Function at 0x423840
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1f
push 0
push 0
dec ecx
jne 0x423848
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4250e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00405990
mov eax, dword [ebp - 0x30]
mov edx, 0x425100
call fcn.00403a40
jne 0x423891
push 1
push 0x425108
call sub.kernel32.dll_WinExec
call fcn.0040359c
lea ecx, [ebp - 0x38]
xor edx, edx
xor eax, eax
call fcn.00422b48
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00405c8c
mov eax, dword [ebp - 0x34]
call fcn.00405ce4
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00405990
mov eax, dword [ebp - 0x3c]
call fcn.0040aaf8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffdc
call fcn.00406b50
mov edx, 0x42a0b4
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00406a60
mov edx, 0x42a0bc
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00406a60
mov edx, 0x42a0c4
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00406a60
mov edx, 0x42a0cc
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00406a60
mov edx, 0x42a0e4
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00406a60
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00406a60
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00406a60
lea edx, [ebp - 0x29]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00406a60
cmp byte [ebp - 0x29], 0xf1
je 0x423994
mov eax, dword [ebp - 0x10]
call fcn.0040a210
xor eax, eax
call fcn.00422c0c
push 0x10
push 0x425114
push 0x42511c
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.0040359c
mov eax, dword [0x42a0b4]
mov edx, dword [0x42a0b8]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4239ae
call fcn.00402d14
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00406b50
xor eax, eax
mov al, byte [ebp - 0x2a]
inc eax
push eax
mov eax, 0x42a090
mov ecx, 1
mov edx, dword [0x422740]
call fcn.00404298
add esp, 4
xor ebx, ebx
mov bl, byte [ebp - 0x2a]
test ebx, ebx
jl 0x423a12
inc ebx
xor esi, esi
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x40]
mov eax, dword [0x42a090]
test eax, eax
je 0x423a01
cmp esi, dword [eax - 4]
jb 0x423a06
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x4239e5
mov eax, 0x62
call fcn.00422b38
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x42a0ac
mov ecx, 1
mov edx, dword [0x422820]
call fcn.00404298
add esp, 4
dec ebx
test ebx, ebx
jl 0x423a71
inc ebx
xor esi, esi
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x44]
mov eax, dword [0x42a0ac]
test eax, eax
je 0x423a60
cmp esi, dword [eax - 4]
jb 0x423a65
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x423a44
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x423b69
inc ebx
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x42a0ac]
test edx, edx
je 0x423a97
cmp eax, dword [edx - 4]
jb 0x423a9c
call fcn.00402d14
mov eax, dword [edx + eax*4]
call fcn.0040d700
test eax, eax
jns 0x423aad
call fcn.00402d14
mov edx, esi
shl edx, 2
add edx, 2
mov ecx, dword [0x42a0ac]
test ecx, ecx
je 0x423ac4
cmp edx, dword [ecx - 4]
jb 0x423ac9
call fcn.00402d14
mov edx, dword [ecx + edx*4]
push edx
mov edx, esi
shl edx, 2
inc edx
mov ecx, dword [0x42a0ac]
test ecx, ecx
je 0x423ae2
cmp edx, dword [ecx - 4]
jb 0x423ae7
call fcn.00402d14
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.00422ea4
mov edx, dword [ebp - 0x48]
mov eax, dword [0x42a0ac]
test eax, eax
je 0x423b01
cmp esi, dword [eax - 4]
jb 0x423b06
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
mov eax, dword [0x42a0ac]
test eax, eax
je 0x423b1c
cmp esi, dword [eax - 4]
jb 0x423b21
call fcn.00402d14
cmp dword [eax + esi*4], 0
