Function at 0x413310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4702a1
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x493120]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x2a0], esi
fld qword [0x4783a8]
fstp qword [ebp - 0x2d0]
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x29c], ebx
call fcn.0042c696
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x413381
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x278], eax
mov dword [ebp - 4], esi
mov byte [ebp - 4], 1
call fcn.0042c696
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4133b4
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x264], eax
mov ecx, dword [ebx + 4]
push ecx
lea edx, [ebp - 0x264]
push 0x476b68
push edx
mov byte [ebp - 4], 2
call fcn.00403be0
add esp, 0xc
cmp dword [ebx + 0x24], 1
jne 0x41341c
mov eax, dword [ebp - 0x264]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x258], esp
mov esi, esp
push eax
call fcn.00401e10
fld qword [0x4783a0]
add esp, 4
add eax, 0x10
sub esp, 8
fstp qword [esp]
mov dword [esi], eax
call fcn.0041ae50
add esp, 0xc
mov eax, dword [ebx + 0x24]
mov edi, dword [ebp - 0x264]
push eax
push ecx
add edi, 0xfffffff0
mov dword [ebp - 0x258], esp
mov esi, esp
push edi
call fcn.00401e10
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov ecx, dword [ebx + 0x14]
lea eax, [ebx + 0x10]
push ecx
mov dword [ebp - 0x26c], eax
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [ebp - 0x270], esp
mov esi, esp
push eax
mov byte [ebp - 4], 3
call fcn.00401e10
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov eax, dword [ebx + 8]
push 0
push ecx
sub eax, 0x10
mov dword [ebp - 0x268], esp
mov esi, esp
push eax
mov byte [ebp - 4], 4
call fcn.00401e10
add eax, 0x10
lea edx, [ebp - 0x3c4]
add esp, 4
mov dword [esi], eax
push edx
mov byte [ebp - 4], 2
call fcn.004111e0
add esp, 0x1c
mov dword [ebp - 0x234], 0xf
mov dword [ebp - 0x238], 0
mov byte [ebp - 0x248], 0
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 6
call fcn.00407ea0
mov eax, dword [ebp - 0x26c]
mov eax, dword [eax]
lea ecx, [ebp - 0x450]
push 3
mov dword [ebp - 0x454], ecx
push eax
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 7
call fcn.00401730
mov edx, dword [ebp - 0x454]
mov eax, edx
mov byte [ebp - 4], 8
mov dword [ebp - 0x280], 0xf
mov dword [ebp - 0x284], 0
mov byte [ebp - 0x294], 0
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413520
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x298]
call fcn.00403b00
mov eax, dword [ebp - 0x294]
mov esi, 0x10
mov byte [ebp - 4], 9
cmp dword [ebp - 0x280], esi
jae 0x413553
lea eax, [ebp - 0x294]
push eax
push str.DownloadComplete
call fcn.00421250
add esp, 8
cmp dword [ebp - 0x280], esi
jb 0x413578
mov edx, dword [ebp - 0x294]
push edx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x454]
xor esi, esi
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x280], 0xf
mov dword [ebp - 0x284], esi
mov byte [ebp - 0x294], 0
mov byte [ebp - 4], 7
cmp eax, ecx
je 0x4135ae
push eax
call fcn.0044f479
add esp, 4
lea edx, [ebp - 0x2c8]
push 1
push edx
call fcn.0041ee10
add esp, 8
mov ecx, dword [ebp - 0x3b4]
sub ecx, dword [ebp - 0x3b8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ebp - 4], 0xa
jne 0x4135e9
call fcn.0044fe08
mov ecx, dword [ebp - 0x3b8]
push 0xffffffffffffffff
push esi
push ecx
lea ecx, [ebp - 0x24c]
call fcn.004039d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x258], esp
push 1
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], esi
push 0x478238
mov byte [ecx + 4], 0
call fcn.00403b00
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x270], esp
push 0xffffffffffffffff
push esi
lea edx, [ebp - 0x24c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], esi
push edx
mov byte [ebp - 4], 0xb
mov byte [ecx + 4], 0
call fcn.004039d0
lea eax, [ebp - 0x294]
push eax
mov byte [ebp - 4], 0xa
