Function at 0x4ab9b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x40
push 0
push 0
dec ecx
jne 0x4ab9c1
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ada2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb560], 0
jne 0x4aba1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431df8
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
jmp 0x4ad995
xor ecx, ecx
push ebp
push 0x4ad962
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [ebp - 0xc], 0
jne 0x4abad7
mov edx, dword [ebp - 8]
mov eax, edx
shl edx, 3
sub edx, eax
mov eax, dword [ebp - 4]
mov al, byte [eax + edx*8 + 0xb55e]
cmp al, 0xb
je 0x4aba5d
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp al, 0xc
jne 0x4aba6a
mov eax, dword [ebp - 4]
cmp dword [eax + edx*8 + 0xb554], 0xffffffff
je 0x4aba76
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xb39c], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb560], 0
jle 0x4abacf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb39c]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 5
je 0x4abacf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb39c]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 6
je 0x4abacf
mov eax, dword [ebp - 4]
call fcn.004ab64c
mov eax, dword [ebp - 4]
call fcn.004ab554
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b0]
mov edx, 0x4ada44
call fcn.00431df8
mov eax, dword [ebp - 4]
mov byte [eax + 0xa5de], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
xor edx, edx
call fcn.00431df8
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb560], 0
jle 0x4acedf
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*8 + 0xb55f]
sub al, 1
jb 0x4abb51
je 0x4abb7e
jmp 0x4abba2
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fbc8]
call fcn.00403c7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb550]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0xa524]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4abbf1
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4fbb8]
call fcn.00403c7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*8 + 0xb550]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
jmp 0x4abbf1
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + edx*8 + 0xb55f]
mov edx, dword [ebp - 4]
mov edx, dword [edx + esi*4 + 0xa5d8]
call fcn.00403c7c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4 + 0xa628]
mov edx, dword [ebp - 4]
add eax, dword [edx + ebx*8 + 0xb550]
dec eax
add eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
call fcn.0040947c
test al, al
jne 0x4abc2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x770]
mov dl, 1
call fcn.004532b0
mov eax, dword [ebp - 4]
mov byte [eax + 0xa928], 0x16
mov eax, dword [ebp - 4]
call fcn.004ab664
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov edx, dword [ebp - 0x2c]
call fcn.0040633e
mov eax, dword [0x4cf300]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov edx, 1
call fcn.00406841
call fcn.00402854
mov edx, dword [ebp - 0x30]
sub edx, 4
mov eax, dword [ebp - 4]
add eax, 0xa93c
call fcn.00406878
call fcn.00402854
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov ecx, 4
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*8 + 0xb55e]
cmp eax, 0xc
ja case.0x4abca5.8
jmp dword [eax*4 + 0x4abcac]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4ada58
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 8]
call fcn.0040920c
push dword [ebp - 0x164]
push 0x4ada68
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4ada58
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 8]
call fcn.0040920c
push dword [ebp - 0x168]
push 0x4ada78
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
lea eax, [ebp - 0x1c]
call fcn.00403be4
cmp dword [ebp - 0xc], 0
jne 0x4acc8e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4ffd8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x16c]
call fcn.00403eb0
mov eax, dword [ebp - 0x16c]
call fcn.004096b0
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4ffd8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x170]
call fcn.00403eb0
mov edx, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0049fab0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa924], 0
je 0x4ac0b7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa924]
call fcn.0040947c
test al, al
je 0x4ac0b7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x20]
call fcn.00408ebc
mov edx, dword [ebp - 0x20]
mov eax, 0x4ada88
call fcn.00404150
mov ebx, eax
test ebx, ebx
jle 0x4acc8e
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 5]