jne 0x423b61
mov eax, dword [0x42a0ac]
test eax, eax
je 0x423b35
cmp esi, dword [eax - 4]
jb 0x423b3a
call fcn.00402d14
lea eax, [eax + esi*4]
mov edx, esi
shl edx, 2
add edx, 3
mov ecx, dword [0x42a0ac]
test ecx, ecx
je 0x423b54
cmp edx, dword [ecx - 4]
jb 0x423b59
call fcn.00402d14
mov edx, dword [ecx + edx*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x423a7f
push edi
mov eax, 0x42a0ac
mov ecx, 1
mov edx, dword [0x422820]
call fcn.00404298
add esp, 4
mov eax, 0x6e
call fcn.00422b10
mov byte [0x4287c4], al
call fcn.0040d880
mov ebx, eax
test ebx, ebx
jle 0x423df3
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00405990
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040a9b4
mov eax, dword [ebp - 8]
mov edx, 0x42516c
call fcn.00403a40
jne 0x423bd0
mov byte [0x4287c4], 1
mov eax, dword [ebp - 8]
mov edx, 0x425178
call fcn.00403a40
jne 0x423be6
mov byte [0x4287c8], 1
mov eax, dword [ebp - 8]
mov edx, 0x425184
call fcn.00403a40
jne 0x423c1b
mov eax, 0x6b
mov edx, dword [0x42a090]
test edx, edx
je 0x423c09
cmp eax, dword [edx - 4]
jb 0x423c0e
call fcn.00402d14
lea eax, [edx + eax*4]
mov edx, 0x425190
call fcn.004036e8
mov eax, dword [ebp - 8]
mov edx, 0x42519c
call fcn.00403a40
jne 0x423c50
mov eax, 0x3f
mov edx, dword [0x42a090]
test edx, edx
je 0x423c3e
cmp eax, dword [edx - 4]
jb 0x423c43
call fcn.00402d14
lea eax, [edx + eax*4]
mov edx, 0x425190
call fcn.004036e8
lea eax, [ebp - 0x4c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403b54
mov eax, dword [ebp - 0x4c]
mov edx, 0x4251a8
call fcn.00403a40
jne 0x423cbf
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
call fcn.004038f4
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00403b54
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00405a08
mov edx, dword [ebp - 0x50]
mov eax, 0x3a
mov ecx, dword [0x42a090]
test ecx, ecx
je 0x423cb2
cmp eax, dword [ecx - 4]
jb 0x423cb7
call fcn.00402d14
lea eax, [ecx + eax*4]
call fcn.004036e8
lea eax, [ebp - 0x58]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403b54
mov eax, dword [ebp - 0x58]
mov edx, 0x4251b4
call fcn.00403a40
jne 0x423d18
mov eax, 0x6a
mov edx, dword [0x42a090]
test edx, edx
je 0x423cf8
cmp eax, dword [edx - 4]
jb 0x423cfd
call fcn.00402d14
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.004038f4
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00403b54
lea eax, [ebp - 0x5c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403b54
mov eax, dword [ebp - 0x5c]
mov edx, 0x4251c0
call fcn.00403a40
jne 0x423d59
push 0x42a0d4
mov eax, dword [ebp - 8]
call fcn.004038f4
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00403b54
lea eax, [ebp - 0x60]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403b54
mov eax, dword [ebp - 0x60]
mov edx, 0x4251cc
call fcn.00403a40
jne 0x423deb
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
call fcn.004038f4
mov ecx, eax
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.00403b54
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00422cf4
mov edx, dword [ebp - 0x64]
mov eax, 0x1d
mov ecx, dword [0x42a090]
test ecx, ecx
je 0x423dbb
cmp eax, dword [ecx - 4]
jb 0x423dc0
call fcn.00402d14
mov eax, dword [ecx + eax*4]
call fcn.00403a40
jne 0x423deb
mov eax, 0x1d
mov edx, dword [0x42a090]
test edx, edx
je 0x423dde
cmp eax, dword [edx - 4]
jb 0x423de3
call fcn.00402d14
lea eax, [edx + eax*4]
call fcn.00403694
inc esi
dec ebx
jne 0x423ba5
cmp byte [0x4287c4], 0
je 0x423e27
mov eax, 0x1d
mov edx, dword [0x42a090]
test edx, edx
je 0x423e10
cmp eax, dword [edx - 4]
jb 0x423e15
call fcn.00402d14
cmp dword [edx + eax*4], 0
je 0x423e27
mov al, 1
