Function at 0x4095ac
Capabilities:
Create process on windows
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452047
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x3e34
call fcn.00451730
mov dword [ebp - 0x3e10], ecx
cmp dword [ebp + 0xc], 0x57e5
jne 0x4095e2
jmp 0x40c307
cmp dword [ebp + 0xc], 0x57ea
jne 0x409630
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x3e10]
call fcn.00409457
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xa0]
jmp 0x40c307
cmp dword [ebp + 0xc], 0x57e7
jne 0x409777
lea ecx, [ebp - 0x18]
call fcn.0043d7b0
mov dword [ebp - 4], 0
push 0
push str.CTImprtu.exe
lea ecx, [ebp - 0x3dec]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0043fe33
mov dword [ebp - 0x3e14], eax
mov edx, dword [ebp - 0x3e14]
mov dword [ebp - 0x3e18], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3e18]
call fcn.00402b00
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3dec]
call sub.MFC42u.DLL_CString::CString
push 0x44
push 0
lea ecx, [ebp - 0x47c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x47c], 0x44
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x47c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409709
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409763
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0x377e
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea edx, [ebp - 0x438]
push edx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x565d
jne 0x40979a
push 0
push 2
push 1
push 1
push 0
mov ecx, dword [ebp - 0x3e10]
call fcn.0041601d
jmp 0x40c307
cmp dword [ebp + 0xc], 0x565e
jne 0x409885
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 0
push 1
lea ecx, [ebp - 0x488]
push ecx
lea edx, [ebp - 0x480]
push edx
mov ecx, dword [ebp - 0x3e10]
call fcn.00409457
push 2
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x484]
push ecx
push 0
mov edx, dword [ebp - 0x488]
push edx
mov eax, dword [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x3e10]
call fcn.0041298f
cmp dword [ebp - 0x484], 0
je 0x409880
mov ecx, dword [ebp - 0x48c]
push ecx
mov edx, dword [ebp - 0x484]
push edx
mov eax, dword [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x124]
mov ecx, dword [ebp - 0x484]
mov dword [ebp - 0x3df4], ecx
mov edx, dword [ebp - 0x3df4]
mov dword [ebp - 0x3df0], edx
cmp dword [ebp - 0x3df0], 0
je 0x409876
push 3
mov ecx, dword [ebp - 0x3df0]
call fcn.00417170
mov dword [ebp - 0x3e1c], eax
jmp 0x409880
mov dword [ebp - 0x3e1c], 0
jmp 0x40c307
cmp dword [ebp + 0xc], 0x567c
jne 0x4098c1
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6d0]
push ecx
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x110]
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5668
jne 0x40999b
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a4]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a4]
mov edx, dword [eax]
push ecx
call dword [edx + 0x44]
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00402db6
test eax, eax
je 0x409996
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00402f17
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6a8], 0
je 0x409996
lea ecx, [ebp - 0x3df8]
push ecx
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00401da7
mov dword [ebp - 0x3e20], eax
mov edx, dword [ebp - 0x3e20]
mov dword [ebp - 0x3e24], edx
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x3e24]
call fcn.00402b00
push eax
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a8]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov edx, dword [eax]
push ecx
call dword [edx + 0x38]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3df8]
call sub.MFC42u.DLL_CString::CString
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5659
jne 0x409a31
lea ecx, [ebp - 0x494]
call fcn.0043d7b0
mov dword [ebp - 4], 3
mov dword [ebp - 0x490], 0
push 0
lea eax, [ebp - 0x490]
push eax
push 4
push 0x461638
push 2
push 0x80000001
lea ecx, [ebp - 0x494]
call fcn.0043dc91
xor ecx, ecx
cmp dword [ebp - 0x490], 0
sete cl
mov dword [ebp - 0x490], ecx
push 0
lea edx, [ebp - 0x490]
push edx
push 4
push 0x461648
push 2
push 0x80000001
lea ecx, [ebp - 0x494]
call fcn.0043de11
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x494]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x565a
jne 0x409b59
lea ecx, [ebp - 0x49c]
call fcn.0043d7b0
mov dword [ebp - 4], 4
mov dword [ebp - 0x498], 0
push 0
lea eax, [ebp - 0x498]
push eax
push 4
push 0x461658
push 2
push 0x80000001
lea ecx, [ebp - 0x49c]
call fcn.0043dc91
cmp dword [ebp + 0x10], 0
jne 0x409ab6
xor ecx, ecx
cmp dword [ebp - 0x498], 0
sete cl
mov dword [ebp - 0x498], ecx
push 0
lea edx, [ebp - 0x498]
push edx
push 4
push 0x461664
push 2
push 0x80000001
lea ecx, [ebp - 0x49c]
call fcn.0043de11
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6b0], 0
je 0x409ae2
mov ecx, dword [ebp - 0x498]
push ecx
push 0x5612
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6b0]
call fcn.00426b96
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6b4], 0
je 0x409b0e
mov ecx, dword [ebp - 0x498]
push ecx
push 0x5612
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6b4]
call fcn.00426b96
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6a8], 0
je 0x409b42
mov ecx, dword [ebp - 0x498]
push ecx
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x6a8]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x2c]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x49c]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x565b
jne 0x409cc4
lea ecx, [ebp - 0x4a4]
call fcn.0043d7b0
mov dword [ebp - 4], 5
mov dword [ebp - 0x4a0], 0
