Function at 0x421957
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x422d4d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x268], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x208], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x194]
movzx eax, byte [eax]
test eax, eax
je 0x422d16
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1a8]
movzx eax, byte [eax]
test eax, eax
je 0x422cd2
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x28], eax
push 0x7821
push 1
push 0x6741
push 0xcbf
push 0x6567
push 1
push 1
push 0x6d65
push 0x7e31
push 0x384c
push 0x4c9
push 0x3e49
push 1
push 0x286a
push 1
push 0xbe5
push 0x3fe8
call fcn.0041f714
add esp, 0x44
push 0x14
push 0
push 0x4160
push 0x47e7
call fcn.00406fbc
pop ecx
pop ecx
call eax
push eax
push 0x4160
push 0x4c41
call fcn.00406fbc
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov dword [ebp - 0x74], 0x495e0e2b
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x120], 0x2a2c7a2e
mov dword [ebp - 0x1c0], 0x598737a3
mov dword [ebp - 0x128], 0x7618de0f
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x180], 0x685e9d07
mov dword [ebp - 0x1c8], 0x3821c760
mov dword [ebp - 0x20], 0
jmp 0x421b41
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x421b54
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x34], 0xb5934215
jmp 0x421b3a
mov dword [ebp - 0x20], 0
jmp 0x421b64
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x421b7a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x158], 4
jmp 0x421b5d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0x28c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0x2c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x34]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x34]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x34]
jge 0x421bde
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
je 0x421bde
mov dword [ebp - 0x130], 1
jmp 0x421be5
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x74], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x74], eax
jg 0x421c0c
cmp dword [ebp - 0x74], 0
jne 0x421c0c
and dword [ebp - 0x174], 0
jmp 0x421c16
mov dword [ebp - 0x174], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
imul eax, dword [ebp - 0x174]
mov dword [ebp - 0x17c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x17c]
mov dword [ebp + eax - 0x158], ecx
cmp dword [ebp - 0x17c], 0
jne 0x421c5f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jne 0x421c5f
and dword [ebp - 0x184], 0
jmp 0x421c69
mov dword [ebp - 0x184], 1
cmp dword [ebp - 0x184], 0x910a
jle 0x421c81
mov dword [ebp - 0xa0], 1
jmp 0x421c88
and dword [ebp - 0xa0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0xa0], eax
jne 0x421ca9
cmp dword [ebp - 0x80], 0
jne 0x421ca9
and dword [ebp - 0x118], 0
jmp 0x421cb3
mov dword [ebp - 0x118], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x118], eax
jne 0x421cd1
mov dword [ebp - 0xa8], 1
jmp 0x421cd8
and dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 2
jne 0x421ced
mov dword [ebp - 0x170], 1
jmp 0x421cf4
and dword [ebp - 0x170], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x170], eax
jge 0x421d12
mov dword [ebp - 0xb0], 1
jmp 0x421d19
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x120], eax
jne 0x421d3f
mov dword [ebp - 0xb8], 1
jmp 0x421d46
and dword [ebp - 0xb8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp eax, dword [ebp - 0xb8]
jne 0x421d64
mov dword [ebp - 0x228], 1
jmp 0x421d6b
and dword [ebp - 0x228], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x80]
cmp dword [ebp + eax - 0x158], ecx
jle 0x421d89
mov dword [ebp - 0xc0], 1
jmp 0x421d90
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0xc0]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
neg eax
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x88], 4