call fcn.00422c0c
call fcn.0040359c
mov eax, 0x41
mov edx, dword [0x42a090]
test edx, edx
je 0x423e3b
cmp eax, dword [edx - 4]
jb 0x423e40
call fcn.00402d14
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x6c]
xor edx, edx
call fcn.0041d480
mov edx, dword [ebp - 0x6c]
mov eax, 0x42a0e0
call fcn.004036e8
mov eax, dword [0x428840]
mov eax, dword [eax]
mov edx, dword [0x42a0e0]
call fcn.0040b86c
cmp byte [0x4287c4], 0
jne 0x423e89
push 5
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_ShowWindow
jmp 0x423e97
mov eax, dword [0x428840]
mov eax, dword [eax]
xor edx, edx
call fcn.0040b8f0
mov eax, 0x32
call fcn.00422b38
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x42a084
mov ecx, 1
mov edx, dword [0x4226e0]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x423ef8
inc ebx
xor esi, esi
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x70]
mov eax, dword [0x42a084]
test eax, eax
je 0x423ee7
cmp esi, dword [eax - 4]
jb 0x423eec
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x423ecb
mov eax, 0x60
call fcn.00422b38
lea edi, [eax + eax*2]
push edi
mov eax, 0x42a0a8
mov ecx, 1
mov edx, dword [0x422800]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x423f55
inc ebx
xor esi, esi
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x74]
mov eax, dword [0x42a0a8]
test eax, eax
je 0x423f44
cmp esi, dword [eax - 4]
jb 0x423f49
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x423f28
mov eax, 0x1f
call fcn.00422b38
mov edi, eax
add edi, edi
push edi
mov eax, 0x42a0b0
mov ecx, 1
mov edx, dword [0x422840]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x423fb3
inc ebx
xor esi, esi
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x78]
mov eax, dword [0x42a0b0]
test eax, eax
je 0x423fa2
cmp esi, dword [eax - 4]
jb 0x423fa7
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x423f86
mov eax, 0x36
call fcn.00422b38
mov edi, eax
shl edi, 3
push edi
mov eax, 0x42a080
mov ecx, 1
mov edx, dword [0x4226c0]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x424012
inc ebx
xor esi, esi
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x42a080]
test eax, eax
je 0x424001
cmp esi, dword [eax - 4]
jb 0x424006
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x423fe5
mov eax, 0x43
call fcn.00422b38
lea edi, [eax + eax*2]
push edi
mov eax, 0x42a088
mov ecx, 1
mov edx, dword [0x422700]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x42406f
inc ebx
xor esi, esi
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x80]
mov eax, dword [0x42a088]
test eax, eax
je 0x42405e
cmp esi, dword [eax - 4]
jb 0x424063
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x424042
mov eax, 0x5d
call fcn.00422b38
mov edi, eax
add edi, edi
push edi
mov eax, 0x42a08c
mov ecx, 1
mov edx, dword [0x422720]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4240d3
inc ebx
xor esi, esi
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x84]
mov eax, dword [0x42a08c]
test eax, eax
je 0x4240c2
cmp esi, dword [eax - 4]
jb 0x4240c7
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x4240a0
mov eax, 0x28
call fcn.00422b38
mov ebx, eax
mov eax, 0x19
call fcn.00422b38
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x42a07c
mov ecx, 1
mov edx, dword [0x4226a0]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x424148
inc ebx
xor esi, esi
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x88]
mov eax, dword [0x42a07c]
test eax, eax
je 0x424137
cmp esi, dword [eax - 4]
jb 0x42413c
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x424115
mov eax, 0x18
call fcn.00422b38
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x42a09c
