Function at 0x4016be
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x298], eax
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
xor ebx, ebx
lea eax, [ebp - 0x202]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
xor edi, edi
push ebx
inc edi
push edi
push ebx
mov dword [ebp - 0x2b8], edi
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x28c], ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
cmp dword [0x403024], ebx
jge 0x401733
xor eax, eax
jmp 0x401f4b
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
push 0x401254
lea eax, [ebp - 0x288]
push 0x41
push eax
call fcn.00401590
add esp, 0x10
test eax, eax
jge 0x40175b
mov eax, edi
jmp 0x401f4b
lea eax, [ebp - 0x288]
push eax
push 2
call dword [sym.imp.msvcrt.dll__wsetlocale]
pop ecx
pop ecx
test eax, eax
je 0x401754
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0x100
lea eax, [ebp - 0x204]
push eax
mov esi, 0x106
push esi
call fcn.004012f5
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x4017b1
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x401214
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
jmp 0x401754
cmp dword [ebp + 8], edi
jle 0x401816
mov eax, dword [ebp - 0x298]
mov esi, dword [eax + edi*4]
cmp byte [esi], 0x2f
jne 0x4017fe
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4017c9
sub eax, edx
cmp eax, 2
jne 0x401837
mov al, byte [esi + 1]
cmp al, 0x4e
je 0x4017f6
cmp al, 0x56
je 0x4017ea
cmp al, 0x6e
je 0x4017f6
cmp al, 0x76
jne 0x401837
mov dword [ebp - 0x2b4], 0x10
jmp 0x401804
mov dword [ebp - 0x2b8], ebx
jmp 0x401804
inc dword [ebp - 0x28c]
inc edi
cmp edi, dword [ebp + 8]
jl 0x4017b6
cmp dword [ebp - 0x28c], 2
jge 0x401869
xor edi, edi
inc edi
push ebx
push ebx
push ebx
push ebx
push 0x105
call fcn.004013d0
push ebx
push ebx
push ebx
push ebx
push 0xfd
call fcn.004013d0
jmp 0x401754
mov eax, dword [ebp - 0x298]
push ebx
push ebx
push ebx
push dword [eax + edi*4]
call fcn.00401381
push eax
push 0x104
call fcn.004013d0
push ebx
push ebx
push ebx
push ebx
push 0xfd
call fcn.004013d0
xor eax, eax
inc eax
jmp 0x401f4b
mov eax, dword [ebp - 0x28c]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemAlloc]
push 4
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call esi
mov dword [ebp - 0x2a4], eax
cmp eax, ebx
jne 0x4018ab
push 0x8007000e
lea ecx, [ebp - 0x2d0]
call fcn.004015ef
push ebx
push ebx
push ebx
push eax
push 0x100
jmp 0x40185c
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x2a0]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x294], eax
mov eax, dword [eax]
cmp byte [eax], 0x2f
je 0x401956
push eax
call fcn.00401381
xor edi, edi
cmp dword [ebp - 0x28c], ebx
mov dword [ebp - 0x2a8], eax
jle 0x401923
mov eax, dword [ebp - 0x2a4]
push dword [eax + edi*4]
push dword [ebp - 0x2a8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x401917
inc edi
cmp edi, dword [ebp - 0x28c]
jl 0x4018f3
cmp edi, dword [ebp - 0x28c]
jl 0x401a9c
mov eax, dword [ebp - 0x294]
push dword [eax]
call fcn.00401381
mov ecx, dword [ebp - 0x28c]
cmp ecx, ebx
mov edx, dword [ebp - 0x2a4]
mov dword [edx + ecx*4], eax
jle 0x401950
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add dword [ebp - 0x290], eax
inc dword [ebp - 0x28c]
inc dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp + 8]
jl 0x4018c1
cmp dword [ebp - 0x2b8], ebx
je 0x401abe
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 0x290]
lea edi, [ecx + eax]
push 2
xor ecx, ecx
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x294], edi
neg ecx
or ecx, eax
push ecx
call esi
mov esi, eax
mov dword [ebp - 0x2a8], esi
cmp esi, ebx
je 0x401890
xor edi, edi
xor eax, eax
inc edi
cmp dword [ebp - 0x28c], edi
mov word [esi], ax
jle 0x4019f3
cmp edi, 1
jle 0x4019d5
push 0x401250
push dword [ebp - 0x294]
push esi
call fcn.00401519
mov eax, dword [ebp - 0x2a4]
push dword [eax + edi*4]
push dword [ebp - 0x294]
push esi
call fcn.00401519
inc edi
cmp edi, dword [ebp - 0x28c]
jl 0x4019bf
push ebx
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x2a4]
push dword [eax]
push esi
push 0xfe
call fcn.004013d0
lea eax, [ebp - 0x204]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x401a17
sub eax, ecx
sar eax, 1
lea esi, [eax + 1]
lea edi, [esi + esi]
mov eax, edi
call fcn.00402220
mov dword [ebp - 0x298], esp
push edi
push ebx
push dword [ebp - 0x298]
call sub.msvcrt.dll_memset
push dword [sym.imp.msvcrt.dll__iob]
push esi
push dword [ebp - 0x298]
call dword [sym.imp.msvcrt.dll_fgetws]
add esp, 0x18
push dword [ebp - 0x2a8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x298]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x401ab8
push ebx
push ebx
push ebx
push ebx
push 0xff
call fcn.004013d0
jmp 0x40172c
push ebx
push ebx
push ebx
push ebx
cmp edi, ebx
jne 0x401aae
push 0x102
jmp 0x40184e
push 0x103
jmp 0x40184e
mov esi, dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov edi, dword [ebp - 0x28c]
push 0x10
dec edi
xor ecx, ecx
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call esi
mov dword [ebp - 0x2ac], eax
cmp eax, ebx
je 0x401890
mov eax, edi
shl eax, 4
push eax
push ebx
push dword [ebp - 0x2ac]
call sub.msvcrt.dll_memset
add esp, 0xc
push 4
xor ecx, ecx
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call esi
mov dword [ebp - 0x298], eax
cmp eax, ebx
je 0x401890
mov eax, edi
shl eax, 2
push eax
push ebx
push dword [ebp - 0x298]
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
push 0x40115c
push 1
push ebx
push 0x40116c
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x29c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x401b61
push eax
jmp 0x401895
mov esi, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
lea edx, [ebp - 0x2e0]
push edx
push dword [esi]
push eax
call dword [ecx + 0x3c]
cmp eax, ebx
jl 0x401b5b
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
lea edx, [ebp - 0x2d4]
push edx
push dword [esi]
push eax
call dword [ecx + 0x40]
cmp eax, ebx
jl 0x401b5b
mov ecx, dword [ebp - 0x2b4]
or ecx, 0x20
cmp dword [ebp - 0x2e0], 0xb
mov dword [ebp - 0x290], ecx
jl 0x401d43
xor eax, eax
inc eax
cmp dword [ebp - 0x28c], eax
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x2a0], eax
jle 0x401d5e
mov edi, dword [ebp - 0x2ac]
add edi, 8
mov dword [ebp - 0x2a8], edi
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0x2a0]
lea esi, [eax + ecx*4]
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
lea edx, [ebp - 0x2dc]
push edx
push dword [esi]
push eax
call dword [ecx + 0x3c]
cmp eax, ebx
jl 0x401b5b
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
lea edx, [ebp - 0x2d8]
push edx
push dword [esi]
push eax
call dword [ecx + 0x40]
cmp eax, ebx
jl 0x401b5b
cmp dword [ebp - 0x2dc], 0xb
jge 0x401c3b
or dword [edi], 0x40
or dword [ebp - 0x290], 0x40
cmp dword [ebp - 0x2d8], ebx
jne 0x401d0d
cmp dword [ebp - 0x2d4], ebx
je 0x401d0d
cmp dword [ebp - 0x2b8], ebx
je 0x401d08
cmp dword [ebp - 0x294], ebx
jne 0x401d08
push ebx
push ebx
push ebx
lea eax, [ebp - 0x204]
push eax
push 0xef
call fcn.004013d0
lea eax, [ebp - 0x204]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x401c88
sub eax, ecx
sar eax, 1
lea esi, [eax + 1]
lea edi, [esi + esi]
mov eax, edi
call fcn.00402220
mov dword [ebp - 0x294], esp
push edi
push ebx
push dword [ebp - 0x294]
call sub.msvcrt.dll_memset
call dword [sym.imp.msvcrt.dll__flushall]
push dword [sym.imp.msvcrt.dll__iob]
push esi
push dword [ebp - 0x294]
call dword [sym.imp.msvcrt.dll_fgetws]
add esp, 0x18
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x294]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x401a89
mov edi, dword [ebp - 0x2a8]
mov dword [ebp - 0x294], 1
or dword [edi], 0x20
jmp 0x401d14
and dword [ebp - 0x290], 0xffffffdf
inc dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x2a0]
add edi, 0x10
cmp eax, dword [ebp - 0x28c]
mov dword [ebp - 0x2a8], edi
jl 0x401bdf
mov ecx, dword [ebp - 0x290]
mov esi, dword [ebp - 0x2a4]
jmp 0x401d5e
cmp dword [ebp - 0x28c], 1
jle 0x401d5e
mov eax, dword [ebp - 0x2ac]
add eax, 8
or dword [eax], 0x20
add eax, 0x10
dec edi
jne 0x401d55
mov eax, dword [ebp - 0x29c]
mov edx, dword [eax]
push ecx
push dword [esi]
push eax
call dword [edx + 0x1c]
cmp eax, ebx
jl 0x401b5b
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
lea edx, [ebp - 0x2bc]
push edx
push eax
call dword [ecx + 0x34]
cmp eax, ebx
jl 0x401b5b
push ebx
push ebx
push ebx
push dword [ebp - 0x2bc]
push 0x101
call fcn.004013d0
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
cmp eax, ebx
mov dword [ebp - 0x290], eax
jl 0x401eb0
mov esi, dword [ebp - 0x28c]
xor edi, edi
inc edi
cmp esi, edi
jle 0x401e35
mov eax, dword [ebp - 0x298]
mov esi, dword [ebp - 0x2ac]
mov dword [ebp - 0x294], eax
add esi, 8
mov ecx, dword [ebp - 0x2a4]
mov edx, dword [ecx]
lea eax, [esi - 8]
mov dword [eax], edx
mov edx, dword [ebp - 0x2b4]
or dword [esi], edx
mov ecx, dword [ecx + edi*4]
mov dword [esi - 4], ecx
lea ecx, [ebp - 0x2a8]
push ecx
push ebx
push eax
push 0x401616
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
cmp eax, ebx
je 0x401e6b
add dword [ebp - 0x294], 4
inc edi
add esi, 0x10
cmp edi, dword [ebp - 0x28c]
jl 0x401ddf
mov esi, dword [ebp - 0x28c]
push 0xffffffffffffffff
xor edi, edi
inc edi
push edi
push dword [ebp - 0x298]
lea eax, [esi - 1]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea eax, [esi - 1]
xor edx, edx
cmp eax, ebx
jle 0x401e87
mov ecx, dword [ebp - 0x2ac]
add ecx, 0xc
cmp dword [ecx], ebx
jl 0x401e81
inc edx
add ecx, 0x10
cmp edx, eax
jl 0x401e5d
jmp 0x401e87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x401e93
and eax, 0xffff
or eax, 0x80070000
jmp 0x401e93
mov dword [ebp - 0x2b0], edi
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
cmp eax, ebx
mov dword [ebp - 0x290], eax
jl 0x401eb0
cmp dword [ebp - 0x2b0], ebx
jne 0x401eb0
push ebx
push ebx
push ebx
push ebx
push 0xfc
jmp 0x401eb9
push ebx
push ebx
push ebx
push ebx
push 0xfb
call fcn.004013d0
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
cmp dword [ebp - 0x28c], ebx
jle 0x401ee2
mov eax, dword [ebp - 0x2a4]
push dword [eax + esi*4]
call edi
inc esi
cmp esi, dword [ebp - 0x28c]
jl 0x401ece
mov eax, dword [ebp - 0x28c]
xor esi, esi
dec eax
cmp eax, ebx
mov dword [ebp - 0x2b0], eax
jle 0x401f12
mov eax, dword [ebp - 0x298]
mov eax, dword [eax + esi*4]
cmp eax, ebx
je 0x401f09
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x2b0]
jl 0x401ef5
push dword [ebp - 0x298]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call esi
push dword [ebp - 0x2ac]
call esi
push dword [ebp - 0x2bc]
call edi
mov eax, dword [ebp - 0x29c]
cmp eax, ebx
je 0x401f40
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x290]
and eax, 0xffff
lea esp, [ebp - 0x2ec]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402208
leave
ret