Function at 0x406660
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cbebc
mov eax, dword fs:[0]
push eax
sub esp, 0x794
mov eax, dword [0x4eadc8]
xor eax, esp
mov dword [esp + 0x790], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eadc8]
xor eax, esp
push eax
lea eax, [esp + 0x7a8]
mov dword fs:[0], eax
mov ebx, ecx
mov al, byte [ebx + 0x203]
movzx ecx, al
mov dword [esp + 0x1c], ebx
cmp ecx, 0x2b
ja case.0x4066ba.2
movzx ecx, byte [ecx + 0x407b34]
jmp dword [ecx*4 + 0x407aec]
push 0xd0
push 0
push 0x639340
mov byte [0x6392d3], 0
call fcn.00493ca0
mov dl, byte [ebx + 0x203]
mov ecx, dword [0x639220]
add esp, 0xc
mov byte [0x639099], dl
call fcn.00489840
test eax, eax
je 0x406703
mov byte [ebx + 0x203], 0xc
jmp case.0x4066ba.2
lea eax, [esp + 0x1a4]
push eax
push 0x4dbb64
push 0x4f9912
call fcn.0048e15e
add esp, 0xc
push 4
lea ecx, [esp + 0x1a8]
push 0x4dbb68
push ecx
call fcn.0048e1e8
add esp, 0xc
test eax, eax
jne 0x40688e
push 0xff
push eax
lea edx, [esp + 0x6d]
push edx
mov byte [esp + 0x70], al
call fcn.00493ca0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x1ac]
push edx
push 0x4dbb70
push 0x4f9912
mov dword [esp + 0x2c], 0
call fcn.0048e15e
add esp, 0x14
push 0xff
lea eax, [esp + 0x2a9]
push 0
push eax
mov byte [esp + 0x2b0], 0
call fcn.00493ca0
add esp, 0xc
cmp dword [0x6392c0], 2
jne 0x40685a
lea eax, [esp + 0x64]
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4067b4
sub eax, esi
test eax, eax
jle 0x4067ce
mov dl, 0x2d
cmp byte [esp + ecx + 0x64], dl
je 0x4067dd
inc ecx
cmp ecx, eax
jl 0x4067c3
push 0x100
lea eax, [esp + 0x68]
push eax
jmp 0x406864
inc ecx
cmp ecx, eax
jge 0x4067ce
lea eax, [esp + 0x64]
mov esi, ecx
lea edi, [eax + 1]
jmp 0x4067f0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4067f0
sub eax, edi
cmp ecx, eax
jae 0x40682e
lea edi, [esp + 0x2a4]
sub edi, ecx
mov al, byte [esp + esi + 0x64]
cmp al, 0x39
jle 0x406816
cmp al, 0x30
jl case.0x4066ba.2
mov byte [edi + esi], al
lea eax, [esp + 0x64]
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406821
sub eax, edx
cmp esi, eax
jb 0x406806
lea ecx, [esp + 0x2a4]
push ecx
call fcn.0048e2d7
add esp, 4
lea edx, [esp + 0x64]
push edx
push 0x4dbb7c
push 0x638f98
mov dword [ebx + 0x46e1c], eax
call fcn.0048dc72
jmp 0x40686e
push 0x100
lea ecx, [esp + 0x68]
push ecx
push 0x638f98
call fcn.0048dfd0
mov edx, dword [esp + 0x24]
add esp, 0xc
mov byte [0x639098], 0
mov dword [0x63909c], edx
mov byte [ebx + 0x203], 0xa
jmp case.0x4066ba.2
cmp byte [esp + 0x1a4], 0x2f
jne 0x406882
movsx eax, byte [esp + 0x1a5]
push eax
call fcn.0048e589
add esp, 4
test eax, eax
je 0x406882
push 2
lea ecx, [esp + 0x1a9]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.0048dfd0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x1e], 0