mov ecx, 0x14
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov edx, dword [ebp - 0x20]
mov eax, 0x4ada98
call fcn.00404150
test eax, eax
jne 0x4abee3
lea edx, [ebx + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa924]
call fcn.004095cc
mov ecx, dword [ebp - 0x17c]
lea eax, [ebp - 0x178]
mov edx, 0x4adaac
call fcn.00403eb0
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
call fcn.00428c98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x4ac09f
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x20]
call fcn.00408ebc
mov edx, dword [ebp - 0x20]
mov eax, 0x4ada98
call fcn.00404150
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebx + 0xa]
mov ecx, 0xff
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov edx, dword [ebp - 0x20]
mov eax, 0x4adacc
call fcn.00404150
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040406c
jmp 0x4abf71
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
dec ecx
mov edx, 2
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov eax, dword [ebp - 0x20]
mov al, byte [eax]
cmp al, 0x5c
je 0x4abf55
cmp al, 0x2e
je 0x4abf55
cmp al, 0x20
je 0x4abf55
cmp al, 0x3d
je 0x4abf55
cmp al, 0x27
je 0x4abf55
cmp al, 0x22
je 0x4abf55
jmp 0x4abfac
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040406c
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x20
je 0x4abf90
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x27
je 0x4abf90
mov eax, dword [ebp - 0x20]
call fcn.00403e64
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x22
je 0x4abf90
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
push 0x4adad8
push dword [ebp - 0x20]
lea eax, [ebp - 0x184]
mov edx, 4
call fcn.00403f24
mov eax, dword [ebp - 0x184]
call fcn.0040947c
test al, al
jne 0x4ac09f
mov edx, ebx
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
mov edx, dword [ebp - 0x18]
add edx, 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov ecx, dword [eax]
call dword [ecx + 0xc4]
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa924]
call fcn.004095cc
mov ecx, dword [ebp - 0x18c]
lea eax, [ebp - 0x188]
mov edx, 0x4adaac
call fcn.00403eb0
mov edx, dword [ebp - 0x188]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
call fcn.00428c98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
mov eax, dword [eax + 0x208]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc4]
jmp 0x4acc8e
mov eax, dword [ebp - 4]
add eax, 0xa924
call fcn.00403be4
jmp 0x4acc8e
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4acc8e
cmp dword [ebp - 0xc], 5
jne 0x4ac155
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*8 + 0xb574], 0
jne 0x4ac148
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa934]
call fcn.004094c8
mov eax, dword [ebp - 4]
inc dword [eax + 0x51508]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adae4
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51508]
call fcn.0040920c
push dword [ebp - 0x190]
push 0x4adaf8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4acc8e
mov eax, dword [ebp - 4]
inc dword [eax + 0x51508]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adb08
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51508]
call fcn.0040920c
push dword [ebp - 0x194]
push 0x4adaf8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa56d], 1
jne 0x4ac2d3
cmp dword [ebp - 0xc], 0
jne 0x4ac26f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5d8]
mov edx, 0x4adb18
call fcn.00404150
test eax, eax
jle 0x4ac26f
xor eax, eax
push ebp
push 0x4ac216
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x198]
mov eax, 0x4adb30
call fcn.00461db4
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 4]
add eax, 0x514e0
call fcn.00405274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac26f
cmp dword [ebp - 0xc], 5
jne 0x4ac282
lea eax, [ebp - 0x1c]
call fcn.00403be4
jmp 0x4acc8e
mov eax, dword [ebp - 4]
inc dword [eax + 0x5150c]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adb4c
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5150c]
call fcn.0040920c
push dword [ebp - 0x1a0]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
push 0x4adb58
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4adb74
call fcn.00431df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa56e], 1
jne 0x4ac482
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5d8]
mov edx, 0x4adba4
call fcn.00404150
test eax, eax
je 0x4ac39d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa5d8]
mov edx, 0x4adbbc
call fcn.00404150
test eax, eax
jne 0x4ac431
xor eax, eax
push ebp
