Function at 0x6c3170
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x6c3179
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 0x18]
mov edx, dword [0x695aec]
call fcn.004081c4
xor eax, eax
push ebp
push 0x6c3fd0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 1
mov eax, ebx
call fcn.006ca0ac
mov esi, eax
cmp dword [ebx + 0x174], 0
jne 0x6c31c1
mov esi, ebx
cmp edi, 0x746774
jg 0x6c327a
je 0x6c355b
cmp edi, 0x656667
jg 0x6c3232
je 0x6c377b
cmp edi, 0x646966
jg 0x6c3218
je 0x6c3d50
sub edi, 0x6469
je 0x6c352f
sub edi, 0x630dfa
je 0x6c3385
sub edi, 0xf104
je 0x6c3581
jmp 0x6c3f93
sub edi, 0x656663
je 0x6c369e
sub edi, 2
je 0x6c3606
jmp 0x6c3f93
cmp edi, 0x6d7270
jg 0x6c325d
je 0x6c3321
sub edi, 0x667367
je 0x6c372b
sub edi, 0xfb05
je 0x6c3be8
jmp 0x6c3f93
sub edi, 0x6e6665
je 0x6c35ba
sub edi, 0x21200
je 0x6c3652
jmp 0x6c3f93
cmp edi, 0x676e6c3f
jg 0x6c32d9
je 0x6c3be8
cmp edi, 0x63657865
jg 0x6c32bc
je 0x6c37e0
sub edi, 0x776f6e
je 0x6c3a87
sub edi, 0x60f103f8
je 0x6c3c6a
sub edi, 0xe
je 0x6c3cfe
jmp 0x6c3f93
sub edi, 0x65646f63
je 0x6c3411
sub edi, 0x10b050d
je 0x6c3857
jmp 0x6c3f93
cmp edi, 0x6f6e7362
jg 0x6c3304
je 0x6c3e09
sub edi, 0x6b706c67
je 0x6c3a32
sub edi, 0x3f60202
je 0x6c392f
jmp 0x6c3f93
sub edi, 0x776f6e3f
je 0x6c3a87
sub edi, 0x1f5fd27
je 0x6c3f68
jmp 0x6c3f93
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
call fcn.004048e8
push eax
xor ecx, ecx
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
call fcn.004048e8
cmp eax, 0x10
jl 0x6c3351
mov eax, 0x10
mov edi, eax
dec edi
test edi, edi
jl 0x6c3f97
inc edi
xor esi, esi
lea edx, [ebp - 0x34]
lea eax, [esi + 1]
call fcn.00404948
mov eax, dword [ebp - 0x34]
push eax
mov ecx, esi
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
inc esi
dec edi
jne 0x6c335f
jmp 0x6c3f97
lea ecx, [ebp - 0x38]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
lea eax, [ebp - 4]
call fcn.00407ec4
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x6c33d4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x6c33d4
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406b68
mov esi, eax
test esi, esi
je 0x6c33df
sub esi, 4
mov esi, dword [esi]
lea ecx, [ebp - 4]
mov edx, esi
add edx, edx
mov eax, edi
call fcn.004e26ac
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x3c]
mov edx, 3
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
mov edx, 4
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x40]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
test esi, esi
jne 0x6c3462
mov esi, 0xc4
lea ecx, [ebp - 0x44]
mov edx, 2
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
cmp dword [ebp - 0x14], 0
jne 0x6c34da
lea ecx, [ebp - 0x48]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x48]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004e1708
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x4c]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.004e1708
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
lea eax, [ebp - 0x50]
call fcn.006a050c
mov eax, dword [ebp - 0x50]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
call sub.winmm.dll_timeGetTime
push eax
xor ecx, ecx
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
jmp 0x6c3f97
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
lea eax, [ebp - 0x54]
call fcn.004167cc
lea eax, [ebp - 0x54]
mov edx, 0x6c4030
call fcn.00407874
mov eax, dword [ebp - 0x54]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x58]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x58]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004165d0
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x5c]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x5c]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00416610
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x60]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x60]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004163bc
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x64]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x64]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
lea ecx, [ebp - 0x68]
mov edx, 2
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x68]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
lea ecx, [ebp - 0x6c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004162e8
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 4]
call fcn.004074b4
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x70]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x70]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 4]
mov edx, esi
mov eax, ebx
call fcn.006cf1a0
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x74]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x74]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
push 1
call sub.kernel32.dll_SetErrorMode
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00415fd8
test al, al
je 0x6c37d5
push 1
xor ecx, ecx
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push esi
call sub.kernel32.dll_SetErrorMode
jmp 0x6c3f97
lea ecx, [ebp - 0x78]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
lea ecx, [ebp - 0x7c]
mov edx, 2
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x7c]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004074ec
push eax
mov eax, dword [ebp - 4]
call fcn.004074ec
push eax
push 0x6c4034
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x6c3f97
lea ecx, [ebp - 0x80]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x80]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
lea ecx, [ebp - 0x84]
mov edx, 2
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x84]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
push 1
push 0
lea eax, [ebp - 0x88]
push eax
mov eax, dword [esi + 0x13c]
mov cl, 1
mov edx, dword [ebp - 4]
call fcn.006a4718
mov eax, dword [ebp - 0x88]
or ecx, 0xffffffff
mov dl, 1
call fcn.004ec300
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x6c391b
xor eax, eax
push ebp
push 0x6c3904
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
call fcn.0043fc10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6c390e
mov eax, dword [ebp - 0x24]
call fcn.004056f8
jmp 0x6c3f97
mov ecx, dword [ebp - 0x1c]
mov edx, 0x6c404c
mov eax, ebx
call fcn.006b8d74
jmp 0x6c3f97
