Function at 0x417ff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x417ff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4197fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00405c48
mov eax, dword [ebp - 0x30]
mov edx, 0x419814
call fcn.00403a54
jne 0x418040
push 1
push 0x41981c
call sub.kernel32.dll_WinExec
call fcn.00403590
lea ecx, [ebp - 0x38]
xor edx, edx
xor eax, eax
call fcn.00417378
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00406114
mov eax, dword [ebp - 0x34]
call fcn.004061ac
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00405c48
mov eax, dword [ebp - 0x3c]
call fcn.0040bd4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffdc
call fcn.00407484
mov edx, 0x41b84c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00407394
mov edx, 0x41b854
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00407394
mov edx, 0x41b85c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00407394
mov edx, 0x41b864
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00407394
mov edx, 0x41b87c
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00407394
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00407394
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00407394
lea edx, [ebp - 0x29]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00407394
cmp byte [ebp - 0x29], 0xf1
je 0x418143
mov eax, dword [ebp - 0x10]
call fcn.0040b304
xor eax, eax
call fcn.0041743c
push 0x10
push 0x419828
push 0x419830
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA_1
call fcn.00403590
mov eax, dword [0x41b84c]
mov edx, dword [0x41b850]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x41815d
call fcn.00402d08
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00407484
xor eax, eax
mov al, byte [ebp - 0x2a]
inc eax
push eax
mov eax, 0x41b828
mov ecx, 1
mov edx, dword [0x416fa0]
call fcn.00404328
add esp, 4
xor ebx, ebx
mov bl, byte [ebp - 0x2a]
test ebx, ebx
jl 0x4181c1
inc ebx
xor esi, esi
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x40]
mov eax, dword [0x41b828]
test eax, eax
je 0x4181b0
cmp esi, dword [eax - 4]
jb 0x4181b5
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x418194
mov eax, 0x62
call fcn.00417368
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x41b844
mov ecx, 1
mov edx, dword [0x417080]
call fcn.00404328
add esp, 4
dec ebx
test ebx, ebx
jl 0x418220
inc ebx
xor esi, esi
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x44]
mov eax, dword [0x41b844]
test eax, eax
je 0x41820f
cmp esi, dword [eax - 4]
jb 0x418214
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x4181f3
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x418318
inc ebx
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x41b844]
test edx, edx
je 0x418246
cmp eax, dword [edx - 4]
jb 0x41824b
call fcn.00402d08
mov eax, dword [edx + eax*4]
call fcn.0040bbb0
test eax, eax
jns 0x41825c
call fcn.00402d08
mov edx, esi
shl edx, 2
add edx, 2
mov ecx, dword [0x41b844]
test ecx, ecx
je 0x418273
cmp edx, dword [ecx - 4]
jb 0x418278
call fcn.00402d08
mov edx, dword [ecx + edx*4]
push edx
mov edx, esi
shl edx, 2
inc edx
mov ecx, dword [0x41b844]
test ecx, ecx
je 0x418291
cmp edx, dword [ecx - 4]
jb 0x418296
call fcn.00402d08
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.004176d4
mov edx, dword [ebp - 0x48]
mov eax, dword [0x41b844]
test eax, eax
je 0x4182b0
cmp esi, dword [eax - 4]
jb 0x4182b5
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
mov eax, dword [0x41b844]
test eax, eax
je 0x4182cb
cmp esi, dword [eax - 4]
