Function at 0x100663e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac0ad
mov eax, dword fs:[0]
push eax
sub esp, 0x404
mov eax, dword [0x10226180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x35c]
mov dword [0x1022943c], ecx
cmp dword [ebp + 8], 0
je 0x10066436
cmp dword [ebp + 8], 0
je 0x10066436
cmp dword [ebp + 0xc], 1
je 0x1006643d
xor al, al
jmp 0x10067dd2
cmp dword [ebp + 0xc], 1
jne 0x10067dd0
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x304]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c40a0
movzx ecx, al
test ecx, ecx
jne 0x100671e4
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x144]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c40a0
movzx ecx, al
test ecx, ecx
jne 0x100671e4
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x174]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c40a0
movzx ecx, al
test ecx, ecx
jne 0x100671e4
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x1c8]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c40a0
movzx ecx, al
test ecx, ecx
jne 0x100671e4
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x170]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c3fb0
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x1b8]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c3fb0
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x218]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c3fb0
nop
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x194]
jne 0x1006682c
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], edx
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 0x1b4]
cmp eax, dword [ebp - 0x2a4]
jb 0x10066624
ja 0x10066581
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 0x1b0]
cmp edx, dword [ebp - 0x2a8]
jbe 0x10066624
push 0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 0x234]
mov esi, dword [ecx + 0x1b0]
sub esi, eax
mov eax, dword [ecx + 0x1b4]
sbb eax, edx
push 0
push 0x3e8
push eax
push esi
call fcn.101520a0
push edx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x344], esp
push str.Dear_Knight__please_wait_this__d_seconds.
call fcn.10008f80
lea ecx, [ebp - 0x214]
push ecx
call fcn.10010a70
add esp, 0x28
mov dword [ebp - 0x26c], eax
mov edx, dword [ebp - 0x26c]
mov dword [ebp - 0x270], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x270]
call fcn.10008c60
push eax
push 0
push 0xffc5d1bd
mov ecx, dword [0x10229c40]
call fcn.100c5f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.10008ea0
nop
xor al, al
jmp 0x10067dd2
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, 0xea60
adc edx, 0
mov ecx, dword [ebp - 0x234]
mov dword [ecx + 0x1b0], eax
mov dword [ecx + 0x1b4], edx
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x1b8]
push eax
lea ecx, [ebp - 0x1f8]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c8c70
mov dword [ebp - 0x274], eax
mov edx, dword [ebp - 0x274]
mov dword [ebp - 0x278], edx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x278]
call fcn.10008c60
push eax
lea ecx, [ebp - 0x2c]
call fcn.10008f80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1f8]
call fcn.10008ea0
nop
push str.Please_check_the_characters_you_entered
lea ecx, [ebp - 0x50]
call fcn.10008f80
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.10008c10
movzx eax, al
test eax, eax
jne 0x10066706
lea ecx, [ebp - 0x2c]
call fcn.10008c40
cmp eax, 0x14
jne 0x10066706
lea ecx, [ebp - 0x2c]
call fcn.10008c40
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x368], esp
lea edx, [ebp - 0x2c]
push edx
call fcn.10009070
mov ecx, dword [0x10229c40]
call fcn.1009c020
mov byte [ebp - 0x23d], al
movzx eax, byte [ebp - 0x23d]
test eax, eax
jne 0x10066751
push 0
lea ecx, [ebp - 0x50]
call fcn.10008c60
push eax
push 0
push 0xffc5d1bd
mov ecx, dword [0x10229c40]
call fcn.100c5f80
nop
mov byte [ebp - 0x23e], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x50]
call fcn.10008ea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10008ea0
mov al, byte [ebp - 0x23e]
jmp 0x10067dd2
push 4
push 0
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10008b90
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push 4
lea edx, [ebp - 0xc0]
push edx
lea ecx, [ebp - 0x2c]
call fcn.10008b90
mov byte [ebp - 4], 6
push 0x59
lea ecx, [ebp - 0x3c8]
call fcn.10060810
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3c8]
call fcn.10064760
lea eax, [ebp - 0xc0]