mov ecx, 1
mov edx, dword [0x4227a0]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4241af
inc ebx
xor esi, esi
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x42a09c]
test eax, eax
je 0x42419e
cmp esi, dword [eax - 4]
jb 0x4241a3
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x42417c
mov eax, 0x2d
call fcn.00422b38
mov edi, eax
add edi, edi
push edi
mov eax, 0x42a0a0
mov ecx, 1
mov edx, dword [0x4227c0]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x424213
inc ebx
xor esi, esi
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x90]
mov eax, dword [0x42a0a0]
test eax, eax
je 0x424202
cmp esi, dword [eax - 4]
jb 0x424207
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x4241e0
mov eax, 0x14
call fcn.00422b38
mov edi, eax
add edi, edi
push edi
mov eax, 0x42a0a4
mov ecx, 1
mov edx, dword [0x4227e0]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x424277
inc ebx
xor esi, esi
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x94]
mov eax, dword [0x42a0a4]
test eax, eax
je 0x424266
cmp esi, dword [eax - 4]
jb 0x42426b
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x424244
mov eax, 0x1a
call fcn.00422b38
mov edi, eax
shl edi, 2
push edi
mov eax, 0x42a098
mov ecx, 1
mov edx, dword [0x422780]
call fcn.00404298
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4242dc
inc ebx
xor esi, esi
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x98]
mov eax, dword [0x42a098]
test eax, eax
je 0x4242cb
cmp esi, dword [eax - 4]
jb 0x4242d0
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x4242a9
mov eax, 0x1a
call fcn.00422b38
mov edi, eax
mov eax, 0x39
call fcn.00422b38
imul edi, eax
lea eax, [edi + 1]
push eax
mov eax, 0x42a094
mov ecx, 1
mov edx, dword [0x422760]
call fcn.00404298
add esp, 4
mov ebx, edi
test ebx, ebx
jle 0x42434f
mov esi, 1
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x42a094]
test eax, eax
je 0x42433e
cmp esi, dword [eax - 4]
jb 0x424343
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x42431c
mov eax, dword [0x42a0c4]
mov edx, dword [0x42a0c8]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x424369
call fcn.00402d14
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00406b50
cmp byte [0x42a0e4], 0
je 0x4243f6
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 2
call fcn.00422b48
mov eax, dword [ebp - 8]
call fcn.0040ab20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, 0x4251dc
call fcn.00406a68
push dword [0x42a0c0]
push dword [0x42a0bc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00422d84
mov eax, dword [ebp - 0x14]
call fcn.0040a210
mov dl, 1
mov eax, dword [0x40e1e0]
call fcn.0040e5b0
mov ebx, eax
lea eax, [ebp - 0xa0]
call fcn.0040d9f8
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040ea3c
mov eax, ebx
call fcn.00402d84
jmp 0x42446f
xor ebx, ebx
mov bl, byte [ebp - 0x2b]
test ebx, ebx
jle 0x42446f
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
call fcn.0040d9f8
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 8]
pop ecx
call fcn.00403940
mov eax, dword [ebp - 8]
call fcn.0040ab20
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov eax, dword [ebp - 0xac]
call fcn.0040d700
mov edi, eax
mov eax, edi
cdq
push edx
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00422d84
mov eax, dword [ebp - 0x14]
call fcn.0040a210
dec ebx
jne 0x4243ff
mov eax, dword [ebp - 0x10]
call fcn.0040a210
cmp dword [0x42a0d4], 0
je 0x424519
mov byte [0x4287c0], 0xff
mov eax, 0x1a
call fcn.00422b38
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x424506
inc ebx
xor esi, esi
mov eax, esi
shl eax, 2
mov edx, dword [0x42a098]
test edx, edx
je 0x4244b3