jb 0x4182d0
call fcn.00402d08
cmp dword [eax + esi*4], 0
jne 0x418310
mov eax, dword [0x41b844]
test eax, eax
je 0x4182e4
cmp esi, dword [eax - 4]
jb 0x4182e9
call fcn.00402d08
lea eax, [eax + esi*4]
mov edx, esi
shl edx, 2
add edx, 3
mov ecx, dword [0x41b844]
test ecx, ecx
je 0x418303
cmp edx, dword [ecx - 4]
jb 0x418308
call fcn.00402d08
mov edx, dword [ecx + edx*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x41822e
push edi
mov eax, 0x41b844
mov ecx, 1
mov edx, dword [0x417080]
call fcn.00404328
add esp, 4
mov eax, 0x6e
call fcn.00417340
mov byte [0x41a654], al
call fcn.00405d54
mov ebx, eax
test ebx, ebx
jle 0x4185a2
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00405c48
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040bbe4
mov eax, dword [ebp - 8]
mov edx, 0x419880
call fcn.00403a54
jne 0x41837f
mov byte [0x41a654], 1
mov eax, dword [ebp - 8]
mov edx, 0x41988c
call fcn.00403a54
jne 0x418395
mov byte [0x41a658], 1
mov eax, dword [ebp - 8]
mov edx, 0x419898
call fcn.00403a54
jne 0x4183ca
mov eax, 0x6b
mov edx, dword [0x41b828]
test edx, edx
je 0x4183b8
cmp eax, dword [edx - 4]
jb 0x4183bd
call fcn.00402d08
lea eax, [edx + eax*4]
mov edx, 0x4198a4
call fcn.004036fc
mov eax, dword [ebp - 8]
mov edx, 0x4198b0
call fcn.00403a54
jne 0x4183ff
mov eax, 0x3f
mov edx, dword [0x41b828]
test edx, edx
je 0x4183ed
cmp eax, dword [edx - 4]
jb 0x4183f2
call fcn.00402d08
lea eax, [edx + eax*4]
mov edx, 0x4198a4
call fcn.004036fc
lea eax, [ebp - 0x4c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403b68
mov eax, dword [ebp - 0x4c]
mov edx, 0x4198bc
call fcn.00403a54
jne 0x41846e
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
call fcn.00403908
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00403b68
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00405e38
mov edx, dword [ebp - 0x50]
mov eax, 0x3a
mov ecx, dword [0x41b828]
test ecx, ecx
je 0x418461
cmp eax, dword [ecx - 4]
jb 0x418466
call fcn.00402d08
lea eax, [ecx + eax*4]
call fcn.004036fc
lea eax, [ebp - 0x58]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403b68
mov eax, dword [ebp - 0x58]
mov edx, 0x4198c8
call fcn.00403a54
jne 0x4184c7
mov eax, 0x6a
mov edx, dword [0x41b828]
test edx, edx
je 0x4184a7
cmp eax, dword [edx - 4]
jb 0x4184ac
call fcn.00402d08
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403908
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00403b68
lea eax, [ebp - 0x5c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403b68
mov eax, dword [ebp - 0x5c]
mov edx, 0x4198d4
call fcn.00403a54
jne 0x418508
push 0x41b86c
mov eax, dword [ebp - 8]
call fcn.00403908
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00403b68
lea eax, [ebp - 0x60]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00403b68
mov eax, dword [ebp - 0x60]
mov edx, 0x4198e0
call fcn.00403a54
jne 0x41859a
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
call fcn.00403908
mov ecx, eax
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.00403b68
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00417524
mov edx, dword [ebp - 0x64]
mov eax, 0x1d
mov ecx, dword [0x41b828]
test ecx, ecx
je 0x41856a
cmp eax, dword [ecx - 4]
jb 0x41856f
call fcn.00402d08
mov eax, dword [ecx + eax*4]
call fcn.00403a54
jne 0x41859a
mov eax, 0x1d
mov edx, dword [0x41b828]
test edx, edx
je 0x41858d
cmp eax, dword [edx - 4]
jb 0x418592
call fcn.00402d08
lea eax, [edx + eax*4]
call fcn.004036a8
inc esi
dec ebx
jne 0x418354
cmp byte [0x41a654], 0
je 0x4185d6
mov eax, 0x1d
mov edx, dword [0x41b828]