call fcn.00406510
test eax, eax
jne 0x406882
mov edi, 0x4dbb8c
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
cmp byte [0x4f78e4], 0
je 0x4068fc
cmp byte [0x4f78e6], 0
je 0x406910
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je case.0x4066ba.2
mov byte [ebx + 0x202], 7
mov byte [ebx + 0x203], 0
jmp case.0x4066ba.2
mov ecx, dword [0x63909c]
push 1
push ecx
mov ecx, dword [0x639220]
push 0x638f98
call fcn.00489d50
call dword [fcn.006392bc]
add eax, 0x3a98
inc byte [ebx + 0x203]
mov dword [0x6391b0], eax
jmp case.0x4066ba.2
mov eax, dword [0x639220]
cmp byte [eax + 0x15], 0
je 0x4069b5
cmp dword [eax + 0x30], 3
mov edi, 0x4dbbf8
jne 0x406972
mov edi, 0x4dbbb0
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
cmp byte [0x4f78e4], 0
je 0x406992
cmp byte [0x4f78e6], 0
je 0x4069a2
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je 0x406a07
mov byte [ebx + 0x202], 7
mov byte [ebx + 0x203], 0
jmp case.0x4066ba.2
call dword [fcn.006392bc]
cmp eax, dword [0x6391b0]
jbe 0x4069f4
mov edi, 0x4dbc70
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je 0x406a07
call fcn.00441d60
mov byte [0x6391a2], 1
jmp 0x406a07
mov edi, 0x4dbccc
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
mov ecx, dword [0x639220]
call fcn.00489840
test eax, eax
je case.0x4066ba.2
inc byte [ebx + 0x203]
jmp case.0x4066ba.2
movzx ecx, byte [0x639099]
add ecx, 0x14
mov byte [ebx + 0x1dd], 1
js case.0x4066ba.20
mov byte [ebx + 0x203], cl
jmp case.0x4066ba.2
inc al
mov byte [ebx + 0x203], al
jmp case.0x4066ba.2
cmp byte [ebx + 0x18], 1
jne 0x406bf5
lea edx, [esp + 0x4a4]
push edx
lea eax, [esp + 0x3a8]
push eax
lea ecx, [esp + 0x1ac]
push ecx
lea edx, [esp + 0x2b0]
push edx
lea eax, [esp + 0x5b4]
push eax
push 0x4dbce0
push 0x4f9912
call fcn.0048e15e
add esp, 0x1c
push 0x100
lea ecx, [esp + 0x68]
push 0
push ecx
call fcn.00493ca0
add esp, 0xc
push 8
lea edx, [esp + 0x68]
push 0x4dbcf0
push edx
call fcn.0048dfd0
add esp, 0xc
push 8
lea eax, [esp + 0x70]
push 0x4dbcf8
push eax
call fcn.0048dfd0
lea eax, [esp + 0x2b0]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406ae0
sub eax, edx
je 0x406b01
push eax
lea ecx, [esp + 0x2a8]
push ecx
lea edx, [esp + 0x7c]
push edx
call fcn.00492c30
add esp, 0xc
lea eax, [esp + 0x1a4]
lea edx, [eax + 1]
jmp 0x406b10
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b10
sub eax, edx
je 0x406b34
push eax
lea eax, [esp + 0x1a8]
push eax
lea ecx, [esp + 0x8c]
push ecx
call fcn.00492c30
add esp, 0xc
lea eax, [esp + 0x3a4]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b40
sub eax, edx
je 0x406b64
push eax
lea edx, [esp + 0x3a8]
push edx
lea eax, [esp + 0x9c]
push eax
call fcn.00492c30
add esp, 0xc
lea eax, [esp + 0x4a4]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b70