push 0
lea edx, [ebp - 0x4a0]
push edx
push 4
push 0x461670
push 2
push 0x80000001
lea ecx, [ebp - 0x4a4]
call fcn.0043dc91
cmp dword [ebp + 0x10], 0
jne 0x409bde
xor eax, eax
cmp dword [ebp - 0x4a0], 0
sete al
mov dword [ebp - 0x4a0], eax
push 0
lea ecx, [ebp - 0x4a0]
push ecx
push 4
push 0x461680
push 2
push 0x80000001
lea ecx, [ebp - 0x4a4]
call fcn.0043de11
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6b0], 0
je 0x409c0a
mov eax, dword [ebp - 0x4a0]
push eax
push 0x560c
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b0]
call fcn.00426b96
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6b4], 0
je 0x409c36
mov eax, dword [ebp - 0x4a0]
push eax
push 0x560c
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b4]
call fcn.00426b96
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6a8], 0
je 0x409cad
cmp dword [ebp - 0x4a0], 0
je 0x409c86
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6e4], 0
jne 0x409c86
mov ecx, dword [ebp - 0x3e10]
push ecx
push 1
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x6a8]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x34]
jmp 0x409cad
mov edx, dword [ebp - 0x3e10]
push edx
push 0
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a8]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov edx, dword [eax]
push ecx
call dword [edx + 0x34]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a4]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x565c
jne 0x409d43
push 1
push 0x565a
push 0
mov ecx, dword [ebp - 0x3e10]
call fcn.004095ac
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6b0], 0
je 0x409d0a
mov ecx, dword [ebp + 0x10]
push ecx
push 0x560b
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6b0]
call fcn.00426b96
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6b4], 0
je 0x409d33
mov ecx, dword [ebp + 0x10]
push ecx
push 0x560b
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6b4]
call fcn.00426b96
mov ecx, dword [ebp - 0x3e10]
call fcn.00419ee0
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5849
jne 0x409d9d
push 1
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x4ac]
push ecx
mov ecx, dword [ebp - 0x3e10]
call fcn.00409457
lea edx, [ebp - 0x4a8]
push edx
push 1
mov eax, dword [ebp - 0x4ac]
push eax
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xa0]
jmp 0x40c307
cmp dword [ebp + 0xc], 0x584a
jne 0x409df7
push 1
lea ecx, [ebp - 0x4b0]
push ecx
lea edx, [ebp - 0x4b4]
push edx
mov ecx, dword [ebp - 0x3e10]
call fcn.00409457
lea eax, [ebp - 0x4b0]
push eax
push 2
mov ecx, dword [ebp - 0x4b4]
push ecx
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0xa0]
jmp 0x40c307
cmp dword [ebp + 0xc], 0x56be
jne 0x409e9d
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6e0], 1
jne 0x409e3e
mov eax, dword [ebp - 0x3e10]
mov dword [eax + 0x6e0], 0
push 3
push 0
push 0
push 0
push 0
mov ecx, dword [sym.imp.MFC42u.DLL_CWndconstCWnd::wndNoTopMost]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CWnd::SetWindowPos
jmp 0x409e66
mov edx, dword [ebp - 0x3e10]
mov dword [edx + 0x6e0], 1
push 3
push 0
push 0
push 0
push 0
mov eax, dword [sym.imp.MFC42u.DLL_CWndconstCWnd::wndTopMost]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CWnd::SetWindowPos
push 0
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x6e0]
push edx
push 4
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0x1cc]
jmp 0x40c307
cmp dword [ebp + 0xc], 0x571e
jne 0x40a00f
lea ecx, [ebp - 0x4bc]
call fcn.0043d7b0
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c8], 0
push 0
lea eax, [ebp - 0x6c4]
push eax
push 1
push 0x461690
push 6
push 0x80000002
lea ecx, [ebp - 0x4bc]
call fcn.0043dc91
test eax, eax
je 0x409f87
push 0x44
push 0
lea ecx, [ebp - 0x924]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x924], 0x44
lea edx, [ebp - 0x6d8]
push edx
lea eax, [ebp - 0x924]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x6c4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409f87
mov edx, dword [ebp - 0x6d4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6d8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4616a8
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0
je 0x409f7d
mov ecx, dword [ebp - 0x4b8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0x6c8], 1
cmp dword [ebp - 0x6c8], 0
jne 0x409ff8
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x4b8], eax
push 0x104
lea edx, [ebp - 0x6c4]
push edx
push 0x3779
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea eax, [ebp - 0x8e0]
push eax
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea ecx, [ebp - 0x8e0]
push ecx
lea edx, [ebp - 0x6c4]
push edx
mov eax, dword [ebp - 0x4b8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x571f
jne 0x40a184
lea ecx, [ebp - 0x92c]
call fcn.0043d7b0
mov dword [ebp - 4], 7
mov dword [ebp - 0xb38], 0
push 0
lea ecx, [ebp - 0xb34]
push ecx
push 1
push str.CTCMSGO.exe
push 6
push 0x80000002
lea ecx, [ebp - 0x92c]
call fcn.0043dc91
test eax, eax
je 0x40a0fc
push 0x44
push 0
lea edx, [ebp - 0xd94]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0xd94], 0x44
lea eax, [ebp - 0xb48]
push eax
lea ecx, [ebp - 0xd94]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push str.__LCR
lea edx, [ebp - 0xb34]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a0fc
mov eax, dword [ebp - 0xb44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xb48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.EStart_U
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 0
je 0x40a0f2
mov edx, dword [ebp - 0x928]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0xb38], 1