test edx, edx
je 0x4185bf
cmp eax, dword [edx - 4]
jb 0x4185c4
call fcn.00402d08
cmp dword [edx + eax*4], 0
je 0x4185d6
mov al, 1
call fcn.0041743c
call fcn.00403590
mov eax, 0x41
mov edx, dword [0x41b828]
test edx, edx
je 0x4185ea
cmp eax, dword [edx - 4]
jb 0x4185ef
call fcn.00402d08
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x6c]
xor edx, edx
call fcn.004125a8
mov edx, dword [ebp - 0x6c]
mov eax, 0x41b878
call fcn.004036fc
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
mov edx, dword [0x41b878]
call fcn.0040ca04
cmp byte [0x41a654], 0
jne 0x418638
push 5
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
jmp 0x418646
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
xor edx, edx
call fcn.00408868
mov eax, 0x32
call fcn.00417368
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x41b81c
mov ecx, 1
mov edx, dword [0x416f40]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4186a7
inc ebx
xor esi, esi
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x70]
mov eax, dword [0x41b81c]
test eax, eax
je 0x418696
cmp esi, dword [eax - 4]
jb 0x41869b
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x41867a
mov eax, 0x60
call fcn.00417368
lea edi, [eax + eax*2]
push edi
mov eax, 0x41b840
mov ecx, 1
mov edx, dword [0x417060]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x418704
inc ebx
xor esi, esi
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x74]
mov eax, dword [0x41b840]
test eax, eax
je 0x4186f3
cmp esi, dword [eax - 4]
jb 0x4186f8
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x4186d7
mov eax, 0x1f
call fcn.00417368
mov edi, eax
add edi, edi
push edi
mov eax, 0x41b848
mov ecx, 1
mov edx, dword [0x4170a0]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x418762
inc ebx
xor esi, esi
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x78]
mov eax, dword [0x41b848]
test eax, eax
je 0x418751
cmp esi, dword [eax - 4]
jb 0x418756
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x418735
mov eax, 0x36
call fcn.00417368
mov edi, eax
shl edi, 3
push edi
mov eax, 0x41b818
mov ecx, 1
mov edx, dword [0x416f20]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4187c1
inc ebx
xor esi, esi
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x41b818]
test eax, eax
je 0x4187b0
cmp esi, dword [eax - 4]
jb 0x4187b5
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x418794
mov eax, 0x43
call fcn.00417368
lea edi, [eax + eax*2]
push edi
mov eax, 0x41b820
mov ecx, 1
mov edx, dword [0x416f60]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x41881e
inc ebx
xor esi, esi
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x80]
mov eax, dword [0x41b820]
test eax, eax
je 0x41880d
cmp esi, dword [eax - 4]
jb 0x418812
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x4187f1
mov eax, 0x5d
call fcn.00417368
mov edi, eax
add edi, edi
push edi
mov eax, 0x41b824
mov ecx, 1
mov edx, dword [0x416f80]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x418882
inc ebx
xor esi, esi
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x84]
mov eax, dword [0x41b824]
test eax, eax
je 0x418871
cmp esi, dword [eax - 4]
jb 0x418876
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x41884f
mov eax, 0x28
call fcn.00417368
mov ebx, eax
mov eax, 0x19
call fcn.00417368
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x41b814
mov ecx, 1
mov edx, dword [0x416f00]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4188f7
inc ebx
xor esi, esi
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x88]
mov eax, dword [0x41b814]
