Function at 0x7369f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x85
push 0
push 0
dec ecx
jne 0x7369f8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x737de2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x73679c]
call fcn.0040999c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x736a2f
sub edx, 0xfffffff8
call fcn.00410d98
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], ebx
mov eax, dword [0x8dc9cc]
cmp byte [eax], 1
je 0x737d9a
mov eax, dword [0x8dc9cc]
cmp byte [eax], 0
jne 0x737d9a
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x736a60
sub edx, 0xffffffe4
xor eax, eax
call fcn.004c776c
call fcn.00433e5c
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0x328]
mov eax, dword [0x8dd7e8]
call fcn.00434e58
mov edx, dword [ebp - 0x328]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x514
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
lea eax, [ebx + 0x4f8]
mov edx, dword [ebx + 0x514]
call fcn.0040bca4
lea eax, [ebp - 0x32c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x32c]
push 0x737dfc
lea eax, [ebp - 0x330]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x330]
push 0x737dfc
lea eax, [ebp - 0x334]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x334]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4f8
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
push dword [ebx + 0x510]
push 0x737e0c
push dword [ebx + 0x4f8]
push 0x737e4c
lea eax, [ebx + 0x4f8]
mov edx, 4
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov dl, 1
call fcn.00430c70
cmp al, 1
jne 0x7377c5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
xor edx, edx
mov dword [eax + 0x4f4], edx
xor edx, edx
push ebp
push 0x736cf4
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [eax + 0x4f8]
xor ecx, ecx
lea eax, [ebp - 0x324]
call fcn.004080e0
call fcn.00407348
lea eax, [ebp - 0x324]
call fcn.00407d94
call fcn.00407348
jmp 0x736ca0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
inc dword [eax + 0x4f4]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov edi, dword [ebx + 0x4f4]
cmp edi, 1
jne 0x736c1d
lea edx, [ebx + 0x4fc]
lea eax, [ebp - 0x324]
call fcn.00408c84
lea eax, [ebp - 0x324]
call fcn.00408da0
call fcn.00407348
jmp 0x736ca0
cmp edi, 2
jne 0x736c45
lea edx, [ebx + 0x500]
lea eax, [ebp - 0x324]
call fcn.00408c84
lea eax, [ebp - 0x324]
call fcn.00408da0
call fcn.00407348
jmp 0x736ca0
lea edx, [ebx + 0x50c]
lea eax, [ebp - 0x324]
call fcn.00408c84
lea eax, [ebp - 0x324]
call fcn.00408da0
call fcn.00407348
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x50c]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x736c7f
mov esi, dword [esi - 4]
cmp esi, 0xa
jle 0x736ca0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x504
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x50c]
call fcn.0040bca4
lea eax, [ebp - 0x324]
call fcn.00408240
call fcn.00407348
test al, al
je 0x736bda
xor eax, eax
push ebp
push 0x736ce0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x324]
call fcn.004081e8
call fcn.00407348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x736cea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x736d2e
call fcn.00433ebc
fstp qword [ebp - 0x28]
wait
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea edx, [ebp - 0x338]
mov eax, dword [0x8dd7e8]
call fcn.00434e7c
mov edx, dword [ebp - 0x338]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4e0
call fcn.0040bca4
lea eax, [ebp - 0x33c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x514]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x33c]
push 0x737e64
lea eax, [ebp - 0x340]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x514]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x340]
push 0x737e64
lea eax, [ebp - 0x344]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x514]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x344]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x51c
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
lea ecx, [eax + 0x520]
mov edx, dword [eax + 0x4e0]
call fcn.00736304
mov bl, 1
mov eax, dword [ebp - 0x10]
mov esi, dword [eax + 0x10]
cmp dword [esi + 0x4fc], 0
jne 0x736e24
xor ebx, ebx
cmp bl, 1
jne 0x736e86
cmp dword [esi + 0x500], 0
je 0x736e84
lea eax, [ebp - 0x348]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x500]
mov ecx, 1
mov edx, 1
call fcn.0040cc5c
mov eax, dword [ebp - 0x348]
mov edx, 0x737e74
call fcn.0040cc24
jne 0x736e80
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x500
mov edx, 0x737e84
call fcn.0040ca34
mov eax, dword [ebp - 0x10]
jmp 0x736e86
xor ebx, ebx
jmp 0x736e86
xor ebx, ebx
cmp bl, 1
jne 0x7377c5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x504], 0
je 0x7377c5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x504]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x504
mov ecx, 0x737e84
call fcn.0040ca8c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