cmp eax, dword [edx - 4]
jb 0x4244b8
call fcn.00402d14
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0xb0]
call fcn.0040a98c
mov eax, dword [ebp - 0xb0]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [0x42a0d4]
call fcn.0040a98c
mov eax, dword [ebp - 0xb4]
pop edx
call fcn.00403c38
test eax, eax
jle 0x424502
mov eax, esi
cmp eax, 0xff
jbe 0x4244fb
call fcn.00402d14
mov byte [0x4287c0], al
jmp 0x424506
inc esi
dec ebx
jne 0x42449f
cmp byte [0x4287c0], 0xff
jne 0x424519
mov eax, 0x42a0d4
call fcn.00403694
mov eax, 0x1a
call fcn.00422b38
dec eax
jle 0x424570
cmp dword [0x42a0d4], 0
jne 0x424570
mov edx, dword [0x428840]
mov edx, dword [edx]
mov eax, dword [0x4287ec]
call fcn.0041a728
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00407c68
mov eax, dword [0x4287ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00408ce8
cmp byte [0x4287cc], 0
jne 0x424570
mov al, 1
call fcn.00422c0c
call fcn.0040359c
mov eax, 0x1a
call fcn.00422b38
dec eax
jle 0x42461d
cmp byte [0x4287c0], 0
jbe 0x42461d
mov eax, 0x42a0d4
xor edx, edx
mov dl, byte [0x4287c0]
shl edx, 2
mov ecx, dword [0x42a098]
test ecx, ecx
je 0x4245ad
cmp edx, dword [ecx - 4]
jb 0x4245b2
call fcn.00402d14
mov edx, dword [ecx + edx*4]
call fcn.004036e8
mov eax, 0x39
call fcn.00422b38
mov ebx, eax
test ebx, ebx
jle 0x424640
mov esi, 1
mov eax, 0x39
call fcn.00422b38
xor edx, edx
mov dl, byte [0x4287c0]
imul edx
add eax, esi
mov edx, dword [0x42a094]
test edx, edx
je 0x4245f4
cmp eax, dword [edx - 4]
jb 0x4245f9
call fcn.00402d14
mov edx, dword [edx + eax*4]
mov eax, dword [0x42a094]
test eax, eax
je 0x42460a
cmp esi, dword [eax - 4]
jb 0x42460f
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc esi
dec ebx
jne 0x4245cf
jmp 0x424640
mov eax, 0x42a0d4
xor edx, edx
mov ecx, dword [0x42a098]
test ecx, ecx
je 0x424633
cmp edx, dword [ecx - 4]
jb 0x424638
call fcn.00402d14
mov edx, dword [ecx + edx*4]
call fcn.004036e8
lea edx, [ebp - 0xb8]
mov eax, dword [0x42a0d4]
call fcn.004237c0
mov edx, dword [ebp - 0xb8]
mov eax, 0x42a0d4
call fcn.004036e8
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x4287c0]
shl edx, 2
add edx, 2
mov ecx, dword [0x42a098]
test ecx, ecx
je 0x424680
cmp edx, dword [ecx - 4]
jb 0x424685
call fcn.00402d14
mov edx, dword [ecx + edx*4]
call fcn.0040372c
cmp dword [ebp - 8], 0
je 0x4246b1
mov eax, dword [ebp - 8]
call fcn.0040d700
cmp eax, 0xff
jbe 0x4246a7
call fcn.00402d14
mov edx, dword [0x428808]
mov byte [edx], al
jmp 0x4246b9
mov eax, dword [0x428808]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x4287c0]
shl edx, 2
add edx, 3
mov ecx, dword [0x42a098]
test ecx, ecx
je 0x4246d9
cmp edx, dword [ecx - 4]
jb 0x4246de
call fcn.00402d14
mov edx, dword [ecx + edx*4]
call fcn.0040372c
cmp dword [ebp - 8], 0
je 0x42470a
mov eax, dword [ebp - 8]
call fcn.0040d700
cmp eax, 0xff
jbe 0x424700
call fcn.00402d14
mov edx, dword [0x428880]
mov byte [edx], al
jmp 0x424712
mov eax, dword [0x428880]
mov byte [eax], 0x10
mov eax, 0x3d
call fcn.00422b38
call fcn.00409d18
test al, al
je 0x4247c5
cmp byte [0x4287c4], 0
jne 0x4247b9
push 0x30
mov eax, 0x41
mov edx, dword [0x42a090]
test edx, edx
je 0x42474c
cmp eax, dword [edx - 4]
jb 0x424751
call fcn.00402d14
mov eax, dword [edx + eax*4]
call fcn.00403af4
push eax
mov eax, 0x3e
mov edx, dword [0x42a090]
test edx, edx
je 0x42476e
cmp eax, dword [edx - 4]
jb 0x424773
call fcn.00402d14
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x42a094]
test edx, edx
je 0x42478a
cmp eax, dword [edx - 4]
jb 0x42478f
call fcn.00402d14
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xbc]
call fcn.00403940