test eax, eax
je 0x4188e6
cmp esi, dword [eax - 4]
jb 0x4188eb
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x4188c4
mov eax, 0x18
call fcn.00417368
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x41b834
mov ecx, 1
mov edx, dword [0x417000]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x41895e
inc ebx
xor esi, esi
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x41b834]
test eax, eax
je 0x41894d
cmp esi, dword [eax - 4]
jb 0x418952
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x41892b
mov eax, 0x2d
call fcn.00417368
mov edi, eax
add edi, edi
push edi
mov eax, 0x41b838
mov ecx, 1
mov edx, dword [0x417020]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4189c2
inc ebx
xor esi, esi
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x90]
mov eax, dword [0x41b838]
test eax, eax
je 0x4189b1
cmp esi, dword [eax - 4]
jb 0x4189b6
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x41898f
mov eax, 0x14
call fcn.00417368
mov edi, eax
add edi, edi
push edi
mov eax, 0x41b83c
mov ecx, 1
mov edx, dword [0x417040]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x418a26
inc ebx
xor esi, esi
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x94]
mov eax, dword [0x41b83c]
test eax, eax
je 0x418a15
cmp esi, dword [eax - 4]
jb 0x418a1a
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x4189f3
mov eax, 0x1a
call fcn.00417368
mov edi, eax
shl edi, 2
push edi
mov eax, 0x41b830
mov ecx, 1
mov edx, dword [0x416fe0]
call fcn.00404328
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x418a8b
inc ebx
xor esi, esi
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x98]
mov eax, dword [0x41b830]
test eax, eax
je 0x418a7a
cmp esi, dword [eax - 4]
jb 0x418a7f
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x418a58
mov eax, 0x1a
call fcn.00417368
mov edi, eax
mov eax, 0x39
call fcn.00417368
imul edi, eax
lea eax, [edi + 1]
push eax
mov eax, 0x41b82c
mov ecx, 1
mov edx, dword [0x416fc0]
call fcn.00404328
add esp, 4
mov ebx, edi
test ebx, ebx
jle 0x418afe
mov esi, 1
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x41b82c]
test eax, eax
je 0x418aed
cmp esi, dword [eax - 4]
jb 0x418af2
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x418acb
mov eax, dword [0x41b85c]
mov edx, dword [0x41b860]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x418b18
call fcn.00402d08
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00407484
cmp byte [0x41b87c], 0
je 0x418ba5
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 2
call fcn.00417378
mov eax, dword [ebp - 8]
call fcn.0040bd74
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, 0x4198f0
call fcn.0040739c
push dword [0x41b858]
push dword [0x41b854]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004175b4
mov eax, dword [ebp - 0x14]
call fcn.0040b304
mov dl, 1
mov eax, dword [0x40e7d4]
call fcn.0040eba4
mov ebx, eax
lea eax, [ebp - 0xa0]
call fcn.004063c0
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040f030
mov eax, ebx
call fcn.00402d78
jmp 0x418c1e
xor ebx, ebx
mov bl, byte [ebp - 0x2b]
test ebx, ebx
jle 0x418c1e
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
call fcn.004063c0
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 8]
pop ecx
call fcn.00403954
mov eax, dword [ebp - 8]
call fcn.0040bd74
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0x10]
call fcn.00407404
mov eax, dword [ebp - 0xac]
call fcn.0040bbb0
mov edi, eax
mov eax, edi
cdq
push edx
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004175b4
mov eax, dword [ebp - 0x14]