sub eax, edx
je 0x406b94
push eax
lea ecx, [esp + 0x4a8]
push ecx
lea edx, [esp + 0xac]
push edx
call fcn.00492c30
add esp, 0xc
mov ecx, dword [0x639220]
push 0x100
lea eax, [esp + 0x68]
push eax
call fcn.0048a1b0
mov ecx, dword [0x639220]
call fcn.0048a2d0
mov ecx, dword [0x639220]
push 0x489bb0
push 0x489b90
call fcn.004897d0
mov ecx, dword [0x639220]
push 5
call fcn.00489fd0
push 9
lea ecx, [ebx + 0x426b5]
push ecx
mov ecx, dword [0x639220]
call fcn.0048a1b0
push 0xc
lea edx, [ebx + 0x426be]
push edx
jmp 0x406c1f
mov ecx, dword [0x639220]
push 5
call fcn.00489fd0
mov ecx, dword [0x639220]
push 9
lea eax, [ebx + 0x426b5]
push eax
call fcn.0048a1b0
push 0xd
lea ecx, [ebx + 0x426be]
push ecx
mov ecx, dword [0x639220]
call fcn.0048a1b0
mov ecx, dword [0x639220]
call fcn.0048a2d0
mov byte [ebx + 0x203], 0x1e
jmp case.0x4066ba.2
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je 0x406c58
mov byte [0x6391a2], 1
mov ecx, dword [0x639220]
call fcn.00489840
test eax, eax
je 0x407a92
mov ecx, dword [0x639220]
push 2
call fcn.0048a3b0
test eax, eax
jne 0x406c86
mov edi, 0x4dbc70
jmp 0x407a97
mov ecx, dword [0x639220]
call fcn.0048a3f0
mov cl, byte [eax]
test cl, cl
je case.0x406e92.0
cmp cl, 0xfe
jne case.0x4066ba.2
cmp byte [0x639099], 0
je case.0x406cc6.6
movzx eax, byte [eax + 1]
dec eax
cmp eax, 0x14
ja case.0x406cc6.6
movzx edx, byte [eax + 0x407b88]
jmp dword [edx*4 + 0x407b60]
mov ecx, dword [0x639220]
push 2
call fcn.0048a670
inc byte [ebx + 0x203]
jmp case.0x406cc6.6
mov edi, 0x4dbd38
jmp 0x406d87
lea eax, [ebx + 0x426b5]
push eax
mov edi, 0x4dbd58
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 8
jmp case.0x406cc6.6
lea ecx, [ebx + 0x426b5]
push ecx
mov edi, 0x4dbd8c
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 8
jmp case.0x406cc6.6
mov edi, 0x4dbdb8
jmp 0x406d87
lea edx, [ebx + 0x426b5]
push edx
mov edi, 0x4dbdd8
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 8
jmp case.0x406cc6.6
mov edi, 0x4dbe08
call fcn.004021e0
push eax
call fcn.00441e30
mov byte [ebx + 0x46e18], 1
jmp 0x406d92
lea eax, [ebx + 0x426b5]
push eax
mov edi, 0x4dbe58
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 8
jmp case.0x406cc6.6
mov edi, 0x4dbea8
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
cmp byte [0x4f78e4], 0
je 0x406da7
cmp byte [0x4f78e6], 0
je 0x406dbb
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je case.0x4066ba.2
cmp byte [ebx + 0x46e18], 0
je 0x406de8
mov ecx, dword [0x4f9a0c]
push 1
push 0
push 0
push 0x4dbf14
push 0x4dbf48
push ecx
mov byte [ebx + 0x46e18], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [0x639220]
push 2
call fcn.0048a670
cmp byte [ebx + 0x18], 1
mov byte [0x4f78e4], 0
mov byte [0x4f78e5], 0