lea ecx, [ebp - 0x8c]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x8c]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
lea ecx, [ebp - 8]
mov eax, dword [0x70b1a4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00690054
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 4]
call fcn.0041493c
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 4]
call fcn.004074b4
mov edx, dword [ebp - 4]
mov eax, 0x6c4080
call fcn.00407f10
test eax, eax
jg 0x6c39cf
mov edx, dword [ebp - 4]
mov eax, 0x6c40a0
call fcn.00407f10
test eax, eax
jg 0x6c39cf
mov edx, dword [ebp - 4]
mov eax, 0x6c40c0
call fcn.00407f10
test eax, eax
jg 0x6c39cf
mov edx, dword [ebp - 4]
mov eax, 0x6c40e4
call fcn.00407f10
test eax, eax
jle 0x6c3a0e
push 0
push 0x400
push 0
push 0x400
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00415b0c
call fcn.004087f8
call fcn.004087f8
push edx
push eax
lea eax, [ebp - 0x94]
call fcn.004159d4
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 8]
call fcn.004074b4
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0x98]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x98]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 0x14]
call fcn.004ec274
test al, al
je 0x6c3f97
push 1
xor ecx, ecx
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
jmp 0x6c3f97
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
call fcn.004189f8
fstp qword [ebp - 0x30]
wait
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x6c4108
call fcn.006a4a08
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415a90
push eax
xor ecx, ecx
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x6c4120
call fcn.006a4a08
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415a90
push eax
mov ecx, 1
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x6c4134
call fcn.006a4a08
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415a90
push eax
mov ecx, 2
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x6c4148
call fcn.006a4a08
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415a90
push eax
mov ecx, 3
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x6c415c
call fcn.006a4a08
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415a90
push eax
mov ecx, 4
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x6c4170
call fcn.006a4a08
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415a90
push eax
mov ecx, 5
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x6c4184
call fcn.006a4a08
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00415a90
push eax
mov ecx, 6
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
jmp 0x6c3f97
call sub.kernel32.dll_GetSystemDefaultLangID
mov esi, eax
and si, 0x3ff
movzx esi, si
mov edi, eax
and di, 0xfc00
movzx edi, di
shr edi, 0xa
push esi
xor ecx, ecx
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push edi
mov ecx, 1
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
and si, 0x3ff
movzx esi, si
mov edi, eax
and di, 0xfc00
movzx edi, di
shr edi, 0xa
push esi
mov ecx, 2
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
push edi
mov ecx, 3
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
jmp 0x6c3f97
lea ecx, [ebp - 0xa0]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x9c]
call fcn.0041493c
mov eax, dword [ebp - 0x9c]
mov edx, 0x6c4198
call fcn.00407b38
jne 0x6c3cac
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00404948
jmp 0x6c3ccf
lea ecx, [ebp - 0xa4]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0xa4]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.006c3054
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0xa8]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0xa8]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.006c30c8
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
lea ecx, [ebp - 0xac]
mov edx, 1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
lea ecx, [ebp - 0xb0]
mov edx, 2
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004074b4
lea ecx, [ebp - 0xb4]
mov edx, 3
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0xb4]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.006bcf94
mov esi, dword [ebp - 0x14]
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004eba88
test al, al
je 0x6c3f97
push 1
xor ecx, ecx
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
jmp 0x6c3f97
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
lea eax, [ebp - 0xc]
mov edx, 0x6c41b0
call fcn.004074b4
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 0xc]
call fcn.004fd564
mov eax, dword [ebp - 0xb8]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
lea eax, [ebp - 0xc]
mov edx, 0x6c4278
call fcn.004074b4
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0xc]
call fcn.004fd564
mov eax, dword [ebp - 0xbc]
push eax
mov ecx, 1
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
lea eax, [ebp - 0xc]
mov edx, 0x6c42d8
call fcn.004074b4
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 0xc]
call fcn.004fd564
mov eax, dword [ebp - 0xc0]
push eax
mov ecx, 2
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
lea eax, [ebp - 0xc]
mov edx, 0x6c43c0
call fcn.004074b4
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0xc]
call fcn.004fd564
mov eax, dword [ebp - 0xc4]
push eax
mov ecx, 3
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
xor edx, edx
mov eax, 0x6c4468
call fcn.00415a90
push eax
xor ecx, ecx
mov edx, 0x6c3ff0
mov eax, ebx
call fcn.006bd050
lea edx, [ebp - 0xcc]
xor eax, eax
call fcn.00404948
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
call fcn.004165d0
mov eax, dword [ebp - 0xc8]
push eax
mov ecx, 8
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
lea edx, [ebp - 0xd4]
xor eax, eax
call fcn.00404948
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xd0]
call fcn.006c3054
mov eax, dword [ebp - 0xd0]
push eax
mov ecx, 9
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
push 1
mov cl, 1
mov dl, 1
mov eax, ebx
call fcn.006c09a0
mov eax, dword [ebx + 0x31c]
test eax, eax
je 0x6c3f97
mov eax, dword [eax + 4]
push eax
xor ecx, ecx
mov edx, 0x6c4010
mov eax, ebx
call fcn.006bd088
jmp 0x6c3f97
mov byte [ebp - 0x1d], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c3fd7
lea eax, [ebp - 0xd4]
mov edx, 0x29
call fcn.00407458
lea eax, [ebp - 0x18]
mov edx, dword [0x695aec]
call fcn.0040829c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407458
ret