Function at 0x411d00
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
enter 0xfe4, 1
push ebx
push ecx
push edx
mov dword [ebp - 8], esp
movzx eax, byte [0x4e8cf7]
cmp ax, 0x54
jne 0x411d31
push 0x4cbd3f
push 8
push 9
push 0x49
push 0x10
push 0x4e
push 0
push 0
call fcn.0040cd00
jmp 0x411d4f
cmp ax, 0x45
jne 0x411d4f
push 0x4cbd53
push 8
push 9
push 0x49
push 0x10
push 0x4e
push 0
push 0
call fcn.0040cd00
mov eax, dword [0x4e91ad]
mov dword [ebp - 0x4b8], eax
push 1
push 9
push 0xd
push dword [0x4cbd64]
push 3
push 0x4cbd68
call fcn.004206d2
movzx eax, byte [0x4e8cf7]
cmp ax, 0x54
jne 0x411e7f
push 1
push 8
push 9
sub esp, 8
mov esi, 0x4cbd69
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4cbd6f
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4e90ad
lea edi, [ebp - 0x5b8]
call fcn.00401b30
mov esi, 0x4cbd75
call fcn.00401af0
mov eax, edi
push eax
push 0x4cbd83
push 0x11
mov eax, dword [ebp - 0x4b8]
call fcn.00420272
push 2
push 0xc
push 9
sub esp, 8
mov esi, 0x4cbd89
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4cbd8f
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4e90ad
lea edi, [ebp - 0x5b8]
call fcn.00401b30
mov esi, 0x4cbd95
call fcn.00401af0
mov eax, edi
push eax
push 0x4cbda4
push 0x13
mov eax, dword [ebp - 0x4b8]
call fcn.00420272
push 1
push 0x2f
push 0xb
push 0x4cbda8
push 0
push 0
mov eax, dword [ebp - 0x4b8]
call fcn.0041fff2
push 0xa
push 0xb
push 0x4cbdc4
call fcn.00408840
push 0xa
push 0xc
push 0x4cbddb
call fcn.00408840
mov byte [ebp - 0x2ac], 0x21
push 0xb
push 0xe
push 0x4cbdf2
call fcn.00408840
push 0xb
push 0xf
push 0x4cbdfc
call fcn.00408840
jmp 0x411f80
cmp ax, 0x45
jne 0x411f80
push 1
push 8
push 9
sub esp, 8
mov esi, 0x4cbe06
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4cbe0c
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4e90ad
lea edi, [ebp - 0x5b8]
call fcn.00401b30
mov esi, 0x4cbe12
call fcn.00401af0
mov eax, edi
push eax
push 0x4cbe20
push 0x11
mov eax, dword [ebp - 0x4b8]
call fcn.00420272
push 2
push 0xc
push 9
sub esp, 8
mov esi, 0x4cbe26
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4cbe2c
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4e90ad
lea edi, [ebp - 0x5b8]
call fcn.00401b30
mov esi, 0x4cbe32
call fcn.00401af0
mov eax, edi
push eax
push 0x4cbe41
push 0x13
mov eax, dword [ebp - 0x4b8]
call fcn.00420272
push 1
push 0x33
push 0xb
push 0x4cbe46
push 0
push 0
mov eax, dword [ebp - 0x4b8]
call fcn.0041fff2
push 0xa
push 0xb
push 0x4cbe5e
call fcn.00408840
push 0xb
push 0xc
push 0x4cbe72
call fcn.00408840
mov byte [ebp - 0x2ac], 0x1e
push 0xe
push 0xe
push 0x4cbe85
call fcn.00408840
push 0xb
push 0xf
push 0x4cbe8c
call fcn.00408840
mov eax, dword [ebp - 0x4b8]
call fcn.0041cea2
push 1
mov al, byte [ebp - 0x2ac]
push eax
push 0xb
push 5
push 1
call fcn.0041fea0
push 2
mov al, byte [ebp - 0x2ac]
push eax
push 0xc
push 5
push 1
call fcn.0041fea0
push 3
push 0x15
push 0xf
push 0x23
push 1
call fcn.0041fea0
mov eax, dword [ebp - 0x4b8]
call fcn.0040b6d2
push 0x15
push 0xe
push 0x32
call fcn.00408970
mov eax, dword [ebp - 0x4b8]
call fcn.004092f2
mov dword [ebp - 0x284], 1
mov eax, dword [0x4e886d]
mov dword [ebp - 0x288], eax
movzx eax, byte [ebp - 0x2ac]
push eax
push 0xb
fild dword [ebp - 0x284]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
movzx eax, byte [ebp - 0x2ac]
push eax
push 0xc
fild dword [ebp - 0x288]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041fe50
lea eax, [ebp - 0x68]
push eax
push 0x80
call fcn.00403b50
push dword [ebp - 0x68]
push 0x80
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x6c]
push eax
push 0x80
call fcn.00403b50
push dword [ebp - 0x6c]
push 0x80
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x5b8]
push eax
push 0x4e8b09
call fcn.0041a3c0
lea esi, [ebp - 0x5b8]
mov edi, 0x4cbe96
call fcn.00415520
test al, al
je 0x41210e
lea eax, [ebp - 0x6b8]
push eax
push 0x4e8b09
call fcn.0041a3c0
lea ebx, [ebp - 0x6b8]
push ebx
call fcn.0041fdd0
call fcn.0041b2a0
test eax, eax
je 0x4120f1
lea eax, [ebp - 0x6b8]
push eax
lea ebx, [ebp - 0x7b8]
push ebx
push dword [ebp - 0x68]
call fcn.00403b00
lea ecx, [ebp - 0x7b8]
push ecx
push 0x32
call fcn.0041b510
mov edi, 0x4e8b09
lea esi, [ebp - 0x6b8]
push 0x7f
call fcn.00401950
jmp 0x41210c
lea eax, [ebp - 0x6b8]
push eax
push dword [ebp - 0x68]
call fcn.00403b00
lea ebx, [ebp - 0x6b8]
push ebx
call fcn.0041fdd0
jmp 0x412144
lea eax, [ebp - 0x6b8]
push eax
lea ebx, [ebp - 0x7b8]
push ebx
push dword [ebp - 0x68]
call fcn.00403b00
lea ecx, [ebp - 0x7b8]
push ecx
push 0x32
call fcn.0041b510
mov edi, 0x4e8b09
lea esi, [ebp - 0x6b8]
push 0x7f
call fcn.00401950
lea eax, [ebp - 0x68]
push eax
push 0x80
call fcn.00403320
mov bl, byte [0x4e8b09]
mov byte [ebp - 0x298], bl
cmp byte [ebp - 0x298], 0
jbe 0x412180
movzx eax, byte [ebp - 0x298]
cmp byte [eax + 0x4e8b09], 0x20
jne 0x412180
dec byte [ebp - 0x298]
jmp 0x41215e
cmp byte [ebp - 0x298], 0
jbe 0x4121ab