call fcn.00410fc0
add esp, 0x3c
push eax
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0xc
call fcn.0040fec0
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0xa
call fcn.00408160
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x3a8], 0x3c
call fcn.00443d55
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 0x3a4], 0x140
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x394], ecx
cmp dword [ebx + 4], esi
je 0x4136cf
mov dword [ebp - 0x38c], esi
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ecx]
mov dword [ebp - 0x388], esi
mov dword [ebp - 0x380], 0x47837c
mov eax, dword [edx - 0xc]
push 3
add eax, 0xfffffffd
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.0040a2c0
push 0x478374
mov ebx, 1
push eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x2a0], ebx
call fcn.00409870
mov esi, dword [ebp - 0x26c]
add esp, 8
test al, al
je 0x413760
mov ecx, dword [esi]
mov eax, dword [ecx - 0xc]
push 3
add eax, 0xfffffffd
push eax
lea edx, [ebp - 0x254]
push edx
mov ecx, esi
call fcn.0040a2c0
push 0x47836c
mov ebx, 3
push eax
mov dword [ebp - 0x2a0], ebx
call fcn.00409870
add esp, 8
mov byte [ebp - 0x24d], 1
test al, al
jne 0x413767
mov byte [ebp - 0x24d], 0
test bl, 2
je 0x413797
mov eax, dword [ebp - 0x254]
and ebx, 0xfffffffd
add eax, 0xfffffff0
mov dword [ebp - 0x2a0], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413797
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xa
test bl, 1
je 0x4137ce
mov eax, dword [ebp - 0x2a4]
and ebx, 0xfffffffe
add eax, 0xfffffff0
mov dword [ebp - 0x2a0], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4137ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp - 0x24d], 0
je 0x4138bf
mov eax, dword [esi]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [ebp - 0x2c4]
push 0x478368
mov ecx, esi
call fcn.004047a0
mov eax, dword [ebp - 0x2c8]
add eax, 0xfffffff0
mov byte [ebp - 4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413829
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x2e8]
call fcn.00408160
cmp dword [ebp - 0x234], 0x10
jb 0x41384c
mov ecx, dword [ebp - 0x248]
push ecx
call fcn.0042c1ba
add esp, 4
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x234], 0xf
mov dword [ebp - 0x238], 0
mov byte [ebp - 0x248], 0
call fcn.00408160
mov byte [ebp - 4], 1
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x41388f
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4138b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x414db8
fld qword [0x478360]
mov ecx, dword [ebp - 0x29c]
fcomp qword [ecx + 0x30]
fnstsw ax
test ah, 0x41
jp 0x413910
mov edx, dword [esi]
mov eax, dword [edx - 0xc]
push 3
add eax, 0xfffffffd
push eax
lea eax, [ebp - 0x254]
push eax
mov ecx, esi
call fcn.0040a2c0
push 0x47836c
or ebx, 8
push eax
mov dword [ebp - 0x2a0], ebx
call fcn.004097b0
add esp, 8
mov byte [ebp - 0x24d], 1
test al, al
jne 0x413917
mov byte [ebp - 0x24d], 0
test bl, 8
je 0x413947
mov eax, dword [ebp - 0x254]
and ebx, 0xfffffff7
add eax, 0xfffffff0
mov dword [ebp - 0x2a0], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413947
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp - 0x24d], 0
mov dword [ebp - 0x39c], 0x47711c
jne 0x413964
mov dword [ebp - 0x39c], str.open
mov ecx, dword [ebp - 0x2d8]
sub ecx, dword [ebp - 0x2dc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 2
ja 0x41398d
call fcn.0044fe08
mov ecx, dword [ebp - 0x2dc]
add ecx, 0x38
mov edi, 0x10
cmp dword [ecx + 0x18], edi
jb 0x4139a5
mov edx, dword [ecx + 4]
jmp 0x4139a8
lea edx, [ecx + 4]
mov eax, dword [ecx + 0x14]
push ecx
add eax, edx
push eax
lea ecx, [ebp - 0x25c]
call fcn.00409950
mov ecx, dword [ebp - 0x2d8]
sub ecx, dword [ebp - 0x2dc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
ja 0x4139e3
call fcn.0044fe08
mov eax, dword [ebp - 0x2dc]
add eax, 0x38
cmp dword [eax + 0x18], edi
jb 0x4139f6
mov ecx, dword [eax + 4]