cmp dword [ebp - 0xb38], 0
jne 0x40a16d
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x928], eax
push 0x104
lea eax, [ebp - 0xb34]
push eax
push 0x377a
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0xd50]
push ecx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea edx, [ebp - 0xd50]
push edx
lea eax, [ebp - 0xb34]
push eax
mov ecx, dword [ebp - 0x928]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x92c]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5722
jne 0x40a2c9
lea ecx, [ebp - 0xd9c]
call fcn.0043d7b0
mov dword [ebp - 4], 8
mov dword [ebp - 0xfa8], 0
push 0
lea edx, [ebp - 0xfa4]
push edx
push 1
push 0x4616f4
push 6
push 0x80000002
lea ecx, [ebp - 0xd9c]
call fcn.0043dc91
test eax, eax
je 0x40a241
push 0x44
push 0
lea eax, [ebp - 0x1204]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x1204], 0x44
lea ecx, [ebp - 0xfb8]
push ecx
lea edx, [ebp - 0x1204]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xfa4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a241
mov ecx, dword [ebp - 0xfb4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xfb8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xfa8], 1
cmp dword [ebp - 0xfa8], 0
jne 0x40a2b2
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0xd98], eax
push 0x104
lea eax, [ebp - 0xfa4]
push eax
push 0x377b
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x11c0]
push ecx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea edx, [ebp - 0x11c0]
push edx
lea eax, [ebp - 0xfa4]
push eax
mov ecx, dword [ebp - 0xd98]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd9c]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5724
jne 0x40a40e
lea ecx, [ebp - 0x120c]
call fcn.0043d7b0
mov dword [ebp - 4], 9
mov dword [ebp - 0x1418], 0
push 0
lea edx, [ebp - 0x1414]
push edx
push 1
push 0x46170c
push 6
push 0x80000002
lea ecx, [ebp - 0x120c]
call fcn.0043dc91
test eax, eax
je 0x40a386
push 0x44
push 0
lea eax, [ebp - 0x1674]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x1674], 0x44
lea ecx, [ebp - 0x1428]
push ecx
lea edx, [ebp - 0x1674]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a386
mov ecx, dword [ebp - 0x1424]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1418], 1
cmp dword [ebp - 0x1418], 0
jne 0x40a3f7
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x1208], eax
push 0x104
lea eax, [ebp - 0x1414]
push eax
push 0x3784
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x1630]
push ecx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea edx, [ebp - 0x1630]
push edx
lea eax, [ebp - 0x1414]
push eax
mov ecx, dword [ebp - 0x1208]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120c]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5725
jne 0x40a59d
lea ecx, [ebp - 0x167c]
call fcn.0043d7b0
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x1888], 0
push 0x44
push 0
lea edx, [ebp - 0x1ae4]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x1ae4], 0x44
push 0
push 0x461720
lea eax, [ebp - 0x3dfc]
push eax
lea ecx, [ebp - 0x167c]
call fcn.0043fe33
mov dword [ebp - 0x3e28], eax
mov ecx, dword [ebp - 0x3e28]
mov dword [ebp - 0x3e2c], ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x3e2c]
call fcn.00402b00
push eax
lea edx, [ebp - 0x1884]
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3dfc]
call sub.MFC42u.DLL_CString::CString
lea eax, [ebp - 0x1884]
push eax
lea ecx, [ebp - 0x167c]
call fcn.0043fde3
test eax, eax
je 0x40a515
lea ecx, [ebp - 0x1898]
push ecx
lea edx, [ebp - 0x1ae4]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1884]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a515
mov ecx, dword [ebp - 0x1894]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1898]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1888], 1
cmp dword [ebp - 0x1888], 0
jne 0x40a586
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x1678], eax
push 0x104
lea eax, [ebp - 0x1884]
push eax
push 0x3785
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x1aa0]
push ecx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea edx, [ebp - 0x1aa0]
push edx
lea eax, [ebp - 0x1884]
push eax
mov ecx, dword [ebp - 0x1678]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x167c]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5726
jne 0x40a6e2
lea ecx, [ebp - 0x1aec]
call fcn.0043d7b0
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x1cf8], 0
push 0
lea edx, [ebp - 0x1cf4]
push edx
push 1
push 0x46173c
push 6
push 0x80000002
lea ecx, [ebp - 0x1aec]
call fcn.0043dc91
test eax, eax
je 0x40a65a
push 0x44
push 0
lea eax, [ebp - 0x1f54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x1f54], 0x44
lea ecx, [ebp - 0x1d08]
push ecx
lea edx, [ebp - 0x1f54]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1cf4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a65a
mov ecx, dword [ebp - 0x1d04]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1d08]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1cf8], 1
cmp dword [ebp - 0x1cf8], 0
jne 0x40a6cb
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x1ae8], eax
push 0x104
lea eax, [ebp - 0x1cf4]
push eax
push 0x3786
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x1f10]
push ecx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea edx, [ebp - 0x1f10]
push edx
lea eax, [ebp - 0x1cf4]
push eax
mov ecx, dword [ebp - 0x1ae8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1aec]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5727
jne 0x40a871
lea ecx, [ebp - 0x1f5c]
call fcn.0043d7b0
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x2168], 0
