Function at 0x41626c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x416274
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x417a7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00403bec
mov eax, dword [ebp - 0x30]
mov edx, 0x417a90
call fcn.00401de4
jne 0x4162bc
push 1
push 0x417a98
call sub.kernel32.dll_WinExec
call fcn.00401940
lea ecx, [ebp - 0x38]
xor edx, edx
xor eax, eax
call fcn.004155f4
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00404024
mov eax, dword [ebp - 0x34]
call fcn.004040a0
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00403bec
mov eax, dword [ebp - 0x3c]
call fcn.00409484
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffdc
call fcn.00409380
mov edx, 0x41986c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x419874
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x41987c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x419884
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x41989c
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x29]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
cmp byte [ebp - 0x29], 0xf1
je 0x4163bf
mov eax, dword [ebp - 0x10]
call fcn.0040867c
xor eax, eax
call fcn.004156b8
push 0x10
push 0x417aa4
push 0x417aac
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00401940
mov eax, dword [0x41986c]
mov edx, dword [0x419870]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4163d9
call fcn.004013ec
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409380
xor eax, eax
mov al, byte [ebp - 0x2a]
inc eax
push eax
mov eax, 0x419848
mov ecx, 1
mov edx, dword [0x415254]
call fcn.0040269c
add esp, 4
xor ebx, ebx
mov bl, byte [ebp - 0x2a]
test ebx, ebx
jl 0x41643d
inc ebx
xor esi, esi
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x40]
mov eax, dword [0x419848]
test eax, eax
je 0x41642c
cmp esi, dword [eax - 4]
jb 0x416431
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416410
mov eax, 0x62
call fcn.004155e4
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x419864
mov ecx, 1
mov edx, dword [0x415334]
call fcn.0040269c
add esp, 4
dec ebx
test ebx, ebx
jl 0x41649c
inc ebx
xor esi, esi
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x44]
mov eax, dword [0x419864]
test eax, eax
je 0x41648b
cmp esi, dword [eax - 4]
jb 0x416490
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x41646f
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416594
inc ebx
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x419864]
test edx, edx
je 0x4164c2
cmp eax, dword [edx - 4]
jb 0x4164c7
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00409018
test eax, eax
jns 0x4164d8
call fcn.004013ec
mov edx, esi
shl edx, 2
add edx, 2
mov ecx, dword [0x419864]
test ecx, ecx
je 0x4164ef
cmp edx, dword [ecx - 4]
jb 0x4164f4
call fcn.004013ec
mov edx, dword [ecx + edx*4]
push edx
mov edx, esi
shl edx, 2
inc edx
mov ecx, dword [0x419864]
test ecx, ecx
je 0x41650d
cmp edx, dword [ecx - 4]
jb 0x416512
call fcn.004013ec
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.00415950
mov edx, dword [ebp - 0x48]
mov eax, dword [0x419864]
test eax, eax
je 0x41652c
cmp esi, dword [eax - 4]
jb 0x416531
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
mov eax, dword [0x419864]
test eax, eax
je 0x416547
cmp esi, dword [eax - 4]
jb 0x41654c
call fcn.004013ec
cmp dword [eax + esi*4], 0
jne 0x41658c
mov eax, dword [0x419864]
test eax, eax
je 0x416560
cmp esi, dword [eax - 4]
jb 0x416565
call fcn.004013ec
lea eax, [eax + esi*4]
mov edx, esi
shl edx, 2
add edx, 3
mov ecx, dword [0x419864]
test ecx, ecx
je 0x41657f
cmp edx, dword [ecx - 4]
jb 0x416584
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4164aa
push edi
mov eax, 0x419864
mov ecx, 1
mov edx, dword [0x415334]
call fcn.0040269c
add esp, 4
mov eax, 0x6e
call fcn.004155bc
mov byte [0x418638], al
call fcn.00403cf8
mov ebx, eax
test ebx, ebx
jle 0x41681e
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00403bec
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040904c
mov eax, dword [ebp - 8]
mov edx, 0x417afc
call fcn.00401de4
jne 0x4165fb
mov byte [0x418638], 1
mov eax, dword [ebp - 8]
mov edx, 0x417b08
call fcn.00401de4
jne 0x416611
mov byte [0x41863c], 1
mov eax, dword [ebp - 8]
mov edx, 0x417b14
call fcn.00401de4
jne 0x416646
mov eax, 0x6b
mov edx, dword [0x419848]