push eax
push 0xa
push 0
lea ecx, [ebp - 0x88]
push ecx
call fcn.100646c0
add esp, 0xc
push eax
push 4
lea ecx, [ebp - 0x3c8]
call fcn.10018540
mov ecx, eax
call fcn.1002c4f0
mov ecx, eax
call fcn.10023d90
lea edx, [ebp - 0x3c8]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c3060
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c8]
call fcn.100186e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc0]
call fcn.10008ea0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x88]
call fcn.10008ea0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x50]
call fcn.10008ea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10008ea0
nop
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x184]
jne 0x1006684e
mov ecx, dword [ebp - 0x234]
call fcn.10068f80
nop
jmp 0x100671df
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x18c]
jne 0x100668d4
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp - 0x234]
mov eax, dword [ecx + 0x120]
cmp eax, dword [edx + 0x124]
jge 0x100668cf
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x120]
add edx, 1
mov eax, dword [ebp - 0x234]
mov dword [eax + 0x120], edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x33c], esp
push 0x101d0f93
call fcn.10008f80
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x128]
push edx
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x120]
push ecx
mov ecx, dword [ebp - 0x234]
call fcn.10069910
nop
jmp 0x100671df
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x190]
jne 0x1006694f
mov ecx, dword [ebp - 0x234]
cmp dword [ecx + 0x120], 1
jle 0x1006694a
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x120]
sub eax, 1
mov ecx, dword [ebp - 0x234]
mov dword [ecx + 0x120], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x338], esp
push 0x101d0f9d
call fcn.10008f80
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x128]
push eax
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x120]
push edx
mov ecx, dword [ebp - 0x234]
call fcn.10069910
nop
jmp 0x100671df
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x360]
jne 0x10066a07
mov edx, dword [ebp - 0x234]
mov dword [edx + 0x120], 1
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x218]
push ecx
lea edx, [ebp - 0x1dc]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c8c70
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x280], eax
mov dword [ebp - 4], 8
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x334], esp
mov ecx, dword [ebp - 0x280]
call fcn.10008c60
push eax
mov ecx, esi
call fcn.10008f80
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x128]
push edx
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x120]
push ecx
mov ecx, dword [ebp - 0x234]
call fcn.10069910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
call fcn.10008ea0
nop
jmp 0x100671df
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x19c]
jne 0x10066a29
mov ecx, dword [ebp - 0x234]
call fcn.1006af90
nop
jmp 0x100671df
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x198]
jne 0x10066a4b
mov ecx, dword [ebp - 0x234]
call fcn.1006b200
nop
jmp 0x100671df
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x1a0]
jne 0x10066a7c
push 0
mov ecx, dword [ebp - 0x234]
call fcn.10069140
push 0
mov ecx, dword [ebp - 0x234]
call fcn.10068f20
nop
jmp 0x100671df
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x188]
jne 0x10066af9
mov ecx, dword [0x10229c40]
cmp dword [ecx + 0x443c], 0
je 0x10066af4
mov edx, dword [0x10229c40]
mov ecx, dword [edx + 0x443c]
add ecx, 0x74
call fcn.10008c40
test eax, eax
je 0x10066af4
push 1
push 0
push 0
mov eax, dword [0x10229c40]
mov ecx, dword [eax + 0x443c]
add ecx, 0x74
call fcn.10008c60
push eax
movzx ecx, byte [ebp - 0x264]
push ecx
push 0x101decd4
lea ecx, [ebp - 0x34]
call fcn.1006c990
mov ecx, eax
call fcn.10011360
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
jmp 0x100671df
mov dword [ebp - 0x24c], 0
jmp 0x10066b14
mov edx, dword [ebp - 0x24c]
add edx, 1
mov dword [ebp - 0x24c], edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x23c
call fcn.100216a0
cmp dword [ebp - 0x24c], eax
jae 0x10066c40
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x23c
call fcn.1006ba50
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
jne 0x10066c3b
mov dword [ebp - 0x25c], 0
jmp 0x10066b6f
mov edx, dword [ebp - 0x25c]
add edx, 1
mov dword [ebp - 0x25c], edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x23c