movzx eax, byte [ebp - 0x298]
cmp byte [eax + 0x4e8b09], 0x5c
jne 0x4121ab
movzx ebx, al
mov byte [ebx + 0x4e8b09], 0x20
dec byte [ebp - 0x298]
cmp byte [ebp - 0x298], 0x32
ja 0x4121d9
push 0x15
push 0xe
lea eax, [ebp - 0x6b8]
push eax
push 0x4e8b09
push 0x32
call fcn.0041b510
lea ebx, [ebp - 0x6b8]
push ebx
call fcn.004043a0
jmp 0x412251
push 0x15
push 0xe
lea eax, [ebp - 0x8b8]
push eax
push 0x4e8b09
push 1
push 0x1e
call fcn.00401cd0
lea esi, [ebp - 0x8b8]
lea edi, [ebp - 0x7b8]
call fcn.00401b30
mov esi, 0x4cbe97
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x6b8]
call fcn.00401b30
lea eax, [ebp - 0x9b8]
push eax
push 0x4e8b09
movzx ebx, byte [ebp - 0x298]
sub ebx, 0x11
push ebx
push 0x12
call fcn.00401cd0
lea esi, [ebp - 0x9b8]
lea edi, [ebp - 0x6b8]
call fcn.00401af0
mov eax, edi
push eax
call fcn.004043a0
mov word [ebp - 0x14], 1
mov eax, dword [0x4e91ad]
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x284], 0
jle 0x412348
mov ebx, dword [ebp - 0x288]
cmp dword [ebp - 0x284], ebx
jg 0x412348
lea eax, [ebp - 0x6bc]
push eax
lea ecx, [ebp - 0x7bc]
push ecx
push 0x15
push 0xe
push 0x32
call fcn.0041b1e0
lea edx, [ebp - 0x7bc]
push edx
call fcn.0041a3c0
lea esi, [ebp - 0x6bc]
mov edi, 0x4cbe9a
call fcn.00415520
test al, al
je 0x412348
lea eax, [ebp - 0x8bc]
push eax
push 0x23
call fcn.0041b490
lea ebx, [ebp - 0x9bc]
push ebx
push 0x15
push 0xf
push 0x23
call fcn.0041b1e0
lea esi, [ebp - 0x9bc]
lea edi, [ebp - 0x8bc]
call fcn.00415520
test al, al
je 0x412348
push 0x4cbe9b
lea eax, [ebp - 0xabc]
push eax
lea ebx, [ebp - 0xbbc]
push ebx
lea ecx, [ebp - 0xcbc]
push ecx
push 0x15
push 0xf
push 0x23
call fcn.0041b1e0
lea edx, [ebp - 0xcbc]
push edx
call fcn.0041a3c0
lea eax, [ebp - 0xbbc]
push eax
call fcn.0041b610
lea ebx, [ebp - 0xabc]
push ebx
call fcn.0040cca0
cmp eax, 1
jbe 0x412348
mov eax, 1
jmp 0x41234d
mov eax, 0
mov byte [ebp - 0x278], al
push 1
push eax
mov eax, dword [ebp - 0x5bc]
call fcn.0041f9e2
push 2
cmp word [ebp - 0x14], 3
sete al
push eax
mov eax, dword [ebp - 0x5bc]
call fcn.0041f9e2
mov byte [ebp - 0x278], 1
movsx eax, word [ebp - 0x14]
cmp eax, 2
je 0x412390
cmp eax, 1
jne 0x4123af
movzx ebx, byte [ebp - 0x2ac]
push ebx
movsx ecx, ax
mov edx, 0xa
add edx, ecx
push edx
push 5
call fcn.0041df70
mov byte [ebp - 0xc], al
jmp 0x4123c6
cmp eax, 3
jne 0x4123c6
push 0x15
push 0xf
push 0x23
push 1
call fcn.0041bc70
mov byte [ebp - 0xc], al
cmp byte [ebp - 0xc], 0x2b
je 0x412a0b
movsx eax, word [ebp - 0x14]
cmp eax, 1
jne 0x412427
lea ebx, [ebp - 0x6bc]
push ebx
mov cl, byte [ebp - 0x2ac]
push ecx
push 0xb
push 5
call fcn.0041b1e0
lea edx, [ebp - 0x6bc]
push edx
call fcn.0041bc10
mov dword [ebp - 0x284], eax
test eax, eax
jle 0x412417
cmp dword [ebp - 0x288], eax
jl 0x412417
mov ebx, 1
jmp 0x41241c
mov ebx, 0
mov byte [ebp - 0x278], bl
jmp 0x412575
cmp eax, 2
jne 0x412484
lea ebx, [ebp - 0x6bc]
push ebx
mov cl, byte [ebp - 0x2ac]
push ecx
push 0xc
push 5
call fcn.0041b1e0
lea edx, [ebp - 0x6bc]
push edx
call fcn.0041bc10
mov dword [ebp - 0x288], eax
cmp dword [0x4e886d], eax
jl 0x412474
mov ebx, dword [ebp - 0x284]
cmp dword [ebp - 0x288], ebx
jl 0x412474
mov eax, 1
jmp 0x412479
mov eax, 0
mov byte [ebp - 0x278], al
jmp 0x412575
cmp eax, 3
jne 0x412575
lea ebx, [ebp - 0x6bc]
push ebx
push 0x23
call fcn.0041b490
lea ecx, [ebp - 0x7bc]
push ecx
push 0x15
push 0xf
push 0x23
call fcn.0041b1e0
lea esi, [ebp - 0x7bc]
lea edi, [ebp - 0x6bc]
call fcn.00415520
mov byte [ebp - 0x278], al
test al, al
je 0x412575
lea ebx, [ebp - 0x6bc]
push ebx
lea eax, [ebp - 0x7bc]
push eax
push 0x15
push 0xf
push 0x23
call fcn.0041b1e0
lea ecx, [ebp - 0x7bc]
push ecx
call fcn.0041a3c0
lea edi, [ebp - 0x26c]
lea esi, [ebp - 0x6bc]
call fcn.00401940
push 0x4cbea0
mov eax, esi
push eax
mov ebx, edi
push ebx
call fcn.0041b610
lea ecx, [ebp - 0x6bc]
push ecx
call fcn.0040cca0
test eax, eax
ja 0x412550
lea esi, [ebp - 0x26c]
lea edi, [ebp - 0x7bc]
call fcn.00401b30
mov esi, 0x4cbea5
call fcn.00401af0
lea edi, [ebp - 0x26c]
lea esi, [ebp - 0x7bc]
call fcn.00401940
push 0x15
push 0xf
lea eax, [ebp - 0x7bc]
push eax
lea ebx, [ebp - 0x26c]
push ebx
push 0x23
call fcn.0041b510
lea ecx, [ebp - 0x7bc]
push ecx
call fcn.004043a0
mov al, byte [ebp - 0xc]
cmp al, 0x11
jne 0x41274e
cmp dword [ebp - 0x284], 0
jle 0x412666
mov ebx, dword [ebp - 0x288]
cmp dword [ebp - 0x284], ebx
jg 0x412666
lea ecx, [ebp - 0x7bc]
push ecx
lea edx, [ebp - 0x8bc]
push edx
push 0x15
push 0xe
push 0x32
call fcn.0041b1e0
lea eax, [ebp - 0x8bc]
push eax
call fcn.0041a3c0
lea esi, [ebp - 0x7bc]
mov edi, 0x4cbeaa
call fcn.00415520
test al, al
je 0x412666
lea eax, [ebp - 0x9bc]
push eax
push 0x23
call fcn.0041b490
lea ebx, [ebp - 0xabc]
push ebx
push 0x15
push 0xf
push 0x23
call fcn.0041b1e0
lea esi, [ebp - 0xabc]
lea edi, [ebp - 0x9bc]
call fcn.00415520
test al, al
je 0x412666
push 0x4cbeab
lea eax, [ebp - 0xbbc]
push eax
lea ebx, [ebp - 0xcbc]
push ebx
lea ecx, [ebp - 0xdbc]
push ecx