call fcn.00738108
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
call fcn.0073851c
mov eax, dword [0x8dd8ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x736ef3
mov eax, dword [eax - 4]
cmp eax, 4
jle 0x7377c5
mov eax, dword [ebp - 0x10]
add eax, 0xc
call fcn.0040b8d8
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
push 0x737f14
lea eax, [ebp - 0x34c]
push eax
mov eax, dword [0x8dd8ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
mov ecx, 1
mov edx, 1
call fcn.0040c31c
push dword [ebp - 0x34c]
push 0x737f38
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 4
call fcn.0040c1c4
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 0x737f7c
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
mov eax, dword [0x8dd8ec]
mov eax, dword [eax]
push dword [eax + 0x48c]
push 0x737fe8
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 3
call fcn.0040c1c4
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
lea eax, [ebp - 0x354]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x51c]
mov ecx, 0
call fcn.0040c4b4
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.00517a04
push dword [ebp - 0x350]
push 0x737fe8
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 3
call fcn.0040c1c4
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
push dword [eax + 0x520]
push 0x737fe8
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 3
call fcn.0040c1c4
lea eax, [ebp - 0x35c]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x35c]
lea edx, [ebp - 0x360]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x57c]
call fcn.00430488
push dword [ebp - 0x360]
push 0x737ff8
lea eax, [ebp - 0x358]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x358]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x368]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x368]
lea edx, [ebp - 0x36c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x580]
call fcn.00430488
push dword [ebp - 0x36c]
push 0x737ff8
lea eax, [ebp - 0x364]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x364]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x374]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x374]
lea edx, [ebp - 0x378]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x584]
call fcn.00430488
push dword [ebp - 0x378]
push 0x737ff8
lea eax, [ebp - 0x370]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x370]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x380]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x380]
lea edx, [ebp - 0x384]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x588]
call fcn.00430488
push dword [ebp - 0x384]
push 0x737ff8
lea eax, [ebp - 0x37c]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x37c]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x38c]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x38c]
lea edx, [ebp - 0x390]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x58c]
call fcn.00430488
push dword [ebp - 0x390]
push 0x737ff8
lea eax, [ebp - 0x388]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x388]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x398]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x398]
lea edx, [ebp - 0x39c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x590]
call fcn.00430488
push dword [ebp - 0x39c]
push 0x737ff8
lea eax, [ebp - 0x394]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x394]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3a4]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x594]
call fcn.00430488
push dword [ebp - 0x3a8]
push 0x737ff8
lea eax, [ebp - 0x3a0]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3b0]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3b0]
lea edx, [ebp - 0x3b4]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x598]
call fcn.00430488
push dword [ebp - 0x3b4]
push 0x737ff8
lea eax, [ebp - 0x3ac]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3ac]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3bc]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
push dword [eax + 0x5ac]
push dword [eax + 0x5a8]
lea eax, [ebp - 0x3c0]
call fcn.004304a4
push dword [ebp - 0x3c0]
push 0x737ff8
lea eax, [ebp - 0x3b8]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3c8]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3c8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
push dword [eax + 0x5b4]
push dword [eax + 0x5b0]
lea eax, [ebp - 0x3cc]
call fcn.004304a4
push dword [ebp - 0x3cc]
push 0x737ff8
lea eax, [ebp - 0x3c4]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3d4]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3d4]
lea edx, [ebp - 0x3d8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x558]
call fcn.00430488
push dword [ebp - 0x3d8]
push 0x737ff8
lea eax, [ebp - 0x3d0]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3d0]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3e0]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3e0]