push 0
push 0x46175c
lea edx, [ebp - 0x3e00]
push edx
lea ecx, [ebp - 0x1f5c]
call fcn.0043fe33
mov dword [ebp - 0x3e30], eax
mov eax, dword [ebp - 0x3e30]
mov dword [ebp - 0x3e34], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x3e34]
call fcn.00402b00
push eax
lea ecx, [ebp - 0x2164]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x3e00]
call sub.MFC42u.DLL_CString::CString
lea edx, [ebp - 0x2164]
push edx
lea ecx, [ebp - 0x1f5c]
call fcn.0043fde3
test eax, eax
je 0x40a7e9
push 0x44
push 0
lea eax, [ebp - 0x23c4]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c4], 0x44
lea ecx, [ebp - 0x2178]
push ecx
lea edx, [ebp - 0x23c4]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2164]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a7e9
mov ecx, dword [ebp - 0x2174]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x2178]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2168], 1
cmp dword [ebp - 0x2168], 0
jne 0x40a85a
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x1f58], eax
push 0x104
lea eax, [ebp - 0x2164]
push eax
push 0x3787
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x2380]
push ecx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea edx, [ebp - 0x2380]
push edx
lea eax, [ebp - 0x2164]
push eax
mov ecx, dword [ebp - 0x1f58]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f5c]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x571d
jne 0x40adc0
lea ecx, [ebp - 0x27ec]
call fcn.0043d7b0
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x23c8], 0
push 0
lea edx, [ebp - 0x23c8]
push edx
push 4
push 0x461770
push 1
push 0x80000001
lea ecx, [ebp - 0x27ec]
call fcn.0043dc91
mov eax, dword [ebp - 0x23c8]
push eax
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x140]
push 1
push 0x565a
push 0
mov ecx, dword [ebp - 0x3e10]
call fcn.004095ac
cmp dword [ebp + 0x10], 0
je 0x40ab90
lea ecx, [ebp - 0x25d0]
push ecx
lea edx, [ebp - 0x27e8]
push edx
mov ecx, dword [ebp - 0x3e10]
call fcn.0040c31c
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp - 0x3e10]
add edx, 0x11a4
push edx
mov eax, dword [ebp - 0x3e10]
add eax, 0x6c8
push eax
mov ecx, dword [ebp - 0x3e10]
call fcn.00418152
mov ecx, dword [ebp - 0x3e10]
call fcn.004165b2
mov ecx, dword [ebp - 0x3e10]
call fcn.0040cf1e
test eax, eax
je 0x40a997
push 0
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x708]
push edx
push 5
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0x1cc]
jmp 0x40a9be
push 0
push 0
push 5
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0x1cc]
mov ecx, dword [ebp - 0x3e10]
call fcn.00416978
push 0
mov ecx, dword [ebp - 0x3e10]
call fcn.00416ccf
mov ecx, dword [ebp - 0x3e10]
call fcn.00416905
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x3e10]
push eax
push 0x43b88e
call sub.MFC42u.DLL_AfxBeginThread
lea ecx, [ebp - 0x27f0]
push ecx
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00401dd8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00402e26
test eax, eax
je 0x40aa3b
push 0x468ca4
lea ecx, [ebp - 0x27f0]
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [ebp - 0x27f0]
call fcn.00402b00
push eax
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x14c]
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6a8], 0
je 0x40aade
lea eax, [ebp - 0x3e04]
push eax
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00401da7
mov dword [ebp - 0x3e38], eax
mov ecx, dword [ebp - 0x3e38]
mov dword [ebp - 0x3e3c], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x3e3c]
call fcn.00402b00
push eax
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x6a8]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x38]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x3e04]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00402db6
test eax, eax
je 0x40ab4f
lea edx, [ebp - 0x27f4]
push edx
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.004035bd
mov byte [ebp - 4], 0x12
push 0
lea ecx, [ebp - 0x27f4]
call fcn.00402b00
push eax
push 0x15
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0x1cc]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x27f4]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6c4], 0
je 0x40ab81
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00401b4e
push eax
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6c4]
call fcn.004385db
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x27f0]
call sub.MFC42u.DLL_CString::CString
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x3e10]
push edx
push 0x43d061
call sub.MFC42u.DLL_AfxBeginThread
mov dword [ebp - 0x25e0], 1
mov ecx, dword [ebp - 0x3e10]
call fcn.00419ac4
cmp eax, 1
jne 0x40abcd
mov dword [ebp - 0x25e0], 0
push 0
lea eax, [ebp - 0x25e0]
push eax
push 4
push 0x461794
push 2
push 0x80000001
lea ecx, [ebp - 0x27ec]
call fcn.0043dc91
mov dword [ebp - 0x25dc], 2
push 0
lea ecx, [ebp - 0x25dc]
push ecx
push 4
push 0x4617a4
push 2
push 0x80000001
lea ecx, [ebp - 0x27ec]
call fcn.0043dc91
cmp dword [ebp - 0x25dc], 2
jbe 0x40ac45
push 0
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.0040282c
test eax, eax
jne 0x40ac45
mov dword [ebp - 0x25dc], 2
mov dword [ebp - 0x25d8], 0
push 0
lea edx, [ebp - 0x25d8]
push edx
push 4
push 0x4617b4
push 2
push 0x80000001
lea ecx, [ebp - 0x27ec]
call fcn.0043dc91
mov dword [ebp - 0x25d4], 0x1f400
push 0
lea eax, [ebp - 0x25d4]
push eax
push 4
push 0x4617c0
push 2
push 0x80000001
lea ecx, [ebp - 0x27ec]
call fcn.0043dc91
mov ecx, dword [ebp - 0x3e10]
mov dx, word [ecx + 0x684]
push edx
lea ecx, [ebp - 0x27ec]
call fcn.0043d7c9
push 0x371e
