Function at 0x4160fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x416104
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41790a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00403c84
mov eax, dword [ebp - 0x30]
mov edx, 0x417920
call fcn.00401d20
jne 0x41614c
push 1
push 0x417928
call sub.kernel32.dll_WinExec
call fcn.00401948
lea ecx, [ebp - 0x38]
xor edx, edx
xor eax, eax
call fcn.00415484
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.004040bc
mov eax, dword [ebp - 0x34]
call fcn.00404138
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00403c84
mov eax, dword [ebp - 0x3c]
call fcn.00409480
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffdc
call fcn.00409384
mov edx, 0x419868
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.0040937c
mov edx, 0x419870
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.0040937c
mov edx, 0x419878
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.0040937c
mov edx, 0x419880
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.0040937c
mov edx, 0x419898
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.0040937c
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.0040937c
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.0040937c
lea edx, [ebp - 0x29]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.0040937c
cmp byte [ebp - 0x29], 0xf1
je 0x41624f
mov eax, dword [ebp - 0x10]
call fcn.00408680
xor eax, eax
call fcn.00415548
push 0x10
push 0x417934
push 0x41793c
mov eax, dword [0x41868c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00401948
mov eax, dword [0x419868]
mov edx, dword [0x41986c]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416269
call fcn.004013f4
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409384
xor eax, eax
mov al, byte [ebp - 0x2a]
inc eax
push eax
mov eax, 0x419844
mov ecx, 1
mov edx, dword [0x4150f8]
call fcn.00402710
add esp, 4
xor ebx, ebx
mov bl, byte [ebp - 0x2a]
test ebx, ebx
jl 0x4162cd
inc ebx
xor esi, esi
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x40]
mov eax, dword [0x419844]
test eax, eax
je 0x4162bc
cmp esi, dword [eax - 4]
jb 0x4162c1
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x4162a0
mov eax, 0x62
call fcn.00415474
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x419860
mov ecx, 1
mov edx, dword [0x4151d8]
call fcn.00402710
add esp, 4
dec ebx
test ebx, ebx
jl 0x41632c
inc ebx
xor esi, esi
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x44]
mov eax, dword [0x419860]
test eax, eax
je 0x41631b
cmp esi, dword [eax - 4]
jb 0x416320
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x4162ff
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416424
inc ebx
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x419860]
test edx, edx
je 0x416352
cmp eax, dword [edx - 4]
jb 0x416357
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.0040901c
test eax, eax
jns 0x416368
call fcn.004013f4
mov edx, esi
shl edx, 2
add edx, 2
mov ecx, dword [0x419860]
test ecx, ecx
je 0x41637f
cmp edx, dword [ecx - 4]
jb 0x416384
call fcn.004013f4
mov edx, dword [ecx + edx*4]
push edx
mov edx, esi
shl edx, 2
inc edx
mov ecx, dword [0x419860]
test ecx, ecx
je 0x41639d
cmp edx, dword [ecx - 4]
jb 0x4163a2
call fcn.004013f4
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.004157e0
mov edx, dword [ebp - 0x48]
mov eax, dword [0x419860]
test eax, eax
je 0x4163bc
cmp esi, dword [eax - 4]
jb 0x4163c1
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
mov eax, dword [0x419860]
test eax, eax
je 0x4163d7
cmp esi, dword [eax - 4]
jb 0x4163dc
call fcn.004013f4
cmp dword [eax + esi*4], 0
jne 0x41641c
mov eax, dword [0x419860]
test eax, eax
je 0x4163f0
cmp esi, dword [eax - 4]
jb 0x4163f5
call fcn.004013f4
lea eax, [eax + esi*4]
mov edx, esi
shl edx, 2
add edx, 3
mov ecx, dword [0x419860]
test ecx, ecx