lea edx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x554]
call fcn.00430488
push dword [ebp - 0x3e4]
push 0x737ff8
lea eax, [ebp - 0x3dc]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3dc]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3ec]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3ec]
lea edx, [ebp - 0x3f0]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x550]
call fcn.00430488
push dword [ebp - 0x3f0]
push 0x738008
lea eax, [ebp - 0x3e8]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
mov eax, dword [0x8dc9cc]
cmp byte [eax], 0
jne 0x7374f7
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x7374f0
sub edx, 0xffffffe8
xor eax, eax
call fcn.004c776c
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x737545
push 0x738018
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
push 0x73802c
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 3
call fcn.0040c1c4
mov eax, 5
call fcn.004c78cc
mov eax, dword [0x8dc9cc]
cmp byte [eax], 0
jne 0x737545
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x73753e
sub edx, 0xffffffec
xor eax, eax
call fcn.004c776c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a0
call fcn.0040b8d8
mov byte [ebp - 9], 0
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 0x57c]
mov edx, dword [0x8dd228]
cmp eax, dword [edx]
jge 0x73759f
mov eax, dword [ebx + 0x580]
mov edx, dword [0x8dd228]
cmp eax, dword [edx]
jge 0x73759f
mov eax, dword [ebx + 0x584]
mov edx, dword [0x8dd228]
cmp eax, dword [edx]
jge 0x73759f
mov eax, dword [ebx + 0x588]
mov edx, dword [0x8dd228]
cmp eax, dword [edx]
jl 0x7375b5
lea eax, [ebx + 0x5a0]
mov edx, 0x738040
call fcn.0040c0e8
mov byte [ebp - 9], 1
jmp 0x7375c5
lea eax, [ebx + 0x5a0]
mov edx, 0x738050
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 0x58c]
mov edx, dword [0x8dd1f4]
cmp eax, dword [edx]
jge 0x73760b
mov eax, dword [ebx + 0x590]
mov edx, dword [0x8dd1f4]
cmp eax, dword [edx]
jge 0x73760b
mov eax, dword [ebx + 0x594]
mov edx, dword [0x8dd1f4]
cmp eax, dword [edx]
jge 0x73760b
mov eax, dword [ebx + 0x598]
mov edx, dword [0x8dd1f4]
cmp eax, dword [edx]
jl 0x737621
lea eax, [ebx + 0x5a0]
mov edx, 0x738040
call fcn.0040c0e8
mov byte [ebp - 9], 1
jmp 0x737631
lea eax, [ebx + 0x5a0]
mov edx, 0x738050
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x558]
mov edx, dword [0x8dc680]
cmp eax, dword [edx]
jl 0x737665
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a0
mov edx, 0x738040
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov byte [ebp - 9], 1
jmp 0x73767d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a0
mov edx, 0x738050
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x554]
mov edx, dword [0x8dd678]
cmp eax, dword [edx]
jl 0x7376b1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a0
mov edx, 0x738040
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov byte [ebp - 9], 1
jmp 0x7376c9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a0
mov edx, 0x738050
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x550]
mov edx, dword [0x8dd6ac]
cmp eax, dword [edx]
jl 0x7376fd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a0
mov edx, 0x738040
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov byte [ebp - 9], 1
jmp 0x737715
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a0
mov edx, 0x738050
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
cmp byte [ebp - 9], 1
jne 0x73778a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4b0
mov dword [ebp - 0x30], eax
push 0
lea edx, [ebp - 0x3f4]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
call fcn.00430488
mov edx, dword [ebp - 0x3f4]
xor ecx, ecx
mov eax, 0x738060
call fcn.0074b5f0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x4b0], 2
je 0x7377c5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x4b0], 2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x5a0]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov edx, 2
call fcn.00738b84
jmp 0x7377c5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x4b0], 2
jne 0x7377c5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x4b0], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x5a0]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov edx, 1
call fcn.00738b84
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 0x518]
mov edx, dword [ebx + 0x514]
call fcn.0040cc24
je 0x737c26
lea eax, [ebx + 0x518]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x514]
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4a8
call fcn.0040b8d8
call fcn.00433e5c
fsub dword [0x738088]
fstp qword [ebp - 0x38]
wait
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea edx, [ebp - 0x3f8]
mov eax, dword [0x8dd7e8]
call fcn.00434e58
mov edx, dword [ebp - 0x3f8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x514