lea eax, [ebp - 0x25e0]
push eax
lea ecx, [ebp - 0x27e8]
push ecx
lea ecx, [ebp - 0x27ec]
call fcn.0043d7e0
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6b0], 0
je 0x40ad00
lea eax, [ebp - 0x27e8]
push eax
push 0x560b
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b0]
call fcn.00426b96
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6b4], 0
je 0x40ad2c
lea eax, [ebp - 0x27e8]
push eax
push 0x560b
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b4]
call fcn.00426b96
mov ecx, dword [ebp - 0x3e10]
call fcn.00419ee0
mov ecx, dword [ebp - 0x3e10]
call fcn.00418d9b
mov edx, dword [ebp - 0x3e10]
xor eax, eax
mov ax, word [edx + 0xf34]
test eax, eax
je 0x40ada9
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x6d4], 4
jne 0x40ad7c
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6b4]
push eax
mov ecx, dword [ebp - 0x3e10]
call fcn.004090e2
mov ecx, dword [ebp - 0x3e10]
add ecx, 0xf34
push ecx
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6b0]
call fcn.00426a5b
mov eax, dword [ebp - 0x3e10]
mov word [eax + 0xf34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27ec]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5b04
jne 0x40af96
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x6c4], 0
jne 0x40aeff
push 0x100
call fcn.00417150
mov dword [ebp - 0x3e0c], eax
mov dword [ebp - 4], 0x13
cmp dword [ebp - 0x3e0c], 0
je 0x40ae15
push 0
mov ecx, dword [ebp - 0x3e0c]
call fcn.00438510
mov dword [ebp - 0x3e40], eax
jmp 0x40ae1f
mov dword [ebp - 0x3e40], 0
mov edx, dword [ebp - 0x3e40]
mov dword [ebp - 0x3e08], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [ebp - 0x3e08]
mov dword [eax + 0x6c4], ecx
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00401b4e
push eax
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6c4]
call fcn.004385db
mov eax, dword [ebp - 0x3e10]
mov cx, word [eax + 0x684]
push ecx
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6c4]
call fcn.00438724
mov eax, dword [ebp - 0x3e10]
push eax
push 0x82
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6c4]
call fcn.00417620
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6d4], 4
jne 0x40aed2
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6b4]
push ecx
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6c4]
call sub.MFC42u.DLL_CWnd::CenterWindow
jmp 0x40aeff
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6d4], 3
jne 0x40aeff
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x6b0]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6c4]
call sub.MFC42u.DLL_CWnd::CenterWindow
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6c4]
call fcn.0043873c
test eax, eax
je 0x40af29
push 5
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6c4]
call sub.MFC42u.DLL_CWnd::ShowWindow
jmp 0x40af91
push 0x104
lea eax, [ebp - 0x2c08]
push eax
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x2a00]
push ecx
push 0x37e6
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x27f8], eax
push 0x10
lea edx, [ebp - 0x2c08]
push edx
lea eax, [ebp - 0x2a00]
push eax
mov ecx, dword [ebp - 0x27f8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40c307
cmp dword [ebp + 0xc], 0x60e
jne 0x40b001
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6b0], 0
je 0x40afc8
mov eax, dword [ebp + 0x10]
push eax
push 0x560b
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b0]
call fcn.00426b96
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6b4], 0
je 0x40aff1
mov eax, dword [ebp + 0x10]
push eax
push 0x560b
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b4]
call fcn.00426b96
mov ecx, dword [ebp - 0x3e10]
call fcn.00419ee0
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5782
jne 0x40b0f9
push 0x104
lea edx, [ebp - 0x30c4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x30c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x30cc], eax
jmp 0x40b049
mov ecx, dword [ebp - 0x30cc]
sub ecx, 1
mov dword [ebp - 0x30cc], ecx
cmp dword [ebp - 0x30cc], 0
jle 0x40b06b
mov edx, dword [ebp - 0x30cc]
xor eax, eax
mov ax, word [ebp + edx*2 - 0x30c4]
cmp eax, 0x5c
jne 0x40b069
jmp 0x40b06b
jmp 0x40b03a
mov ecx, dword [ebp - 0x30cc]
mov word [ebp + ecx*2 - 0x30c2], 0
lea edx, [ebp - 0x30c4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x30c4]
mov dword [ebp - 0x30c8], eax
push str.HelpCMSMainu.chm
mov ecx, dword [ebp - 0x30c8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x200
push 0x2b4
lea edx, [ebp - 0x2ebc]
push edx
push 0
lea eax, [ebp - 0x30c4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x40b0dd
push str.HelpCTCMSu.chm
mov ecx, dword [ebp - 0x30c8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 5
push 0
push 0
lea edx, [ebp - 0x30c4]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40c307
cmp dword [ebp + 0xc], 0xbb9
jne 0x40b251
lea eax, [ebp - 0x30d0]
push eax
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x118]
cmp dword [ebp - 0x30d0], 3
jne 0x40b15d
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xf0]
jmp 0x40b24c
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x6d4], 4
jne 0x40b186
push 0
push 2
push 2
push 1
push 0
mov ecx, dword [ebp - 0x3e10]
call fcn.0041601d
jmp 0x40b24c
mov dword [ebp - 0x32e0], 0
lea edx, [ebp - 0x32e0]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0xe8]
cmp dword [ebp - 0x32e0], 0
je 0x40b1e4
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0xec]
jmp 0x40b24c
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x30d4], eax
push 0x104
lea eax, [ebp - 0x32dc]
push eax
push 0x37e9
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x34e8]