call fcn.0040b304
dec ebx
jne 0x418bae
mov eax, dword [ebp - 0x10]
call fcn.0040b304
cmp dword [0x41b86c], 0
je 0x418cc6
mov byte [0x41a650], 0xff
mov eax, 0x1a
call fcn.00417368
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x418cb3
inc ebx
xor esi, esi
mov eax, esi
shl eax, 2
mov edx, dword [0x41b830]
test edx, edx
je 0x418c62
cmp eax, dword [edx - 4]
jb 0x418c67
call fcn.00402d08
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0xb0]
call fcn.0040bbe4
mov eax, dword [ebp - 0xb0]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [0x41b86c]
call fcn.0040bbe4
mov eax, dword [ebp - 0xb4]
pop edx
call fcn.00403c4c
test eax, eax
jle 0x418caf
mov eax, esi
cmp eax, 0xff
jbe 0x418caa
call fcn.00402d08
mov byte [0x41a650], al
inc esi
dec ebx
jne 0x418c4e
cmp byte [0x41a650], 0xff
jne 0x418cc6
mov eax, 0x41b86c
call fcn.004036a8
mov eax, 0x1a
call fcn.00417368
dec eax
jle 0x418d1d
cmp dword [0x41b86c], 0
jne 0x418d1d
mov edx, dword [0x41a6c8]
mov edx, dword [edx]
mov eax, dword [0x41a67c]
call fcn.0040fac0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00408878
mov eax, dword [0x41a67c]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00409b50
cmp byte [0x41a65c], 0
jne 0x418d1d
mov al, 1
call fcn.0041743c
call fcn.00403590
mov eax, 0x1a
call fcn.00417368
dec eax
jle 0x418dca
cmp byte [0x41a650], 0
jbe 0x418dca
mov eax, 0x41b86c
xor edx, edx
mov dl, byte [0x41a650]
shl edx, 2
mov ecx, dword [0x41b830]
test ecx, ecx
je 0x418d5a
cmp edx, dword [ecx - 4]
jb 0x418d5f
call fcn.00402d08
mov edx, dword [ecx + edx*4]
call fcn.004036fc
mov eax, 0x39
call fcn.00417368
mov ebx, eax
test ebx, ebx
jle 0x418ded
mov esi, 1
mov eax, 0x39
call fcn.00417368
xor edx, edx
mov dl, byte [0x41a650]
imul edx
add eax, esi
mov edx, dword [0x41b82c]
test edx, edx
je 0x418da1
cmp eax, dword [edx - 4]
jb 0x418da6
call fcn.00402d08
mov edx, dword [edx + eax*4]
mov eax, dword [0x41b82c]
test eax, eax
je 0x418db7
cmp esi, dword [eax - 4]
jb 0x418dbc
call fcn.00402d08
lea eax, [eax + esi*4]
call fcn.004036fc
inc esi
dec ebx
jne 0x418d7c
jmp 0x418ded
mov eax, 0x41b86c
xor edx, edx
mov ecx, dword [0x41b830]
test ecx, ecx
je 0x418de0
cmp edx, dword [ecx - 4]
jb 0x418de5
call fcn.00402d08
mov edx, dword [ecx + edx*4]
call fcn.004036fc
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x41a650]
shl edx, 2
add edx, 2
mov ecx, dword [0x41b830]
test ecx, ecx
je 0x418e0d
cmp edx, dword [ecx - 4]
jb 0x418e12
call fcn.00402d08
mov edx, dword [ecx + edx*4]
call fcn.00403740
cmp dword [ebp - 8], 0
je 0x418e3e
mov eax, dword [ebp - 8]
call fcn.0040bbb0
cmp eax, 0xff
jbe 0x418e34
call fcn.00402d08
mov edx, dword [0x41a698]
mov byte [edx], al
jmp 0x418e46
mov eax, dword [0x41a698]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x41a650]
shl edx, 2
add edx, 3
mov ecx, dword [0x41b830]
test ecx, ecx
je 0x418e66
cmp edx, dword [ecx - 4]
jb 0x418e6b
call fcn.00402d08
mov edx, dword [ecx + edx*4]
call fcn.00403740
cmp dword [ebp - 8], 0
je 0x418e97
mov eax, dword [ebp - 8]
call fcn.0040bbb0
cmp eax, 0xff
jbe 0x418e8d
call fcn.00402d08
mov edx, dword [0x41a708]
mov byte [edx], al
jmp 0x418e9f
mov eax, dword [0x41a708]
mov byte [eax], 0x10
mov eax, 0x3d
call fcn.00417368
call fcn.0040ac94
test al, al
je 0x418f52
cmp byte [0x41a654], 0
jne 0x418f46
push 0x30
mov eax, 0x41
mov edx, dword [0x41b828]
test edx, edx
je 0x418ed9
cmp eax, dword [edx - 4]
jb 0x418ede
call fcn.00402d08
mov eax, dword [edx + eax*4]
call fcn.00403b08
push eax
mov eax, 0x3e
mov edx, dword [0x41b828]
test edx, edx
je 0x418efb