push 0x15
push 0xf
push 0x23
call fcn.0041b1e0
lea edx, [ebp - 0xdbc]
push edx
call fcn.0041a3c0
lea eax, [ebp - 0xcbc]
push eax
call fcn.0041b610
lea ebx, [ebp - 0xbbc]
push ebx
call fcn.0040cca0
cmp eax, 1
jbe 0x412666
mov eax, 1
jmp 0x41266b
mov eax, 0
mov byte [ebp - 0x278], al
test al, al
je 0x412749
push 0x4e8328
lea ebx, [ebp - 0x9bc]
push ebx
push 0x4e8b09
call fcn.0041a3c0
lea esi, [ebp - 0x9bc]
lea edi, [ebp - 0x8bc]
call fcn.00401b30
mov esi, 0x4cbeb0
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x7bc]
call fcn.00401b30
lea eax, [ebp - 0xabc]
push eax
lea ebx, [ebp - 0xbbc]
push ebx
push 0x15
push 0xf
push 0x23
call fcn.0041b1e0
lea ecx, [ebp - 0xbbc]
push ecx
call fcn.0041a3c0
lea esi, [ebp - 0xabc]
lea edi, [ebp - 0x7bc]
call fcn.00401af0
mov eax, edi
push eax
call fcn.00401e60
push 0x4e8328
call fcn.00401210
call fcn.0041b2a0
test eax, eax
sete al
mov byte [ebp - 0x278], al
test al, al
jne 0x412749
movzx ebx, byte [0x4e8cf7]
mov ax, bx
cmp ax, 0x54
jne 0x412734
push 0x4cbeb2
push 0x4cbec4
call fcn.00414260
jmp 0x412749
cmp ax, 0x45
jne 0x412749
push 0x4cbec5
push 0x4cbedd
call fcn.00414260
jmp 0x412a0b
cmp al, 0x13
jne 0x4129fd
cmp word [ebp - 0x14], 3
jne 0x4129fb
cmp byte [0x4e8cf7], 0x54
jne 0x4127bd
lea ebx, [ebp - 0x7bc]
push ebx
push 1
push 1
push 0x4cbede
lea ecx, [ebp - 0x8bc]
push ecx
push 0x4e8b09
call fcn.0041a3c0
lea edx, [ebp - 0x8bc]
push edx
push 0x4cbeec
push 0
lea eax, [ebp - 0x298]
push eax
push 0x4cbeed
call fcn.0041b770
lea edi, [ebp - 0x26c]
lea esi, [ebp - 0x7bc]
call fcn.00401940
jmp 0x41280e
lea ebx, [ebp - 0x7bc]
push ebx
push 1
push 1
push 0x4cbf04
lea ecx, [ebp - 0x8bc]
push ecx
push 0x4e8b09
call fcn.0041a3c0
lea edx, [ebp - 0x8bc]
push edx
push 0x4cbf0f
push 0
lea eax, [ebp - 0x298]
push eax
push 0x4cbf10
call fcn.0041b770
lea edi, [ebp - 0x26c]
lea esi, [ebp - 0x7bc]
call fcn.00401940
cmp byte [ebp - 0x298], 0
jbe 0x412978
lea eax, [ebp - 0x7bc]
push eax
lea ebx, [ebp - 0x26c]
push ebx
push 1
movzx ecx, byte [ebp - 0x298]
dec ecx
push ecx
call fcn.00401cd0
lea esi, [ebp - 0x7bc]
mov edi, 0x4e8fad
call fcn.00415520
test al, al
je 0x412978
lea eax, [ebp - 0x8bc]
push eax
lea ebx, [ebp - 0x26c]
push ebx
push 1
movzx ecx, byte [ebp - 0x298]
dec ecx
push ecx
call fcn.00401cd0
mov edi, 0x4e8b09
lea esi, [ebp - 0x8bc]
push 0x7f
call fcn.00401950
cmp byte [ebp - 0x298], 1
jbe 0x4128a9
push 0x15
push 0xe
mov eax, esi
push eax
push edi
push 0x32
call fcn.0041b510
lea ebx, [ebp - 0x8bc]
push ebx
call fcn.004043a0
jmp 0x4128c3
push 0x15
push 0xe
mov eax, esi
push eax
push 0x32
call fcn.0041b490
lea ebx, [ebp - 0x8bc]
push ebx
call fcn.004043a0
lea eax, [ebp - 0x8bc]
push eax
lea ebx, [ebp - 0x26c]
push ebx
movzx ecx, byte [ebp - 0x298]
inc ecx
push ecx
movzx ecx, byte [ebp - 0x298]
movzx edx, byte [ebp - 0x26c]
sub edx, ecx
push edx
call fcn.00401cd0
lea edi, [ebp - 0x26c]
lea esi, [ebp - 0x8bc]
call fcn.00401940
push 0x4cbf27
mov eax, esi
push eax
mov ebx, edi
push ebx
call fcn.0041b610
lea ecx, [ebp - 0x8bc]
push ecx
call fcn.0040cca0
test eax, eax
ja 0x41294e
lea esi, [ebp - 0x26c]
lea edi, [ebp - 0x9bc]
call fcn.00401b30
mov esi, 0x4cbf2c
call fcn.00401af0
lea edi, [ebp - 0x26c]
lea esi, [ebp - 0x9bc]
call fcn.00401940
push 0x15
push 0xf
lea eax, [ebp - 0x9bc]
push eax
lea ebx, [ebp - 0x26c]
push ebx
push 0x23
call fcn.0041b510
lea ecx, [ebp - 0x9bc]
push ecx
call fcn.004043a0
jmp 0x4129fb
lea eax, [ebp - 0x9bc]
push eax
lea ebx, [ebp - 0x26c]
push ebx
push 1
movzx ecx, byte [ebp - 0x298]
dec ecx
push ecx
call fcn.00401cd0
lea esi, [ebp - 0x9bc]
mov edi, 0x4e8fad
call fcn.00415790
test al, al
je 0x4129ba
push 0x4cbf31
push 0x4cbf4c
call fcn.00414260
push 0x15
push 0xe
lea eax, [ebp - 0xabc]
push eax
push 0x4e8b09
push 0x32
call fcn.0041b510
lea ebx, [ebp - 0xabc]
push ebx
call fcn.004043a0
push 0x15
push 0xf
lea eax, [ebp - 0xabc]
push eax
push 0x32
call fcn.0041b490
lea ebx, [ebp - 0xabc]
push ebx
call fcn.004043a0
jmp 0x412a0b
lea ebx, [ebp - 0x14]
push ebx
push eax
push 1
push 3
call fcn.0041b2c0
mov al, byte [ebp - 0x278]
test al, al
je 0x412257
mov esi, 0x4cbf4d
movzx eax, byte [ebp - 0xc]
push 0x1f0010
call fcn.0040148e
test al, al
je 0x412257
cmp byte [ebp - 0xc], 0x2b
je 0x41422f
push 0x4e8328
call fcn.00401d90
call fcn.0041b260
lea eax, [ebp - 0xcbc]
push eax
push 0x4e8b09
call fcn.0041a3c0
lea esi, [ebp - 0xcbc]
lea edi, [ebp - 0xbbc]
call fcn.00401b30
mov esi, 0x4cbf51
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0xabc]
call fcn.00401b30
lea eax, [ebp - 0xdbc]
push eax
lea ebx, [ebp - 0xebc]
push ebx
push 0x15
push 0xf
push 0x23
call fcn.0041b1e0
lea ecx, [ebp - 0xebc]
push ecx
call fcn.0041a3c0
lea esi, [ebp - 0xdbc]
lea edi, [ebp - 0xabc]
call fcn.00401af0
lea edi, [ebp - 0x26c]
lea esi, [ebp - 0xabc]
call fcn.00401940
call fcn.0041b1b0
cmp dword [ebp + 0x14], 0
je 0x412ae7
lea eax, [ebp - 0x26c]
push eax
call dword [ebp + 0x14]
jmp 0x414192
push 0x2e7
call fcn.00403b30