call fcn.100216a0
cmp dword [ebp - 0x25c], eax
jae 0x10066bb3
push 2
mov eax, dword [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x23c
call fcn.1006ba50
mov ecx, dword [eax]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c6220
nop
jmp 0x10066b60
push 7
mov edx, dword [ebp - 0x24c]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x23c
call fcn.1006ba50
mov eax, dword [eax]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c6220
mov ecx, dword [ebp - 0x234]
mov dword [ecx + 0x120], 1
mov edx, dword [ebp - 0x24c]
add edx, 1
mov eax, dword [ebp - 0x234]
mov dword [eax + 0x128], edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x330], esp
push 0x101d0f92
call fcn.10008f80
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x128]
push edx
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x120]
push ecx
mov ecx, dword [ebp - 0x234]
call fcn.10069910
nop
jmp 0x10066b05
mov dword [ebp - 0x250], 0
jmp 0x10066c5b
mov edx, dword [ebp - 0x250]
add edx, 1
mov dword [ebp - 0x250], edx
cmp dword [ebp - 0x250], 9
jge 0x10066e13
mov eax, dword [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
cmp dword [eax + 0x18], 0
je 0x10066e0e
mov ecx, dword [ebp - 0x250]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
mov edx, dword [ebp + 8]
cmp edx, dword [eax + 0x18]
jne 0x10066e0e
mov eax, dword [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
mov ecx, dword [ebp - 0x234]
mov edx, dword [eax + 4]
mov dword [ecx + 0x130], edx
mov dword [ebp - 0x238], 0
jmp 0x10066cf0
mov eax, dword [ebp - 0x238]
add eax, 1
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bb70
cmp dword [ebp - 0x238], eax
jae 0x10066e02
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax]
cmp eax, dword [edx + 0x130]
jne 0x10066dfd
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax]
mov dword [edx + 0x130], eax
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax + 4]
mov dword [edx + 0x134], eax
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax + 8]
mov dword [edx + 0x138], eax
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax + 0xc]
mov dword [edx + 0x13c], eax
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov al, byte [eax + 0x10]
mov byte [edx + 0x140], al
jmp 0x10066e02
jmp 0x10066ce1
mov ecx, dword [ebp - 0x234]
call fcn.10068030
nop
jmp 0x10066c4c
mov dword [ebp - 0x248], 0
jmp 0x10066e2e
mov ecx, dword [ebp - 0x248]
add ecx, 1
mov dword [ebp - 0x248], ecx
cmp dword [ebp - 0x248], 9
jge 0x1006704b
mov edx, dword [ebp - 0x248]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
cmp dword [eax + 0x24], 0
je 0x10067046
mov eax, dword [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x24]
jne 0x10067046
mov edx, dword [ebp - 0x248]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
mov ecx, dword [ebp - 0x234]
mov edx, dword [eax + 4]
mov dword [ecx + 0x130], edx
mov dword [ebp - 0x23c], 0
jmp 0x10066ec3
mov eax, dword [ebp - 0x23c]
add eax, 1
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bb70
cmp dword [ebp - 0x23c], eax
jae 0x10066fd5
mov ecx, dword [ebp - 0x23c]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax]
cmp eax, dword [edx + 0x130]
jne 0x10066fd0
mov ecx, dword [ebp - 0x23c]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax]
mov dword [edx + 0x130], eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax + 4]
mov dword [edx + 0x134], eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax + 8]
mov dword [edx + 0x138], eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov eax, dword [eax + 0xc]
mov dword [edx + 0x13c], eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov edx, dword [ebp - 0x234]
mov al, byte [eax + 0x10]
mov byte [edx + 0x140], al
jmp 0x10066fd5
jmp 0x10066eb4
push 0x13
push 0xe9
lea ecx, [ebp - 0x3ec]
call fcn.10018630
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x134]
push edx
push 0xb
lea ecx, [ebp - 0x3ec]
call fcn.10018540
mov ecx, eax
call fcn.1002c4f0
lea eax, [ebp - 0x3ec]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c3060
nop
mov byte [ebp - 0x23f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ec]
call fcn.100186e0
mov al, byte [ebp - 0x23f]
jmp 0x10067dd2
jmp 0x10066e1f
mov dword [ebp - 0x254], 0
jmp 0x10067066
mov ecx, dword [ebp - 0x254]
add ecx, 1
mov dword [ebp - 0x254], ecx
cmp dword [ebp - 0x254], 9
jge 0x100671cf