je 0x41640f
cmp edx, dword [ecx - 4]
jb 0x416414
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x41633a
push edi
mov eax, 0x419860
mov ecx, 1
mov edx, dword [0x4151d8]
call fcn.00402710
add esp, 4
mov eax, 0x6e
call fcn.0041544c
mov byte [0x418618], al
call fcn.00403d90
mov ebx, eax
test ebx, ebx
jle 0x4166ae
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00403c84
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00409050
mov eax, dword [ebp - 8]
mov edx, 0x41798c
call fcn.00401d20
jne 0x41648b
mov byte [0x418618], 1
mov eax, dword [ebp - 8]
mov edx, 0x417998
call fcn.00401d20
jne 0x4164a1
mov byte [0x41861c], 1
mov eax, dword [ebp - 8]
mov edx, 0x4179a4
call fcn.00401d20
jne 0x4164d6
mov eax, 0x6b
mov edx, dword [0x419844]
test edx, edx
je 0x4164c4
cmp eax, dword [edx - 4]
jb 0x4164c9
call fcn.004013f4
lea eax, [edx + eax*4]
mov edx, 0x4179b0
call fcn.00401aa4
mov eax, dword [ebp - 8]
mov edx, 0x4179bc
call fcn.00401d20
jne 0x41650b
mov eax, 0x3f
mov edx, dword [0x419844]
test edx, edx
je 0x4164f9
cmp eax, dword [edx - 4]
jb 0x4164fe
call fcn.004013f4
lea eax, [edx + eax*4]
mov edx, 0x4179b0
call fcn.00401aa4
lea eax, [ebp - 0x4c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x4c]
mov edx, 0x4179c8
call fcn.00401d20
jne 0x41657a
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00403de0
mov edx, dword [ebp - 0x50]
mov eax, 0x3a
mov ecx, dword [0x419844]
test ecx, ecx
je 0x41656d
cmp eax, dword [ecx - 4]
jb 0x416572
call fcn.004013f4
lea eax, [ecx + eax*4]
call fcn.00401aa4
lea eax, [ebp - 0x58]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x58]
mov edx, 0x4179d4
call fcn.00401d20
jne 0x4165d3
mov eax, 0x6a
mov edx, dword [0x419844]
test edx, edx
je 0x4165b3
cmp eax, dword [edx - 4]
jb 0x4165b8
call fcn.004013f4
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
lea eax, [ebp - 0x5c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x5c]
mov edx, 0x4179e0
call fcn.00401d20
jne 0x416614
push 0x419888
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
lea eax, [ebp - 0x60]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x60]
mov edx, 0x4179ec
call fcn.00401d20
jne 0x4166a6
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.00401e30
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00415630
mov edx, dword [ebp - 0x64]
mov eax, 0x1d
mov ecx, dword [0x419844]
test ecx, ecx
je 0x416676
cmp eax, dword [ecx - 4]
jb 0x41667b
call fcn.004013f4
mov eax, dword [ecx + eax*4]
call fcn.00401d20
jne 0x4166a6
mov eax, 0x1d
mov edx, dword [0x419844]
test edx, edx
je 0x416699
cmp eax, dword [edx - 4]
jb 0x41669e
call fcn.004013f4
lea eax, [edx + eax*4]
call fcn.00401a50
inc esi
dec ebx
jne 0x416460
cmp byte [0x418618], 0
je 0x4166e2
mov eax, 0x1d
mov edx, dword [0x419844]
test edx, edx
je 0x4166cb
cmp eax, dword [edx - 4]
jb 0x4166d0
call fcn.004013f4
cmp dword [edx + eax*4], 0
je 0x4166e2
mov al, 1
call fcn.00415548
call fcn.00401948
mov eax, 0x41
mov edx, dword [0x419844]
test edx, edx
je 0x4166f6
cmp eax, dword [edx - 4]
jb 0x4166fb
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x6c]
xor edx, edx
call fcn.004107c8
mov edx, dword [ebp - 0x6c]
mov eax, 0x419894
call fcn.00401aa4
mov eax, dword [0x41868c]
mov eax, dword [eax]
mov edx, dword [0x419894]
call fcn.0040a7e0
cmp byte [0x418618], 0
jne 0x416744
push 5
mov eax, dword [0x41868c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
jmp 0x416752
mov eax, dword [0x41868c]
mov eax, dword [eax]
xor edx, edx
call fcn.00405f90
mov eax, 0x32
call fcn.00415474
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x419838
mov ecx, 1
mov edx, dword [0x415098]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4167b3
inc ebx
xor esi, esi
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x70]
mov eax, dword [0x419838]
test eax, eax
je 0x4167a2
cmp esi, dword [eax - 4]