push ecx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x30
lea edx, [ebp - 0x34e8]
push edx
lea eax, [ebp - 0x32dc]
push eax
mov ecx, dword [ebp - 0x30d4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40c307
cmp dword [ebp + 0xc], 0xbb8
jne 0x40b2f7
lea edx, [ebp - 0x34ec]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0x118]
cmp dword [ebp - 0x34ec], 3
jne 0x40b2b2
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0xf0]
jmp 0x40b2f2
cmp dword [ebp - 0x34ec], 1
jne 0x40b2de
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0xf0]
jmp 0x40b2f2
push 0
push 0xbb9
push 0
mov ecx, dword [ebp - 0x3e10]
call fcn.004095ac
jmp 0x40c307
cmp dword [ebp + 0xc], 0xbbf
jne 0x40b338
mov eax, dword [ebp - 0x3e10]
push eax
push 0
push 0
push 4
call fcn.0040d3bf
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xf8]
jmp 0x40c307
cmp dword [ebp + 0xc], 0xbc0
jne 0x40b379
mov ecx, dword [ebp - 0x3e10]
push ecx
push 0
push 0
push 4
call fcn.0040d3bf
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0xfc]
jmp 0x40c307
cmp dword [ebp + 0xc], 0xbba
jne 0x40b3a8
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0xf0]
jmp 0x40c307
cmp dword [ebp + 0xc], 0xbbc
jne 0x40b567
lea ecx, [ebp - 0x34f8]
call fcn.0043d7b0
mov dword [ebp - 4], 0x14
lea edx, [ebp - 0x34fc]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0x118]
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6a8], 0
je 0x40b516
push 0
push 0
lea ecx, [ebp - 0x34f0]
push ecx
lea edx, [ebp - 0x34f4]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a8]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov edx, dword [eax]
push ecx
call dword [edx + 0x28]
cmp dword [ebp - 0x34f4], 0x10000
jne 0x40b4da
cmp dword [ebp - 0x34f0], 0x200
jne 0x40b4da
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a8]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov edx, dword [eax]
push ecx
call dword [edx + 0x24]
cmp dword [ebp - 0x34fc], 2
je 0x40b4aa
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0xf4]
mov eax, dword [ebp - 0x3e10]
mov dword [eax + 0x6cc], 2
cmp dword [ebp + 0x10], 0
jne 0x40b4bc
mov dword [ebp - 0x34f0], 0
jmp 0x40b4c6
mov dword [ebp - 0x34f0], 1
mov ecx, dword [ebp - 0x34f0]
push ecx
mov ecx, dword [ebp - 0x3e10]
call fcn.004130ef
jmp 0x40b514
cmp dword [ebp - 0x34fc], 2
je 0x40b514
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0xf4]
mov edx, dword [ebp - 0x3e10]
mov dword [edx + 0x6cc], 2
jmp 0x40b550
cmp dword [ebp - 0x34fc], 2
je 0x40b550
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0xf4]
mov eax, dword [ebp - 0x3e10]
mov dword [eax + 0x6cc], 2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34f8]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x715f
jne 0x40b6a1
lea ecx, [ebp - 0x3504]
call fcn.0043d7b0
mov dword [ebp - 4], 0x15
mov ecx, dword [ebp - 0x3e10]
xor edx, edx
cmp dword [ecx + 0x6e4], 0
sete dl
mov eax, dword [ebp - 0x3e10]
mov dword [eax + 0x6e4], edx
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x6b0], 0
je 0x40b5c4
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6b0]
call fcn.00425fe3
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6b4], 0
je 0x40b5e4
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b4]
call fcn.00425fe3
mov dword [ebp - 0x3500], 0
push 0
lea edx, [ebp - 0x3500]
push edx
push 4
push 0x461814
push 2
push 0x80000001
lea ecx, [ebp - 0x3504]
call fcn.0043dc91
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x678], 0xfffefffe
je 0x40b68a
cmp dword [ebp - 0x3500], 0
je 0x40b663
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x6e4], 0
jne 0x40b663
mov edx, dword [ebp - 0x3e10]
push edx
push 1
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a8]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov edx, dword [eax]
push ecx
call dword [edx + 0x34]
jmp 0x40b68a
mov eax, dword [ebp - 0x3e10]
push eax
push 0
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x6a8]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a8]
mov eax, dword [ecx]
push edx
call dword [eax + 0x34]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3504]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x7160
jne 0x40b826
mov dword [ebp - 0x3508], 1
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x6d4], 4
jne 0x40b738
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6e8], 0
jne 0x40b738
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6b4]
call fcn.00417260
test eax, eax
je 0x40b708
push 0
push 0xf120
push 0x112
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b4]
call fcn.00417200
mov edx, dword [ebp - 0x3e10]
mov ecx, dword [edx + 0x6b4]
call fcn.00417280
push 1
push 0
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6b4]
call fcn.00425563
mov eax, 1
jmp 0x40c30c
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x6b0], 0
je 0x40b7cf
lea edx, [ebp - 0x3508]
push edx
push 1
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0xe4]
cmp dword [ebp - 0x3508], 0
jne 0x40b795
push 1
push 1
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6b0]
call fcn.00425563
jmp 0x40b7cd
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b0]
call fcn.00417280
push 0
push 0
push 3
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x1cc]
jmp 0x40b821
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x20]
push eax
push 1
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xdc]
push 1
push 1
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xe0]
jmp 0x40c307
cmp dword [ebp + 0xc], 0xc80
jne 0x40b884
lea ecx, [ebp - 0x350c]
push ecx