test edx, edx
je 0x416634
cmp eax, dword [edx - 4]
jb 0x416639
call fcn.004013ec
lea eax, [edx + eax*4]
mov edx, 0x417b20
call fcn.00401a9c
mov eax, dword [ebp - 8]
mov edx, 0x417b2c
call fcn.00401de4
jne 0x41667b
mov eax, 0x3f
mov edx, dword [0x419848]
test edx, edx
je 0x416669
cmp eax, dword [edx - 4]
jb 0x41666e
call fcn.004013ec
lea eax, [edx + eax*4]
mov edx, 0x417b20
call fcn.00401a9c
lea eax, [ebp - 0x4c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x4c]
mov edx, 0x417b38
call fcn.00401de4
jne 0x4166ea
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00403d48
mov edx, dword [ebp - 0x50]
mov eax, 0x3a
mov ecx, dword [0x419848]
test ecx, ecx
je 0x4166dd
cmp eax, dword [ecx - 4]
jb 0x4166e2
call fcn.004013ec
lea eax, [ecx + eax*4]
call fcn.00401a9c
lea eax, [ebp - 0x58]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x58]
mov edx, 0x417b44
call fcn.00401de4
jne 0x416743
mov eax, 0x6a
mov edx, dword [0x419848]
test edx, edx
je 0x416723
cmp eax, dword [edx - 4]
jb 0x416728
call fcn.004013ec
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
lea eax, [ebp - 0x5c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x5c]
mov edx, 0x417b50
call fcn.00401de4
jne 0x416784
push 0x41988c
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
lea eax, [ebp - 0x60]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x60]
mov edx, 0x417b5c
call fcn.00401de4
jne 0x416816
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.004157a0
mov edx, dword [ebp - 0x64]
mov eax, 0x1d
mov ecx, dword [0x419848]
test ecx, ecx
je 0x4167e6
cmp eax, dword [ecx - 4]
jb 0x4167eb
call fcn.004013ec
mov eax, dword [ecx + eax*4]
call fcn.00401de4
jne 0x416816
mov eax, 0x1d
mov edx, dword [0x419848]
test edx, edx
je 0x416809
cmp eax, dword [edx - 4]
jb 0x41680e
call fcn.004013ec
lea eax, [edx + eax*4]
call fcn.00401a48
inc esi
dec ebx
jne 0x4165d0
cmp byte [0x418638], 0
je 0x416852
mov eax, 0x1d
mov edx, dword [0x419848]
test edx, edx
je 0x41683b
cmp eax, dword [edx - 4]
jb 0x416840
call fcn.004013ec
cmp dword [edx + eax*4], 0
je 0x416852
mov al, 1
call fcn.004156b8
call fcn.00401940
mov eax, 0x41
mov edx, dword [0x419848]
test edx, edx
je 0x416866
cmp eax, dword [edx - 4]
jb 0x41686b
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x6c]
xor edx, edx
call fcn.0041085c
mov edx, dword [ebp - 0x6c]
mov eax, 0x419898
call fcn.00401a9c
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov edx, dword [0x419898]
call fcn.0040a7e0
cmp byte [0x418638], 0
jne 0x4168b4
push 5
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4168c2
mov eax, dword [0x4186ac]
mov eax, dword [eax]
xor edx, edx
call fcn.00405f8c
mov eax, 0x32
call fcn.004155e4
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x41983c
mov ecx, 1
mov edx, dword [0x4151f4]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416923
inc ebx
xor esi, esi
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x70]
mov eax, dword [0x41983c]
test eax, eax
je 0x416912
cmp esi, dword [eax - 4]
jb 0x416917
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4168f6
mov eax, 0x60
call fcn.004155e4
lea edi, [eax + eax*2]
push edi
mov eax, 0x419860
mov ecx, 1
mov edx, dword [0x415314]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416980
inc ebx
xor esi, esi
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x74]
mov eax, dword [0x419860]
test eax, eax
je 0x41696f
cmp esi, dword [eax - 4]
jb 0x416974
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416953
mov eax, 0x1f
call fcn.004155e4
mov edi, eax
add edi, edi
push edi
mov eax, 0x419868
mov ecx, 1
mov edx, dword [0x415354]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4169de
inc ebx
xor esi, esi
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x78]
mov eax, dword [0x419868]
test eax, eax
je 0x4169cd
cmp esi, dword [eax - 4]
jb 0x4169d2
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4169b1
mov eax, 0x36
call fcn.004155e4
mov edi, eax
shl edi, 3
push edi
mov eax, 0x419838
mov ecx, 1
mov edx, dword [0x4151d4]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416a3d
inc ebx
xor esi, esi
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x419838]
test eax, eax
je 0x416a2c
cmp esi, dword [eax - 4]
jb 0x416a31
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416a10
mov eax, 0x43
call fcn.004155e4
