Function at 0x408fd0
Capabilities:
Create process on windows
Create process suspended
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf4
mov eax, 0x517570
push ebx
push esi
push edi
lea esi, [ebp - 0x64]
lea ebx, [ebp - 0x20]
call fcn.00509108
push 0x44
push 0
lea edx, [ebp - 0x294]
push edx
call fcn.00508c67
mov dword [ebp - 0x294], 0x44
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add esp, 0xc
mov eax, dword [ecx + 0x30]
mov ecx, dword [eax + edx*4]
cmp byte [ecx + 0x1b], 0
je 0x40902e
mov dword [ebp - 0x268], 1
mov word [ebp - 0x264], 0
push 0x10
push 0
lea eax, [ebp - 0x2a4]
push eax
call fcn.00508c67
add esp, 0xc
lea edx, [ebp - 0x2a4]
lea ecx, [ebp - 0x294]
xor eax, eax
push edx
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x88]
mov word [ebp - 0xac], 0x18
mov dword [ebp - 0x88], eax
inc dword [ebp - 0xa0]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov edx, dword [ebp + 0xc]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
add edx, 0x14
add eax, 4
call fcn.00514a04
cmp dword [ebp - 0x88], 0
je 0x4090a5
mov ecx, dword [ebp - 0x88]
jmp 0x4090aa
mov ecx, 0x516358
push ecx
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
mov edx, 2
setne al
and eax, 1
mov byte [ebp - 0xbd], al
lea eax, [ebp - 0x88]
dec dword [ebp - 0xa0]
call fcn.005149c8
mov word [ebp - 0xac], 0xc
cmp byte [ebp - 0xbd], 0
jne 0x40916e
mov ecx, dword [ebp - 0x2a4]
push ecx
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x2a0]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0xac], 0x24
xor edx, edx
mov dword [ebp - 0x8c], edx
lea ecx, [ebp - 0x8c]
inc dword [ebp - 0xa0]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + eax*4]
add edx, 0x14
mov eax, dword [ebp + 8]
add eax, 4
call fcn.00514a04
lea eax, [ebp - 0x8c]
mov eax, dword [eax]
call fcn.00514584
dec dword [ebp - 0xa0]
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.005149c8
mov ecx, dword [ebp - 0xbc]
mov dword fs:[0], ecx
jmp 0x409f9c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2a4]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov edx, dword [ebp - 0x2a4]
push edx
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 0x2a0]
push ecx
call sub.KERNEL32.DLL_CloseHandle
push 0x1388
call sub.KERNEL32.DLL_Sleep
mov word [ebp - 0xac], 0x30
lea eax, [ebp - 0xc8]
push eax
call fcn.00409fa4
pop ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebx + 8]
push ecx
call fcn.00409fcc
xor eax, eax
xor edx, edx
mov dword [ebx + 0x10], eax
xor ecx, ecx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], ecx
add esp, 8
lea eax, [ebp - 0xd0]
inc dword [ebp - 0xa0]
mov word [ebp - 0xac], 0xc
mov word [ebp - 0xac], 0x3c
push eax
call fcn.0040a020
pop ecx
lea edx, [ebp - 0xd0]
push edx
lea ecx, [ebp - 0x38]
push ecx
call fcn.0040a048
xor eax, eax
xor edx, edx
mov dword [ebp - 0x30], eax
xor ecx, ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
add esp, 8
inc dword [ebp - 0xa0]
mov word [ebp - 0xac], 0xc
push 0
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x3cc]
mov dword [ebp - 0x3cc], 0x128
push eax
push edi
call sub.KERNEL32.DLL_Process32First
test eax, eax
setne al
and eax, 1
test al, al
je 0x409600
mov word [ebp - 0xac], 0x48
lea edx, [ebp - 0x3a8]
lea eax, [ebp - 0x90]
call fcn.005148b4
inc dword [ebp - 0xa0]
cmp dword [ebx + 0x10], 0
jne 0x409288
xor edx, edx
jmp 0x409298
mov edx, dword [ebx + 0x14]
sub edx, dword [ebx + 0x10]
test edx, edx
jns 0x409295
add edx, 3
sar edx, 2
cmp dword [ebx + 0x10], 0
jne 0x4092a2