jb 0x4167a7
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416786
mov eax, 0x60
call fcn.00415474
lea edi, [eax + eax*2]
push edi
mov eax, 0x41985c
mov ecx, 1
mov edx, dword [0x4151b8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416810
inc ebx
xor esi, esi
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x74]
mov eax, dword [0x41985c]
test eax, eax
je 0x4167ff
cmp esi, dword [eax - 4]
jb 0x416804
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x4167e3
mov eax, 0x1f
call fcn.00415474
mov edi, eax
add edi, edi
push edi
mov eax, 0x419864
mov ecx, 1
mov edx, dword [0x4151f8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x41686e
inc ebx
xor esi, esi
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x78]
mov eax, dword [0x419864]
test eax, eax
je 0x41685d
cmp esi, dword [eax - 4]
jb 0x416862
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416841
mov eax, 0x36
call fcn.00415474
mov edi, eax
shl edi, 3
push edi
mov eax, 0x419834
mov ecx, 1
mov edx, dword [0x415078]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4168cd
inc ebx
xor esi, esi
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x419834]
test eax, eax
je 0x4168bc
cmp esi, dword [eax - 4]
jb 0x4168c1
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x4168a0
mov eax, 0x43
call fcn.00415474
lea edi, [eax + eax*2]
push edi
mov eax, 0x41983c
mov ecx, 1
mov edx, dword [0x4150b8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x41692a
inc ebx
xor esi, esi
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x80]
mov eax, dword [0x41983c]
test eax, eax
je 0x416919
cmp esi, dword [eax - 4]
jb 0x41691e
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x4168fd
mov eax, 0x5d
call fcn.00415474
mov edi, eax
add edi, edi
push edi
mov eax, 0x419840
mov ecx, 1
mov edx, dword [0x4150d8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x41698e
inc ebx
xor esi, esi
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x84]
mov eax, dword [0x419840]
test eax, eax
je 0x41697d
cmp esi, dword [eax - 4]
jb 0x416982
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x41695b
mov eax, 0x28
call fcn.00415474
mov ebx, eax
mov eax, 0x19
call fcn.00415474
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419830
mov ecx, 1
mov edx, dword [0x415058]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416a03
inc ebx
xor esi, esi
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x88]
mov eax, dword [0x419830]
test eax, eax
je 0x4169f2
cmp esi, dword [eax - 4]
jb 0x4169f7
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x4169d0
mov eax, 0x18
call fcn.00415474
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419850
mov ecx, 1
mov edx, dword [0x415158]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416a6a
inc ebx
xor esi, esi
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x419850]
test eax, eax
je 0x416a59
cmp esi, dword [eax - 4]
jb 0x416a5e
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416a37
mov eax, 0x2d
call fcn.00415474
mov edi, eax
add edi, edi
push edi
mov eax, 0x419854
mov ecx, 1
mov edx, dword [0x415178]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416ace
inc ebx
xor esi, esi
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x90]
mov eax, dword [0x419854]
test eax, eax
je 0x416abd
cmp esi, dword [eax - 4]
jb 0x416ac2
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416a9b
mov eax, 0x14
call fcn.00415474
mov edi, eax
add edi, edi
push edi
mov eax, 0x419858
mov ecx, 1
mov edx, dword [0x415198]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416b32
inc ebx
xor esi, esi
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x94]
mov eax, dword [0x419858]
test eax, eax
je 0x416b21
cmp esi, dword [eax - 4]
jb 0x416b26
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416aff
mov eax, 0x1a
call fcn.00415474
mov edi, eax
shl edi, 2
push edi
mov eax, 0x41984c
mov ecx, 1
mov edx, dword [0x415138]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416b97
inc ebx
xor esi, esi
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x98]
mov eax, dword [0x41984c]
test eax, eax
je 0x416b86
cmp esi, dword [eax - 4]
jb 0x416b8b
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416b64
mov eax, 0x1a
call fcn.00415474
mov edi, eax
mov eax, 0x39
call fcn.00415474
imul edi, eax
lea eax, [edi + 1]
push eax
mov eax, 0x419848
mov ecx, 1
mov edx, dword [0x415118]
call fcn.00402710
add esp, 4
mov ebx, edi
test ebx, ebx
jle 0x416c0a
mov esi, 1
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x419848]
test eax, eax
je 0x416bf9
cmp esi, dword [eax - 4]
jb 0x416bfe
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416bd7
mov eax, dword [0x419878]
mov edx, dword [0x41987c]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416c24
call fcn.004013f4
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409384
cmp byte [0x419898], 0
je 0x416cb1
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 2
call fcn.00415484
mov eax, dword [ebp - 8]
call fcn.004094a8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, 0x4179fc
call fcn.004052fc
push dword [0x419874]
push dword [0x419870]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004156c0
mov eax, dword [ebp - 0x14]
call fcn.00408680
mov dl, 1
mov eax, dword [0x40c934]
call fcn.0040cd04
mov ebx, eax
lea eax, [ebp - 0xa0]
call fcn.0040434c
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040d190
mov eax, ebx
call fcn.00401464
jmp 0x416d2a
xor ebx, ebx
mov bl, byte [ebp - 0x2b]
test ebx, ebx
jle 0x416d2a
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
call fcn.0040434c
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 8]
pop ecx
call fcn.00401c28
mov eax, dword [ebp - 8]
call fcn.004094a8
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0x10]
call fcn.00405364
mov eax, dword [ebp - 0xac]
call fcn.0040901c
mov edi, eax
mov eax, edi
cdq
push edx
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004156c0
mov eax, dword [ebp - 0x14]
call fcn.00408680
dec ebx
jne 0x416cba
mov eax, dword [ebp - 0x10]
call fcn.00408680
cmp dword [0x419888], 0
je 0x416dd2
mov byte [0x418614], 0xff
mov eax, 0x1a
call fcn.00415474
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x416dbf
inc ebx
xor esi, esi
mov eax, esi
shl eax, 2
mov edx, dword [0x41984c]
test edx, edx
je 0x416d6e
cmp eax, dword [edx - 4]
jb 0x416d73
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0xb0]
call fcn.00409050
mov eax, dword [ebp - 0xb0]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [0x419888]
call fcn.00409050
mov eax, dword [ebp - 0xb4]
pop edx
call fcn.00401f14
test eax, eax
jle 0x416dbb
mov eax, esi
cmp eax, 0xff
jbe 0x416db6
call fcn.004013f4
mov byte [0x418614], al
inc esi
dec ebx
jne 0x416d5a
cmp byte [0x418614], 0xff
jne 0x416dd2
mov eax, 0x419888
call fcn.00401a50
mov eax, 0x1a
call fcn.00415474
dec eax
jle 0x416e29
cmp dword [0x419888], 0
jne 0x416e29
mov edx, dword [0x41868c]
mov edx, dword [edx]
mov eax, dword [0x418640]
call fcn.0040dc0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405fa0
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00406fd4
cmp byte [0x418620], 0
jne 0x416e29
mov al, 1
call fcn.00415548
call fcn.00401948
mov eax, 0x1a
call fcn.00415474
dec eax
jle 0x416ed6
cmp byte [0x418614], 0
jbe 0x416ed6
mov eax, 0x419888
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x416e66
cmp edx, dword [ecx - 4]
jb 0x416e6b
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
mov eax, 0x39
call fcn.00415474
mov ebx, eax
test ebx, ebx
jle 0x416ef9
mov esi, 1
mov eax, 0x39
call fcn.00415474
xor edx, edx
mov dl, byte [0x418614]
imul edx
add eax, esi
mov edx, dword [0x419848]
test edx, edx
je 0x416ead
cmp eax, dword [edx - 4]
jb 0x416eb2
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, dword [0x419848]
test eax, eax
je 0x416ec3
cmp esi, dword [eax - 4]
jb 0x416ec8
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416e88
jmp 0x416ef9
mov eax, 0x419888
xor edx, edx
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x416eec
cmp edx, dword [ecx - 4]
jb 0x416ef1
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
add edx, 2
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x416f19
cmp edx, dword [ecx - 4]
jb 0x416f1e
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
cmp dword [ebp - 8], 0
je 0x416f4a
mov eax, dword [ebp - 8]
call fcn.0040901c
cmp eax, 0xff
jbe 0x416f40
call fcn.004013f4
mov edx, dword [0x41865c]
mov byte [edx], al
jmp 0x416f52
mov eax, dword [0x41865c]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
add edx, 3
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x416f72
cmp edx, dword [ecx - 4]
jb 0x416f77
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
cmp dword [ebp - 8], 0
je 0x416fa3
mov eax, dword [ebp - 8]
call fcn.0040901c
cmp eax, 0xff
jbe 0x416f99
call fcn.004013f4
mov edx, dword [0x4186cc]
mov byte [edx], al
jmp 0x416fab
mov eax, dword [0x4186cc]
mov byte [eax], 0x10
mov eax, 0x3d
call fcn.00415474
call fcn.00408010
test al, al
je 0x41705e
cmp byte [0x418618], 0
jne 0x417052
push 0x30
mov eax, 0x41
mov edx, dword [0x419844]
test edx, edx
je 0x416fe5
cmp eax, dword [edx - 4]
jb 0x416fea
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
mov eax, 0x3e
mov edx, dword [0x419844]
test edx, edx
je 0x417007
cmp eax, dword [edx - 4]
jb 0x41700c
call fcn.004013f4
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x419848]
test edx, edx
je 0x417023
cmp eax, dword [edx - 4]
jb 0x417028
call fcn.004013f4
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xb8]
call fcn.00401c28
mov eax, dword [ebp - 0xb8]
call fcn.00401dd4
push eax
mov eax, dword [0x41868c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
mov al, 1
call fcn.00415548
call fcn.00401948
mov eax, 0x63
call fcn.0041544c
test al, al
je 0x4170c0
call fcn.004159b8
test al, al
jne 0x4170c0
push 0x30
mov eax, dword [0x419894]
call fcn.00401dd4
push eax
mov eax, 0x55
mov edx, dword [0x419848]
test edx, edx
je 0x417096
cmp eax, dword [edx - 4]
jb 0x41709b
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
mov eax, dword [0x41868c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
mov al, 1
call fcn.00415548
call fcn.00401948
mov eax, 0x64
call fcn.0041544c
test al, al
je 0x417219
mov eax, 0x64
mov edx, dword [0x419844]
test edx, edx
je 0x4170e6
cmp eax, dword [edx - 4]
jb 0x4170eb
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00403894
fstp qword [ebp - 0x20]
wait
call fcn.00415840
fstp qword [ebp - 0x28]
wait
mov eax, 0x55
call fcn.0041544c
test al, al
je 0x417119
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jb 0x41713a
mov eax, 0x55
call fcn.0041544c
test al, al
jne 0x417219
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
je 0x417219
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x419848]
test ecx, ecx
je 0x417151
cmp edx, dword [ecx - 4]
jb 0x417156
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
mov eax, 2
call fcn.0041544c
test al, al
je 0x4171a4
mov esi, 4
push dword [ebp - 8]
push 0x417a0c
mov eax, 0x57
mov edx, dword [0x419848]
test edx, edx
je 0x41718d
cmp eax, dword [edx - 4]
jb 0x417192
call fcn.004013f4
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401c9c
jmp 0x4171a6
xor esi, esi
or esi, 0x30
test esi, esi
jns 0x4171b2
call fcn.004013f4
push esi
mov eax, dword [0x419894]
call fcn.00401dd4
push eax
mov eax, dword [ebp - 8]
call fcn.00401dd4
push eax
mov eax, dword [0x41868c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x41720d
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x419844]
test edx, edx
je 0x4171f6
cmp eax, dword [edx - 4]
jb 0x4171fb
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov al, 1
call fcn.00415548
call fcn.00401948
mov eax, 0x67
call fcn.0041544c
test al, al
je 0x4172f3
lea eax, [ebp - 8]
mov edx, 0x68
mov ecx, dword [0x419844]
test ecx, ecx
je 0x417242
cmp edx, dword [ecx - 4]
jb 0x417247
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
mov eax, 0x69
call fcn.00415474
cmp eax, 2
jge 0x4172cd
mov ebx, 1
xor esi, esi
jmp 0x4172c3
mov esi, ebx
mov eax, 0x69
call fcn.00415474
sub eax, 1
jb 0x41727c
je 0x417290
jmp 0x41729a
mov eax, dword [ebp - 8]
call fcn.00401dd4
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
jmp 0x41729a
mov eax, dword [ebp - 8]
call fcn.00415d8c
mov ebx, eax
test ebx, ebx
je 0x4172c3
mov eax, dword [0x41868c]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x28]
je 0x4172c3
mov eax, dword [0x41982c]
mov eax, dword [eax + 0x18]
cmp ebx, dword [eax + 0x28]
je 0x4172c3
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
je 0x4172f3
cmp ebx, esi
jne 0x417267
jmp 0x4172f3
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00409050
call fcn.0040c800
cmp al, 3
jbe 0x4172eb
mov eax, dword [ebp - 0xc]
call fcn.00415f8c
jmp 0x4172f3
mov eax, dword [ebp - 0xc]
call fcn.00415e7c
mov eax, 1
call fcn.0041544c
test al, al
je 0x417759
cmp byte [0x418618], 0
jne 0x417759
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
xor edx, edx
call fcn.0040364c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.0040802c
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040ad54
call fcn.0040a974
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
pop edx
call fcn.0040b764
mov edx, dword [0x418688]
mov dword [edx], eax
mov eax, 3
call fcn.0041544c
test al, al
je 0x4173fa
mov eax, 6
call fcn.0041544c
xor al, 1
push eax
mov eax, 4
call fcn.00415474
push eax
mov eax, 5
call fcn.00415474
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
push eax
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e5c
pop edx
pop ecx
call fcn.00415aa0
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.004072c8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.0040364c
jmp 0x417580
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418660]
mov dword [edx], eax
lea ecx, [ebp - 0xbc]
xor edx, edx
mov eax, 6
call fcn.00415484
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x418660]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 7
call fcn.00415474
sub eax, 1
jb 0x41744c
je 0x41746f
dec eax
je 0x4174ca
jmp 0x417580
mov eax, dword [0x418660]
mov eax, dword [eax]
call fcn.004072c8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.0040364c
jmp 0x417580
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a9d0
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e5c
mov edx, eax
mov eax, dword [0x418660]
mov eax, dword [eax]
pop ecx
call fcn.0040b93c
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.004072c8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.0040364c
jmp 0x417580
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
mov edx, dword [0x418660]
mov edx, dword [edx]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xd0], eax
fild dword [ebp - 0xd0]
fdiv dword [0x417a10]
call fcn.00401298
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x417505
call fcn.004013f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
mov edx, dword [0x418660]
mov edx, dword [edx]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xd4], eax
fild dword [ebp - 0xd4]
fdiv dword [0x417a10]
call fcn.00401298
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x417541
call fcn.004013f4
push eax
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e5c
mov edx, eax
mov eax, dword [0x418660]
mov eax, dword [eax]
pop ecx
call fcn.0040b88c
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.004072c8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.0040364c