mov eax, dword [ebp - 0xbc]
call fcn.00403af4
push eax
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
mov al, 1
call fcn.00422c0c
call fcn.0040359c
mov eax, 0x63
call fcn.00422b10
test al, al
je 0x424827
call fcn.0042307c
test al, al
jne 0x424827
push 0x30
mov eax, dword [0x42a0e0]
call fcn.00403af4
push eax
mov eax, 0x55
mov edx, dword [0x42a094]
test edx, edx
je 0x4247fd
cmp eax, dword [edx - 4]
jb 0x424802
call fcn.00402d14
mov eax, dword [edx + eax*4]
call fcn.00403af4
push eax
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
mov al, 1
call fcn.00422c0c
call fcn.0040359c
mov eax, 0x64
call fcn.00422b10
test al, al
je 0x424980
mov eax, 0x64
mov edx, dword [0x42a090]
test edx, edx
je 0x42484d
cmp eax, dword [edx - 4]
jb 0x424852
call fcn.00402d14
mov eax, dword [edx + eax*4]
call fcn.00405608
fstp qword [ebp - 0x20]
wait
call fcn.00422f04
fstp qword [ebp - 0x28]
wait
mov eax, 0x55
call fcn.00422b10
test al, al
je 0x424880
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jb 0x4248a1
mov eax, 0x55
call fcn.00422b10
test al, al
jne 0x424980
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
je 0x424980
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x42a094]
test ecx, ecx
je 0x4248b8
cmp edx, dword [ecx - 4]
jb 0x4248bd
call fcn.00402d14
mov edx, dword [ecx + edx*4]
call fcn.0040372c
mov eax, 2
call fcn.00422b10
test al, al
je 0x42490b
mov esi, 4
push dword [ebp - 8]
push 0x4251ec
mov eax, 0x57
mov edx, dword [0x42a094]
test edx, edx
je 0x4248f4
cmp eax, dword [edx - 4]
jb 0x4248f9
call fcn.00402d14
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004039b4
jmp 0x42490d
xor esi, esi
or esi, 0x30
test esi, esi
jns 0x424919
call fcn.00402d14
push esi
mov eax, dword [0x42a0e0]
call fcn.00403af4
push eax
mov eax, dword [ebp - 8]
call fcn.00403af4
push eax
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x424974
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x42a090]
test edx, edx
je 0x42495d
cmp eax, dword [edx - 4]
jb 0x424962
call fcn.00402d14
mov eax, dword [edx + eax*4]
call fcn.00403af4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov al, 1
call fcn.00422c0c
call fcn.0040359c
mov eax, 0x67
call fcn.00422b10
test al, al
je 0x424a5a
lea eax, [ebp - 8]
mov edx, 0x68
mov ecx, dword [0x42a090]
test ecx, ecx
je 0x4249a9
cmp edx, dword [ecx - 4]
jb 0x4249ae
call fcn.00402d14
mov edx, dword [ecx + edx*4]
call fcn.0040372c
mov eax, 0x69
call fcn.00422b38
cmp eax, 2
jge 0x424a34
mov ebx, 1
xor esi, esi
jmp 0x424a2a
mov esi, ebx
mov eax, 0x69
call fcn.00422b38
sub eax, 1
jb 0x4249e3
je 0x4249f7
jmp 0x424a01
mov eax, dword [ebp - 8]
call fcn.00403af4
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
jmp 0x424a01
mov eax, dword [ebp - 8]
call fcn.00423450
mov ebx, eax
test ebx, ebx
je 0x424a2a
mov eax, dword [0x428840]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x1c]
je 0x424a2a
mov eax, dword [0x42a078]
mov eax, dword [eax + 0x18]
cmp ebx, dword [eax + 0x1c]
je 0x424a2a
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
je 0x424a5a
cmp ebx, esi
jne 0x4249ce
jmp 0x424a5a
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040a9b4
call fcn.0040d470
cmp al, 3
jbe 0x424a52
mov eax, dword [ebp - 0xc]
call fcn.00423650
jmp 0x424a5a
mov eax, dword [ebp - 0xc]
call fcn.00423540
mov eax, 1
call fcn.00422b10
test al, al
je 0x424ec0
cmp byte [0x4287c4], 0
jne 0x424ec0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bf88
xor edx, edx
call fcn.0040541c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.00409d34
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040bdb8