mov dword [0x4e9ac2], eax
call fcn.0041afe2
lea ebx, [ebp - 0xabc]
push ebx
lea eax, [ebp - 0xbbc]
push eax
lea ecx, [ebp - 0xcbc]
push ecx
push dword [ebp + 0x10]
call fcn.00403b00
lea edx, [ebp - 0xcbc]
push edx
call fcn.0041a3c0
lea eax, [ebp - 0xbbc]
push eax
push 1
push 0x1f
call fcn.00401cd0
lea edi, [ebp - 0x16c]
lea esi, [ebp - 0xabc]
call fcn.00401940
movzx eax, byte [ebp - 0x16c]
test eax, eax
jbe 0x412b87
mov byte [ebp - 0x9c0], al
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x28c]
cmp byte [ebp + eax - 0x16c], 0x2f
jne 0x412b7f
movzx ebx, al
mov byte [ebp + ebx - 0x16c], 0x2d
dec byte [ebp - 0x9c0]
jne 0x412b5d
lea eax, [ebp - 0x16c]
push eax
mov eax, dword [0x4e9ac2]
call fcn.0041aec2
mov dword [ebp - 0x270], eax
mov edi, dword [0x4e9ac2]
mov eax, dword [ebp - 0x270]
mov dword [edi + 0x1f], eax
mov byte [ebp - 0x9c4], 0x40
mov byte [ebp - 0x290], 0
inc byte [ebp - 0x290]
movzx eax, byte [ebp - 0x290]
mov byte [ebp + eax - 0x59], 0
dec byte [ebp - 0x9c4]
jne 0x412bbb
cmp dword [0x4e8a85], 0
jne 0x412c78
push 0x2280
call fcn.00403b30
mov dword [0x4e8a85], eax
mov byte [ebp - 0x274], 1
mov byte [ebp - 0x9c8], 3
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
test ebx, ebx
jbe 0x412c6e
mov byte [ebp - 0x9cc], bl
mov byte [ebp - 0x290], 0
inc byte [ebp - 0x290]
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x28c]
imul edx, ecx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + edx - 0xbae]
lea edi, [esi + ebx]
mov esi, 0x4cbf53
push 0x2d
call fcn.00401950
dec byte [ebp - 0x9cc]
jne 0x412c2a
dec byte [ebp - 0x9c8]
jne 0x412c06
jmp 0x412c7f
mov byte [ebp - 0x274], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x9d0], eax
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
test ebx, ebx
jbe 0x412cec
mov byte [ebp - 0x9d4], bl
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
movzx ebx, byte [eax + 0x4e887d]
inc ebx
push ebx
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.0041ae32
dec byte [ebp - 0x9d4]
jne 0x412ca9
mov byte [ebp - 0x2b0], 0x20
mov byte [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x280], eax
mov eax, 0
mov dword [ebp - 0x27c], eax
mov byte [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
push eax
mov eax, 0x4e886d
call fcn.0041adf2
movzx ebx, byte [0x4e8cfd]
mov ax, bx
cmp ax, 0x20
je 0x412d51
cmp ax, 0x54
je 0x412d51
cmp ax, 0x53
jne 0x413565
mov byte [ebp - 0x290], 2
inc dword [ebp - 0x27c]
cmp byte [0x4e8cfd], 0x54
jne 0x413084
inc byte [ebp - 0x2a8]
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x28c]
mov bl, byte [eax + 0x4e887d]
mov byte [ebp - 0x2a4], bl
cmp byte [ebp - 0x2a8], 1
jne 0x412de4
movzx eax, byte [ebp - 0x28c]
movzx ebx, byte [ebp - 0x2a4]
movzx ecx, byte [ebp - 0x290]
add ecx, ebx
mov cl, byte [ecx + 0x4e8d06]
mov byte [ebp + eax - 0x59], cl
movzx eax, byte [ebp - 0x28c]
movzx ebx, byte [ebp + eax - 0x59]
mov esi, 0x4cbf54
mov eax, ebx
push 0x2f00b0
call fcn.0040148e
test al, al
jne 0x412de4
inc byte [ebp - 0x2a4]
lea eax, [ebp - 0xad4]
push eax
lea ebx, [ebp - 0xbd4]
push ebx
push 0x4e8d06
movzx ecx, byte [ebp - 0x290]
push ecx
movzx edx, byte [ebp - 0x2a4]
push edx
call fcn.00401cd0
lea eax, [ebp - 0xbd4]
push eax
call fcn.0041ac50
mov edi, 0x4e9cf6
lea esi, [ebp - 0xad4]
call fcn.00401940
mov esi, edi
mov edi, 0x4cbf5a
call fcn.00415520
test al, al
je 0x412f13
mov byte [ebp - 0x294], 0
inc byte [ebp - 0x294]
mov al, byte [ebp - 0x294]
cmp byte [0x4e9cf6], al
jbe 0x412e77
movzx ebx, al
movzx ecx, byte [ebx + 0x4e9cf6]
mov esi, 0x4cbf5b
mov eax, ecx
push 0x2f00b0
call fcn.0040148e
test al, al
je 0x412e43
movzx eax, byte [ebp - 0x294]
movzx ebx, byte [eax + 0x4e9cf6]
mov esi, 0x4cbf61
mov eax, ebx
push 0x2f00b0
call fcn.0040148e
test al, al
je 0x412ed3
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x2a8]
imul edx, ecx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + edx - 0xbae]
lea edi, [esi + ebx]
mov esi, 0x4cbf67
push 0x2d
call fcn.00401950
jmp 0x412f13
mov al, byte [ebp - 0x274]
test al, al
je 0x412f13
movzx ebx, byte [ebp - 0x28c]
imul ecx, ebx, 0x2e
movzx edx, byte [ebp - 0x2a8]
imul eax, edx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + eax - 0xbae]
lea edi, [esi + ecx]
mov esi, 0x4e9cf6
push 0x2d
call fcn.00401950
mov esi, 0x4e9cf6
mov edi, 0x4cbf69
call fcn.00415520
test al, al
je 0x412fe0
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x2a8]
imul edx, ecx, 0xb80
mov eax, dword [0x4e8a85]
lea edi, [eax + edx - 0xbae]
lea esi, [edi + ebx]
mov edi, 0x4cbf6a
call fcn.00415520
test al, al
je 0x412fe0
lea eax, [ebp - 0x68]
push eax
movzx ebx, byte [0x4e9cf6]
inc ebx
push ebx
call fcn.00403b50
push dword [ebp - 0x68]
push 0x4e9cf6
call fcn.00401a00
mov eax, dword [ebp - 0x27c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x9d0]
call fcn.00419ca2
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x68]
push ebx
movzx eax, byte [0x4e9cf6]
inc eax
push eax
call fcn.00403320
push dword [ebp - 0x10]