mov edx, dword [ebp - 0x254]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
cmp dword [eax + 0x1c], 0
je 0x100671ca
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x1c]
jne 0x100671ca
mov edx, dword [ebp - 0x254]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x258
call fcn.100513a0
mov ecx, dword [ebp - 0x234]
mov edx, dword [eax + 4]
mov dword [ecx + 0x130], edx
mov eax, dword [ebp - 0x234]
cmp dword [eax + 0x130], 0
je 0x100671ca
mov dword [ebp - 0x244], 0
jmp 0x1006710e
mov ecx, dword [ebp - 0x244]
add ecx, 1
mov dword [ebp - 0x244], ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bb70
cmp dword [ebp - 0x244], eax
jae 0x100671ca
mov edx, dword [ebp - 0x244]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov ecx, dword [ebp - 0x234]
mov edx, dword [eax]
cmp edx, dword [ecx + 0x130]
jne 0x100671c5
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov cl, byte [eax + 0x10]
movzx edx, cl
push edx
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x244]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x278
call fcn.1006bae0
mov eax, dword [eax + 4]
push eax
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x130]
push edx
mov ecx, dword [ebp - 0x234]
call fcn.1006a6e0
nop
jmp 0x100671ca
jmp 0x100670ff
jmp 0x10067057
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x234]
call fcn.1006ad60
nop
jmp 0x10067dd0
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x1cc]
jne 0x1006722f
push 1
mov ecx, dword [ebp - 0x234]
call fcn.10068f20
push 0
mov ecx, dword [ebp - 0x234]
call fcn.10069140
push 0
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x1c8]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c4070
nop
jmp 0x10067dd0
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x348]
jne 0x10067251
mov ecx, dword [ebp - 0x234]
call fcn.10067e70
nop
jmp 0x10067dd0
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x17c]
jne 0x10067273
mov ecx, dword [ebp - 0x234]
call fcn.1006b050
nop
jmp 0x10067dd0
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x180]
jne 0x100672a4
push 0
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x174]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c4070
nop
jmp 0x10067dd0
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x148]
jne 0x10067576
mov eax, dword [ebp - 0x234]
cmp dword [eax + 0x170], 0
jne 0x100672cf
xor al, al
jmp 0x10067dd2
mov ecx, dword [ebp - 0x234]
cmp dword [ecx + 0x12c], 0
jne 0x100672ee
mov edx, dword [ebp - 0x234]
mov dword [edx + 0x12c], 1
push 0xe9
lea ecx, [ebp - 0x3a4]
call fcn.10060810
mov dword [ebp - 4], 0xa
push 0xa8
lea ecx, [ebp - 0x3a4]
call fcn.10018540
lea ecx, [ebp - 0x3a4]
call fcn.10023d70
nop
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x170]
push ecx
lea edx, [ebp - 0x1c0]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c8c70
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x288], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x288]
call fcn.10008c60
push eax
lea ecx, [ebp - 0x6c]
call fcn.10008f80
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c0]
call fcn.10008ea0
nop
lea ecx, [ebp - 0x6c]
call fcn.10008c10
movzx ecx, al
test ecx, ecx
je 0x100673c2
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx + 0x12c]
push eax
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x130]
push edx
push 1
lea ecx, [ebp - 0x3a4]
call fcn.10018540
mov ecx, eax
call fcn.1002c4f0
mov ecx, eax
call fcn.10018540
nop
jmp 0x10067426
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x1a4]
call fcn.10009070
mov dword [ebp - 0x28c], eax
mov ecx, dword [ebp - 0x28c]
mov dword [ebp - 0x290], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x290]
push edx
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x130]
push ecx
push 3
lea ecx, [ebp - 0x3a4]
call fcn.10018540
mov ecx, eax
call fcn.1002c4f0
mov ecx, eax
call fcn.10023d90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a4]
call fcn.10008ea0
nop
lea edx, [ebp - 0x3a4]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c3060
push 0
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x144]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c4070
push 2
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x148]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c6220
push 2
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x14c]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c6220
mov eax, dword [ebp - 0x234]