mov byte [0x4f78e6], 0
mov dword [0x4f78f0], 0
jne 0x406e30
mov ecx, dword [0x639220]
call fcn.00489810
mov ecx, dword [0x639220]
call fcn.00489800
mov byte [ebx + 0x202], 4
mov byte [ebx + 0x203], 0
jmp case.0x4066ba.2
mov ecx, dword [0x639220]
call fcn.00489840
test eax, eax
je 0x407a92
mov ecx, dword [0x639220]
push 0x14
call fcn.0048a3b0
test eax, eax
jne 0x406e71
mov edi, 0x4dbc70
jmp 0x407a97
mov ecx, dword [0x639220]
call fcn.0048a3f0
movzx ecx, byte [eax]
cmp ecx, 0xfe
ja case.0x406e92.1
movzx edx, byte [ecx + 0x407bb8]
jmp dword [edx*4 + 0x407ba0]
mov ecx, dword [0x639220]
push 1
call fcn.0048a670
jmp case.0x4066ba.2
mov cl, byte [eax + 1]
mov byte [ebx + 0x42668], cl
mov edx, dword [eax + 2]
mov ecx, dword [0x639220]
mov dword [ebx + 0x4266c], edx
mov eax, dword [eax + 6]
push 0xa
mov dword [ebx + 0x42670], eax
call fcn.0048a670
jmp case.0x4066ba.2
mov cl, byte [eax + 1]
mov edx, dword [eax + 2]
mov dword [0x6390a0], edx
mov edx, dword [eax + 6]
mov dword [0x6390a4], edx
mov edx, dword [eax + 0xa]
mov dword [0x6390a8], edx
mov edx, dword [eax + 0xe]
mov dword [0x6390ac], edx
movzx eax, word [eax + 0x12]
mov byte [0x4fa6a0], cl
mov ecx, dword [0x639220]
push 0x14
mov dword [0x6391a4], eax
call fcn.0048a670
movzx ecx, byte [0x4fa6a0]
push ecx
call fcn.004346e0
mov edx, dword [0x6391a4]
mov ecx, dword [0x639224]
add esp, 4
push 1
push edx
push 0x6390a0
call fcn.00489d50
call dword [fcn.006392bc]
add eax, 0x3a98
inc byte [ebx + 0x203]
mov dword [0x6391bc], eax
jmp case.0x4066ba.2
movzx eax, byte [ebx + 0x203]
push ecx
push ecx
push eax
push 0x4dbf50
push 0x4dbf84
call fcn.00476f98
add esp, 0x14
jmp 0x407ab5
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je 0x406f97
mov byte [ebx + 0x203], 0x23
mov edi, 0x4dbf8c
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
call dword [fcn.006392bc]
cmp eax, dword [0x6391bc]
jbe 0x407007
mov edi, 0x4dbfa8
call fcn.004021e0
push eax
mov edi, 0x4dbfcc
call fcn.004021e0
push eax
lea ecx, [esp + 0x5ac]
push 0x4dbff8
push ecx
call fcn.0048dc72
lea edx, [esp + 0x5b4]
push edx
call fcn.00441e30
add esp, 0x14
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je 0x407007
mov byte [ebx + 0x203], 0x23
mov ecx, dword [0x639224]
jmp 0x406a0d
mov ecx, dword [0x639224]
push 1
call fcn.00489fd0
movzx eax, word [0x6392d0]
mov ecx, dword [0x639224]
push 2
push eax
call fcn.0048a260
mov ax, word [0x6392d0]
test ax, ax
je 0x407053
movzx ecx, ax
push ecx
mov ecx, dword [0x639224]
push 0x50e618
call fcn.0048a180
mov ecx, dword [0x639224]
call fcn.0048a2d0
inc byte [ebx + 0x203]
jmp case.0x4066ba.2
mov ecx, dword [0x639224]
call fcn.00489840
test eax, eax
jne 0x407276
mov ecx, dword [0x639224]
cmp dword [ecx + 0x2c], eax
je 0x407241
call fcn.0048a3f0