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a4]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x6a4]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x24]
xor edx, edx
cmp dword [ebp - 0x350c], 0
sete dl
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a4]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a4]
mov edx, dword [eax]
push ecx
call dword [edx + 0x30]
jmp 0x40c307
cmp dword [ebp + 0xc], 0xbbb
jne 0x40b9d1
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6a8], 0
je 0x40b9cc
push 0
push 0
lea ecx, [ebp - 0x3510]
push ecx
lea edx, [ebp - 0x3514]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6a8]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov edx, dword [eax]
push ecx
call dword [edx + 0x28]
cmp dword [ebp - 0x3514], 2
jne 0x40b922
cmp dword [ebp + 0x10], 0
jne 0x40b8f1
mov eax, dword [ebp - 0x3e10]
mov dword [ebp - 0x3518], eax
jmp 0x40b8fa
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x3518], ecx
push 0
mov ecx, dword [ebp - 0x3e10]
call fcn.00415195
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3518]
push eax
mov ecx, dword [ebp - 0x3e10]
call fcn.00414134
jmp 0x40b9cc
cmp dword [ebp - 0x3514], 0x10000
jne 0x40b9cc
cmp dword [ebp - 0x3510], 0x205
jne 0x40b980
cmp dword [ebp + 0x10], 0
jne 0x40b952
mov ecx, dword [ebp - 0x3e10]
mov dword [ebp - 0x3518], ecx
jmp 0x40b95b
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3518], edx
push 0
mov ecx, dword [ebp - 0x3e10]
call fcn.00415195
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x3518]
push ecx
mov ecx, dword [ebp - 0x3e10]
call fcn.00414134
jmp 0x40b9cc
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x6a8]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x6a8]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x24]
cmp dword [ebp + 0x10], 0
jne 0x40b9b0
mov dword [ebp - 0x3510], 0
jmp 0x40b9ba
mov dword [ebp - 0x3510], 1
mov edx, dword [ebp - 0x3510]
push edx
mov ecx, dword [ebp - 0x3e10]
call fcn.004130ef
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5617
jne 0x40bb3e
mov dword [ebp - 0x3520], 0
lea eax, [ebp - 0x351c]
push eax
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x17c]
mov ecx, dword [ebp - 0x351c]
and ecx, 1
test ecx, ecx
jne 0x40ba29
mov dword [ebp - 0x3520], 1
jmp 0x40ba65
push 1
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x174]
mov dword [ebp - 0x351c], eax
cmp dword [ebp - 0x351c], 2
jne 0x40ba65
mov dword [ebp - 0x3520], 1
cmp dword [ebp - 0x3520], 0
je 0x40bb39
lea ecx, [ebp - 0x3740]
call fcn.00450010
mov dword [ebp - 4], 0x16
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x3524], eax
mov edx, dword [ebp - 0x3e10]
mov ax, word [edx + 0x684]
push eax
lea ecx, [ebp - 0x3740]
call fcn.004502b0
push 0
push 0
lea ecx, [ebp - 0x3948]
push ecx
push 0
push 1
push 0xc4e
lea ecx, [ebp - 0x3740]
call fcn.00450079
push 0x104
lea edx, [ebp - 0x372c]
push edx
push 0x37eb
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea eax, [ebp - 0x3948]
push eax
lea ecx, [ebp - 0x372c]
push ecx
mov edx, dword [ebp - 0x3524]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x670], 0
jne 0x40bb27
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x3e10]
call fcn.00417230
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3740]
call fcn.0045004f
jmp 0x40c307
cmp dword [ebp + 0xc], 0xc85
jne 0x40bc53
mov dword [ebp - 0x3954], 0
lea ecx, [ebp - 0x3950]
push ecx
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x17c]
mov edx, dword [ebp - 0x3950]
and edx, 1
test edx, edx
jne 0x40bb96
mov dword [ebp - 0x3954], 1
jmp 0x40bc13
lea eax, [ebp - 0x394c]
push eax
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x150]
mov dword [ebp - 0x3950], eax
cmp dword [ebp - 0x3950], 1
jne 0x40bc09
xor ecx, ecx
cmp dword [ebp - 0x394c], 0
sete cl
mov dword [ebp - 0x394c], ecx
lea edx, [ebp - 0x394c]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0x154]
jmp 0x40bc13
mov dword [ebp - 0x3954], 1
cmp dword [ebp - 0x3954], 0
je 0x40bc4e
mov ecx, dword [ebp - 0x3e10]
call fcn.0041886f
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x670], 0
jne 0x40bc47
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x3e10]
call fcn.00417230
xor eax, eax
jmp 0x40c30c
jmp 0x40c307
cmp dword [ebp + 0xc], 0x5603
jne 0x40bd5c
mov dword [ebp - 0x3958], 0
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x688], 1
jne 0x40bc85
mov dword [ebp - 0x3958], 1
jmp 0x40bca7
push 0
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.004025c0
cmp eax, 1
jne 0x40bca7
mov dword [ebp - 0x3958], 1
cmp dword [ebp - 0x3958], 0
je 0x40bd50
lea edx, [ebp - 0x395c]
push edx
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov edx, dword [eax]
push ecx
call dword [edx + 0x16c]
mov dword [ebp - 0x3960], eax
cmp dword [ebp - 0x3960], 1
jne 0x40bd27
xor eax, eax
cmp dword [ebp - 0x395c], 0
sete al
mov dword [ebp - 0x395c], eax
lea ecx, [ebp - 0x395c]
push ecx
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x170]
jmp 0x40bd4e
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x670], 0
jne 0x40bd47
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x3e10]
call fcn.00417230
xor eax, eax
jmp 0x40c30c
jmp 0x40bd57
xor eax, eax
jmp 0x40c30c
jmp 0x40c307
cmp dword [ebp + 0xc], 0x561e
jne 0x40bd79
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x3e10]
call fcn.00415e60
jmp 0x40c30c
cmp dword [ebp + 0xc], 0x569e
jne 0x40bded
mov dword [ebp - 0x3964], 0
mov ecx, dword [ebp - 0x3e10]
cmp dword [ecx + 0x688], 1
jne 0x40bda7
mov dword [ebp - 0x3964], 1
jmp 0x40bdc9
push 0
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.004024f0
cmp eax, 1
jne 0x40bdc9