mov dword [eax + 0x12c], 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x32c], esp
mov dword [ebp - 0x294], ecx
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x12c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x320], esp
push 0x101decec
call fcn.10008f80
mov ecx, dword [ebp - 0x294]
push ecx
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x358], eax
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x16c]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c3940
nop
push 0x101d0f9e
lea ecx, [ebp - 0xa4]
call fcn.10008f80
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x170]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c8cb0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa4]
call fcn.10008ea0
nop
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x170]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c3fb0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6c]
call fcn.10008ea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a4]
call fcn.100186e0
nop
jmp 0x10067dd0
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x164]
jne 0x1006782b
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x12c]
add eax, 1
mov ecx, dword [ebp - 0x234]
mov dword [ecx + 0x12c], eax
mov edx, dword [ebp - 0x234]
cmp dword [edx + 0x12c], 0x1c
jle 0x100675c5
mov eax, dword [ebp - 0x234]
mov dword [eax + 0x12c], 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x324], esp
mov dword [ebp - 0x298], ecx
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x12c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x328], esp
push 0x101decdc
call fcn.10008f80
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x340], eax
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x16c]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c3940
nop
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x348], esp
mov dword [ebp - 0x2e8], ecx
push 0x2e
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x12c]
push eax
lea ecx, [ebp - 0x188]
push ecx
mov edx, dword [0x10229c40]
mov ecx, dword [edx + 0x43d4]
call fcn.101169c0
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp - 0x2a0]
call fcn.10008c60
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x34c], esp
movzx ecx, byte [ebp - 0x25d]
push ecx
push 0x101dece0
lea ecx, [ebp - 0xd8]
call fcn.1002c950
mov ecx, eax
call fcn.100112e0
push eax
mov ecx, esi
call fcn.10008f80
mov edx, dword [ebp - 0x2e8]
push edx
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x15c]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c3940
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.10008ea0
nop
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx + 0x140]
cmp eax, 1
jne 0x1006779b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x354], esp
mov dword [ebp - 0x2e4], ecx
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x234]
mov ecx, dword [edx + 0x12c]
imul ecx, dword [eax + 0x138]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x35c], esp
movzx edx, byte [ebp - 0x25e]
push edx
push 0x101ded2c
lea ecx, [ebp - 0x118]
call fcn.1006ca30
mov ecx, eax
call fcn.1003f7c0
push eax
mov ecx, esi
call fcn.10008f80
mov eax, dword [ebp - 0x2e4]
push eax
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x160]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c3940
nop
jmp 0x10067826
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x364], esp
mov dword [ebp - 0x2e0], eax
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp - 0x234]
mov eax, dword [ecx + 0x12c]
imul eax, dword [edx + 0x138]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x36c], esp
movzx ecx, byte [ebp - 0x25f]
push ecx
push 0x101ded3c
lea ecx, [ebp - 0x108]
call fcn.1006cbc0
mov ecx, eax
call fcn.1003f7c0
push eax
mov ecx, esi
call fcn.10008f80
mov edx, dword [ebp - 0x2e0]
push edx
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x160]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c3940
nop
jmp 0x10067dd0
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x168]
jne 0x10067b49
mov ecx, dword [ebp - 0x234]
cmp dword [ecx + 0x12c], 1
jle 0x1006786c
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x12c]
sub eax, 1
mov ecx, dword [ebp - 0x234]
mov dword [ecx + 0x12c], eax
jmp 0x100678e3
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x374], esp
push str.Dear_Knight__The_number_of_items_must_be_more_than_0.