cmp eax, dword [edx - 4]
jb 0x418f00
call fcn.00402d08
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x41b82c]
test edx, edx
je 0x418f17
cmp eax, dword [edx - 4]
jb 0x418f1c
call fcn.00402d08
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xb8]
call fcn.00403954
mov eax, dword [ebp - 0xb8]
call fcn.00403b08
push eax
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA_1
mov al, 1
call fcn.0041743c
call fcn.00403590
mov eax, 0x63
call fcn.00417340
test al, al
je 0x418fb4
call fcn.004178ac
test al, al
jne 0x418fb4
push 0x30
mov eax, dword [0x41b878]
call fcn.00403b08
push eax
mov eax, 0x55
mov edx, dword [0x41b82c]
test edx, edx
je 0x418f8a
cmp eax, dword [edx - 4]
jb 0x418f8f
call fcn.00402d08
mov eax, dword [edx + eax*4]
call fcn.00403b08
push eax
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA_1
mov al, 1
call fcn.0041743c
call fcn.00403590
mov eax, 0x64
call fcn.00417340
test al, al
je 0x41910d
mov eax, 0x64
mov edx, dword [0x41b828]
test edx, edx
je 0x418fda
cmp eax, dword [edx - 4]
jb 0x418fdf
call fcn.00402d08
mov eax, dword [edx + eax*4]
call fcn.00405748
fstp qword [ebp - 0x20]
wait
call fcn.00417734
fstp qword [ebp - 0x28]
wait
mov eax, 0x55
call fcn.00417340
test al, al
je 0x41900d
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jb 0x41902e
mov eax, 0x55
call fcn.00417340
test al, al
jne 0x41910d
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
je 0x41910d
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x41b82c]
test ecx, ecx
je 0x419045
cmp edx, dword [ecx - 4]
jb 0x41904a
call fcn.00402d08
mov edx, dword [ecx + edx*4]
call fcn.00403740
mov eax, 2
call fcn.00417340
test al, al
je 0x419098
mov esi, 4
push dword [ebp - 8]
push 0x419900
mov eax, 0x57
mov edx, dword [0x41b82c]
test edx, edx
je 0x419081
cmp eax, dword [edx - 4]
jb 0x419086
call fcn.00402d08
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004039c8
jmp 0x41909a
xor esi, esi
or esi, 0x30
test esi, esi
jns 0x4190a6
call fcn.00402d08
push esi
mov eax, dword [0x41b878]
call fcn.00403b08
push eax
mov eax, dword [ebp - 8]
call fcn.00403b08
push eax
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x419101
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x41b828]
test edx, edx
je 0x4190ea
cmp eax, dword [edx - 4]
jb 0x4190ef
call fcn.00402d08
mov eax, dword [edx + eax*4]
call fcn.00403b08
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov al, 1
call fcn.0041743c
call fcn.00403590
mov eax, 0x67
call fcn.00417340
test al, al
je 0x4191e7
lea eax, [ebp - 8]
mov edx, 0x68
mov ecx, dword [0x41b828]
test ecx, ecx
je 0x419136
cmp edx, dword [ecx - 4]
jb 0x41913b
call fcn.00402d08
mov edx, dword [ecx + edx*4]
call fcn.00403740
mov eax, 0x69
call fcn.00417368
cmp eax, 2
jge 0x4191c1
mov ebx, 1
xor esi, esi
jmp 0x4191b7
mov esi, ebx
mov eax, 0x69
call fcn.00417368
sub eax, 1
jb 0x419170
je 0x419184
jmp 0x41918e
mov eax, dword [ebp - 8]
call fcn.00403b08
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
jmp 0x41918e
mov eax, dword [ebp - 8]
call fcn.00417c80
mov ebx, eax
test ebx, ebx
je 0x4191b7
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x28]
je 0x4191b7
mov eax, dword [0x41b810]
mov eax, dword [eax + 0x18]
cmp ebx, dword [eax + 0x28]
je 0x4191b7
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
je 0x4191e7
cmp ebx, esi
jne 0x41915b
jmp 0x4191e7
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040bbe4
call fcn.0040e668
cmp al, 3
jbe 0x4191df
mov eax, dword [ebp - 0xc]
call fcn.00417e80
jmp 0x4191e7
mov eax, dword [ebp - 0xc]
call fcn.00417d70