mov dword [ebp - 0x6c], 0x11151
mov dword [ebp - 0x1d8], 0x823aaf5b
cmp dword [ebp - 0x24], 0
jg 0x421e07
mov dword [ebp - 0xd0], 1
jmp 0x421e0e
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xd0], eax
jne 0x421e3a
mov dword [ebp - 0x230], 1
jmp 0x421e41
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x6c], 0
je 0x421ec1
mov dword [ebp - 0x238], 0x8f0d0714
mov dword [ebp - 0x1d0], 0x65c
lea eax, [ebp - 0x1d0]
push eax
push 1
push 0x5f5a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x238]
push eax
push 1
push 1
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x1d8]
push eax
push 0x1eb9
push 0x36fb
push 0x3296
push 1
push 0x732f
push 0
push 0x5bcb
push 0x1099
call fcn.0041f714
add esp, 0x44
jmp 0x421f0e
push 1
push 0x3747
push 1
push 0x2356
push 1
push 0x281e
push 1
push 1
push 0x13de
call fcn.0041fb95
add esp, 0x24
mov byte [ebp - 0x29], 0
push 0x7f4d
push 1
push 1
push 0x1ab3
push 1
push 0x78ea
lea eax, [ebp - 0x29]
push eax
push 1
call fcn.0041cb75
add esp, 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x3d6f
push 0x393c
push 1
push 0x4661
push 0x2d3b
push 1
push 1
push 0x626
call fcn.00420e40
add esp, 0x28
push 1
push 0x7b0c
push 1
push 1
push 1
lea eax, [ebp - 0x28]
push eax
push 0x4aff
push 0x208d
push 1
push 0x56a2
call fcn.0041a494
add esp, 0x28
mov dword [ebp - 8], 7
mov dword [ebp - 0x98], 0x1e87df2f
mov dword [ebp - 0x240], 7
mov dword [ebp - 0x248], 0xb51f
mov dword [ebp - 0x50], 0
jmp 0x421f9c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x421fb2
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x94], 0x8256
jmp 0x421f95
mov eax, dword [ebp - 8]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x422176
mov dword [ebp - 0x1c], 0
jmp 0x421fd8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x421fee
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd8], 0
jmp 0x421fd1
mov dword [ebp - 0x1c], 0
jmp 0x421ffe
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x422014
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x288], 0xffffffff
jmp 0x421ff7
mov dword [ebp - 8], 0
jmp 0x422024
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jg 0x422174
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x94], 0
je 0x4220db
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x94]
mov dword [ebp - 0x2dc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94]
mov dword [ebp - 0x2e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0
jne 0x42208b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0
jne 0x42208b
and dword [ebp - 0x160], 0
jmp 0x422095
mov dword [ebp - 0x160], 1
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x94]
cmp dword [ebp - 0x160], eax
jge 0x4220b4
xor eax, eax
jne 0x4220b4
and dword [ebp - 0xe0], 0
jmp 0x4220be
mov dword [ebp - 0xe0], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x240]
imul ecx, dword [ebp - 0xe0]
imul ecx, ecx, 0xfff6
cmp dword [ebp + eax*4 - 0x94], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x288], 0
je 0x422107
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 0
je 0x422107
mov dword [ebp - 0x138], 1
jmp 0x42210e
and dword [ebp - 0x138], 0
cmp dword [ebp - 0x138], 0x7bdd
jge 0x422126
mov dword [ebp - 0xe8], 1
jmp 0x42212d
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x94]
add eax, dword [ebp - 0xe8]
je 0x422152
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x288], 0x4fd52280
jmp 0x42216f
push 1
push 0x3884
push 0x48c2
push 0x7e8f
push 1
push 1
call fcn.0041a7a0
add esp, 0x18
jmp 0x42201d
jmp 0x4221a3
mov dword [ebp - 0x1e0], 0xc0336ae3
push 1
lea eax, [ebp - 0x1e0]
push eax
push 1
push 1
lea eax, [ebp - 0x248]
push eax
push 0x6961
push 0
call fcn.0041d1a0
add esp, 0x1c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
and dword [eax + 8], 0
mov dword [ebp - 0x84], 0x82a10aa4