push 0
push 0
push 0
push 2
mov al, byte [0x4cbf6c]
push eax
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x413014
push 0
mov eax, dword [ebp - 0x27c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push 0
push 2
mov al, byte [0x4cbf6d]
push eax
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
movzx eax, byte [ebp - 0x28c]
movzx ebx, byte [eax + 0x4e887d]
inc ebx
add byte [ebp - 0x290], bl
mov eax, 0x4e886d
call fcn.00419182
cmp al, byte [ebp - 0x28c]
ja 0x412d78
movzx eax, byte [ebp - 0x2b0]
test eax, eax
jl 0x413052
cmp dword [ebp - 0x27c], eax
jge 0x413060
mov al, byte [ebp - 0x27c]
mov byte [ebp - 0x2b0], al
movzx eax, byte [ebp - 0x2b4]
test eax, eax
jl 0x413071
cmp dword [ebp - 0x27c], eax
jle 0x41307f
mov al, byte [ebp - 0x27c]
mov byte [ebp - 0x2b4], al
jmp 0x413560
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
test ebx, ebx
jbe 0x413560
mov byte [ebp - 0x9d8], bl
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
lea eax, [ebp - 0xad8]
push eax
push 0x4e8d06
movzx ebx, byte [ebp - 0x290]
push ebx
movzx ecx, byte [ebp - 0x28c]
movzx edx, byte [ecx + 0x4e887d]
push edx
call fcn.00401cd0
mov edi, 0x4e9cf6
lea esi, [ebp - 0xad8]
call fcn.00401940
movzx eax, byte [ebp - 0x28c]
cmp byte [eax + 0x4e88b9], 0
jne 0x413269
movzx ebx, al
cmp byte [ebx + 0x4e88b9], 4
je 0x413256
cmp byte [0x4e9cf6], 0xa
jae 0x41312d
cmp byte [0x4e9cf9], 0x2f
jne 0x41312d
mov esi, edi
mov edi, 0x4cbf6e
call fcn.00415520
test al, al
jne 0x413180
cmp byte [0x4e9cf6], 0xa
jne 0x413194
cmp byte [0x4e9cf9], 0x2f
jne 0x413194
cmp byte [0x4e9cfc], 0x2f
jne 0x413194
lea eax, [ebp - 0xad8]
push eax
lea ebx, [ebp - 0xae4]
push ebx
push 0x4e9cf6
call fcn.0041ad80
lea ecx, [ebp - 0xae4]
push ecx
call fcn.0041ac50
lea esi, [ebp - 0xad8]
mov edi, 0x4cbf74
call fcn.00415520
test al, al
je 0x413194
movzx eax, byte [ebp - 0x28c]
mov byte [eax + 0x4e88b9], 2
jmp 0x413256
lea eax, [ebp - 0xbe4]
push eax
push 0x4e9cf6
call fcn.0041ac50
lea esi, [ebp - 0xbe4]
mov edi, 0x4cbf75
call fcn.00415520
test al, al
je 0x41321c
push 0x4e9cf6
call fcn.0041aa30
test al, al
je 0x4131d8
movzx eax, byte [ebp - 0x28c]
mov byte [eax + 0x4e88b9], 3
jmp 0x41321a
movzx eax, byte [ebp - 0x28c]
mov esi, 0x4cbf76
movzx eax, byte [eax + 0x4e88b9]
push 0x70000
call fcn.0040148e
test al, al
jne 0x41320b
movzx eax, byte [ebp - 0x28c]
mov byte [eax + 0x4e88b9], 4
jmp 0x41321a
movzx eax, byte [ebp - 0x28c]
mov byte [eax + 0x4e88b9], 1
jmp 0x413256
movzx eax, byte [ebp - 0x28c]
mov esi, 0x4cbf77
movzx eax, byte [eax + 0x4e88b9]
push 0x70000
call fcn.0040148e
test al, al
jne 0x413256
cmp byte [0x4e8cfd], 0x20
jne 0x413256
movzx eax, byte [ebp - 0x28c]
mov byte [eax + 0x4e88b9], 4
movzx eax, byte [ebp - 0x28c]
mov bl, byte [eax + 0x4e88b9]
mov byte [ebp - 0x18], bl
jmp 0x413276
movzx ebx, al
mov cl, byte [ebx + 0x4e88b9]
mov byte [ebp - 0x18], cl
mov al, byte [ebp - 0x18]
cmp al, 3
jne 0x413321
mov ebx, dword [ebp - 0x27c]
dec ebx
push ebx
movzx ebx, byte [ebp - 0x28c]
dec ebx
push ebx
push 0x4e9cf6
call fcn.0040c2a0
sub esp, 8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x9d0]
call fcn.0041a462
mov dword [ebp - 0x10], eax
push 0x4cbf78
push 0x4e9cf6
call fcn.0040cca0
mov byte [ebp - 0x298], al
cmp al, 0
jbe 0x4132f5
push dword [ebp - 0x10]
push 0
push 0
push 0
push 3
mov bl, byte [0x4cbf7a]
push ebx
push 1
push 2
push 0x13
push 0
push 4
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x41331c
push dword [ebp - 0x10]
push 0
push 0
push 0
push 3
mov bl, byte [0x4cbf7b]
push ebx
push 1
push 2
push 0x13
push 0
push 3
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x41353d
cmp al, 2
jne 0x413459
cmp byte [0x4e9cf9], 0x2f
jne 0x41339b
lea ebx, [ebp - 0xce4]
push ebx
push 0x4e9cf6
push 1
push 5
call fcn.00401cd0
lea esi, [ebp - 0xce4]
mov edi, 0x4cbf7c
call fcn.00415520
test al, al
je 0x41339b
mov eax, dword [ebp - 0x27c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push 0x4e9cf6
call fcn.0041a4b0
mov dword [ebp - 0xce8], eax
fild dword [ebp - 0xce8]
sub esp, 8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x9d0]
call fcn.0041a462
mov dword [ebp - 0x10], eax
jmp 0x4133ee
mov edi, 0x4e9cf6
mov esi, 0x4cbf82
call fcn.00401940
lea eax, [ebp - 0x68]
push eax
movzx ebx, byte [0x4e9cf6]
inc ebx
push ebx
call fcn.00403b50
push dword [ebp - 0x68]
push 0x4e9cf6
call fcn.00401a00
mov eax, dword [ebp - 0x27c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x9d0]
call fcn.00419ca2
mov dword [ebp - 0x10], eax
cmp byte [0x4e9cf6], 0xa
jae 0x41342b
cmp byte [0x4e9cf9], 0x2f
jne 0x41342b
push dword [ebp - 0x10]
push 0
push 0
push 0
push 2
mov al, byte [0x4cbf83]
push eax
push 1
push 2
push 0x13
push 0
push 0xa5
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x413454
push dword [ebp - 0x10]
push 0
push 0
push 0
push 2
mov al, byte [0x4cbf84]
push eax
push 1
push 2
push 0x13
push 0
push 0xa4
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x41353d