push 0x4ac3d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1a4]
mov eax, 0x4adbd0
call fcn.00461db4
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 4]
add eax, 0x514f0
call fcn.00405274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac431
mov eax, dword [ebp - 4]
inc dword [eax + 0x51510]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adb4c
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51510]
call fcn.0040920c
push dword [ebp - 0x1ac]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
push 0x4adbec
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4adbfc
call fcn.00431df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa56f], 1
jne 0x4ac567
mov eax, dword [ebp - 4]
inc dword [eax + 0x51514]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push 0x4adc2c
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51514]
call fcn.0040920c
push dword [ebp - 0x1b0]
mov eax, dword [ebp - 4]
push dword [eax + 0x4ffd8]
push 0x4adc3c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403f24
jmp 0x4acc8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4adc4c
call fcn.00431df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa570], 1
jne 0x4ac806
push 0
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov ecx, 0x1e
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 0
je 0x4ac64c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 3
jne 0x4ac663
mov ebx, 0x1e
lea eax, [ebp - 0x160]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec ebx
jne 0x4ac657
mov ebx, 0xf
lea esi, [ebp - 0x160]
lea eax, [ebp - 0x1b4]
mov dl, byte [esi]
call fcn.00403d8c
mov edx, dword [ebp - 0x1b4]
lea eax, [ebp - 0x20]
call fcn.00403e6c
inc esi
dec ebx
jne 0x4ac66e
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push dword [ebp - 0x20]
push 0x4adc84
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 1
je 0x4ac6d9
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 4
jne 0x4ac6dd
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 0x1c]
call fcn.0040947c
test al, al
je 0x4acc8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004ae028
mov ebx, 1
lea edx, [ebp - 0x1b8]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x4ffd8]
call fcn.00403f74
je 0x4ac77e
inc ebx
cmp ebx, 0x12d
jne 0x4ac750
cmp ebx, 0x12d
jne 0x4ac7f9
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x4ffd8], 0
je 0x4ac7c5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x4ffd8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x1bc]
call fcn.00403eb0
mov eax, dword [ebp - 0x1bc]
call fcn.0040947c
test al, al
jne 0x4ac7f0
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa938]
call fcn.00409594
mov edx, dword [ebp - 0x1c0]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x4ffd8]
call fcn.00403c38
jmp 0x4ac7f9
inc ebx
cmp ebx, 0x12d
jne 0x4ac78b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov edx, 0x4adb68
call fcn.00431df8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e8]
call fcn.0043200c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6e4]
xor edx, edx
call fcn.00431ce0
mov eax, dword [ebp - 4]
add eax, 0xa938
call fcn.00403be4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae028
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov dl, 1
call fcn.00431ce0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70c]
mov edx, 0x4adc94
call fcn.00431df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
push 0
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 4]
add eax, 0xa93c
mov ecx, 0x1e
call fcn.004063e0
call fcn.00402854
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 0
je 0x4ac8db
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 3
jne 0x4ac8f2
mov ebx, 0x1e
lea eax, [ebp - 0x160]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec ebx
jne 0x4ac8e6
mov ebx, 0xf
lea esi, [ebp - 0x160]
lea eax, [ebp - 0x1c4]
mov dl, byte [esi]
call fcn.00403d8c
mov edx, dword [ebp - 0x1c4]
lea eax, [ebp - 0x20]
call fcn.00403e6c
inc esi
dec ebx
jne 0x4ac8fd
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 5
jne 0x4ac951
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push dword [ebp - 0x20]
push 0x4adcd4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb55e], 6
jne 0x4ac986
mov eax, dword [ebp - 4]
push dword [eax + 0x4ff90]
push dword [ebp - 0x20]
push 0x4adce4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 1
je 0x4ac9b4
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
cmp byte [edx + eax*8 + 0xb578], 4
jne 0x4ac9b8
add dword [ebp - 0x30], 0x1e
mov eax, dword [ebp - 4]
add eax, 0x844