call fcn.0040b9e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bc64
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bc3c
pop edx
call fcn.0040c6a4
mov edx, dword [0x42883c]
mov dword [edx], eax
mov eax, 3
call fcn.00422b10
test al, al
je 0x424b61
mov eax, 6
call fcn.00422b10
xor al, 1
push eax
mov eax, 4
call fcn.00422b38
push eax
mov eax, 5
call fcn.00422b38
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bc64
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bc3c
push eax
mov eax, dword [0x42883c]
mov eax, dword [eax]
call fcn.0040cad8
call fcn.0040a930
pop edx
pop ecx
call fcn.00423164
mov eax, dword [0x42883c]
mov eax, dword [eax]
call fcn.00408ff8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bf88
pop edx
call fcn.0040541c
jmp 0x424ce7
xor edx, edx
xor eax, eax
call fcn.0040c6a4
mov edx, dword [0x42880c]
mov dword [edx], eax
lea ecx, [ebp - 0xc0]
xor edx, edx
mov eax, 6
call fcn.00422b48
mov edx, dword [ebp - 0xc0]
mov eax, dword [0x42880c]
mov eax, dword [eax]
call fcn.0040cb70
mov eax, 7
call fcn.00422b38
sub eax, 1
jb 0x424bb3
je 0x424bd6
dec eax
je 0x424c31
jmp 0x424ce7
mov eax, dword [0x42880c]
mov eax, dword [eax]
call fcn.00408ff8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bf88
pop edx
call fcn.0040541c
jmp 0x424ce7
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ba20
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [0x42883c]
mov eax, dword [eax]
call fcn.0040cad8
call fcn.0040a930
mov edx, eax
mov eax, dword [0x42880c]
mov eax, dword [eax]
pop ecx
call fcn.0040c87c
mov eax, dword [0x42883c]
mov eax, dword [eax]
call fcn.00408ff8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bf88
pop edx
call fcn.0040541c
jmp 0x424ce7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bc64
mov edx, dword [0x42880c]
mov edx, dword [edx]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xd4], eax
fild dword [ebp - 0xd4]
fdiv dword [0x4251f0]
call fcn.0040299c
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x424c6c
call fcn.00402d14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bc3c
mov edx, dword [0x42880c]
mov edx, dword [edx]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xd8], eax
fild dword [ebp - 0xd8]
fdiv dword [0x4251f0]
call fcn.0040299c
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x424ca8
call fcn.00402d14
push eax
mov eax, dword [0x42883c]
mov eax, dword [eax]
call fcn.0040cad8
call fcn.0040a930
mov edx, eax
mov eax, dword [0x42880c]
mov eax, dword [eax]
pop ecx
call fcn.0040c7cc
mov eax, dword [0x42883c]
mov eax, dword [eax]
call fcn.00408ff8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bf88
pop edx
call fcn.0040541c
mov eax, 8
mov edx, dword [0x42a090]
test edx, edx
je 0x424cfb
cmp eax, dword [edx - 4]
jb 0x424d00
call fcn.00402d14
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xdc]
xor edx, edx
call fcn.0041d480
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040b86c
mov eax, 9
mov edx, dword [0x42a090]
test edx, edx
je 0x424d35
cmp eax, dword [edx - 4]
jb 0x424d3a
call fcn.00402d14
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xe0]
xor edx, edx
call fcn.0041d480
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040b86c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040bf50
mov ebx, eax
mov eax, 0xa
call fcn.00422b38
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.0040a54c
mov eax, 0xb
mov edx, dword [0x42a090]
test edx, edx
je 0x424d94
cmp eax, dword [edx - 4]
jb 0x424d99
call fcn.00402d14
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.0040d550
mov eax, 0xc
call fcn.00422b38
mov edx, eax
mov eax, ebx
call fcn.004053fc
mov eax, 0xd