mov ecx, dword [0x639224]
mov esi, eax
movzx eax, byte [esi]
sub eax, 1
je 0x4071dc
sub eax, 1
je 0x4070da
sub eax, 1
jne 0x40722c
push 1
call fcn.0048a3b0
mov ecx, dword [0x639224]
test eax, eax
je 0x40722c
push 1
mov byte [ebx + 0x203], 0x23
call fcn.0048a670
jmp 0x407231
push 0x184
call fcn.0048a3b0
test eax, eax
je 0x407226
movzx ecx, word [esi + 1]
mov dword [0x689104], 1
lea ebp, [esi + 3]
cmp cx, word [0x6392d0]
jbe 0x40710d
mov word [0x6392d0], cx
mov al, byte [ebp]
inc ebp
test al, al
jne 0x407117
mov al, 1
movzx ebx, cx
cmp dword [ebx*4 + 0x50f618], 0
mov byte [ebx + 0x50e617], al
jne 0x407189
push 0x2c
call fcn.0048d65a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7b0], 0
test eax, eax
je 0x407156
push 0
push 0xc
push 0x10
mov ecx, eax
call fcn.0047b160
jmp 0x407158
xor eax, eax
mov dword [esp + 0x7b0], 0xffffffff
movzx edx, byte [0x4efb84]
neg edx
sbb edx, edx
and edx, 0x7c00
add edx, 0x7c1f
push edx
mov ecx, eax
mov dword [ebx*4 + 0x50f618], eax
call fcn.0047ac00
mov ecx, dword [ebx*4 + 0x50f618]
lea eax, [esp + 0x18]
push eax
call fcn.0047a6f0
mov edx, 0xc
nop
mov esi, ebp
mov edi, eax
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
add ebp, 0x20
sub edx, 1
lea eax, [eax + ecx*2]
jne 0x4071a0
mov ecx, dword [ebx*4 + 0x50f618]
call fcn.0047a720
mov ecx, dword [0x639224]
push 0x184
call fcn.0048a670
mov ebx, dword [esp + 0x1c]
jmp 0x407231
push 3
call fcn.0048a3b0
test eax, eax
je 0x407226
cmp dword [0x689104], 0
mov si, word [esi + 1]
mov word [0x6392d0], si
jne 0x407200
test si, si
jne 0x407210
movzx edx, byte [0x4fa6a0]
push edx
call fcn.004348a0
add esp, 4
mov ecx, dword [0x639224]
push 3
mov byte [ebx + 0x203], 0x23
call fcn.0048a670
jmp 0x407231
mov ecx, dword [0x639224]
call fcn.0048a640
mov ecx, dword [0x639224]
cmp dword [ecx + 0x2c], 0
jne 0x40708b
cmp dword [0x689104], 0
jne 0x407254
cmp word [0x6392d0], 0
jne 0x40726a
movzx eax, byte [0x4fa6a0]
push eax
call fcn.004348a0
mov ecx, dword [0x639224]
add esp, 4
mov byte [ebx + 0x203], 0x23
call fcn.0048a640
mov ecx, dword [0x639224]
push 1
call fcn.0048a3b0
test eax, eax
jne 0x407291
mov edi, 0x4dbc70
jmp 0x407a97
mov ecx, dword [0x639224]
call fcn.0048a3f0
mov ecx, dword [0x639224]
mov ebp, eax
movzx eax, byte [ebp]
sub eax, 1
je 0x4073cd
sub eax, 1
je 0x4072db
sub eax, 1
je 0x4072c5
call fcn.0048a640
jmp 0x407415
push 1
call fcn.0048a3b0
test eax, eax
je 0x407415
push 1
jmp 0x407403
push 0x184
call fcn.0048a3b0
test eax, eax
je 0x407415
movzx ecx, word [ebp + 1]
add ebp, 3
mov dword [0x689104], 1
cmp cx, word [0x6392d0]
jbe 0x40730e
mov word [0x6392d0], cx
mov al, byte [ebp]
inc ebp
test al, al
jne 0x407318
mov al, 1
movzx ebx, cx
cmp dword [ebx*4 + 0x50f618], 0
mov byte [ebx + 0x50e617], al
jne 0x40738a
push 0x2c
call fcn.0048d65a
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x7b0], 1
test eax, eax
je 0x407357
push 0
push 0xc
push 0x10
mov ecx, eax
call fcn.0047b160
jmp 0x407359
xor eax, eax
mov dword [esp + 0x7b0], 0xffffffff
movzx ecx, byte [0x4efb84]
neg ecx
sbb ecx, ecx
and ecx, 0x7c00
add ecx, 0x7c1f
push ecx
mov ecx, eax
mov dword [ebx*4 + 0x50f618], eax
call fcn.0047ac00
mov ecx, dword [ebx*4 + 0x50f618]
lea edx, [esp + 0x1c]
push edx
call fcn.0047a6f0
mov edx, 0xc
mov esi, ebp
mov edi, eax
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
add ebp, 0x20
sub edx, 1
lea eax, [eax + ecx*2]
jne 0x4073a0
mov ecx, dword [ebx*4 + 0x50f618]
call fcn.0047a720
push 0x184
jmp 0x40740a
push 3
call fcn.0048a3b0
test eax, eax
je 0x407415
cmp dword [0x689104], 0
mov bp, word [ebp + 1]
mov word [0x6392d0], bp
jne 0x4073f1
test bp, bp
jne 0x407401
movzx edx, byte [0x4fa6a0]
push edx
call fcn.004348a0
add esp, 4
push 3
mov byte [ebx + 0x203], 0x23
mov ecx, dword [0x639224]
call fcn.0048a670
movzx eax, word [0x6392d0]
push eax
mov edi, 0x4dc000
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 8
jmp case.0x4066ba.2
mov ecx, dword [0x639224]
call fcn.00489810
push 1
mov ecx, 0x4dc020
call fcn.004512c0
add esp, 4
mov byte [ebx + 0x202], 4
mov byte [ebx + 0x203], 0
jmp case.0x4066ba.2
push 1
mov ecx, 0x4dc028
call fcn.004512c0
mov eax, dword [0x516e98]
add esp, 4
call fcn.00451950
mov eax, dword [0x516e9c]
call fcn.00451950
mov eax, dword [0x516ea0]
call fcn.00451950
mov eax, dword [0x516ea4]
call fcn.00451950
mov eax, dword [0x516ea8]
call fcn.00451950
mov eax, dword [0x516eac]
call fcn.00451950
mov eax, dword [0x516eb0]
call fcn.00451950
mov eax, dword [0x516eb4]
call fcn.00451950
mov eax, dword [0x516eb8]
call fcn.00451950
mov eax, dword [0x516ebc]
call fcn.00451950
mov eax, dword [0x516ec8]
call fcn.00451950
mov eax, dword [0x516ec4]
call fcn.00451950
mov eax, dword [0x516ecc]
call fcn.00451950
mov eax, dword [0x516e94]
call fcn.00451950
mov eax, dword [0x516ed4]
call fcn.00451950
mov eax, dword [0x516edc]
call fcn.00451950
mov eax, dword [0x516ed8]
call fcn.00451950
mov eax, dword [0x516ee0]
call fcn.00451950
mov eax, dword [0x516ee4]
call fcn.00451950
mov eax, dword [0x516ee8]
call fcn.00451950
mov eax, dword [0x516eec]
call fcn.00451950
mov eax, dword [0x516ef0]
call fcn.00451950
mov ecx, dword [0x516e98]
mov byte [ecx + 0x973], 0
mov edx, dword [0x516e9c]
mov byte [edx + 0x973], 0
mov eax, dword [0x516ea0]
mov byte [eax + 0x973], 0
mov ecx, dword [0x516ea4]
mov byte [ecx + 0x973], 0
mov edx, dword [0x516eac]
mov byte [edx + 0x973], 0
mov eax, dword [0x516ea8]
mov byte [eax + 0x973], 0
mov ecx, dword [0x516eb0]
mov byte [ecx + 0x973], 0
mov edx, dword [0x516eb4]
mov byte [edx + 0x973], 0
mov eax, dword [0x516eb8]
mov byte [eax + 0x973], 0
mov ecx, dword [0x516ebc]
mov byte [ecx + 0x973], 0
mov edx, dword [0x516ec4]
mov byte [edx + 0x973], 0
mov eax, dword [0x516ec8]
mov byte [eax + 0x973], 0
mov ecx, dword [0x516ecc]
mov byte [ecx + 0x973], 0
mov edx, dword [0x516ed4]
mov byte [edx + 0x973], 0
mov eax, dword [0x516edc]
mov byte [eax + 0x973], 0
mov ecx, dword [0x516ed8]
mov byte [ecx + 0x973], 0
mov edx, dword [0x516ee0]
mov byte [edx + 0x973], 0
mov eax, dword [0x516ee4]
mov byte [eax + 0x973], 0
mov ecx, dword [0x516ee8]
mov byte [ecx + 0x973], 0
mov edx, dword [0x516eec]
mov byte [edx + 0x973], 0
mov eax, dword [0x516ef0]
mov byte [eax + 0x973], 0
mov eax, 7
call fcn.00451890
inc byte [ebx + 0x203]
jmp case.0x4066ba.2
mov ecx, dword [0x516ee8]
mov byte [ecx + 0x973], 0
mov edx, dword [0x516ee0]
mov ecx, dword [0x639220]
mov byte [edx + 0x973], 0
mov eax, dword [0x516ee4]
mov byte [eax + 0x973], 0
call fcn.00489840
test eax, eax
jne 0x4076db
mov edi, 0x4dc030
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
push 0
push 0x1c
call fcn.004838e0
add esp, 8
test eax, eax
je 0x407aa5
mov byte [ebx + 0x202], 7
mov byte [ebx + 0x203], 0
jmp 0x407aa5
mov ecx, dword [0x639220]
push 1
call fcn.0048a3b0
test eax, eax
jne 0x407704
mov edi, 0x4dc098
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
jmp case.0x4066ba.2
mov ecx, dword [0x639220]
call fcn.0048a3f0
mov ebp, eax
movzx eax, byte [ebp]
cmp eax, 0xfe
jg 0x407785
je 0x40775e
test eax, eax
je case.0x406e92.0
cmp eax, 0xfd
jne case.0x4066ba.2
mov ecx, dword [0x639220]
push 0xfd
call fcn.00489fd0
mov ecx, dword [0x639220]
call fcn.0048a2d0
mov ecx, dword [0x639220]
push 1
call fcn.0048a670
jmp case.0x4066ba.2
mov ecx, dword [0x639220]
push 2
call fcn.0048a3b0
test eax, eax
je case.0x4066ba.2
mov ecx, dword [0x639220]
push 2
call fcn.0048a670
jmp case.0x4066ba.2
cmp eax, 0xff
jne case.0x4066ba.2
mov ecx, dword [0x639220]
push 0x23
call fcn.0048a3b0
test eax, eax
je case.0x4066ba.2
inc ebp
mov ecx, 8
mov esi, ebp
lea edi, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp + 0x20]
mov word [0x6391d0], cx
mov ecx, dword [0x639220]
push 0x23
call fcn.0048a670
cmp dword [0x6392c0], 2
jne 0x4078aa
xor eax, eax
push 0x3f
push eax
lea edx, [esp + 0x16d]
push edx
mov byte [esp + 0x30], 0
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov word [esp + 0x4d], ax
mov byte [esp + 0x4f], al
mov byte [esp + 0x170], al
call fcn.00493ca0
add esp, 0xc
xor esi, esi
mov al, 0x2e
cmp byte [esp + esi + 0x44], al
je 0x40784f
cmp byte [esp + esi + 0x45], al
je 0x407844
cmp byte [esp + esi + 0x46], al
je 0x407847
cmp byte [esp + esi + 0x47], al
je 0x40784c
add esi, 4
cmp esi, 0x20
jb 0x407822
jmp 0x40784f
inc esi
jmp 0x40784f