mov edx, dword [ebp - 0x1c]
call fcn.00403c38
mov eax, dword [ebp - 0x1c]
call fcn.0040947c
test al, al
je 0x4acc8e
mov ebx, 1
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50488]
call fcn.00403f74
jne 0x4acae9
mov eax, dword [ebp - 4]
mov esi, dword [eax + ebx*4 + 0x50938]
test esi, esi
je 0x4aca50
mov eax, dword [ebp - 4]
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x4aca50
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50938]
push eax
call sub.user32.dll_SetForegroundWindow
push 9
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50938]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ff90]
call fcn.00404028
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50488]
call fcn.00404028
push eax
push 0x4adcec
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4acaf6
lea edx, [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50488]
call fcn.00403c38
mov eax, dword [ebp - 4]
mov dword [eax + 0x50dec], ebx
mov eax, dword [ebp - 4]
call fcn.004c0e40
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50df0], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov dl, 1
call fcn.004532b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
inc ebx
cmp ebx, 0x12d
jne 0x4ac9dd
cmp ebx, 0x12d
jne 0x4acc14
mov ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0x50488], 0
je 0x4acb45
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ebx*4 + 0x50488]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x1d0]
call fcn.00403eb0
mov eax, dword [ebp - 0x1d0]
call fcn.0040947c
test al, al
jne 0x4acc07
mov eax, dword [ebp - 4]
mov dword [eax + 0x50dec], ebx
lea edx, [ebp - 0x1d4]
mov eax, dword [ebp - 0x1c]
call fcn.00409594
mov edx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50488]
call fcn.00403c38
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4ff90]
call fcn.00404028
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x50488]
call fcn.00404028
push eax
push 0x4adcec
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x4acbd3
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x50df0], edx
mov eax, dword [ebp - 4]
call fcn.004c0e40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x51c]
mov dl, 1
call fcn.004532b0
jmp 0x4acbfa
push 0
mov ecx, 0x4adcf4
mov edx, 0x4adcfc
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4 + 0x50488]
call fcn.00403be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
inc ebx
cmp ebx, 0x12d
jne 0x4acb07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x4fbf5
call fcn.00403e08
mov eax, dword [ebp - 4]
call fcn.004ab664
push 0
push 0x4add24
push dword [ebp - 0x20]
push 0x4add54
push 0x4add64
push 0x4add78
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.00403f24
mov eax, dword [ebp - 0x1d8]
call fcn.00404028
mov edx, eax
mov ecx, 0x4adcf4
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ad995
cmp dword [ebp - 0xc], 0
jne 0x4accaf
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xb55e], 0xa
je 0x4acd9e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb578]
cmp al, 1
je 0x4accdc
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 4
jne 0x4acd9e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb560]
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax*8 + 0xb55e]
test dl, dl
je 0x4acd3e
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 2
je 0x4acd3e
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 0xa
je 0x4acd3e
mov ecx, dword [ebp - 8]
mov ebx, ecx
shl ecx, 3
sub ecx, ebx
mov ebx, dword [ebp - 4]
cmp dl, 1
jne 0x4acd8b
mov edx, dword [ebp - 4]
cmp dword [edx + eax*8 + 0xb574], 0
jle 0x4acd8b
cmp dword [ebp - 0xc], 0
jne 0x4acd5d
mov edx, dword [ebp - 4]
sub esi, dword [edx + eax*8 + 0xb574]
jmp 0x4acd8b
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*8 + 0xb560]
add edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
sub edx, dword [ecx + eax*8 + 0xb574]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb574]
mov eax, dword [ebp - 0x30]
push eax
push esi
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004c88cc
cmp dword [ebp - 0xc], 0
jne 0x4acdbf
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp byte [ecx + edx*8 + 0xb55e], 0xa
je 0x4acedf
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*8 + 0xb578]
test al, al
je 0x4acdec
mov edx, dword [ebp - 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp al, 3
jne 0x4acedf
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov esi, dword [edx + eax*8 + 0xb560]
mov ebx, dword [ebp - 8]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [ebp - 4]