xor eax, eax
jmp 0x4092b2
mov eax, dword [ebx + 0x18]
sub eax, dword [ebx + 0x10]
test eax, eax
jns 0x4092af
add eax, 3
sar eax, 2
cmp edx, eax
jae 0x40930f
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xd4], edx
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0xdc], ecx
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0xd8], ecx
lea ecx, [ebx + 8]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x90]
push ecx
push eax
push 1
mov edx, dword [ebp - 0xd4]
push edx
call fcn.0040a09c
add esp, 0x18
mov ecx, dword [ebp - 0xd4]
add ecx, 4
mov dword [ebx + 0x14], ecx
jmp 0x409421
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0xe8], eax
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0x3d4], edx
cmp dword [ebx + 0x10], 0
jne 0x40932e
xor ecx, ecx
jmp 0x40933e
mov ecx, dword [ebx + 0x14]
sub ecx, dword [ebx + 0x10]
test ecx, ecx
jns 0x40933b
add ecx, 3
sar ecx, 2
test ecx, ecx
jne 0x409346
xor eax, eax
jmp 0x409371
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0xf0], edx
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x3e4]
test eax, eax
jns 0x40936e
add eax, 3
sar eax, 2
mov dword [ebp - 0xec], eax
lea edx, [ebp - 0x90]
push edx
push 1
add esp, 0xfffffff0
mov ecx, dword [ebp - 0x3dc]
mov dword [esp], ecx
mov ecx, dword [ebp - 0x3d8]
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x3d4]
mov dword [esp + 8], eax
push ebx
call fcn.0040a154
add esp, 0x1c
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0xf4], edx
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0xf8], ecx
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x3f4], eax
mov edx, dword [ebp - 0x3fc]
mov dword [ebp - 0x40c], edx
mov edx, dword [ebp - 0x3f8]
mov dword [ebp - 0x408], edx
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x404], ecx
mov eax, dword [ebp - 0xf4]
shl eax, 2
add dword [ebp - 0x404], eax
mov edx, dword [ebp - 0x40c]
mov dword [ebp - 0x41c], edx
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x418], edx
mov ecx, dword [ebp - 0x404]
mov dword [ebp - 0x414], ecx
dec dword [ebp - 0xa0]
lea eax, [ebp - 0x90]
mov edx, 2
call fcn.005149c8
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp - 0xfc], ecx
cmp dword [ebp - 0x30], 0
jne 0x40944d
xor eax, eax
jmp 0x40945d
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
test eax, eax
jns 0x40945a
add eax, 3
sar eax, 2
cmp dword [ebp - 0x30], 0
jne 0x409467
xor edx, edx
jmp 0x409477
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x30]
test edx, edx
jns 0x409474
add edx, 3
sar edx, 2
cmp eax, edx
jae 0x4094c5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x110]
mov dword [ebp - 0x108], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x104], ecx
lea eax, [ebp - 0xfc]
push eax
push 1
mov edx, dword [ebp - 0x100]
push edx
call fcn.0040b4f4
add esp, 0xc
mov ecx, dword [ebp - 0x100]
add ecx, 4
mov dword [ebp - 0x2c], ecx
jmp 0x4095e3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x114], eax
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x424], edx
cmp dword [ebp - 0x30], 0
jne 0x4094e4
xor ecx, ecx
jmp 0x4094f4
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x30]
test ecx, ecx
jns 0x4094f1
add ecx, 3
sar ecx, 2
test ecx, ecx
jne 0x4094fc
xor eax, eax
jmp 0x409527
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x424]
sub eax, dword [ebp - 0x434]
test eax, eax
jns 0x409524
add eax, 3
sar eax, 2
mov dword [ebp - 0x118], eax
lea edx, [ebp - 0xfc]
mov word [ebp - 0xac], 0xc
push edx
push 1