lea edi, [eax + eax*2]
push edi
mov eax, 0x419840
mov ecx, 1
mov edx, dword [0x415214]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416a9a
inc ebx
xor esi, esi
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x80]
mov eax, dword [0x419840]
test eax, eax
je 0x416a89
cmp esi, dword [eax - 4]
jb 0x416a8e
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416a6d
mov eax, 0x5d
call fcn.004155e4
mov edi, eax
add edi, edi
push edi
mov eax, 0x419844
mov ecx, 1
mov edx, dword [0x415234]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416afe
inc ebx
xor esi, esi
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x84]
mov eax, dword [0x419844]
test eax, eax
je 0x416aed
cmp esi, dword [eax - 4]
jb 0x416af2
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416acb
mov eax, 0x28
call fcn.004155e4
mov ebx, eax
mov eax, 0x19
call fcn.004155e4
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419834
mov ecx, 1
mov edx, dword [0x4151b4]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416b73
inc ebx
xor esi, esi
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x88]
mov eax, dword [0x419834]
test eax, eax
je 0x416b62
cmp esi, dword [eax - 4]
jb 0x416b67
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416b40
mov eax, 0x18
call fcn.004155e4
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419854
mov ecx, 1
mov edx, dword [0x4152b4]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416bda
inc ebx
xor esi, esi
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x419854]
test eax, eax
je 0x416bc9
cmp esi, dword [eax - 4]
jb 0x416bce
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416ba7
mov eax, 0x2d
call fcn.004155e4
mov edi, eax
add edi, edi
push edi
mov eax, 0x419858
mov ecx, 1
mov edx, dword [0x4152d4]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416c3e
inc ebx
xor esi, esi
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x90]
mov eax, dword [0x419858]
test eax, eax
je 0x416c2d
cmp esi, dword [eax - 4]
jb 0x416c32
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416c0b
mov eax, 0x14
call fcn.004155e4
mov edi, eax
add edi, edi
push edi
mov eax, 0x41985c
mov ecx, 1
mov edx, dword [0x4152f4]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416ca2
inc ebx
xor esi, esi
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x94]
mov eax, dword [0x41985c]
test eax, eax
je 0x416c91
cmp esi, dword [eax - 4]
jb 0x416c96
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416c6f
mov eax, 0x1a
call fcn.004155e4
mov edi, eax
shl edi, 2
push edi
mov eax, 0x419850
mov ecx, 1
mov edx, dword [0x415294]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416d07
inc ebx
xor esi, esi
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x98]
mov eax, dword [0x419850]
test eax, eax
je 0x416cf6
cmp esi, dword [eax - 4]
jb 0x416cfb
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416cd4
mov eax, 0x1a
call fcn.004155e4
mov edi, eax
mov eax, 0x39
call fcn.004155e4
imul edi, eax
lea eax, [edi + 1]
push eax
mov eax, 0x41984c
mov ecx, 1
mov edx, dword [0x415274]
call fcn.0040269c
add esp, 4
mov ebx, edi
test ebx, ebx
jle 0x416d7a
mov esi, 1
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x41984c]
test eax, eax
je 0x416d69
cmp esi, dword [eax - 4]
jb 0x416d6e
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416d47
mov eax, dword [0x41987c]
mov edx, dword [0x419880]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416d94
call fcn.004013ec
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409380
cmp byte [0x41989c], 0
je 0x416e21
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 2
call fcn.004155f4
mov eax, dword [ebp - 8]
call fcn.004094ac
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, 0x417b6c
call fcn.00405264
push dword [0x419878]
push dword [0x419874]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00415830
mov eax, dword [ebp - 0x14]
call fcn.0040867c
mov dl, 1
mov eax, dword [0x40c964]
call fcn.0040cd34
mov ebx, eax
lea eax, [ebp - 0xa0]
call fcn.004042b4
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040d1c0
mov eax, ebx
call fcn.0040145c
jmp 0x416e9a
xor ebx, ebx
mov bl, byte [ebp - 0x2b]
test ebx, ebx
jle 0x416e9a
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
call fcn.004042b4
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 8]