mov eax, 1
call fcn.00417340
test al, al
je 0x41964d
cmp byte [0x41a654], 0
jne 0x41964d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cfc8
xor edx, edx
call fcn.004054e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.0040acb0
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040cf28
call fcn.0040cb98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cdfc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cdd4
pop edx
call fcn.0040d6d4
mov edx, dword [0x41a6c4]
mov dword [edx], eax
mov eax, 3
call fcn.00417340
test al, al
je 0x4192ee
mov eax, 6
call fcn.00417340
xor al, 1
push eax
mov eax, 4
call fcn.00417368
push eax
mov eax, 5
call fcn.00417368
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cdfc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cdd4
push eax
mov eax, dword [0x41a6c4]
mov eax, dword [eax]
call fcn.0040db08
call fcn.0040b9f0
pop edx
pop ecx
call fcn.00417994
mov eax, dword [0x41a6c4]
mov eax, dword [eax]
call fcn.00409e44
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cfc8
pop edx
call fcn.004054e4
jmp 0x419474
xor edx, edx
xor eax, eax
call fcn.0040d6d4
mov edx, dword [0x41a69c]
mov dword [edx], eax
lea ecx, [ebp - 0xbc]
xor edx, edx
mov eax, 6
call fcn.00417378
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x41a69c]
mov eax, dword [eax]
call fcn.0040dba8
mov eax, 7
call fcn.00417368
sub eax, 1
jb 0x419340
je 0x419363
dec eax
je 0x4193be
jmp 0x419474
mov eax, dword [0x41a69c]
mov eax, dword [eax]
call fcn.00409e44
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cfc8
pop edx
call fcn.004054e4
jmp 0x419474
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cbd8
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [0x41a6c4]
mov eax, dword [eax]
call fcn.0040db08
call fcn.0040b9f0
mov edx, eax
mov eax, dword [0x41a69c]
mov eax, dword [eax]
pop ecx
call fcn.0040d8ac
mov eax, dword [0x41a6c4]
mov eax, dword [eax]
call fcn.00409e44
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cfc8
pop edx
call fcn.004054e4
jmp 0x419474
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cdfc
mov edx, dword [0x41a69c]
mov edx, dword [edx]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xd0], eax
fild dword [ebp - 0xd0]
fdiv dword [0x419904]
call fcn.00402984
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4193f9
call fcn.00402d08
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cdd4
mov edx, dword [0x41a69c]
mov edx, dword [edx]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xd4], eax
fild dword [ebp - 0xd4]
fdiv dword [0x419904]
call fcn.00402984
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x419435
call fcn.00402d08
push eax
mov eax, dword [0x41a6c4]
mov eax, dword [eax]
call fcn.0040db08
call fcn.0040b9f0
mov edx, eax
mov eax, dword [0x41a69c]
mov eax, dword [eax]
pop ecx
call fcn.0040d7fc
mov eax, dword [0x41a6c4]
mov eax, dword [eax]
call fcn.00409e44
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cfc8
pop edx
call fcn.004054e4
mov eax, 8
mov edx, dword [0x41b828]
test edx, edx
je 0x419488
cmp eax, dword [edx - 4]
jb 0x41948d
call fcn.00402d08
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd8]
xor edx, edx
call fcn.004125a8
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040ca04
mov eax, 9
mov edx, dword [0x41b828]
test edx, edx
je 0x4194c2
cmp eax, dword [edx - 4]
jb 0x4194c7
call fcn.00402d08
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xdc]
xor edx, edx
call fcn.004125a8
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ca04