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x2f8], 0xffffffff
mov dword [ebp - 0x64], 0xfff9
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x2e8], 8
mov dword [ebp - 0x298], 0xfffffff8
mov dword [ebp - 0x244], 0xe9f21c9b
mov dword [ebp - 0x2c8], 0xffffffff
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x1fc], 0xfc35327
mov dword [ebp - 0x258], 0xfffffff8
mov dword [ebp - 0x1f4], 0x7b6a
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x1e8], 3
mov dword [ebp - 0x280], 0xffffffff
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x14], 0
jmp 0x42225d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x422273
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2f0], 0x56a218f0
jmp 0x422256
mov dword [ebp - 0x14], 0
jmp 0x422283
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x422299
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x190], 0
jmp 0x42227c
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
jne 0x4222c3
cmp dword [ebp - 0x84], 0
jne 0x4222c3
and dword [ebp - 0x178], 0
jmp 0x4222cd
mov dword [ebp - 0x178], 1
cmp dword [ebp - 0x178], 0xffffffff
jne 0x4222e2
mov dword [ebp - 0xf0], 1
jmp 0x4222e9
and dword [ebp - 0xf0], 0
imul eax, dword [ebp - 0xf0], 0
test eax, eax
jg 0x422300
mov dword [ebp - 0x140], 1
jmp 0x422307
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x140], eax
jg 0x422321
mov dword [ebp - 0x250], 1
jmp 0x422328
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x1f4], 0x92cebb36
ja 0x42234c
mov dword [ebp - 0xf8], 1
jmp 0x422353
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x64], eax
jl 0x422374
mov dword [ebp - 0x23c], 1
jmp 0x42237b
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x84], eax
je 0x4223a1
mov dword [ebp - 0x168], 1
jmp 0x4223a8
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x168], eax
jle 0x4223c2
mov dword [ebp - 0x100], 1
jmp 0x4223c9
and dword [ebp - 0x100], 0
cmp dword [ebp - 0x100], 0xb87840ef
ja 0x4223e1
mov dword [ebp - 0x148], 1
jmp 0x4223e8
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x2f0]
cmp eax, dword [ebp - 0x244]
je 0x422418
mov dword [ebp - 0x108], 1
jmp 0x42241f
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x20c]
add eax, dword [ebp - 0x108]
cmp eax, 1
je 0x42243c
mov dword [ebp - 0x188], 1
jmp 0x422443
and dword [ebp - 0x188], 0
cmp dword [ebp - 0x188], 0xfffb
jne 0x42245b
mov dword [ebp - 0x110], 1
jmp 0x422462
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
neg eax
jne 0x422580
mov dword [ebp - 0x264], 0xfffffffd
mov dword [ebp - 0xac], 0x4cb52c22
mov dword [ebp - 0x18], 0
jmp 0x422494
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x42257e
mov dword [ebp - 0x214], 0xd2e7865d
mov eax, 0x29123eba
test eax, eax
je 0x422538
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x190]
mov ecx, dword [ebp - 0x18]
imul eax, dword [ebp + ecx*4 - 0x190]
cmp eax, dword [ebp - 0x264]
jne 0x4224de
mov dword [ebp - 0x150], 1
jmp 0x4224e5
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x150], eax
jg 0x4224ff
mov dword [ebp - 0x9c], 1
jmp 0x422506
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x190]
cmp dword [ebp - 0x9c], eax
jg 0x422531
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x190], 0
je 0x422531
mov dword [ebp - 0xa4], 1
jmp 0x422538
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xac], eax
mov eax, 0x2e93
test eax, eax
jne 0x422563
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x190], 0
jne 0x422563
and dword [ebp - 0xb4], 0
jmp 0x42256d
mov dword [ebp - 0xb4], 1
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x214], eax
jmp 0x42248d
jmp 0x42259f
push 1
push 1
push 1
push 0x7687
push 0x494a
push 0x2846
push 1
call fcn.0041d2ba
add esp, 0x1c
lea eax, [ebp - 0x28]
push eax
push 1
push 1
push 0x5a2b
push 0
push 0x413b
push 0x2845
push 1
call fcn.0041cb75
add esp, 0x20
push 4