pop ecx
call fcn.00401cec
mov eax, dword [ebp - 8]
call fcn.004094ac
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov eax, dword [ebp - 0xac]
call fcn.00409018
mov edi, eax
mov eax, edi
cdq
push edx
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00415830
mov eax, dword [ebp - 0x14]
call fcn.0040867c
dec ebx
jne 0x416e2a
mov eax, dword [ebp - 0x10]
call fcn.0040867c
cmp dword [0x41988c], 0
je 0x416f42
mov byte [0x418634], 0xff
mov eax, 0x1a
call fcn.004155e4
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x416f2f
inc ebx
xor esi, esi
mov eax, esi
shl eax, 2
mov edx, dword [0x419850]
test edx, edx
je 0x416ede
cmp eax, dword [edx - 4]
jb 0x416ee3
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0xb0]
call fcn.0040904c
mov eax, dword [ebp - 0xb0]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [0x41988c]
call fcn.0040904c
mov eax, dword [ebp - 0xb4]
pop edx
call fcn.00401fd8
test eax, eax
jle 0x416f2b
mov eax, esi
cmp eax, 0xff
jbe 0x416f26
call fcn.004013ec
mov byte [0x418634], al
inc esi
dec ebx
jne 0x416eca
cmp byte [0x418634], 0xff
jne 0x416f42
mov eax, 0x41988c
call fcn.00401a48
mov eax, 0x1a
call fcn.004155e4
dec eax
jle 0x416f99
cmp dword [0x41988c], 0
jne 0x416f99
mov edx, dword [0x4186ac]
mov edx, dword [edx]
mov eax, dword [0x418660]
call fcn.0040dc50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405f9c
mov eax, dword [0x418660]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00406fd0
cmp byte [0x418640], 0
jne 0x416f99
mov al, 1
call fcn.004156b8
call fcn.00401940
mov eax, 0x1a
call fcn.004155e4
dec eax
jle 0x417046
cmp byte [0x418634], 0
jbe 0x417046
mov eax, 0x41988c
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
mov ecx, dword [0x419850]
test ecx, ecx
je 0x416fd6
cmp edx, dword [ecx - 4]
jb 0x416fdb
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
mov eax, 0x39
call fcn.004155e4
mov ebx, eax
test ebx, ebx
jle 0x417069
mov esi, 1
mov eax, 0x39
call fcn.004155e4
xor edx, edx
mov dl, byte [0x418634]
imul edx
add eax, esi
mov edx, dword [0x41984c]
test edx, edx
je 0x41701d
cmp eax, dword [edx - 4]
jb 0x417022
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, dword [0x41984c]
test eax, eax
je 0x417033
cmp esi, dword [eax - 4]
jb 0x417038
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416ff8
jmp 0x417069
mov eax, 0x41988c
xor edx, edx
mov ecx, dword [0x419850]
test ecx, ecx
je 0x41705c
cmp edx, dword [ecx - 4]
jb 0x417061
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
add edx, 2
mov ecx, dword [0x419850]
test ecx, ecx
je 0x417089
cmp edx, dword [ecx - 4]
jb 0x41708e
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
cmp dword [ebp - 8], 0
je 0x4170ba
mov eax, dword [ebp - 8]
call fcn.00409018
cmp eax, 0xff
jbe 0x4170b0
call fcn.004013ec
mov edx, dword [0x41867c]
mov byte [edx], al
jmp 0x4170c2
mov eax, dword [0x41867c]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
add edx, 3
mov ecx, dword [0x419850]
test ecx, ecx
je 0x4170e2
cmp edx, dword [ecx - 4]
jb 0x4170e7
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
cmp dword [ebp - 8], 0
je 0x417113
mov eax, dword [ebp - 8]
call fcn.00409018
cmp eax, 0xff
jbe 0x417109
call fcn.004013ec
mov edx, dword [0x4186ec]
mov byte [edx], al
jmp 0x41711b
mov eax, dword [0x4186ec]
mov byte [eax], 0x10
mov eax, 0x3d
call fcn.004155e4
call fcn.0040800c
test al, al
je 0x4171ce
cmp byte [0x418638], 0
jne 0x4171c2
push 0x30
mov eax, 0x41
mov edx, dword [0x419848]
test edx, edx
je 0x417155
cmp eax, dword [edx - 4]
jb 0x41715a
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
mov eax, 0x3e
mov edx, dword [0x419848]
test edx, edx
je 0x417177
cmp eax, dword [edx - 4]
jb 0x41717c
call fcn.004013ec
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x41984c]
test edx, edx
je 0x417193
cmp eax, dword [edx - 4]
jb 0x417198
call fcn.004013ec
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xb8]
call fcn.00401cec
mov eax, dword [ebp - 0xb8]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
mov al, 1
call fcn.004156b8
call fcn.00401940
mov eax, 0x63
call fcn.004155bc
test al, al
je 0x417230
call fcn.00415b28
test al, al
jne 0x417230
push 0x30
mov eax, dword [0x419898]
call fcn.00401e98
push eax
mov eax, 0x55
mov edx, dword [0x41984c]
test edx, edx
je 0x417206
cmp eax, dword [edx - 4]
jb 0x41720b