lea ebx, [ebp - 0xde4]
push ebx
push 0x4e9cf6
call fcn.0041a3c0
mov edi, 0x4e9cf6
lea esi, [ebp - 0xde4]
call fcn.00401940
mov esi, edi
mov edi, 0x4cbf85
call fcn.00415520
test al, al
je 0x413509
lea eax, [ebp - 0x68]
push eax
movzx ebx, byte [0x4e9cf6]
inc ebx
push ebx
call fcn.00403b50
push dword [ebp - 0x68]
push 0x4e9cf6
call fcn.00401a00
mov eax, dword [ebp - 0x27c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x9d0]
call fcn.00419ca2
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x68]
push ebx
movzx eax, byte [0x4e9cf6]
inc eax
push eax
call fcn.00403320
push dword [ebp - 0x10]
push 0
push 0
push 0
push 1
mov al, byte [0x4cbf86]
push eax
push 0
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x41353d
push 0
mov eax, dword [ebp - 0x27c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push 0
push 1
mov al, byte [0x4cbf87]
push eax
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
movzx eax, byte [ebp - 0x28c]
movzx ebx, byte [eax + 0x4e887d]
inc ebx
add byte [ebp - 0x290], bl
dec byte [ebp - 0x9d8]
jne 0x4130a6
jmp 0x413990
cmp ax, 0x43
jne 0x41377d
inc dword [ebp - 0x27c]
lea eax, [ebp - 0xde4]
push eax
lea ebx, [ebp - 0xee4]
push ebx
lea ecx, [ebp - 0xfe4]
push ecx
push 0x4e8d06
movzx edx, byte [0x4e89fe]
inc edx
push edx
movzx edx, byte [0x4e89fe]
movzx eax, byte [0x4e89fd]
sub eax, edx
dec eax
push eax
call fcn.00401cd0
lea eax, [ebp - 0xfe4]
push eax
call fcn.0041a3c0
lea ebx, [ebp - 0xee4]
push ebx
call fcn.0041a340
mov edi, 0x4e9cf6
lea esi, [ebp - 0xde4]
call fcn.00401940
mov esi, edi
mov edi, 0x4cbf88
call fcn.00415520
test al, al
je 0x413660
lea eax, [ebp - 0x68]
push eax
movzx ebx, byte [0x4e9cf6]
inc ebx
push ebx
call fcn.00403b50
push dword [ebp - 0x68]
push 0x4e9cf6
call fcn.00401a00
mov eax, dword [ebp - 0x27c]
dec eax
push eax
push 0
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x9d0]
call fcn.00419ca2
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x68]
push ebx
movzx eax, byte [0x4e9cf6]
inc eax
push eax
call fcn.00403320
push dword [ebp - 0x10]
push 0
push 0
push 0
push 2
mov al, byte [0x4cbf89]
push eax
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x41368c
push 0
mov eax, dword [ebp - 0x27c]
dec eax
push eax
push 0
push 0
push 2
mov al, byte [0x4cbf8a]
push eax
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
dec ebx
movzx eax, bl
test eax, eax
jbe 0x413749
mov byte [ebp - 0xce8], al
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
dec ebx
movzx eax, byte [ebp - 0x28c]
test eax, eax
jl 0x4136d5
cmp ebx, eax
jle 0x41370b
push 0
mov eax, dword [ebp - 0x27c]
dec eax
push eax
mov al, byte [ebp - 0x28c]
push eax
push 0
push 2
mov bl, byte [0x4cbf8b]
push ebx
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x41373d
push 0
mov eax, dword [ebp - 0x27c]
dec eax
push eax
mov al, byte [ebp - 0x28c]
push eax
push 0
push 2
mov bl, byte [0x4cbf8c]
push ebx
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
dec byte [ebp - 0xce8]
jne 0x4136b3
mov eax, dword [ebp - 0x27c]
dec eax
push eax
mov eax, dword [ebp - 0x27c]
dec eax
push eax
push 0
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
dec ebx
push ebx
mov eax, dword [ebp - 0x9d0]
call fcn.004191a2
jmp 0x413990
cmp ax, 0x45
jne 0x413990
inc dword [ebp - 0x27c]
lea eax, [ebp - 0xde8]
push eax
lea ebx, [ebp - 0xee8]
push ebx
lea ecx, [ebp - 0xfe8]
push ecx
push 0x4e8d06
movzx edx, byte [0x4e89fe]
inc edx
push edx
movzx edx, byte [0x4e89fe]
movzx eax, byte [0x4e89fd]
sub eax, edx
dec eax
push eax
call fcn.00401cd0
lea eax, [ebp - 0xfe8]
push eax
call fcn.0041a3c0
lea ebx, [ebp - 0xee8]
push ebx
call fcn.0041a340
mov edi, 0x4e9cf6
lea esi, [ebp - 0xde8]
call fcn.00401940
mov esi, edi
mov edi, 0x4cbf8d
call fcn.00415520
test al, al
je 0x413878
lea eax, [ebp - 0x68]
push eax
movzx ebx, byte [0x4e9cf6]
inc ebx
push ebx
call fcn.00403b50
push dword [ebp - 0x68]
push 0x4e9cf6
call fcn.00401a00
mov eax, dword [ebp - 0x27c]
dec eax
push eax
push 0
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x9d0]
call fcn.00419ca2
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x68]
push ebx
movzx eax, byte [0x4e9cf6]
inc eax
push eax
call fcn.00403320
push dword [ebp - 0x10]
push 0
push 0
push 0
push 5
mov al, byte [0x4cbf8e]
push eax
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x4138a4
push 0
mov eax, dword [ebp - 0x27c]
dec eax
push eax
push 0
push 0
push 5
mov al, byte [0x4cbf8f]
push eax
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
dec ebx
movzx eax, bl
test eax, eax
jbe 0x413961
mov byte [ebp - 0xcec], al
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
dec ebx
movzx eax, byte [ebp - 0x28c]
test eax, eax
jl 0x4138ed
cmp ebx, eax
jle 0x413923
push 0
mov eax, dword [ebp - 0x27c]
dec eax
push eax
mov al, byte [ebp - 0x28c]
push eax
push 0
push 5
mov bl, byte [0x4cbf90]
push ebx
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
jmp 0x413955
push 0
mov eax, dword [ebp - 0x27c]
dec eax
push eax
mov al, byte [ebp - 0x28c]
push eax
push 0
push 5
mov bl, byte [0x4cbf91]
push ebx
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
dec byte [ebp - 0xcec]
jne 0x4138cb
mov eax, dword [ebp - 0x27c]
dec eax
push eax
mov eax, dword [ebp - 0x27c]
dec eax
push eax
push 0
mov eax, 0x4e886d
call fcn.00419182
movzx ebx, al
dec ebx
push ebx
mov eax, dword [ebp - 0x9d0]
call fcn.004191a2
movsx eax, word [ebp + 0xc]
cmp eax, dword [ebp - 0x280]
jne 0x4139bb
mov edi, dword [ebp - 0x9d0]
mov bx, word [ebp + 8]
mov word [edi + 0x27], bx
mov eax, dword [ebp - 0x9d0]
mov bx, word [ebp - 0x27c]
mov word [eax + 0x25], bx
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x288], eax
jg 0x412d18
cmp byte [ebp - 0x2a8], 0
jbe 0x41414d
mov dword [ebp - 0x27c], 1
push 0
mov eax, 0x4e886d
call fcn.00419182
push eax
push 1
push 1
push 0x4cbf92
lea edi, [ebp - 0xd0c]
call fcn.00401403
lea esi, [ebp - 0xd0c]
lea edi, [ebp - 0xd18]
push 0x90000
call fcn.004013e0
lea esi, [ebp - 0xd18]
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x2a8], 3
jne 0x413f36
mov byte [ebp - 0x290], 0
inc byte [ebp - 0x290]
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
mov edi, dword [0x4e8a85]
lea esi, [edi + ebx + 0xb52]
mov edi, 0x4cbfb2
call fcn.00415790
test al, al
jne 0x413a7b
mov eax, 0x4e886d
call fcn.00419182
cmp al, byte [ebp - 0x290]
ja 0x413a3b
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
mov edi, dword [0x4e8a85]
lea esi, [edi + ebx + 0xb52]
mov edi, 0x4cbfb4
call fcn.00415790
test al, al
je 0x413f36
mov byte [ebp - 0x290], 0
inc byte [ebp - 0x290]
mov byte [ebp - 0x28c], 0
mov edi, 0x4e9cf6
mov esi, 0x4cbfb6
call fcn.00401940
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
mov ecx, dword [0x4e8a85]
lea esi, [ecx + ebx + 0xb52]
mov edi, 0x4cbfb7
call fcn.00415790
test al, al
je 0x413d1b
mov al, byte [ebp - 0x290]
mov byte [ebp - 0x298], al
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
mov edi, dword [0x4e8a85]
lea esi, [edi + ebx - 0x2e]
mov edi, 0x4cbfb9
call fcn.00415520
test al, al
je 0x413b48
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
mov esi, dword [0x4e8a85]
mov edi, 0x4e9cf6
lea esi, [esi + ebx - 0x2e]
call fcn.00401940
inc byte [ebp - 0x298]
movzx eax, byte [ebp - 0x298]
imul ebx, eax, 0x2e
mov edi, dword [0x4e8a85]
lea esi, [edi + ebx + 0xb52]
mov edi, 0x4cbfba
call fcn.00415790
test al, al
je 0x413bfc
movzx eax, byte [ebp - 0x298]
movzx ebx, byte [ebp + eax - 0x59]
mov esi, 0x4cbfbc
mov eax, ebx
push 0x2f00b0
call fcn.0040148e
test al, al
jne 0x413bfc
movzx eax, byte [ebp - 0x298]
imul ebx, eax, 0x2e
mov edi, dword [0x4e8a85]
lea esi, [edi + ebx - 0x2e]
mov edi, 0x4cbfc2
call fcn.00415520
test al, al
je 0x413bfc
mov esi, 0x4e9cf6
lea edi, [ebp - 0xdec]
call fcn.00401b30
movzx eax, byte [ebp - 0x298]
imul ebx, eax, 0x2e
mov ecx, dword [0x4e8a85]
lea esi, [ecx + ebx - 0x2e]
call fcn.00401af0
mov edi, 0x4e9cf6
lea esi, [ebp - 0xdec]
call fcn.00401940
movzx eax, byte [ebp - 0x298]
imul ebx, eax, 0x2e
mov edi, dword [0x4e8a85]
lea esi, [edi + ebx + 0xb52]
mov edi, 0x4cbfc3
call fcn.00415520
test al, al
jne 0x413c5b
movzx eax, byte [ebp - 0x298]
movzx ebx, byte [ebp + eax - 0x59]
mov esi, 0x4cbfc5
mov eax, ebx
push 0x2f00b0
call fcn.0040148e
test al, al
jne 0x413c5b
mov eax, 0x4e886d
call fcn.00419182
cmp al, byte [ebp - 0x298]
ja 0x413b48
lea eax, [ebp - 0x68]
push eax
movzx ebx, byte [0x4e9cf6]
inc ebx
push ebx
call fcn.00403b50
push dword [ebp - 0x68]
push 0x4e9cf6
call fcn.00401a00
movzx eax, byte [ebp - 0x2b0]
dec eax
push eax
movzx eax, byte [ebp - 0x290]
dec eax
push eax
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x9d0]
call fcn.00419ca2
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x68]
push ebx
movzx eax, byte [0x4e9cf6]
inc eax
push eax
call fcn.00403320
push dword [ebp - 0x10]
push 0
push 0
push 0
push 2
mov al, byte [0x4cbfcb]
push eax
push 0
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
movzx ebx, byte [ebp - 0x2b0]
dec ebx
push ebx
movzx eax, byte [ebp - 0x2b0]
push eax
movzx ebx, byte [ebp - 0x290]
dec ebx
push ebx
movzx ebx, byte [ebp - 0x298]
dec ebx
push ebx
mov eax, dword [ebp - 0x9d0]
call fcn.004191a2
mov bl, byte [ebp - 0x298]
mov byte [ebp - 0x290], bl
jmp 0x413f16
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x28c]
imul edx, ecx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + edx - 0xbae]
lea esi, [esi + ebx]
mov edi, 0x4cbfcc
call fcn.00415520
test al, al
je 0x413e05
mov esi, 0x4e9cf6
mov edi, 0x4cbfcd
call fcn.00415520
test al, al
je 0x413dd5
lea edi, [ebp - 0xeec]
call fcn.00401b30
mov esi, 0x4cbfce
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0xdec]
call fcn.00401b30
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
movzx edx, cl
imul eax, edx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + eax - 0xbae]
lea esi, [esi + ebx]
lea edi, [ebp - 0xdec]
call fcn.00401af0
mov edi, 0x4e9cf6
lea esi, [ebp - 0xdec]
call fcn.00401940
jmp 0x413e05