push 0x1000
mov eax, dword [ebp - 0x7c]
push dword [eax + 0x50]
mov eax, dword [ebp - 0x48]
push dword [eax]
push 0x4160
push 0x38ac
call fcn.00406fbc
pop ecx
pop ecx
call eax
push 4
push 0x1000
mov eax, dword [ebp - 0x7c]
push dword [eax + 0x54]
mov eax, dword [ebp - 0x48]
push dword [eax]
push 0x4160
push 0x38ac
call fcn.00406fbc
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x7c]
add eax, dword [ecx + 0x54]
push eax
push dword [ebp - 0x70]
mov eax, dword [ebp - 0x68]
push dword [eax]
call fcn.0040764b
add esp, 0xc
mov dword [ebp - 0x24c], 8
mov dword [ebp - 0xbc], 0x67d50f82
mov dword [ebp - 0x21c], 0xd53a38d0
mov dword [ebp - 0x44], 0
jmp 0x42265c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x422672
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x2d0], 0x6711db60
jmp 0x422655
lea eax, [ebp - 0x24c]
push eax
push 1
push 1
lea eax, [ebp - 0xbc]
push eax
push 1
push 0x210d
push 1
lea eax, [ebp - 0x21c]
push eax
push 0x4f98
call fcn.0041afb9
add esp, 0x24
push 1
push 1
push 0x50d4
push 0x668e
push 0x1f41
lea eax, [ebp - 0xbc]
push eax
push 0x5642
push 1
call fcn.0042127a
add esp, 0x20
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [ecx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x274], 0x3c86992f
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0xd4], 0x919c44d4
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x422718
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x42272b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x60], 1
jmp 0x422711
mov dword [ebp - 0xc], 0
jmp 0x42273b
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x422751
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x10c], 0x4811
jmp 0x422734
mov dword [ebp - 4], 0
jmp 0x422761
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jg 0x422c9e
mov dword [ebp - 0x78], 1
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x60], 0
je 0x422781
jmp 0x422c9e
cmp dword [ebp - 0x274], 0xffffffff
jl 0x422796
mov dword [ebp - 0x224], 1
jmp 0x42279d
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x60], 0xfffffff8
jg 0x4227bc
mov dword [ebp - 0xc4], 1
jmp 0x4227c3
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0xc4]
neg eax
cmp eax, 0xfffffffd
jbe 0x4227dc
mov dword [ebp - 0xcc], 1
jmp 0x4227e3
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
sub eax, 0xdc86
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x60]
jg 0x422818
mov dword [ebp - 0xdc], 1
jmp 0x42281f
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0xdc], eax
jle 0x42283a
mov dword [ebp - 0xe4], 1
jmp 0x422841
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xe4]
jge 0x422858
mov dword [ebp - 0xec], 1
jmp 0x42285f
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, dword [ebp - 0xec]
jle 0x42287a
mov dword [ebp - 0x254], 1
jmp 0x422881
and dword [ebp - 0x254], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
mov ecx, dword [ebp - 4]
imul eax, dword [ebp + ecx*4 - 0x60]
mov ecx, dword [ebp - 4]
cmp eax, dword [ebp + ecx*4 - 0x60]
jle 0x4228b8
mov dword [ebp - 0x22c], 1
jmp 0x4228bf
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 4], 0
je 0x422aa1
mov dword [ebp - 0x10], 9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x10], 0
jne 0x42295e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
add eax, 0x8bc1
cmp eax, 0xfffffffb
jge 0x42291f
push 9
pop eax
test eax, eax
jne 0x42291f
and dword [ebp - 0xf4], 0
jmp 0x422929
mov dword [ebp - 0xf4], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xf4]
jg 0x422940
mov dword [ebp - 0xfc], 1
jmp 0x422947
and dword [ebp - 0xfc], 0
imul eax, dword [ebp - 0xfc], 0xf833
test eax, eax
jne 0x42295e
and dword [ebp - 0x104], 0
jmp 0x422968
mov dword [ebp - 0x104], 1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x104]
cmp eax, 1
ja 0x422983
mov dword [ebp - 0x26c], 1