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
mov al, 1
call fcn.004156b8
call fcn.00401940
mov eax, 0x64
call fcn.004155bc
test al, al
je 0x417389
mov eax, 0x64
mov edx, dword [0x419848]
test edx, edx
je 0x417256
cmp eax, dword [edx - 4]
jb 0x41725b
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.004037fc
fstp qword [ebp - 0x20]
wait
call fcn.004159b0
fstp qword [ebp - 0x28]
wait
mov eax, 0x55
call fcn.004155bc
test al, al
je 0x417289
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jb 0x4172aa
mov eax, 0x55
call fcn.004155bc
test al, al
jne 0x417389
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
je 0x417389
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x4172c1
cmp edx, dword [ecx - 4]
jb 0x4172c6
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
mov eax, 2
call fcn.004155bc
test al, al
je 0x417314
mov esi, 4
push dword [ebp - 8]
push 0x417b7c
mov eax, 0x57
mov edx, dword [0x41984c]
test edx, edx
je 0x4172fd
cmp eax, dword [edx - 4]
jb 0x417302
call fcn.004013ec
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401d60
jmp 0x417316
xor esi, esi
or esi, 0x30
test esi, esi
jns 0x417322
call fcn.004013ec
push esi
mov eax, dword [0x419898]
call fcn.00401e98
push eax
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x41737d
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x419848]
test edx, edx
je 0x417366
cmp eax, dword [edx - 4]
jb 0x41736b
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov al, 1
call fcn.004156b8
call fcn.00401940
mov eax, 0x67
call fcn.004155bc
test al, al
je 0x417463
lea eax, [ebp - 8]
mov edx, 0x68
mov ecx, dword [0x419848]
test ecx, ecx
je 0x4173b2
cmp edx, dword [ecx - 4]
jb 0x4173b7
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
mov eax, 0x69
call fcn.004155e4
cmp eax, 2
jge 0x41743d
mov ebx, 1
xor esi, esi
jmp 0x417433
mov esi, ebx
mov eax, 0x69
call fcn.004155e4
sub eax, 1
jb 0x4173ec
je 0x417400
jmp 0x41740a
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
jmp 0x41740a
mov eax, dword [ebp - 8]
call fcn.00415efc
mov ebx, eax
test ebx, ebx
je 0x417433
mov eax, dword [0x4186ac]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x28]
je 0x417433
mov eax, dword [0x419830]
mov eax, dword [eax + 0x18]
cmp ebx, dword [eax + 0x28]
je 0x417433
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
je 0x417463
cmp ebx, esi
jne 0x4173d7
jmp 0x417463
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040904c
call fcn.0040c800
cmp al, 3
jbe 0x41745b
mov eax, dword [ebp - 0xc]
call fcn.004160fc
jmp 0x417463
mov eax, dword [ebp - 0xc]
call fcn.00415fec
mov eax, 1
call fcn.004155bc
test al, al
je 0x4178c9
cmp byte [0x418638], 0
jne 0x4178c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
xor edx, edx
call fcn.004035b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.00408028
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040ad54
call fcn.0040a974
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
pop edx
call fcn.0040b764
mov edx, dword [0x4186a8]
mov dword [edx], eax
mov eax, 3
call fcn.004155bc
test al, al
je 0x41756a
mov eax, 6
call fcn.004155bc
xor al, 1
push eax
mov eax, 4
call fcn.004155e4
push eax
mov eax, 5
call fcn.004155e4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e58
pop edx
pop ecx
call fcn.00415c10
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.004035b4
jmp 0x4176f0
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418680]
mov dword [edx], eax
lea ecx, [ebp - 0xbc]
xor edx, edx
mov eax, 6
call fcn.004155f4
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 7
call fcn.004155e4
sub eax, 1
jb 0x4175bc
je 0x4175df
dec eax
je 0x41763a
jmp 0x4176f0
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.004035b4
jmp 0x4176f0
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a9d0
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e58
mov edx, eax
mov eax, dword [0x418680]
mov eax, dword [eax]
pop ecx
call fcn.0040b93c
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.004035b4
jmp 0x4176f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
mov edx, dword [0x418680]
mov edx, dword [edx]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xd0], eax
fild dword [ebp - 0xd0]
fdiv dword [0x417b80]
call fcn.00401290
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x417675
call fcn.004013ec
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
mov edx, dword [0x418680]
mov edx, dword [edx]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xd4], eax
fild dword [ebp - 0xd4]
fdiv dword [0x417b80]
call fcn.00401290
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4176b1
call fcn.004013ec
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e58
mov edx, eax
mov eax, dword [0x418680]
mov eax, dword [eax]
pop ecx
call fcn.0040b88c
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.004035b4
mov eax, 8
mov edx, dword [0x419848]
test edx, edx
je 0x417704
cmp eax, dword [edx - 4]
jb 0x417709
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd8]
xor edx, edx
call fcn.0041085c
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040a7e0
mov eax, 9
mov edx, dword [0x419848]
test edx, edx
je 0x41773e
cmp eax, dword [edx - 4]
jb 0x417743
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xdc]
xor edx, edx
call fcn.0041085c
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a7e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040adbc
mov ebx, eax
mov eax, 0xa
call fcn.004155e4
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408a10
mov eax, 0xb
mov edx, dword [0x419848]
test edx, edx
je 0x41779d
cmp eax, dword [edx - 4]
jb 0x4177a2
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403604
mov eax, 0xc
call fcn.004155e4
mov edx, eax
mov eax, ebx
call fcn.00403594
mov eax, 0xd
call fcn.004155e4
mov edx, eax
cmp edx, 0xff
jbe 0x4177d8
call fcn.004013ec
mov eax, ebx
call fcn.004035f4
mov eax, 0xe
call fcn.004155e4
mov edx, eax
mov eax, ebx
call fcn.00408a44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040adbc
mov ebx, eax
mov eax, 0xf
call fcn.004155e4
mov edx, eax
mov eax, ebx
call fcn.00408a44
mov eax, 0x10
call fcn.004155e4
mov edx, eax
mov eax, ebx
call fcn.00403594
mov eax, 0x11
call fcn.004155e4
mov edx, eax
cmp edx, 0xff
jbe 0x41783e
call fcn.004013ec
mov eax, ebx
call fcn.004035f4
mov eax, 0x12
call fcn.004155e4
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408a10
mov eax, 0x13
mov edx, dword [0x419848]
test edx, edx
je 0x417871
cmp eax, dword [edx - 4]
jb 0x417876
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403604
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ac2c
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ac04
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.00408028
jmp 0x4178d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405f9c
mov eax, 0x31
call fcn.004155bc
test al, al
je 0x417917
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x4186a4]
mov dword [edx], eax
lea ecx, [ebp - 0xe0]
xor edx, edx
mov eax, 4
call fcn.004155f4
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x4186a4]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x3f
call fcn.004155bc
test al, al
je 0x41795a
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418688]
mov dword [edx], eax
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, 5
call fcn.004155f4
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x70
call fcn.004155bc
test al, al
je 0x41799d
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418690]
mov dword [edx], eax
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, 7
call fcn.004155f4
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x418690]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x58
call fcn.004155bc
test al, al
jne 0x4179c7
mov eax, 0x59
call fcn.004155bc
test al, al
jne 0x4179c7
mov eax, 0x5a
call fcn.004155bc
test al, al
je 0x4179fc
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x4186bc]
mov dword [edx], eax
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, 8
call fcn.004155f4
mov edx, dword [ebp - 0xec]
mov eax, dword [0x4186bc]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x1d
call fcn.004155bc
test al, al
je 0x417a3f
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x4186f8]
mov dword [edx], eax
lea ecx, [ebp - 0xf0]
xor edx, edx
mov eax, 9
call fcn.004155f4
mov edx, dword [ebp - 0xf0]
mov eax, dword [0x4186f8]
mov eax, dword [eax]
call fcn.0040bc38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417a81
lea eax, [ebp - 0xf0]
mov edx, 7
call fcn.00401a6c
lea eax, [ebp - 0xbc]
mov edx, 0x24
call fcn.00401a6c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401a6c
ret