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
lea eax, [ebx + 0x4f8]
mov edx, dword [ebx + 0x514]
call fcn.0040bca4
lea eax, [ebp - 0x3fc]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x3fc]
push 0x737dfc
lea eax, [ebp - 0x400]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x400]
push 0x737dfc
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x404]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4f8
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
push dword [ebx + 0x510]
push 0x737e0c
push dword [ebx + 0x4f8]
push 0x737e4c
lea eax, [ebx + 0x4f8]
mov edx, 4
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov dl, 1
call fcn.00430c70
cmp al, 1
jne 0x737968
xor eax, eax
push ebp
push 0x73795e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
call fcn.0043101c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x737968
call fcn.00433e5c
fsub dword [0x73808c]
fstp qword [ebp - 0x40]
wait
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea edx, [ebp - 0x408]
mov eax, dword [0x8dd7e8]
call fcn.00434e58
mov edx, dword [ebp - 0x408]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x514
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
lea eax, [ebx + 0x4f8]
mov edx, dword [ebx + 0x514]
call fcn.0040bca4
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x40c]
push 0x737dfc
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x410]
push 0x737dfc
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x414]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4f8
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
push dword [ebx + 0x510]
push 0x737e0c
push dword [ebx + 0x4f8]
push 0x737e4c
lea eax, [ebx + 0x4f8]
mov edx, 4
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov dl, 1
call fcn.00430c70
cmp al, 1
jne 0x737ac7
xor eax, eax
push ebp
push 0x737abd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
call fcn.0043101c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x737ac7
call fcn.00433e5c
fsub dword [0x738090]
fstp qword [ebp - 0x48]
wait
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea edx, [ebp - 0x418]
mov eax, dword [0x8dd7e8]
call fcn.00434e58
mov edx, dword [ebp - 0x418]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x514
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
lea eax, [ebx + 0x4f8]
mov edx, dword [ebx + 0x514]
call fcn.0040bca4
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x41c]
push 0x737dfc
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x420]
push 0x737dfc
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x424]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4f8
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
push dword [ebx + 0x510]
push 0x737e0c
push dword [ebx + 0x4f8]
push 0x737e4c
lea eax, [ebx + 0x4f8]
mov edx, 4
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
mov dl, 1
call fcn.00430c70
cmp al, 1
jne 0x737c26
xor eax, eax
push ebp
push 0x737c1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4f8]
call fcn.0043101c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x737c26
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
inc dword [eax + 0x540]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x540], 0xe
jle 0x737d9a
xor edx, edx
mov dword [eax + 0x540], edx
lea edx, [ebp - 0x42c]
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e982c
mov eax, dword [ebp - 0x42c]
lea edx, [ebp - 0x428]
call fcn.004311a0
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x510
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov edx, dword [ebx + 0x510]
lea eax, [ebx + 0x4cc]
mov ecx, 0x7380a0
call fcn.0040ca8c
mov eax, 0x7380d4
call fcn.0070f208
mov eax, 0x7d0
call fcn.004c78cc
mov eax, 0x7380d4
call fcn.0070f3ec
test eax, eax
jle 0x737cd8
mov eax, 0x7380d4
call fcn.0070f208
mov eax, 0xbb8
call fcn.004c78cc
xor eax, eax
push ebp
push 0x737d90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x7380d4
call fcn.0070f3ec
test eax, eax
jne 0x737d79
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4cc]
mov dl, 1
call fcn.00430c70
cmp al, 1
jne 0x737d6a
xor eax, eax
push ebp
push 0x737d51
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x7380f8
push 0x7380f8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4cc]
call fcn.0040c824
push eax
push 0x7380fc
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x737d5b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x524], 1
jmp 0x737d86
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x524], 0
jmp 0x737d86
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x524], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x737d9a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x737de9
lea eax, [ebp - 0x42c]
mov edx, 0x36
call fcn.0040b914
lea eax, [ebp - 0x354]
mov edx, 3
call fcn.0040b94c
lea eax, [ebp - 0x348]
mov edx, 9
call fcn.0040b914
lea eax, [ebp - 8]
call fcn.00410d80
pop eax
jmp eax