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
movzx edx, cl
imul eax, edx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + eax - 0xbae]
mov edi, 0x4e9cf6
lea esi, [esi + ebx]
call fcn.00401940
cmp byte [ebp - 0x28c], 3
jb 0x413d1b
lea eax, [ebp - 0x68]
push eax
movzx ebx, byte [0x4e9cf6]
inc ebx
push ebx
call fcn.00403b50
push dword [ebp - 0x68]
push 0x4e9cf6
call fcn.00401a00
movzx eax, byte [ebp - 0x2b0]
dec eax
push eax
movzx eax, byte [ebp - 0x290]
dec eax
push eax
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x9d0]
call fcn.00419ca2
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x68]
push ebx
movzx eax, byte [0x4e9cf6]
inc eax
push eax
call fcn.00403320
push dword [ebp - 0x10]
push 0
push 0
push 0
push 2
mov al, byte [0x4cbfd0]
push eax
push 0
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
movzx ebx, byte [ebp - 0x2b0]
dec ebx
push ebx
movzx eax, byte [ebp - 0x2b0]
inc eax
push eax
movzx eax, byte [ebp - 0x290]
dec eax
push eax
movzx eax, byte [ebp - 0x290]
dec eax
push eax
mov eax, dword [ebp - 0x9d0]
call fcn.004191a2
mov al, byte [ebp - 0x290]
push eax
push 1
push 0
push 0x4cbfd1
lea edi, [ebp - 0xd2c]
call fcn.00401403
lea ebx, [ebp - 0xd2c]
push ebx
lea esi, [ebp - 0x64]
lea edi, [ebp - 0xd0c]
push 0x200a0920
call fcn.00401509
mov esi, edi
lea edi, [ebp - 0xd38]
push 0x90000
call fcn.004013e0
lea esi, [ebp - 0xd38]
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, 0x4e886d
call fcn.00419182
cmp al, byte [ebp - 0x290]
ja 0x413aae
mov dword [ebp - 0x27c], 3
mov byte [ebp - 0x290], 0
inc byte [ebp - 0x290]
movzx eax, byte [ebp - 0x290]
lea esi, [ebp - 0x64]
push 0x3f0101
call fcn.0040148e
test al, al
je 0x414137
mov eax, dword [ebp - 0x27c]
dec eax
mov byte [ebp - 0x28c], al
mov edi, 0x4e9cf6
mov esi, 0x4cbff1
call fcn.00401940
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x28c]
imul edx, ecx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + edx - 0xbae]
lea esi, [esi + ebx]
mov edi, 0x4cbff2
call fcn.00415520
test al, al
je 0x414066
mov esi, 0x4e9cf6
mov edi, 0x4cbff3
call fcn.00415520
test al, al
je 0x414036
lea edi, [ebp - 0xeec]
call fcn.00401b30
mov esi, 0x4cbff4
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0xdec]
call fcn.00401b30
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
movzx edx, cl
imul eax, edx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + eax - 0xbae]
lea esi, [esi + ebx]
lea edi, [ebp - 0xdec]
call fcn.00401af0
mov edi, 0x4e9cf6
lea esi, [ebp - 0xdec]
call fcn.00401940
jmp 0x414066
movzx eax, byte [ebp - 0x290]
imul ebx, eax, 0x2e
movzx edx, cl
imul eax, edx, 0xb80
mov edi, dword [0x4e8a85]
lea esi, [edi + eax - 0xbae]
mov edi, 0x4e9cf6
lea esi, [esi + ebx]
call fcn.00401940
mov al, byte [ebp - 0x28c]
cmp byte [ebp - 0x2a8], al
ja 0x413f7c
lea ebx, [ebp - 0x68]
push ebx
movzx ecx, byte [0x4e9cf6]
inc ecx
push ecx
call fcn.00403b50
push dword [ebp - 0x68]
push 0x4e9cf6
call fcn.00401a00
movzx eax, byte [ebp - 0x2b0]
add eax, dword [ebp - 0x27c]
sub eax, 2
push eax
movzx eax, byte [ebp - 0x290]
dec eax
push eax
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x9d0]
call fcn.00419ca2
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x68]
push ebx
movzx eax, byte [0x4e9cf6]
inc eax
push eax
call fcn.00403320
push dword [ebp - 0x10]
push 0
push 0
push 0
push 2
mov al, byte [0x4cbff6]
push eax
push 0
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9d0]
call fcn.00419232
movzx ebx, byte [ebp - 0x2b0]
add ebx, dword [ebp - 0x27c]
sub ebx, 2
push ebx
movzx eax, byte [ebp - 0x2b4]
dec eax
push eax
movzx eax, byte [ebp - 0x290]
dec eax
push eax
movzx eax, byte [ebp - 0x290]
dec eax
push eax
mov eax, dword [ebp - 0x9d0]
call fcn.004191a2
mov eax, 0x4e886d
call fcn.00419182
cmp al, byte [ebp - 0x290]
ja 0x413f3d
lea eax, [ebp - 0x26c]
push eax
mov eax, dword [0x4e9ac2]
call fcn.004163d2
mov bl, byte [ebp - 0x274]
test bl, bl
je 0x41417d
push dword [0x4e8a85]
call fcn.00403310
mov eax, 0
mov dword [0x4e8a85], eax
mov eax, dword [0x4e9ac2]
call fcn.00416232
push dword [0x4e9ac2]
call fcn.00403310
call fcn.00416200
push 1
mov eax, dword [0x4e91ad]
call fcn.00416172
test al, al
je 0x41422f
lea eax, [ebp - 0x68]
push eax
movzx ebx, byte [ebp - 0x26c]
mov ecx, 0xd
add ecx, ebx
add ecx, 2
push ecx
call fcn.00403b50
push dword [ebp - 0x68]
mov esi, 0x4cbff7
lea edi, [ebp - 0xdec]
call fcn.00401b30
lea esi, [ebp - 0x26c]
call fcn.00401af0
mov eax, edi
push eax
call fcn.00401a00
push 0
push dword [ebp - 0x68]
call sub.kernel32.dll_WinExec
mov dword [ebp - 0x27c], eax
lea ebx, [ebp - 0x68]
push ebx
movzx eax, byte [ebp - 0x26c]
mov ecx, 0xd
add ecx, eax
add ecx, 2
push ecx
call fcn.00403320
cmp dword [ebp - 0x27c], 0x1f
jg 0x41422f
push 0x4cc005
push 0x4cc018
call fcn.00414260
push dword [ebp - 0x6c]
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x6c]
push eax
push 0x80
call fcn.00403320
call fcn.00402ee0
pop edx
pop ecx
pop ebx
leave
ret 0x10