add esp, 0xfffffff0
mov ecx, dword [ebp - 0x42c]
lea edx, [ebp - 0x40]
mov dword [esp], ecx
mov ecx, dword [ebp - 0x428]
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x424]
mov dword [esp + 8], eax
push edx
call fcn.0040b514
add esp, 0x1c
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x120], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x444], edx
mov ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x45c], ecx
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x458], ecx
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x454], eax
mov edx, dword [ebp - 0x120]
shl edx, 2
add dword [ebp - 0x454], edx
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x46c], ecx
mov ecx, dword [ebp - 0x458]
mov dword [ebp - 0x468], ecx
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x464], eax
lea edx, [ebp - 0x3cc]
push edx
push edi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
setne al
and eax, 1
test al, al
jne 0x40925e
push edi
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0xac], 0x84
mov edx, str.msiexec.exe
lea eax, [ebp - 0x44]
call fcn.005148b4
inc dword [ebp - 0xa0]
lea edx, [ebp - 0x12c]
mov word [ebp - 0xac], 0xc
mov word [ebp - 0xac], 0x90
push edx
call fcn.0040a020
pop ecx
lea ecx, [ebp - 0x12c]
push ecx
lea eax, [esi + 8]
push eax
call fcn.0040a048
xor edx, edx
xor ecx, ecx
mov dword [esi + 0x10], edx
xor eax, eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], eax
add esp, 8
inc dword [ebp - 0xa0]
mov word [ebp - 0xac], 0xc
xor edx, edx
mov dword [ebp - 0x130], edx
mov word [ebp - 0xac], 0xc
jmp 0x409835
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x130]
shl eax, 2
add eax, dword [ebx + 0x10]
call fcn.00514a88
test al, al
je 0x40982f
cmp dword [esi + 0x10], 0
jne 0x4096ae
xor ecx, ecx
jmp 0x4096be
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
test ecx, ecx
jns 0x4096bb
add ecx, 3
sar ecx, 2
cmp dword [esi + 0x10], 0
jne 0x4096c8
xor eax, eax
jmp 0x4096d8
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x10]
test eax, eax
jns 0x4096d5
add eax, 3
sar eax, 2
cmp ecx, eax
jae 0x409714
mov edi, dword [esi + 0x14]
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x138], edx
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x134], edx
lea ecx, [ebp - 0x130]
push ecx
push 1
push edi
call fcn.0040b4f4
add esp, 0xc
add edi, 4
mov dword [esi + 0x14], edi
jmp 0x40982f
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x474], edx
cmp dword [esi + 0x10], 0
jne 0x409733
xor ecx, ecx
jmp 0x409743
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
test ecx, ecx
jns 0x409740
add ecx, 3
sar ecx, 2
test ecx, ecx
jne 0x40974b
xor eax, eax
jmp 0x409776
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x484]
test eax, eax
jns 0x409773
add eax, 3
sar eax, 2
mov dword [ebp - 0x148], eax
lea edx, [ebp - 0x130]
mov word [ebp - 0xac], 0xc
push edx
push 1
add esp, 0xfffffff0
mov ecx, dword [ebp - 0x47c]
mov dword [esp], ecx
mov ecx, dword [ebp - 0x478]
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x474]
mov dword [esp + 8], eax
push esi
call fcn.0040b514
add esp, 0x1c
mov edx, dword [ebp - 0x148]
mov dword [ebp - 0x150], edx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x154], ecx
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x494], eax
mov edx, dword [ebp - 0x49c]
mov dword [ebp - 0x4ac], edx
mov edx, dword [ebp - 0x498]
mov dword [ebp - 0x4a8], edx
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x4a4], ecx
mov eax, dword [ebp - 0x150]