mov eax, 8
mov edx, dword [0x419844]
test edx, edx
je 0x417594
cmp eax, dword [edx - 4]
jb 0x417599
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd8]
xor edx, edx
call fcn.004107c8
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040a7e0
mov eax, 9
mov edx, dword [0x419844]
test edx, edx
je 0x4175ce
cmp eax, dword [edx - 4]
jb 0x4175d3
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xdc]
xor edx, edx
call fcn.004107c8
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a7e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040adbc
mov ebx, eax
mov eax, 0xa
call fcn.00415474
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408a14
mov eax, 0xb
mov edx, dword [0x419844]
test edx, edx
je 0x41762d
cmp eax, dword [edx - 4]
jb 0x417632
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.0040369c
mov eax, 0xc
call fcn.00415474
mov edx, eax
mov eax, ebx
call fcn.0040362c
mov eax, 0xd
call fcn.00415474
mov edx, eax
cmp edx, 0xff
jbe 0x417668
call fcn.004013f4
mov eax, ebx
call fcn.0040368c
mov eax, 0xe
call fcn.00415474
mov edx, eax
mov eax, ebx
call fcn.00408a48
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040adbc
mov ebx, eax
mov eax, 0xf
call fcn.00415474
mov edx, eax
mov eax, ebx
call fcn.00408a48
mov eax, 0x10
call fcn.00415474
mov edx, eax
mov eax, ebx
call fcn.0040362c
mov eax, 0x11
call fcn.00415474
mov edx, eax
cmp edx, 0xff
jbe 0x4176ce
call fcn.004013f4
mov eax, ebx
call fcn.0040368c
mov eax, 0x12
call fcn.00415474
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408a14
mov eax, 0x13
mov edx, dword [0x419844]
test edx, edx
je 0x417701
cmp eax, dword [edx - 4]
jb 0x417706
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.0040369c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ac2c
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ac04
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.0040802c
jmp 0x417764
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405fa0
mov eax, 0x31
call fcn.0041544c
test al, al
je 0x4177a7
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418684]
mov dword [edx], eax
lea ecx, [ebp - 0xe0]
xor edx, edx
mov eax, 4
call fcn.00415484
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x3f
call fcn.0041544c
test al, al
je 0x4177ea
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418668]
mov dword [edx], eax
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, 5
call fcn.00415484
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x418668]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x70
call fcn.0041544c
test al, al
je 0x41782d
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418670]
mov dword [edx], eax
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, 7
call fcn.00415484
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x418670]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x58
call fcn.0041544c
test al, al
jne 0x417857
mov eax, 0x59
call fcn.0041544c
test al, al
jne 0x417857
mov eax, 0x5a
call fcn.0041544c
test al, al
je 0x41788c
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x41869c]
mov dword [edx], eax
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, 8
call fcn.00415484
mov edx, dword [ebp - 0xec]
mov eax, dword [0x41869c]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x1d
call fcn.0041544c
test al, al
je 0x4178cf
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x4186d4]
mov dword [edx], eax
lea ecx, [ebp - 0xf0]
xor edx, edx
mov eax, 9
call fcn.00415484
mov edx, dword [ebp - 0xf0]
mov eax, dword [0x4186d4]
mov eax, dword [eax]
call fcn.0040bc38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417911
lea eax, [ebp - 0xf0]
mov edx, 7
call fcn.00401a74
lea eax, [ebp - 0xbc]
mov edx, 0x24
call fcn.00401a74
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401a74
ret