call fcn.10008f80
lea edx, [ebp - 0x16c]
push edx
call fcn.10010a70
add esp, 0x20
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 4], 0x11
mov ecx, dword [ebp - 0x2d8]
call fcn.10008c60
push eax
push 0
push 0xffc5d1bd
mov ecx, dword [0x10229c40]
call fcn.100c5f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.10008ea0
nop
xor al, al
jmp 0x10067dd2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x378], esp
mov dword [ebp - 0x2d4], ecx
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x12c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x37c], esp
push 0x101ded28
call fcn.10008f80
mov ecx, dword [ebp - 0x2d4]
push ecx
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x380], eax
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x16c]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c3940
nop
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2ec], esp
mov dword [ebp - 0x2cc], ecx
push 0x2e
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x12c]
push eax
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [0x10229c40]
mov ecx, dword [edx + 0x43d4]
call fcn.101169c0
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 4], 0x12
mov ecx, dword [ebp - 0x2d0]
call fcn.10008c60
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x2f0], esp
movzx ecx, byte [ebp - 0x260]
push ecx
push 0x101ded60
lea ecx, [ebp - 0xcc]
call fcn.1002a850
mov ecx, eax
call fcn.100112e0
push eax
mov ecx, esi
call fcn.10008f80
mov edx, dword [ebp - 0x2cc]
push edx
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x15c]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c3940
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10008ea0
nop
mov edx, dword [ebp - 0x234]
movzx eax, byte [edx + 0x140]
cmp eax, 1
jne 0x10067ab9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2f8], esp
mov dword [ebp - 0x2c8], ecx
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x234]
mov ecx, dword [edx + 0x12c]
imul ecx, dword [eax + 0x138]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x2fc], esp
movzx edx, byte [ebp - 0x261]
push edx
push 0x101ded6c
lea ecx, [ebp - 0xf8]
call fcn.1006cd50
mov ecx, eax
call fcn.1003f7c0
push eax
mov ecx, esi
call fcn.10008f80
mov eax, dword [ebp - 0x2c8]
push eax
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x300], eax
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x160]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c3940
nop
jmp 0x10067b44
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x304], esp
mov dword [ebp - 0x2c4], eax
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp - 0x234]
mov eax, dword [ecx + 0x12c]
imul eax, dword [edx + 0x138]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x308], esp
movzx ecx, byte [ebp - 0x262]
push ecx
push 0x101ded4c
lea ecx, [ebp - 0xe8]
call fcn.1006cee0
mov ecx, eax
call fcn.1003f7c0
push eax
mov ecx, esi
call fcn.10008f80
mov edx, dword [ebp - 0x2c4]
push edx
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x160]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c3940
nop
jmp 0x10067dd0
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x14c]
jne 0x10067c22
push 0
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0x144]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c4070
push 2
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x148]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c6220
push 2
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x14c]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c6220
mov ecx, dword [ebp - 0x234]
mov dword [ecx + 0x12c], 1
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0x310], esp
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x12c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x314], esp
push 0x101ded5c
call fcn.10008f80
mov edx, dword [ebp - 0x2c0]
push edx
call fcn.10010a70
add esp, 0x24
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x16c]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c3940
nop
jmp 0x10067dd0
mov dword [ebp - 0x258], 0
jmp 0x10067c3d
mov edx, dword [ebp - 0x258]
add edx, 1
mov dword [ebp - 0x258], edx
cmp dword [ebp - 0x258], 0x12
jge 0x10067dd0
mov eax, dword [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 0x298
call fcn.100513a0
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x1c]
jne 0x10067dcb
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 0x234]
sub eax, dword [ecx + 0x1a8]
sbb edx, dword [ecx + 0x1ac]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], edx
cmp dword [ebp - 0x2ac], 0
ja 0x10067d3e
jb 0x10067cae
cmp dword [ebp - 0x2b0], 5
ja 0x10067d3e
push 0xa30000
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x31c], esp
movzx edx, byte [ebp - 0x263]
push edx
push str.You_must_wait_5_seconds_
lea ecx, [ebp - 0x230]
call fcn.1006d070
mov ecx, eax
call fcn.10067df0
push eax
mov ecx, esi
call fcn.10008f80
lea eax, [ebp - 0x134]
push eax
call fcn.10010a70
add esp, 0x20
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2b8], ecx
mov dword [ebp - 4], 0x13
mov ecx, dword [ebp - 0x2b8]
call fcn.10008c60
push eax
mov ecx, dword [0x10229c40]
call fcn.100c5ea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.10008ea0
nop
xor al, al
jmp 0x10067dd2
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 0x234]
mov dword [ecx + 0x1a8], eax
mov dword [ecx + 0x1ac], edx
push 0xd4
push 0xe9
lea ecx, [ebp - 0x410]
call fcn.10018630
mov dword [ebp - 4], 0x14
mov edx, dword [ebp - 0x258]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 0x298
call fcn.100513a0
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [eax + 8]
push edx
push 0
lea ecx, [ebp - 0x410]
call fcn.10018540
mov ecx, eax
call fcn.10064740
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c3060
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.100186e0
nop
jmp 0x10067c2e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10150c60
mov esp, ebp
pop ebp
ret 8