mov dword [ebp - 0x3964], 1
cmp dword [ebp - 0x3964], 0
je 0x40bde6
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x3e10]
call fcn.004192d9
jmp 0x40c30c
xor eax, eax
jmp 0x40c30c
cmp dword [ebp + 0xc], 0x560e
jne 0x40bec0
mov dword [ebp - 0x3968], 0
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x688], 1
jne 0x40be1f
mov dword [ebp - 0x3968], 1
jmp 0x40be41
push 0
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.004024f0
cmp eax, 1
jne 0x40be41
mov dword [ebp - 0x3968], 1
cmp dword [ebp - 0x3968], 0
je 0x40beb4
mov dword [ebp - 0x396c], 0x3f800000
lea ecx, [ebp - 0x396c]
push ecx
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0x160]
mov dword [ebp - 0x3970], eax
cmp dword [ebp - 0x3970], 2
jne 0x40beb2
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x670], 0
jne 0x40beab
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x3e10]
call fcn.00417230
xor eax, eax
jmp 0x40c30c
jmp 0x40bebb
xor eax, eax
jmp 0x40c30c
jmp 0x40c307
cmp dword [ebp + 0xc], 0xc83
jne 0x40c1f7
lea ecx, [ebp - 0x3978]
call fcn.0043d7b0
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x3b84], 0
push 0
mov ecx, dword [ebp - 0x3e10]
add ecx, 0x11c4
call fcn.00402800
test eax, eax
je 0x40bfa6
push 0
lea eax, [ebp - 0x3b80]
push eax
push 1
push str.ConsoLC.exe
push 6
push 0x80000002
lea ecx, [ebp - 0x3978]
call fcn.0043dc91
test eax, eax
je 0x40bfa6
push 0x44
push 0
lea ecx, [ebp - 0x3de0]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x3de0], 0x44
lea edx, [ebp - 0x3b94]
push edx
lea eax, [ebp - 0x3de0]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push str.__Mixer
lea ecx, [ebp - 0x3b80]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x3b84], eax
cmp dword [ebp - 0x3b84], 1
jne 0x40bfa6
mov edx, dword [ebp - 0x3b90]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3b94]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x3b84], 1
cmp dword [ebp - 0x3b84], 0
jne 0x40c048
push 0
lea ecx, [ebp - 0x3b80]
push ecx
push 1
push str.SurMixer.exe
push 6
push 0x80000002
lea ecx, [ebp - 0x3978]
call fcn.0043dc91
test eax, eax
je 0x40c048
push 0x44
push 0
lea edx, [ebp - 0x3de0]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x3de0], 0x44
lea eax, [ebp - 0x3b94]
push eax
lea ecx, [ebp - 0x3de0]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3b80]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x40c048
mov eax, dword [ebp - 0x3b90]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x3b94]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x3b84], 1
cmp dword [ebp - 0x3b84], 0
jne 0x40c133
mov dword [ebp - 0x3de4], 0
lea edx, [ebp - 0x3de4]
push edx
push 0x454f28
push 1
push 0
push 0x454f18
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40c133
mov eax, dword [ebp - 0x3de4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x3de4]
push edx
call dword [ecx + 8]
mov dword [ebp - 0x3de4], 0
push 0
lea eax, [ebp - 0x3b80]
push eax
push 1
push str.SMax4.exe
push 6
push 0x80000002
lea ecx, [ebp - 0x3978]
call fcn.0043dc91
test eax, eax
je 0x40c133
push 0x44
push 0
lea ecx, [ebp - 0x3de0]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x3de0], 0x44
lea edx, [ebp - 0x3b94]
push edx
lea eax, [ebp - 0x3de0]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x3b80]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x40c133
mov edx, dword [ebp - 0x3b90]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3b94]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x3b84], 1
cmp dword [ebp - 0x3b84], 0
jne 0x40c1e0
push str.Sndvol32.exe
lea ecx, [ebp - 0x3b80]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
push 0
push 0
lea edx, [ebp - 0x3b80]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x3de8], eax
cmp dword [ebp - 0x3de8], 0x21
jge 0x40c1e0
mov ecx, dword [ebp - 0x3e10]
call fcn.004163ac
mov dword [ebp - 0x3974], eax
push 0x104
lea eax, [ebp - 0x3b80]
push eax
push 0x377c
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea ecx, [ebp - 0x3d9c]
push ecx
push 0x3751
call fcn.00404110
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea edx, [ebp - 0x3d9c]
push edx
lea eax, [ebp - 0x3b80]
push eax
mov ecx, dword [ebp - 0x3974]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3978]
call fcn.0043d7be
jmp 0x40c307
cmp dword [ebp + 0xc], 0x55f9
jne 0x40c274
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6d4], 4
jne 0x40c238
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x69c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xe4]
jmp 0x40c25f
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp - 0x3e10]
mov eax, dword [edx + 0x69c]
mov ecx, dword [ebp - 0x3e10]
mov edx, dword [ecx + 0x69c]
mov ecx, dword [edx]
push eax
call dword [ecx + 0xe4]
mov edx, dword [ebp + 0x10]
xor eax, eax
cmp dword [edx], 0
sete al
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x40c307
cmp dword [ebp + 0xc], 0x55f7
jne 0x40c28e
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x3e10]
call fcn.004090e2
jmp 0x40c307
cmp dword [ebp + 0xc], 0x59d8
jne 0x40c2a6
push 1
mov ecx, dword [ebp - 0x3e10]
call fcn.00412626
jmp 0x40c307
cmp dword [ebp + 0xc], 0x59d9
jne 0x40c2be
push 2
mov ecx, dword [ebp - 0x3e10]
call fcn.00412626
jmp 0x40c307
cmp dword [ebp + 0xc], 0x55fd
jne 0x40c307
mov eax, dword [ebp - 0x3e10]
cmp dword [eax + 0x6b0], 0
je 0x40c2e7
mov ecx, dword [ebp - 0x3e10]
mov ecx, dword [ecx + 0x6b0]
call fcn.0042f01a
mov edx, dword [ebp - 0x3e10]
cmp dword [edx + 0x6b4], 0
je 0x40c307
mov eax, dword [ebp - 0x3e10]
mov ecx, dword [eax + 0x6b4]
call fcn.0042f01a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc