Function at 0x73614c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x85
push 0
push 0
dec ecx
jne 0x736154
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x73753e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x735f2c]
call fcn.0040999c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x73618b
sub edx, 0xfffffff8
call fcn.00410d98
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], ebx
mov eax, dword [0x8d1a20]
cmp byte [eax], 1
je 0x7374f6
mov eax, dword [0x8d1a20]
cmp byte [eax], 0
jne 0x7374f6
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x7361bc
sub edx, 0xffffffe4
xor eax, eax
call fcn.004c703c
call fcn.00433768
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0x328]
mov eax, dword [0x8d284c]
call fcn.00434764
mov edx, dword [ebp - 0x328]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x518
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
lea eax, [ebx + 0x4fc]
mov edx, dword [ebx + 0x518]
call fcn.0040bca4
lea eax, [ebp - 0x32c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x32c]
push 0x737558
lea eax, [ebp - 0x330]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x330]
push 0x737558
lea eax, [ebp - 0x334]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x334]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4fc
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
push dword [ebx + 0x514]
push 0x737568
push dword [ebx + 0x4fc]
push 0x7375a8
lea eax, [ebx + 0x4fc]
mov edx, 4
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov dl, 1
call fcn.0043057c
cmp al, 1
jne 0x736f21
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
xor edx, edx
mov dword [eax + 0x4f8], edx
xor edx, edx
push ebp
push 0x736450
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [eax + 0x4fc]
xor ecx, ecx
lea eax, [ebp - 0x324]
call fcn.004080e0
call fcn.00407348
lea eax, [ebp - 0x324]
call fcn.00407d94
call fcn.00407348
jmp 0x7363fc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
inc dword [eax + 0x4f8]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov edi, dword [ebx + 0x4f8]
cmp edi, 1
jne 0x736379
lea edx, [ebx + 0x500]
lea eax, [ebp - 0x324]
call fcn.00408c84
lea eax, [ebp - 0x324]
call fcn.00408da0
call fcn.00407348
jmp 0x7363fc
cmp edi, 2
jne 0x7363a1
lea edx, [ebx + 0x504]
lea eax, [ebp - 0x324]
call fcn.00408c84
lea eax, [ebp - 0x324]
call fcn.00408da0
call fcn.00407348
jmp 0x7363fc
lea edx, [ebx + 0x510]
lea eax, [ebp - 0x324]
call fcn.00408c84
lea eax, [ebp - 0x324]
call fcn.00408da0
call fcn.00407348
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x510]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x7363db
mov esi, dword [esi - 4]
cmp esi, 0xa
jle 0x7363fc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x508
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x510]
call fcn.0040bca4
lea eax, [ebp - 0x324]
call fcn.00408240
call fcn.00407348
test al, al
je 0x736336
xor eax, eax
push ebp
push 0x73643c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x324]
call fcn.004081e8
call fcn.00407348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x736446
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73648a
call fcn.004337c8
fstp qword [ebp - 0x28]
wait
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea edx, [ebp - 0x338]
mov eax, dword [0x8d284c]
call fcn.00434788
mov edx, dword [ebp - 0x338]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4e4
call fcn.0040bca4
lea eax, [ebp - 0x33c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x518]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x33c]
push 0x7375c0
lea eax, [ebp - 0x340]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x518]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x340]
push 0x7375c0
lea eax, [ebp - 0x344]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x518]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x344]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x520
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
lea ecx, [eax + 0x524]
mov edx, dword [eax + 0x4e4]
call fcn.00735a94
mov bl, 1
mov eax, dword [ebp - 0x10]
mov esi, dword [eax + 0x10]
cmp dword [esi + 0x500], 0
jne 0x736580
xor ebx, ebx
cmp bl, 1
jne 0x7365e2
cmp dword [esi + 0x504], 0
je 0x7365e0
lea eax, [ebp - 0x348]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x504]
mov ecx, 1
mov edx, 1
call fcn.0040cc5c
mov eax, dword [ebp - 0x348]
mov edx, 0x7375d0
call fcn.0040cc24
jne 0x7365dc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x504
mov edx, 0x7375e0
call fcn.0040ca34
mov eax, dword [ebp - 0x10]
jmp 0x7365e2
xor ebx, ebx
jmp 0x7365e2
xor ebx, ebx
cmp bl, 1
jne 0x736f21
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x508], 0
je 0x736f21
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x508]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x508
mov ecx, 0x7375e0
call fcn.0040ca8c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
call fcn.00737864
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
call fcn.00737c78
mov eax, dword [0x8d2950]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x73664f
mov eax, dword [eax - 4]
cmp eax, 4
jle 0x736f21
mov eax, dword [ebp - 0x10]
add eax, 0xc
call fcn.0040b8d8
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
push 0x737670
lea eax, [ebp - 0x34c]
push eax
mov eax, dword [0x8d2950]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
mov ecx, 1
mov edx, 1
call fcn.0040c31c
push dword [ebp - 0x34c]
push 0x737694
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 4
call fcn.0040c1c4
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 0x7376d8
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
mov eax, dword [0x8d2950]
mov eax, dword [eax]
push dword [eax + 0x48c]
push 0x737744
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 3
call fcn.0040c1c4
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
lea eax, [ebp - 0x354]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x520]
mov ecx, 0
call fcn.0040c4b4
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.005172d4
push dword [ebp - 0x350]
push 0x737744
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 3
call fcn.0040c1c4
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
push dword [eax + 0x524]
push 0x737744
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 3
call fcn.0040c1c4
lea eax, [ebp - 0x35c]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x35c]
lea edx, [ebp - 0x360]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x584]
call fcn.0042fd94
push dword [ebp - 0x360]
push 0x737754
lea eax, [ebp - 0x358]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x358]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x368]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x368]
lea edx, [ebp - 0x36c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x588]
call fcn.0042fd94
push dword [ebp - 0x36c]
push 0x737754
lea eax, [ebp - 0x364]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x364]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x374]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x374]
lea edx, [ebp - 0x378]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x58c]
call fcn.0042fd94
push dword [ebp - 0x378]
push 0x737754
lea eax, [ebp - 0x370]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x370]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x380]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x380]
lea edx, [ebp - 0x384]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x590]
call fcn.0042fd94
push dword [ebp - 0x384]
push 0x737754
lea eax, [ebp - 0x37c]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x37c]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x38c]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x38c]
lea edx, [ebp - 0x390]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x594]
call fcn.0042fd94
push dword [ebp - 0x390]
push 0x737754
lea eax, [ebp - 0x388]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x388]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x398]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x398]
lea edx, [ebp - 0x39c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x598]
call fcn.0042fd94
push dword [ebp - 0x39c]
push 0x737754
lea eax, [ebp - 0x394]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x394]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3a4]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x59c]
call fcn.0042fd94
push dword [ebp - 0x3a8]
push 0x737754
lea eax, [ebp - 0x3a0]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3b0]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3b0]
lea edx, [ebp - 0x3b4]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x5a0]
call fcn.0042fd94
push dword [ebp - 0x3b4]
push 0x737754
lea eax, [ebp - 0x3ac]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3ac]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3bc]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
push dword [eax + 0x5b4]
push dword [eax + 0x5b0]
lea eax, [ebp - 0x3c0]
call fcn.0042fdb0
push dword [ebp - 0x3c0]
push 0x737754
lea eax, [ebp - 0x3b8]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3c8]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3c8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
push dword [eax + 0x5bc]
push dword [eax + 0x5b8]
lea eax, [ebp - 0x3cc]
call fcn.0042fdb0
push dword [ebp - 0x3cc]
push 0x737754
lea eax, [ebp - 0x3c4]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3d4]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3d4]
lea edx, [ebp - 0x3d8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x560]
call fcn.0042fd94
push dword [ebp - 0x3d8]
push 0x737754
lea eax, [ebp - 0x3d0]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3d0]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3e0]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3e0]
lea edx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x55c]
call fcn.0042fd94
push dword [ebp - 0x3e4]
push 0x737754
lea eax, [ebp - 0x3dc]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3dc]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 0x3ec]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.0040c8f4
push dword [ebp - 0x3ec]
lea edx, [ebp - 0x3f0]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x558]
call fcn.0042fd94
push dword [ebp - 0x3f0]
push 0x737764
lea eax, [ebp - 0x3e8]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov ecx, 0
call fcn.0040c4b4
mov eax, dword [0x8d1a20]
cmp byte [eax], 0
jne 0x736c53
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x736c4c
sub edx, 0xffffffe8
xor eax, eax
call fcn.004c703c
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x736ca1
push 0x737774
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
push 0x737788
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, 3
call fcn.0040c1c4
mov eax, 5
call fcn.004c719c
mov eax, dword [0x8d1a20]
cmp byte [eax], 0
jne 0x736ca1
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x736c9a
sub edx, 0xffffffec
xor eax, eax
call fcn.004c703c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a8
call fcn.0040b8d8
mov byte [ebp - 9], 0
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 0x584]
mov edx, dword [0x8d2284]
cmp eax, dword [edx]
jge 0x736cfb
mov eax, dword [ebx + 0x588]
mov edx, dword [0x8d2284]
cmp eax, dword [edx]
jge 0x736cfb
mov eax, dword [ebx + 0x58c]
mov edx, dword [0x8d2284]
cmp eax, dword [edx]
jge 0x736cfb
mov eax, dword [ebx + 0x590]
mov edx, dword [0x8d2284]
cmp eax, dword [edx]
jl 0x736d11
lea eax, [ebx + 0x5a8]
mov edx, 0x73779c
call fcn.0040c0e8
mov byte [ebp - 9], 1
jmp 0x736d21
lea eax, [ebx + 0x5a8]
mov edx, 0x7377ac
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 0x594]
mov edx, dword [0x8d2250]
cmp eax, dword [edx]
jge 0x736d67
mov eax, dword [ebx + 0x598]
mov edx, dword [0x8d2250]
cmp eax, dword [edx]
jge 0x736d67
mov eax, dword [ebx + 0x59c]
mov edx, dword [0x8d2250]
cmp eax, dword [edx]
jge 0x736d67
mov eax, dword [ebx + 0x5a0]
mov edx, dword [0x8d2250]
cmp eax, dword [edx]
jl 0x736d7d
lea eax, [ebx + 0x5a8]
mov edx, 0x73779c
call fcn.0040c0e8
mov byte [ebp - 9], 1
jmp 0x736d8d
lea eax, [ebx + 0x5a8]
mov edx, 0x7377ac
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x560]
mov edx, dword [0x8d16d4]
cmp eax, dword [edx]
jl 0x736dc1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a8
mov edx, 0x73779c
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov byte [ebp - 9], 1
jmp 0x736dd9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a8
mov edx, 0x7377ac
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x55c]
mov edx, dword [0x8d26d8]
cmp eax, dword [edx]
jl 0x736e0d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a8
mov edx, 0x73779c
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov byte [ebp - 9], 1
jmp 0x736e25
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a8
mov edx, 0x7377ac
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x558]
mov edx, dword [0x8d270c]
cmp eax, dword [edx]
jl 0x736e59
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a8
mov edx, 0x73779c
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
mov byte [ebp - 9], 1
jmp 0x736e71
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x5a8
mov edx, 0x7377ac
call fcn.0040c0e8
mov eax, dword [ebp - 0x10]
cmp byte [ebp - 9], 1
jne 0x736ee6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4b0
mov dword [ebp - 0x30], eax
push 0
lea edx, [ebp - 0x3f4]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
call fcn.0042fd94
mov edx, dword [ebp - 0x3f4]
xor ecx, ecx
mov eax, 0x7377bc
call fcn.00748c60
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x4b0], 2
je 0x736f21
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x4b0], 2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x5a8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov edx, 2
call fcn.007382c0
jmp 0x736f21
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x4b0], 2
jne 0x736f21
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov dword [eax + 0x4b0], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x5a8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov edx, 1
call fcn.007382c0
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 0x51c]
mov edx, dword [ebx + 0x518]
call fcn.0040cc24
je 0x737382
lea eax, [ebx + 0x51c]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x518]
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4a8
call fcn.0040b8d8
call fcn.00433768
fsub dword [0x7377e4]
fstp qword [ebp - 0x38]
wait
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea edx, [ebp - 0x3f8]
mov eax, dword [0x8d284c]
call fcn.00434764
mov edx, dword [ebp - 0x3f8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x518
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
lea eax, [ebx + 0x4fc]
mov edx, dword [ebx + 0x518]
call fcn.0040bca4
lea eax, [ebp - 0x3fc]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x3fc]
push 0x737558
lea eax, [ebp - 0x400]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x400]
push 0x737558
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x404]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4fc
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
push dword [ebx + 0x514]
push 0x737568
push dword [ebx + 0x4fc]
push 0x7375a8
lea eax, [ebx + 0x4fc]
mov edx, 4
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov dl, 1
call fcn.0043057c
cmp al, 1
jne 0x7370c4
xor eax, eax
push ebp
push 0x7370ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
call fcn.00430928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7370c4
call fcn.00433768
fsub dword [0x7377e8]
fstp qword [ebp - 0x40]
wait
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea edx, [ebp - 0x408]
mov eax, dword [0x8d284c]
call fcn.00434764
mov edx, dword [ebp - 0x408]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x518
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
lea eax, [ebx + 0x4fc]
mov edx, dword [ebx + 0x518]
call fcn.0040bca4
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x40c]
push 0x737558
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x410]
push 0x737558
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x414]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4fc
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
push dword [ebx + 0x514]
push 0x737568
push dword [ebx + 0x4fc]
push 0x7375a8
lea eax, [ebx + 0x4fc]
mov edx, 4
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov dl, 1
call fcn.0043057c
cmp al, 1
jne 0x737223
xor eax, eax
push ebp
push 0x737219
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
call fcn.00430928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x737223
call fcn.00433768
fsub dword [0x7377ec]
fstp qword [ebp - 0x48]
wait
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea edx, [ebp - 0x418]
mov eax, dword [0x8d284c]
call fcn.00434764
mov edx, dword [ebp - 0x418]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x518
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
lea eax, [ebx + 0x4fc]
mov edx, dword [ebx + 0x518]
call fcn.0040bca4
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 4
mov edx, 7
call fcn.0040cc5c
push dword [ebp - 0x41c]
push 0x737558
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 2
mov edx, 4
call fcn.0040cc5c
push dword [ebp - 0x420]
push 0x737558
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov ecx, 2
mov edx, 1
call fcn.0040cc5c
push dword [ebp - 0x424]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x4fc
mov edx, 5
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
push dword [ebx + 0x514]
push 0x737568
push dword [ebx + 0x4fc]
push 0x7375a8
lea eax, [ebx + 0x4fc]
mov edx, 4
call fcn.0040cb14
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
mov dl, 1
call fcn.0043057c
cmp al, 1
jne 0x737382
xor eax, eax
push ebp
push 0x737378
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4fc]
call fcn.00430928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x737382
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
inc dword [eax + 0x548]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x548], 0xe
jle 0x7374f6
xor edx, edx
mov dword [eax + 0x548], edx
lea edx, [ebp - 0x42c]
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e90fc
mov eax, dword [ebp - 0x42c]
lea edx, [ebp - 0x428]
call fcn.00430aac
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, 0x514
call fcn.0040bca4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x10]
mov edx, dword [ebx + 0x514]
lea eax, [ebx + 0x4d0]
mov ecx, 0x7377fc
call fcn.0040ca8c
mov eax, 0x737830
call fcn.0070ef64
mov eax, 0x7d0
call fcn.004c719c
mov eax, 0x737830
call fcn.0070f148
test eax, eax
jle 0x737434
mov eax, 0x737830
call fcn.0070ef64
mov eax, 0xbb8
call fcn.004c719c
xor eax, eax
push ebp
push 0x7374ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x737830
call fcn.0070f148
test eax, eax
jne 0x7374d5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4d0]
mov dl, 1
call fcn.0043057c
cmp al, 1
jne 0x7374c6
xor eax, eax
push ebp
push 0x7374ad
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x737854
push 0x737854
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x4d0]
call fcn.0040c824
push eax
push 0x737858
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7374b7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x528], 1
jmp 0x7374e2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x528], 0
jmp 0x7374e2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x528], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7374f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x737545
lea eax, [ebp - 0x42c]
mov edx, 0x36
call fcn.0040b914
lea eax, [ebp - 0x354]
mov edx, 3
call fcn.0040b94c
lea eax, [ebp - 0x348]
mov edx, 9
call fcn.0040b914
lea eax, [ebp - 8]
call fcn.00410d80
pop eax
jmp eax