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040cf90
mov ebx, eax
mov eax, 0xa
call fcn.00417368
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.0040b5c0
mov eax, 0xb
mov edx, dword [0x41b828]
test edx, edx
je 0x419521
cmp eax, dword [edx - 4]
jb 0x419526
call fcn.00402d08
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00405534
mov eax, 0xc
call fcn.00417368
mov edx, eax
mov eax, ebx
call fcn.004054c4
mov eax, 0xd
call fcn.00417368
mov edx, eax
cmp edx, 0xff
jbe 0x41955c
call fcn.00402d08
mov eax, ebx
call fcn.00405524
mov eax, 0xe
call fcn.00417368
mov edx, eax
mov eax, ebx
call fcn.0040b5f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040cf90
mov ebx, eax
mov eax, 0xf
call fcn.00417368
mov edx, eax
mov eax, ebx
call fcn.0040b5f4
mov eax, 0x10
call fcn.00417368
mov edx, eax
mov eax, ebx
call fcn.004054c4
mov eax, 0x11
call fcn.00417368
mov edx, eax
cmp edx, 0xff
jbe 0x4195c2
call fcn.00402d08
mov eax, ebx
call fcn.00405524
mov eax, 0x12
call fcn.00417368
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.0040b5c0
mov eax, 0x13
mov edx, dword [0x41b828]
test edx, edx
je 0x4195f5
cmp eax, dword [edx - 4]
jb 0x4195fa
call fcn.00402d08
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00405534
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cdfc
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040cdfc
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040cdd4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040cdd4
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.0040acb0
jmp 0x419658
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00408878
mov eax, 0x31
call fcn.00417340
test al, al
je 0x41969b
xor edx, edx
xor eax, eax
call fcn.0040d6d4
mov edx, dword [0x41a6c0]
mov dword [edx], eax
lea ecx, [ebp - 0xe0]
xor edx, edx
mov eax, 4
call fcn.00417378
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x41a6c0]
mov eax, dword [eax]
call fcn.0040dba8
mov eax, 0x3f
call fcn.00417340
test al, al
je 0x4196de
xor edx, edx
xor eax, eax
call fcn.0040d6d4
mov edx, dword [0x41a6a4]
mov dword [edx], eax
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, 5
call fcn.00417378
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x41a6a4]
mov eax, dword [eax]
call fcn.0040dba8
mov eax, 0x70
call fcn.00417340
test al, al
je 0x419721
xor edx, edx
xor eax, eax
call fcn.0040d6d4
mov edx, dword [0x41a6ac]
mov dword [edx], eax
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, 7
call fcn.00417378
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x41a6ac]
mov eax, dword [eax]
call fcn.0040dba8
mov eax, 0x58
call fcn.00417340
test al, al
jne 0x41974b
mov eax, 0x59
call fcn.00417340
test al, al
jne 0x41974b
mov eax, 0x5a
call fcn.00417340
test al, al
je 0x419780
xor edx, edx
xor eax, eax
call fcn.0040d6d4
mov edx, dword [0x41a6d8]
mov dword [edx], eax
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, 8
call fcn.00417378
mov edx, dword [ebp - 0xec]
mov eax, dword [0x41a6d8]
mov eax, dword [eax]
call fcn.0040dba8
mov eax, 0x1d
call fcn.00417340
test al, al
je 0x4197c3
xor edx, edx
xor eax, eax
call fcn.0040d6d4
mov edx, dword [0x41a714]
mov dword [edx], eax
lea ecx, [ebp - 0xf0]
xor edx, edx
mov eax, 9
call fcn.00417378
mov edx, dword [ebp - 0xf0]
mov eax, dword [0x41a714]
mov eax, dword [eax]
call fcn.0040dba8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419805
lea eax, [ebp - 0xf0]
mov edx, 7
call fcn.004036cc
lea eax, [ebp - 0xbc]
mov edx, 0x24
call fcn.004036cc
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004036cc
ret