415683
mov eax, dword [0x417678]
mov byte [eax], 0x10
mov eax, 0x3d
call fcn.00413d08
call fcn.0040780c
test al, al
jne 0x415734
cmp byte [0x4175ec], 0
jne 0x41572a
push 0x30
mov eax, 0x41
mov edx, dword [0x418b4c]
test edx, edx
je 0x4156bd
cmp eax, dword [edx - 4]
jb 0x4156c2
call fcn.00401408
mov eax, dword [edx + eax*4]
call fcn.00401de8
push eax
mov eax, 0x3e
mov edx, dword [0x418b4c]
test edx, edx
je 0x4156df
cmp eax, dword [edx - 4]
jb 0x4156e4
call fcn.00401408
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x418b50]
test edx, edx
je 0x4156fb
cmp eax, dword [edx - 4]
jb 0x415700
call fcn.00401408
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xa8]
call fcn.00401c3c
mov eax, dword [ebp - 0xa8]
call fcn.00401de8
push eax
mov eax, dword [0x417654]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00413dac
call fcn.0040195c
mov eax, 0x63
call fcn.00413ce0
test al, al
je 0x4157a7
call fcn.00414184
test al, al
jne 0x4157a7
push 0x30
lea edx, [ebp - 0xac]
mov eax, dword [0x417654]
mov eax, dword [eax]
call fcn.004057fc
mov eax, dword [ebp - 0xac]
call fcn.00401de8
push eax
mov eax, 0x55
mov edx, dword [0x418b50]
test edx, edx
je 0x41577f
cmp eax, dword [edx - 4]
jb 0x415784
call fcn.00401408
mov eax, dword [edx + eax*4]
call fcn.00401de8
push eax
mov eax, dword [0x417654]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00413dac
call fcn.0040195c
mov eax, 0x64
call fcn.00413ce0
test al, al
je 0x415911
mov eax, 0x64
mov edx, dword [0x418b4c]
test edx, edx
je 0x4157cd
cmp eax, dword [edx - 4]
jb 0x4157d2
call fcn.00401408
mov eax, dword [edx + eax*4]
call fcn.00403754
fstp qword [ebp - 0x18]
wait
call fcn.0041400c
fstp qword [ebp - 0x20]
wait
mov eax, 0x55
call fcn.00413ce0
test al, al
je 0x415800
fld qword [ebp - 0x20]
fcomp qword [ebp - 0x18]
fnstsw ax
sahf
jb 0x415821
mov eax, 0x55
call fcn.00413ce0
test al, al
jne 0x415911
fld qword [ebp - 0x20]
fcomp qword [ebp - 0x18]
fnstsw ax
sahf
je 0x415911
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x418b50]
test ecx, ecx
je 0x415838
cmp edx, dword [ecx - 4]
jb 0x41583d
call fcn.00401408
mov edx, dword [ecx + edx*4]
call fcn.00401afc
mov eax, 2
call fcn.00413ce0
test al, al
je 0x41588b
mov ebx, 4
push dword [ebp - 8]
push 0x415e40
mov eax, 0x57
mov edx, dword [0x418b50]
test edx, edx
je 0x415874
cmp eax, dword [edx - 4]
jb 0x415879
call fcn.00401408
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401cb0
jmp 0x41588d
xor ebx, ebx
or ebx, 0x30
test ebx, ebx
jns 0x415899
call fcn.00401408
push ebx
lea edx, [ebp - 0xb0]
mov eax, dword [0x417654]
mov eax, dword [eax]
call fcn.004057fc
mov eax, dword [ebp - 0xb0]
call fcn.00401de8
push eax
mov eax, dword [ebp - 8]
call fcn.00401de8
push eax
mov eax, dword [0x417654]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x415907
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x418b4c]
test edx, edx
je 0x4158f0
cmp eax, dword [edx - 4]
jb 0x4158f5
call fcn.00401408
mov eax, dword [edx + eax*4]
call fcn.00401de8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00413dac
call fcn.0040195c
mov eax, 0x67
call fcn.00413ce0
test al, al
je 0x415924
call fcn.004143dc
mov eax, 1
call fcn.00413ce0
test al, al
je 0x415d66
cmp byte [0x4175ec], 0
jne 0x415d66
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a550
xor edx, edx
call fcn.00403500
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.00407828
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040a4b0
call fcn.0040a05c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a344
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a31c
pop edx
call fcn.0040ae94
mov dword [0x418b78], eax
mov eax, 3
call fcn.00413ce0
test al, al
je 0x415a24
mov eax, 6
call fcn.00413ce0
xor al, 1
push eax
mov eax, 4
call fcn.00413d08
push eax
mov eax, 5
call fcn.00413d08
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a344
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a31c
push eax
mov eax, dword [0x418b78]
call fcn.0040b2c0
call fcn.00408658
pop edx
pop ecx
call fcn.004144a0
mov eax, dword [0x418b78]