jmp 0x42298a
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x294], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
cmp dword [ebp + eax - 0x10c], ecx
jle 0x4229b5
mov dword [ebp - 0x114], 1
jmp 0x4229bc
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
neg eax
jne 0x4229ce
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x60], 0
mov eax, 0x21eb1ed3
cmp eax, 0xffffffff
je 0x4229e4
mov dword [ebp - 0x11c], 1
jmp 0x4229eb
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0x11c], eax
jne 0x422a4c
mov dword [ebp - 0x234], 5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x60], ecx
mov dword [ebp - 0x10], 0xffffffef
jmp 0x422a21
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x36
jl 0x422a4a
push 0x6f7a
push 1
push 1
push 0x3298
push 0x512
lea eax, [ebp - 0x38]
push eax
push 1
call fcn.0042154a
add esp, 0x1c
jmp 0x422a1a
jmp 0x422a9c
push 1
push 0x4701
push 0x66
push 1
push 1
lea eax, [ebp - 0x78]
push eax
push 0x2bf3
call fcn.0041c02b
add esp, 0x1c
push 1
push 0x74f3
push 0x437c
push 1
push 0x29b0
push 0x6d55
push 1
push 0x2e98
push 1
push 0x22c2
lea eax, [ebp - 0x38]
push eax
call fcn.0041c45b
add esp, 0x2c
jmp 0x422c99
mov dword [ebp - 0x3c], 0xa137
mov dword [ebp - 0x1f8], 0xffff
mov dword [ebp - 0x16c], 0x90efdf24
mov dword [ebp - 0x198], 0xbe2d7e08
mov dword [ebp - 0x4c], 0
jmp 0x422ad6
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x422aec
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x27c], 0xc39f
jmp 0x422acf
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1ec], eax
jge 0x422b0c
mov dword [ebp - 0x124], 1
jmp 0x422b13
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x124], eax
je 0x422b2a
mov dword [ebp - 0x1f0], 1
jmp 0x422b31
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2ac], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
cmp dword [ebp + eax - 0x27c], ecx
jg 0x422b65
mov dword [ebp - 0x12c], 1
jmp 0x422b6c
and dword [ebp - 0x12c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x27c]
cmp dword [ebp - 0x12c], eax
jl 0x422b8d
mov dword [ebp - 0x134], 1
jmp 0x422b94
and dword [ebp - 0x134], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x27c]
cmp dword [ebp - 0x134], eax
jl 0x422bb5
mov dword [ebp - 0x13c], 1
jmp 0x422bbc
and dword [ebp - 0x13c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x13c], eax
jl 0x422bd9
mov dword [ebp - 0x144], 1
jmp 0x422be0
and dword [ebp - 0x144], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x3c]
jge 0x422bfa
mov dword [ebp - 0x14c], 1
jmp 0x422c01
and dword [ebp - 0x14c], 0
cmp dword [ebp - 0x14c], 0
ja 0x422c16
mov dword [ebp - 0x154], 1
jmp 0x422c1d
and dword [ebp - 0x154], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x154], eax
jg 0x422c3b
mov dword [ebp - 0x15c], 1
jmp 0x422c42
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2bc], eax
imul eax, dword [ebp - 0x1f8], 0x6467
cmp eax, 0x9a0c
jge 0x422c7a
mov dword [ebp - 0x164], 1
jmp 0x422c81
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x198], eax
jmp 0x42275a
push 1
push 1
push 0x3002
push 1
push 0x36ed
push 1
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x48]
push eax
push 1
push 0x17d4
push 1
push 0x134a
call fcn.0041c754
add esp, 0x34
jmp 0x422d14
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
movzx eax, byte [eax]
test eax, eax
je 0x422d14
push 0
push 0
push 0
push 0
push 0x1622
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x422d4b
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1cc], eax
push dword [ebp - 0x1c4]
push 1
push dword [ebp - 0x1cc]
push 0
push 0x22a8
call fcn.00419452
add esp, 0x14
jmp 0x422d84
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x1d4], eax
push dword [ebp - 0x1d4]
push dword [ebp - 0x1dc]
push 0
push dword [ebp - 0x1e4]
call fcn.0040b31b
add esp, 0x10
mov esp, ebp
pop ebp
ret