add esi, 2
jmp 0x40784f
add esi, 3
cmp esi, 0x20
je 0x406910
push esi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00492c30
mov eax, dword [ebx + 0x46e1c]
add esp, 0xc
lea edx, [esp + esi + 0x45]
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x170]
push 0x4dc0bc
push edx
call fcn.0048dc72
movzx eax, word [0x6391d0]
add esp, 0x14
push 1
xor eax, 0x5421
push eax
lea ecx, [esp + 0x16c]
push ecx
jmp 0x4078bf
movzx edx, word [0x6391d0]
push 1
xor edx, 0x5421
push edx
lea eax, [esp + 0x4c]
push eax
mov ecx, dword [0x63921c]
call fcn.00489d50
call dword [fcn.006392bc]
add eax, 0x3a98
inc byte [ebx + 0x203]
mov dword [0x6391c8], eax
jmp case.0x4066ba.2
mov eax, dword [0x63921c]
cmp byte [eax + 0x15], 0
je 0x407943
cmp dword [eax + 0x30], 3
mov edi, 0x4dbbf8
jne 0x407900
mov edi, 0x4dbbb0
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
cmp byte [0x4f78e4], 0
je 0x407920
cmp byte [0x4f78e6], 0
je 0x407930
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je 0x40799a
mov byte [ebx + 0x202], 7
mov byte [ebx + 0x203], 0
jmp case.0x4066ba.2
call dword [fcn.006392bc]
cmp eax, dword [0x6391c8]
jbe 0x407987
mov edi, 0x4dc0e0
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je 0x40799a
mov byte [ebx + 0x202], 7
mov byte [ebx + 0x203], 0
jmp case.0x4066ba.2
mov edi, 0x4dc12c
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
mov ecx, dword [0x63921c]
jmp 0x406a0d
mov ecx, dword [0x63921c]
push 5
call fcn.00489fd0
push 8
lea ecx, [ebx + 0x426b5]
push ecx
mov ecx, dword [0x63921c]
call fcn.0048a1b0
mov ecx, dword [0x63921c]
push 0xc
lea edx, [ebx + 0x426be]
push edx
call fcn.0048a1b0
movzx eax, byte [ebx + 0x42739]
mov ecx, dword [0x63921c]
push eax
call fcn.0048a040
mov ecx, dword [ebx + 0x42670]
push ecx
mov ecx, dword [0x63921c]
call fcn.0048a0e0
lea edx, [ebx + 0x46e20]
push edx
call fcn.0048e2d7
mov ecx, dword [0x63921c]
add esp, 4
push eax
call fcn.0048a0e0
mov ecx, dword [0x63921c]
call fcn.0048a2d0
inc byte [ebx + 0x203]
jmp case.0x4066ba.2
mov ecx, dword [0x63921c]
call fcn.00489840
test eax, eax
je 0x407a92
mov ecx, dword [0x639220]
call fcn.00489840
test eax, eax
je 0x407a92
cmp byte [ebx + 0x1f7], 0
je 0x407a7d
mov edi, 0x4dc12c
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
call fcn.0041d990
inc byte [ebx + 0x203]
push ebx
call fcn.00404040
jmp case.0x4066ba.2
mov edi, 0x4dc140
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
jmp case.0x4066ba.2
mov edi, 0x4dbd00
call fcn.004021e0
push eax
call fcn.00441e30
add esp, 4
push 0
push 1
call fcn.004838e0
add esp, 8
test eax, eax
je case.0x4066ba.2
mov byte [0x6391a2], 1
mov eax, 1
mov ecx, dword [esp + 0x7a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x790]
xor ecx, esp
call fcn.0048d5a8
add esp, 0x7a0
ret