call fcn.00406ac4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a550
pop edx
call fcn.00403500
jmp 0x415b8d
xor edx, edx
xor eax, eax
call fcn.0040ae94
mov dword [0x418b74], eax
lea edx, [ebp - 0xb4]
mov eax, 6
call fcn.00413d18
mov edx, dword [ebp - 0xb4]
mov eax, dword [0x418b74]
call fcn.0040b360
mov eax, 7
call fcn.00413d08
sub eax, 1
jb 0x415a6b
je 0x415a8c
dec eax
je 0x415ae1
jmp 0x415b8d
mov eax, dword [0x418b74]
call fcn.00406ac4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a550
pop edx
call fcn.00403500
jmp 0x415b8d
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a0b8
lea eax, [ebp - 0xc4]
push eax
mov eax, dword [0x418b78]
call fcn.0040b2c0
call fcn.00408658
mov edx, eax
mov eax, dword [0x418b74]
pop ecx
call fcn.0040b064
mov eax, dword [0x418b78]
call fcn.00406ac4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a550
pop edx
call fcn.00403500
jmp 0x415b8d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a344
mov edx, dword [0x418b74]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xc8], eax
fild dword [ebp - 0xc8]
fdiv dword [0x415e44]
call fcn.004012b4
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x415b1a
call fcn.00401408
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a31c
mov edx, dword [0x418b74]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xcc], eax
fild dword [ebp - 0xcc]
fdiv dword [0x415e44]
call fcn.004012b4
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x415b54
call fcn.00401408
push eax
mov eax, dword [0x418b78]
call fcn.0040b2c0
call fcn.00408658
mov edx, eax
mov eax, dword [0x418b74]
pop ecx
call fcn.0040afb4
mov eax, dword [0x418b78]
call fcn.00406ac4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a550
pop edx
call fcn.00403500
mov eax, 8
mov edx, dword [0x418b4c]
test edx, edx
je 0x415ba1
cmp eax, dword [edx - 4]
jb 0x415ba6
call fcn.00401408
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd0]
xor edx, edx
call fcn.0040f01c
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.00409ec8
mov eax, 9
mov edx, dword [0x418b4c]
test edx, edx
je 0x415bdb
cmp eax, dword [edx - 4]
jb 0x415be0
call fcn.00401408
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd4]
xor edx, edx
call fcn.0040f01c
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00409ec8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040a518
mov ebx, eax
mov eax, 0xa
call fcn.00413d08
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408210
mov eax, 0xb
mov edx, dword [0x418b4c]
test edx, edx
je 0x415c3a
cmp eax, dword [edx - 4]
jb 0x415c3f
call fcn.00401408
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403550
mov eax, 0xc
call fcn.00413d08
mov edx, eax
mov eax, ebx
call fcn.004034e0
mov eax, 0xd
call fcn.00413d08
mov edx, eax
cmp edx, 0xff
jbe 0x415c75
call fcn.00401408
mov eax, ebx
call fcn.00403540
mov eax, 0xe
call fcn.00413d08
mov edx, eax
mov eax, ebx
call fcn.00408244
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a518
mov ebx, eax
mov eax, 0xf
call fcn.00413d08
mov edx, eax
mov eax, ebx
call fcn.00408244
mov eax, 0x10
call fcn.00413d08
mov edx, eax
mov eax, ebx
call fcn.004034e0
mov eax, 0x11
call fcn.00413d08
mov edx, eax
cmp edx, 0xff
jbe 0x415cdb
call fcn.00401408
mov eax, ebx
call fcn.00403540
mov eax, 0x12
call fcn.00413d08
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408210
mov eax, 0x13
mov edx, dword [0x418b4c]
test edx, edx
je 0x415d0e
cmp eax, dword [edx - 4]
jb 0x415d13
call fcn.00401408
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403550
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a344
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a344
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a31c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a31c
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.00407828
jmp 0x415d71
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415db3
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.00401a88
lea eax, [ebp - 0xb4]
mov edx, 0x21
call fcn.00401a88
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401a88
ret