jmp 0x4139f9
lea ecx, [eax + 4]
push eax
push ecx
lea ecx, [ebp - 0x274]
call fcn.00409950
mov edx, dword [ebp - 0x258]
mov eax, dword [ebp - 0x258]
push edx
mov edx, dword [ebp - 0x270]
xor ecx, ecx
push eax
mov eax, dword [ebp - 0x274]
mov word [ebp - 0x22c], cx
mov ecx, dword [ebp - 0x25c]
push ecx
push edx
push eax
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x21c], 0
call fcn.0040aea0
mov edi, 8
cmp dword [ebp - 0x218], edi
jb 0x413a6c
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x398], ecx
jmp 0x413a78
lea edx, [ebp - 0x22c]
mov dword [ebp - 0x398], edx
push ecx
mov ecx, esp
mov dword [ebp - 0x258], esp
push 0x476a05
mov byte [ebp - 4], 0xf
call fcn.00403d60
mov eax, dword [ebp - 0x22c]
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x218], edi
jae 0x413aa7
lea eax, [ebp - 0x22c]
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call fcn.004047a0
mov byte [ebp - 4], 0xf
call fcn.00420ba0
add esp, 8
test al, al
je 0x414159
push str._param
lea ecx, [ebp - 0x254]
call fcn.00403d60
push str.ShellExecuteEx
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 0x11
call fcn.00403d60
mov eax, dword [esi]
lea ecx, [ebp - 0x368]
push 3
mov dword [ebp - 0x36c], ecx
push eax
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x12
call fcn.00401730
mov edx, dword [ebp - 0x36c]
mov eax, edx
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2a8], 0xf
mov dword [ebp - 0x2ac], 0
mov byte [ebp - 0x2bc], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413b38
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x2c0]
call fcn.00403b00
cmp dword [ebp - 0x218], 8
mov eax, dword [ebp - 0x22c]
mov byte [ebp - 4], 0x14
jae 0x413b67
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x258]
call fcn.004047a0
push eax
lea edx, [ebp - 0x2a4]
push edx
lea eax, [ebp - 0x270]
push eax
mov byte [ebp - 4], 0x15
call fcn.0040a6d0
add esp, 0xc
lea ecx, [ebp - 0x254]
push ecx
push eax
lea edx, [ebp - 0x268]
push edx
mov byte [ebp - 4], 0x16
call fcn.0040a6d0
add esp, 0xc
mov edi, dword [ebp - 0x29c]
lea ecx, [edi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x27c]
mov bl, 0x17
push eax
mov byte [ebp - 4], bl
call fcn.0040a6d0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x450]
push 3
mov dword [ebp - 0x454], ecx
push eax
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x18
call fcn.00401730
mov edx, dword [ebp - 0x454]
mov eax, edx
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x280], 0xf
mov dword [ebp - 0x284], 0
mov byte [ebp - 0x294], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413c12
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x298]
call fcn.00403b00
mov ecx, dword [ebp - 0x2bc]
mov esi, 0x10
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x2a8], esi
jae 0x413c45
lea ecx, [ebp - 0x2bc]
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x280], esi
jae 0x413c59
lea eax, [ebp - 0x294]
push ecx
push eax
call fcn.00421250
add esp, 8
cmp dword [ebp - 0x280], esi
jb 0x413c7a
mov edx, dword [ebp - 0x294]
push edx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x454]
lea ecx, [ebp - 0x450]
mov esi, 0xf
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x284], 0
mov byte [ebp - 0x294], 0
cmp eax, ecx
je 0x413caf
push eax
call fcn.0044f479
add esp, 4
mov eax, dword [ebp - 0x27c]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413cd4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x16
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413cfa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x15
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d20
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x258]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x2a8], 0x10
jb 0x413d5e
mov ecx, dword [ebp - 0x2bc]
push ecx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x36c]
lea edx, [ebp - 0x368]