call fcn.00422b38
mov edx, eax
cmp edx, 0xff
jbe 0x424dcf
call fcn.00402d14
mov eax, ebx
call fcn.0040545c
mov eax, 0xe
call fcn.00422b38
mov edx, eax
mov eax, ebx
call fcn.0040a580
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040bf50
mov ebx, eax
mov eax, 0xf
call fcn.00422b38
mov edx, eax
mov eax, ebx
call fcn.0040a580
mov eax, 0x10
call fcn.00422b38
mov edx, eax
mov eax, ebx
call fcn.004053fc
mov eax, 0x11
call fcn.00422b38
mov edx, eax
cmp edx, 0xff
jbe 0x424e35
call fcn.00402d14
mov eax, ebx
call fcn.0040545c
mov eax, 0x12
call fcn.00422b38
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.0040a54c
mov eax, 0x13
mov edx, dword [0x42a090]
test edx, edx
je 0x424e68
cmp eax, dword [edx - 4]
jb 0x424e6d
call fcn.00402d14
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.0040d550
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bc64
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040bc64
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040bc3c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040bc3c
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.00409d34
jmp 0x424ecb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00407c68
mov eax, 0x31
call fcn.00422b10
test al, al
je 0x424f4f
mov eax, 0x65
call fcn.00422b10
test al, al
je 0x424f1a
call fcn.004190e0
mov edx, dword [0x428824]
mov dword [edx], eax
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, 4
call fcn.00422b48
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x428824]
mov eax, dword [eax]
call fcn.0041929c
jmp 0x424f4f
xor edx, edx
xor eax, eax
call fcn.0040c6a4
mov edx, dword [0x428838]
mov dword [edx], eax
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, 4
call fcn.00422b48
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x428838]
mov eax, dword [eax]
call fcn.0040cb70
mov eax, 0x3f
call fcn.00422b10
test al, al
je 0x424fd3
mov eax, 0x66
call fcn.00422b10
test al, al
je 0x424f9e
call fcn.004190e0
mov edx, dword [0x428814]
mov dword [edx], eax
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, 5
call fcn.00422b48
mov edx, dword [ebp - 0xec]
mov eax, dword [0x428814]
mov eax, dword [eax]
call fcn.0041929c
jmp 0x424fd3
xor edx, edx
xor eax, eax
call fcn.0040c6a4
mov edx, dword [0x42881c]
mov dword [edx], eax
lea ecx, [ebp - 0xf0]
xor edx, edx
mov eax, 5
call fcn.00422b48
mov edx, dword [ebp - 0xf0]
mov eax, dword [0x42881c]
mov eax, dword [eax]
call fcn.0040cb70
mov eax, 0x70
call fcn.00422b10
test al, al
je 0x425012
call fcn.004190e0
mov edx, dword [0x428818]
mov dword [edx], eax
lea ecx, [ebp - 0xf4]
xor edx, edx
mov eax, 7
call fcn.00422b48
mov edx, dword [ebp - 0xf4]
mov eax, dword [0x428818]
mov eax, dword [eax]
call fcn.0041929c
mov eax, 0x58
call fcn.00422b10
test al, al
jne 0x42503c
mov eax, 0x59
call fcn.00422b10
test al, al
jne 0x42503c
mov eax, 0x5a
call fcn.00422b10
test al, al
je 0x42506d
call fcn.004190e0
mov edx, dword [0x428844]
mov dword [edx], eax
lea ecx, [ebp - 0xf8]
xor edx, edx
mov eax, 8
call fcn.00422b48
mov edx, dword [ebp - 0xf8]
mov eax, dword [0x428844]
mov eax, dword [eax]
call fcn.0041929c
mov eax, 0x1d
call fcn.00422b10
test al, al
je 0x4250ac
call fcn.004190e0
mov edx, dword [0x428888]
mov dword [edx], eax
lea ecx, [ebp - 0xfc]
xor edx, edx
mov eax, 9
call fcn.00422b48
mov edx, dword [ebp - 0xfc]
mov eax, dword [0x428888]
mov eax, dword [eax]
call fcn.0041929c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4250ee
lea eax, [ebp - 0xfc]
mov edx, 9
call fcn.004036b8
lea eax, [ebp - 0xc0]
mov edx, 0x25
call fcn.004036b8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004036b8
ret