shl eax, 2
add dword [ebp - 0x4a4], eax
mov edx, dword [ebp - 0x4ac]
mov dword [ebp - 0x4bc], edx
mov edx, dword [ebp - 0x4a8]
mov dword [ebp - 0x4b8], edx
mov ecx, dword [ebp - 0x4a4]
mov dword [ebp - 0x4b4], ecx
inc dword [ebp - 0x130]
cmp dword [ebx + 0x10], 0
jne 0x40983f
xor eax, eax
jmp 0x40984f
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
test eax, eax
jns 0x40984c
add eax, 3
sar eax, 2
cmp eax, dword [ebp - 0x130]
ja 0x409688
cmp dword [esi + 0x10], 0
jne 0x409865
xor edx, edx
jmp 0x409875
mov edx, dword [esi + 0x14]
sub edx, dword [esi + 0x10]
test edx, edx
jns 0x409872
add edx, 3
sar edx, 2
cmp edx, 1
ja 0x409a33
mov word [ebp - 0xac], 0xb4
xor eax, eax
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0x94]
inc dword [ebp - 0xa0]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + eax*4]
add edx, 0x14
mov eax, dword [ebp + 8]
add eax, 4
call fcn.00514a04
lea eax, [ebp - 0x94]
mov eax, dword [eax]
call fcn.00514584
dec dword [ebp - 0xa0]
lea eax, [ebp - 0x94]
mov edx, 2
call fcn.005149c8
dec dword [ebp - 0xa0]
cmp dword [esi + 0x10], 0
je 0x409924
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x158], ecx
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x16c]
mov dword [ebp - 0x164], edx
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x160], edx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x170]
push eax
call fcn.004f3a34
pop ecx
xor edx, edx
xor ecx, ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ecx
xor eax, eax
mov edx, 2
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x44]
dec dword [ebp - 0xa0]
call fcn.005149c8
dec dword [ebp - 0xa0]
cmp dword [ebp - 0x30], 0
je 0x409992
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x174], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x178], eax
mov edx, dword [ebp - 0x188]
mov dword [ebp - 0x180], edx
mov edx, dword [ebp - 0x184]
mov dword [ebp - 0x17c], edx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18c], ecx
mov eax, dword [ebp - 0x18c]
push eax
call fcn.004f3a34
pop ecx
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x30], edx
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
dec dword [ebp - 0xa0]
cmp dword [ebx + 0x10], 0
je 0x409a12
mov edx, dword [ebx + 0x14]
mov dword [ebp - 0x190], edx
lea edx, [ebp - 0x19c]
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x194], ecx
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x198], eax
lea eax, [ebx + 8]
push dword [edx + 4]
push dword [edx]
push eax
mov edx, dword [ebp - 0x190]
push edx
mov ecx, dword [ebp - 0x194]
push ecx
call fcn.0040c7f4
add esp, 0x14
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x1a8], eax
mov edx, dword [ebp - 0x1a8]
push edx
call fcn.004f3a34
pop ecx
xor ecx, ecx
mov dword [ebx + 0x10], ecx
xor eax, eax
mov dword [ebx + 0x14], eax
xor edx, edx
mov dword [ebx + 0x18], edx
mov ecx, dword [ebp - 0xbc]
mov dword fs:[0], ecx
jmp 0x409f9c
mov word [ebp - 0xac], 0xc0
lea eax, [ebp - 0x1b0]
push eax
call fcn.0040c838
pop ecx
lea edx, [ebp - 0x1b0]
push edx
lea ecx, [ebp - 0x7c]
push ecx
call fcn.0040c860
xor eax, eax
xor edx, edx
mov dword [ebp - 0x74], eax
xor ecx, ecx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], ecx
add esp, 8
inc dword [ebp - 0xa0]
mov word [ebp - 0xac], 0xc
mov word [ebp - 0xac], 0xc
xor edi, edi
jmp 0x409c69
mov eax, dword [esi + 0x10]
mov edx, dword [eax + edi*4]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x1fffff
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