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2ac], 0
mov byte [ebp - 0x2bc], 0
cmp eax, edx
je 0x413d8e
push eax
call fcn.0044f479
add esp, 4
mov eax, dword [ebp - 0x2a4]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413db4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413dda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x3a8]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x413f8b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp dword [edi + 4], 0
jne 0x413e04
push 0x3e8
jmp 0x413e1c
cmp dword [edi + 0x24], 0
jne 0x413e17
mov eax, dword [edi + 0x28]
mov ecx, dword [ebp - 0x370]
push eax
push ecx
jmp 0x413e23
push 0x493e0
mov edx, dword [ebp - 0x370]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call esi
mov ecx, dword [ebp - 0x370]
lea eax, [ebp - 0x260]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x413f0f
call esi
mov edx, dword [ebp - 0x26c]
mov eax, dword [edx]
lea ecx, [ebp - 0x368]
push 3
mov dword [ebp - 0x36c], ecx
push eax
lea ecx, [ebp - 0x36c]
call fcn.00401730
mov edx, dword [ebp - 0x36c]
push edx
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x1b
call fcn.00404080
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x1c
jb 0x413e90
mov eax, dword [eax + 4]
jmp 0x413e93
add eax, 4
push eax
push str.Error_GetExitCodeProcess
call fcn.00421250
add esp, 8
lea ecx, [ebp - 0x2c0]
call fcn.00402fb0
mov eax, dword [ebp - 0x36c]
lea ecx, [ebp - 0x368]
cmp eax, ecx
je 0x413ec5
push eax
call fcn.0044f479
add esp, 4
lea ecx, [ebp - 0x254]
call fcn.004027f0
mov edx, dword [ebp - 0x260]
push edx
lea eax, [ebp - 0x254]
push 0x476b68
push eax
mov byte [ebp - 4], 0x1d
call fcn.00403be0
add esp, 0xc
push str._99
lea ecx, [ebp - 0x264]
call fcn.00403c00
lea ecx, [ebp - 0x254]
call fcn.004098d0
jmp 0x4143ef
push 0x476b64
lea ecx, [ebp - 0x264]
call fcn.00403c00
lea ecx, [ebp - 0x26c]
call fcn.004027f0
mov ecx, dword [ebp - 0x260]
push ecx
lea edx, [ebp - 0x26c]
push 0x476b68
push edx
mov byte [ebp - 4], 0x1e
call fcn.00403be0
mov eax, dword [ebp - 0x26c]
mov ecx, dword [eax - 0xc]
add esp, 0xc
push ecx
push eax
lea ecx, [ebp - 0x264]
call fcn.004033a0
fild dword [ebp - 0x260]
mov eax, dword [ebp - 0x260]
test eax, eax
jge 0x413f75
fadd qword [0x476b50]
lea ecx, [ebp - 0x26c]
fstp qword [ebp - 0x2d0]
call fcn.004098d0
jmp 0x4143ef
mov ecx, dword [ebp - 0x26c]
mov eax, dword [ecx]
push 3
lea edx, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x454], edx
call fcn.00401730
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x1f
call fcn.00404080
mov esi, eax
cmp dword [ebp - 0x218], 8
mov eax, dword [ebp - 0x22c]
mov byte [ebp - 4], 0x20
jae 0x413fde
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x270]
call fcn.004047a0
push eax
lea ecx, [ebp - 0x258]
push str.Error_ShellExecuteEx
mov bl, 0x21
push ecx
mov byte [ebp - 4], bl
call fcn.0040a870
add esp, 0xc
mov eax, dword [eax]
push 3
lea edx, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x36c], edx
call fcn.00401730
mov eax, dword [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x23
call fcn.00404080
mov edi, 0x10
mov byte [ebp - 4], 0x24
cmp dword [esi + 0x18], edi
jb 0x41404d
mov ecx, dword [esi + 4]
jmp 0x414050
lea ecx, [esi + 4]
cmp dword [eax + 0x18], edi
jb 0x41405a
mov eax, dword [eax + 4]
jmp 0x41405d
add eax, 4
push ecx
push eax
call fcn.00421250
add esp, 8
cmp dword [ebp - 0x2a8], edi
jb 0x41407e
mov ecx, dword [ebp - 0x2bc]
push ecx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x36c]
xor edi, edi
lea edx, [ebp - 0x368]
mov esi, 0xf
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2ac], edi
mov byte [ebp - 0x2bc], 0
cmp eax, edx
je 0x4140b1
push eax
call fcn.0044f479
add esp, 4
mov eax, dword [ebp - 0x258]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4140d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x20