je 0x409c68
cmp dword [ebp - 0x74], 0
jne 0x409ac0
xor edx, edx
jmp 0x409ad0
mov edx, dword [ebp - 0x70]
sub edx, dword [ebp - 0x74]
test edx, edx
jns 0x409acd
add edx, 3
sar edx, 2
cmp dword [ebp - 0x74], 0
jne 0x409ada
xor eax, eax
jmp 0x409aea
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x74]
test eax, eax
jns 0x409ae7
add eax, 3
sar eax, 2
cmp edx, eax
jae 0x409b47
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1b8], edx
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x1c0], ecx
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1bc], ecx
lea ecx, [ebp - 0x7c]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x1b4]
push ecx
push eax
push 1
mov edx, dword [ebp - 0x1b8]
push edx
call fcn.0040c8b4
add esp, 0x18
mov ecx, dword [ebp - 0x1b8]
add ecx, 4
mov dword [ebp - 0x70], ecx
jmp 0x409c68
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1cc], eax
mov edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x4c4], edx
cmp dword [ebp - 0x74], 0
jne 0x409b66
xor ecx, ecx
jmp 0x409b76
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x74]
test ecx, ecx
jns 0x409b73
add ecx, 3
sar ecx, 2
test ecx, ecx
jne 0x409b7e
xor eax, eax
jmp 0x409ba9
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x1d4], edx
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x4c4]
sub eax, dword [ebp - 0x4d4]
test eax, eax
jns 0x409ba6
add eax, 3
sar eax, 2
mov dword [ebp - 0x1d0], eax
lea edx, [ebp - 0x1b4]
mov word [ebp - 0xac], 0xc
push edx
push 1
add esp, 0xfffffff0
mov ecx, dword [ebp - 0x4cc]
lea edx, [ebp - 0x84]
mov dword [esp], ecx
mov ecx, dword [ebp - 0x4c8]
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x4c4]
mov dword [esp + 8], eax
push edx
call fcn.0040c944
add esp, 0x1c
mov ecx, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d8], ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1dc], eax
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x4e4], edx
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp - 0x4fc], ecx
mov ecx, dword [ebp - 0x4e8]
mov dword [ebp - 0x4f8], ecx
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x4f4], eax
mov edx, dword [ebp - 0x1d8]
shl edx, 2
add dword [ebp - 0x4f4], edx
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0x50c], ecx
mov ecx, dword [ebp - 0x4f8]
mov dword [ebp - 0x508], ecx
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x504], eax
inc edi
cmp dword [esi + 0x10], 0
jne 0x409c73
xor edx, edx
jmp 0x409c83
mov edx, dword [esi + 0x14]
sub edx, dword [esi + 0x10]
test edx, edx
jns 0x409c80
add edx, 3
sar edx, 2
cmp edx, edi
ja 0x409a8a
cmp dword [ebp - 0x74], 0
jne 0x409c95
xor eax, eax
jmp 0x409ca5
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x74]
test eax, eax
jns 0x409ca2
add eax, 3
sar eax, 2
shl eax, 2
push eax
call fcn.004ffad8
pop ecx
mov dword [ebp - 0x1e0], eax
mov word [ebp - 0xac], 0xc
mov word [ebp - 0xac], 0xc
xor eax, eax
jmp 0x409cdb
mov edx, dword [ebp - 0x74]
mov ecx, dword [edx + eax*4]
mov edx, dword [ebp - 0x1e0]
mov dword [edx + eax*4], ecx
inc eax
cmp dword [ebp - 0x74], 0
jne 0x409ce5
xor ecx, ecx
jmp 0x409cf5
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x74]
test ecx, ecx
jns 0x409cf2
add ecx, 3
sar ecx, 2
cmp ecx, eax
ja 0x409ccb
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0x1e0]
push eax
cmp dword [ebp - 0x74], 0
jne 0x409d0e
xor edx, edx
jmp 0x409d1e
mov edx, dword [ebp - 0x70]
sub edx, dword [ebp - 0x74]
test edx, edx
jns 0x409d1b
add edx, 3
sar edx, 2