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4140fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x280], 0x10
jb 0x414114
mov ecx, dword [ebp - 0x294]
push ecx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x454]
lea edx, [ebp - 0x450]
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x284], edi
mov byte [ebp - 0x294], 0
mov byte [ebp - 4], 0xf
cmp eax, edx
je 0x414144
push eax
call fcn.0044f479
add esp, 4
push str._99
lea ecx, [ebp - 0x264]
call fcn.00403c00
jmp 0x4143ef
mov eax, dword [esi]
lea ecx, [ebp - 0x450]
push 3
mov dword [ebp - 0x454], ecx
push eax
lea ecx, [ebp - 0x454]
call fcn.00401730
mov edx, dword [ebp - 0x454]
mov edi, 0xf
mov eax, edx
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x280], edi
mov dword [ebp - 0x284], 0
mov byte [ebp - 0x294], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4141a0
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x298]
call fcn.00403b00
cmp dword [ebp - 0x218], 8
mov eax, dword [ebp - 0x22c]
mov byte [ebp - 4], 0x26
jae 0x4141cf
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x270]
call fcn.004047a0
push eax
lea edx, [ebp - 0x258]
push str.Not_Exist_File_ShellExecuteEx_file:
mov bl, 0x27
push edx
mov byte [ebp - 4], bl
call fcn.0040a870
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x368]
push 3
mov dword [ebp - 0x36c], ecx
push eax
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x28
call fcn.00401730
mov edx, dword [ebp - 0x36c]
mov eax, edx
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2ac], 0
mov byte [ebp - 0x2bc], 0
lea esi, [eax + 1]
jmp 0x414240
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414240
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x2c0]
call fcn.00403b00
mov ecx, dword [ebp - 0x294]
mov esi, 0x10
mov byte [ebp - 4], 0x2a
cmp dword [ebp - 0x280], esi
jae 0x414273
lea ecx, [ebp - 0x294]
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x2a8], esi
jae 0x414287
lea eax, [ebp - 0x2bc]
push ecx
push eax
call fcn.00421250
add esp, 8
cmp dword [ebp - 0x2a8], esi
jb 0x4142a8
mov edx, dword [ebp - 0x2bc]
push edx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x36c]
lea ecx, [ebp - 0x368]
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2ac], 0
mov byte [ebp - 0x2bc], 0
cmp eax, ecx
je 0x4142d8
push eax
call fcn.0044f479
add esp, 4
mov eax, dword [ebp - 0x258]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4142fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x26
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414323
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x280], esi
jb 0x41433a
mov ecx, dword [ebp - 0x294]
push ecx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x454]
lea edx, [ebp - 0x450]
mov dword [ebp - 0x280], edi
mov dword [ebp - 0x284], 0
mov byte [ebp - 0x294], 0
mov byte [ebp - 4], 0xf
cmp eax, edx
je 0x41436e
push eax
call fcn.0044f479
add esp, 4
call fcn.0042c696
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x414388
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x29c]
mov edx, dword [ecx + 0x24]
push edx
lea eax, [ebp - 0x254]
push eax
mov byte [ebp - 4], 0x2b
call fcn.0040a950
add esp, 8
push 4
push str._99
lea ecx, [ebp - 0x264]
call fcn.004033a0
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4143ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xe
push str.End_Execute_IDexitCode___
lea ecx, [ebp - 0x254]
xor edi, edi
call fcn.00403d60
mov ebx, dword [ebp - 0x29c]
mov eax, dword [ebx + 0x10]
add ebx, 0x10
lea ecx, [ebp - 0x450]
push 3
mov dword [ebp - 0x454], ecx
push eax
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x31
call fcn.00401730
mov edx, dword [ebp - 0x454]
mov eax, edx
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x280], 0xf
mov dword [ebp - 0x284], edi
mov byte [ebp - 0x294], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414458
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x298]
call fcn.00403b00
lea edx, [ebp - 0x264]
push edx
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x268]
push ecx
mov byte [ebp - 4], 0x33
call fcn.0040a6d0
add esp, 0xc
push str._Filename:
push eax
lea edx, [ebp - 0x270]
push edx
mov byte [ebp - 4], 0x34
call fcn.0040a790
add esp, 0xc
push ebx
push eax
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 4], 0x35
call fcn.0040a6d0
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x368]
push 3
mov dword [ebp - 0x36c], ecx
push eax
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x36
call fcn.00401730
mov edx, dword [ebp - 0x36c]
mov ebx, 0xf
mov eax, edx
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2ac], edi
mov byte [ebp - 0x2bc], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414504
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x2c0]
call fcn.00403b00
mov ecx, dword [ebp - 0x294]
mov esi, 0x10
mov byte [ebp - 4], 0x38
cmp dword [ebp - 0x280], esi
jae 0x414537
lea ecx, [ebp - 0x294]
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x2a8], esi
jae 0x41454b
lea eax, [ebp - 0x2bc]
push ecx
push eax
call fcn.00421250
add esp, 8
cmp dword [ebp - 0x2a8], esi
jb 0x41456c
mov edx, dword [ebp - 0x2bc]
push edx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x36c]
lea ecx, [ebp - 0x368]
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2ac], edi
mov byte [ebp - 0x2bc], 0
cmp eax, ecx
je 0x414598
push eax
call fcn.0044f479
add esp, 4
mov eax, dword [ebp - 0x258]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x35
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4145be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x34
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4145e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x33
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41460a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x280], esi
jb 0x414621
mov ecx, dword [ebp - 0x294]
push ecx
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x454]
lea edx, [ebp - 0x450]
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], edi
mov byte [ebp - 0x294], 0
cmp eax, edx
je 0x41464d
push eax
call fcn.0044f479
add esp, 4
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xe
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414673
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x29c]
cmp dword [eax + 0x24], 1
jne 0x4146cb
mov ecx, dword [eax + 4]
push ecx
lea edx, [ebp - 0x278]
push 0x476b68
push edx
call fcn.00403be0
mov eax, dword [ebp - 0x278]
add esp, 0xc
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x258], esp
mov esi, esp
push eax
call fcn.00401e10
fld qword [ebp - 0x2d0]
add esp, 4
add eax, 0x10
sub esp, 8
fstp qword [esp]
mov dword [esi], eax
call fcn.0041ae50
add esp, 0xc
mov esi, dword [ebp - 0x264]
add esi, 0xfffffff0
push esi
call fcn.00401e10
mov ebx, dword [ebp - 0x2c4]
add eax, 0x10
add esp, 4
cmp dword [ebp - 0x218], 8
mov dword [ebx], eax
jb 0x414700
mov eax, dword [ebp - 0x22c]
push eax
call fcn.0042c1ba
add esp, 4
mov eax, dword [ebp - 0x2c8]
xor ecx, ecx
add eax, 0xfffffff0
mov word [ebp - 0x22c], cx
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x21c], edi
mov byte [ebp - 4], 7
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41473f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x2e8]
call fcn.00408160
cmp dword [ebp - 0x234], 0x10
jb 0x414762
mov ecx, dword [ebp - 0x248]
push ecx
call fcn.0042c1ba
add esp, 4
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x234], 0xf
mov dword [ebp - 0x238], edi
mov byte [ebp - 0x248], 0
call fcn.00408160
mov byte [ebp - 4], 1
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4147a1
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4147ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
jmp 0x414db8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044fc9c
mov esp, ebp
pop ebp
ret