push edx
call sub.KERNEL32.DLL_WaitForMultipleObjects
mov word [ebp - 0xac], 0xc
xor edi, edi
jmp 0x409d41
mov eax, dword [ebp - 0x1e0]
mov edx, dword [eax + edi*4]
push edx
call sub.KERNEL32.DLL_CloseHandle
inc edi
cmp dword [esi + 0x10], 0
jne 0x409d4b
xor ecx, ecx
jmp 0x409d5b
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
test ecx, ecx
jns 0x409d58
add ecx, 3
sar ecx, 2
cmp ecx, edi
ja 0x409d31
mov eax, dword [ebp - 0x1e0]
push eax
call fcn.004f3a0c
pop ecx
xor edx, edx
mov word [ebp - 0xac], 0xe4
mov dword [ebp - 0x98], edx
lea ecx, [ebp - 0x98]
inc dword [ebp - 0xa0]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp + 8]
add edx, 0x14
add eax, 4
call fcn.00514a04
lea eax, [ebp - 0x98]
mov eax, dword [eax]
call fcn.00514584
dec dword [ebp - 0xa0]
lea eax, [ebp - 0x98]
mov edx, 2
call fcn.005149c8
dec dword [ebp - 0xa0]
cmp dword [ebp - 0x74], 0
je 0x409e37
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x1e4], ecx
lea ecx, [ebp - 0x1f0]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1e8], eax
mov edx, dword [ebp - 0x1f8]
mov dword [ebp - 0x1f0], edx
mov edx, dword [ebp - 0x1f4]
mov dword [ebp - 0x1ec], edx
lea edx, [ebp - 0x7c]
push dword [ecx + 4]
push dword [ecx]
push edx
mov ecx, dword [ebp - 0x1e4]
push ecx
mov eax, dword [ebp - 0x1e8]
push eax
call fcn.0040dc78
add esp, 0x14
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x1fc], edx
mov ecx, dword [ebp - 0x1fc]
push ecx
call fcn.004f3a34
pop ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x74], eax
xor ecx, ecx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], ecx
dec dword [ebp - 0xa0]
cmp dword [esi + 0x10], 0
je 0x409e92
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x200], eax
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x204], edx
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x20c], ecx
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x208], ecx
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
push edx
call fcn.004f3a34
pop ecx
xor ecx, ecx
xor eax, eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
xor edx, edx
lea eax, [ebp - 0x44]
mov dword [esi + 0x18], edx
mov edx, 2
dec dword [ebp - 0xa0]
call fcn.005149c8
dec dword [ebp - 0xa0]
cmp dword [ebp - 0x30], 0
je 0x409f00
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x220], eax
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x228], edx
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x224], edx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x234], ecx
mov eax, dword [ebp - 0x234]
push eax
call fcn.004f3a34
pop ecx
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x30], edx
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
dec dword [ebp - 0xa0]
cmp dword [ebx + 0x10], 0
je 0x409f80
mov edx, dword [ebx + 0x14]
mov dword [ebp - 0x238], edx
lea edx, [ebp - 0x244]
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x23c], ecx
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x240], eax
lea eax, [ebx + 8]
push dword [edx + 4]
push dword [edx]
push eax
mov edx, dword [ebp - 0x238]
push edx
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.0040c7f4
add esp, 0x14
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x250], eax
mov edx, dword [ebp - 0x250]
push edx
call fcn.004f3a34
pop ecx
xor ecx, ecx
mov dword [ebx + 0x10], ecx
xor eax, eax
mov dword [ebx + 0x14], eax
xor edx, edx
mov dword [ebx + 0x18], edx
mov ecx, dword [ebp - 0xbc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret