Function at 0x416224
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x41622c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x417a32
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00403bec
mov eax, dword [ebp - 0x30]
mov edx, 0x417a48
call fcn.00401de4
jne 0x416274
push 1
push 0x417a50
call sub.kernel32.dll_WinExec
call fcn.00401940
lea ecx, [ebp - 0x38]
xor edx, edx
xor eax, eax
call fcn.004155ac
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00404024
mov eax, dword [ebp - 0x34]
call fcn.004040a0
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00403bec
mov eax, dword [ebp - 0x3c]
call fcn.00409484
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffdc
call fcn.00409380
mov edx, 0x41986c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x419874
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x41987c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x419884
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x41989c
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x29]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
cmp byte [ebp - 0x29], 0xf1
je 0x416377
mov eax, dword [ebp - 0x10]
call fcn.0040867c
xor eax, eax
call fcn.00415670
push 0x10
push 0x417a5c
push 0x417a64
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00401940
mov eax, dword [0x41986c]
mov edx, dword [0x419870]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416391
call fcn.004013ec
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409380
xor eax, eax
mov al, byte [ebp - 0x2a]
inc eax
push eax
mov eax, 0x419848
mov ecx, 1
mov edx, dword [0x41520c]
call fcn.0040269c
add esp, 4
xor ebx, ebx
mov bl, byte [ebp - 0x2a]
test ebx, ebx
jl 0x4163f5
inc ebx
xor esi, esi
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x40]
mov eax, dword [0x419848]
test eax, eax
je 0x4163e4
cmp esi, dword [eax - 4]
jb 0x4163e9
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4163c8
mov eax, 0x62
call fcn.0041559c
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x419864
mov ecx, 1
mov edx, dword [0x4152ec]
call fcn.0040269c
add esp, 4
dec ebx
test ebx, ebx
jl 0x416454
inc ebx
xor esi, esi
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x44]
mov eax, dword [0x419864]
test eax, eax
je 0x416443
cmp esi, dword [eax - 4]
jb 0x416448
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416427
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x41654c
inc ebx
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x419864]
test edx, edx
je 0x41647a
cmp eax, dword [edx - 4]
jb 0x41647f
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00409018
test eax, eax
jns 0x416490
call fcn.004013ec
mov edx, esi
shl edx, 2
add edx, 2
mov ecx, dword [0x419864]
test ecx, ecx
je 0x4164a7
cmp edx, dword [ecx - 4]
jb 0x4164ac
call fcn.004013ec
mov edx, dword [ecx + edx*4]
push edx
mov edx, esi
shl edx, 2
inc edx
mov ecx, dword [0x419864]
test ecx, ecx
je 0x4164c5
cmp edx, dword [ecx - 4]
jb 0x4164ca
call fcn.004013ec
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.00415908
mov edx, dword [ebp - 0x48]
mov eax, dword [0x419864]
test eax, eax
je 0x4164e4
cmp esi, dword [eax - 4]
jb 0x4164e9
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
mov eax, dword [0x419864]
test eax, eax
je 0x4164ff
cmp esi, dword [eax - 4]
jb 0x416504
call fcn.004013ec
cmp dword [eax + esi*4], 0
jne 0x416544
mov eax, dword [0x419864]
test eax, eax
je 0x416518
cmp esi, dword [eax - 4]
jb 0x41651d
call fcn.004013ec
lea eax, [eax + esi*4]
mov edx, esi
shl edx, 2
add edx, 3
mov ecx, dword [0x419864]
test ecx, ecx
je 0x416537
cmp edx, dword [ecx - 4]
jb 0x41653c
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416462
push edi
mov eax, 0x419864
mov ecx, 1
mov edx, dword [0x4152ec]
call fcn.0040269c
add esp, 4
mov eax, 0x6e
call fcn.00415574
mov byte [0x418638], al
call fcn.00403cf8
mov ebx, eax
test ebx, ebx
jle 0x4167d6
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00403bec
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040904c
mov eax, dword [ebp - 8]
mov edx, 0x417ab4
call fcn.00401de4
jne 0x4165b3
mov byte [0x418638], 1
mov eax, dword [ebp - 8]
mov edx, 0x417ac0
call fcn.00401de4
jne 0x4165c9
mov byte [0x41863c], 1
mov eax, dword [ebp - 8]
mov edx, 0x417acc
call fcn.00401de4
jne 0x4165fe
mov eax, 0x6b
mov edx, dword [0x419848]
test edx, edx
je 0x4165ec
cmp eax, dword [edx - 4]
jb 0x4165f1
call fcn.004013ec
lea eax, [edx + eax*4]
mov edx, 0x417ad8
call fcn.00401a9c
mov eax, dword [ebp - 8]
mov edx, 0x417ae4
call fcn.00401de4
jne 0x416633
mov eax, 0x3f
mov edx, dword [0x419848]
test edx, edx
je 0x416621
cmp eax, dword [edx - 4]
jb 0x416626
call fcn.004013ec
lea eax, [edx + eax*4]
mov edx, 0x417ad8
call fcn.00401a9c
lea eax, [ebp - 0x4c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x4c]
mov edx, 0x417af0
call fcn.00401de4
jne 0x4166a2
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00403d48
mov edx, dword [ebp - 0x50]
mov eax, 0x3a
mov ecx, dword [0x419848]
test ecx, ecx
je 0x416695
cmp eax, dword [ecx - 4]
jb 0x41669a
call fcn.004013ec
lea eax, [ecx + eax*4]
call fcn.00401a9c
lea eax, [ebp - 0x58]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x58]
mov edx, 0x417afc
call fcn.00401de4
jne 0x4166fb
mov eax, 0x6a
mov edx, dword [0x419848]
test edx, edx
je 0x4166db
cmp eax, dword [edx - 4]
jb 0x4166e0
call fcn.004013ec
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
lea eax, [ebp - 0x5c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x5c]
mov edx, 0x417b08
call fcn.00401de4
jne 0x41673c
push 0x41988c
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
lea eax, [ebp - 0x60]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x60]
mov edx, 0x417b14
call fcn.00401de4
jne 0x4167ce
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00415758
mov edx, dword [ebp - 0x64]
mov eax, 0x1d
mov ecx, dword [0x419848]
test ecx, ecx
je 0x41679e
cmp eax, dword [ecx - 4]
jb 0x4167a3
call fcn.004013ec
mov eax, dword [ecx + eax*4]
call fcn.00401de4
jne 0x4167ce
mov eax, 0x1d
mov edx, dword [0x419848]
test edx, edx
je 0x4167c1
cmp eax, dword [edx - 4]
jb 0x4167c6
call fcn.004013ec
lea eax, [edx + eax*4]
call fcn.00401a48
inc esi
dec ebx
jne 0x416588
cmp byte [0x418638], 0
je 0x41680a
mov eax, 0x1d
mov edx, dword [0x419848]
test edx, edx
je 0x4167f3
cmp eax, dword [edx - 4]
jb 0x4167f8
call fcn.004013ec
cmp dword [edx + eax*4], 0
je 0x41680a
mov al, 1
call fcn.00415670
call fcn.00401940
mov eax, 0x41
mov edx, dword [0x419848]
test edx, edx
je 0x41681e
cmp eax, dword [edx - 4]
jb 0x416823
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x6c]
xor edx, edx
call fcn.0041085c
mov edx, dword [ebp - 0x6c]
mov eax, 0x419898
call fcn.00401a9c
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov edx, dword [0x419898]
call fcn.0040a7e0
cmp byte [0x418638], 0
jne 0x41686c
push 5
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
jmp 0x41687a
mov eax, dword [0x4186ac]
mov eax, dword [eax]
xor edx, edx
call fcn.00405f8c
mov eax, 0x32
call fcn.0041559c
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x41983c
mov ecx, 1
mov edx, dword [0x4151ac]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4168db
inc ebx
xor esi, esi
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x70]
mov eax, dword [0x41983c]
test eax, eax
je 0x4168ca
cmp esi, dword [eax - 4]
jb 0x4168cf
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4168ae
mov eax, 0x60
call fcn.0041559c
lea edi, [eax + eax*2]
push edi
mov eax, 0x419860
mov ecx, 1
mov edx, dword [0x4152cc]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416938
inc ebx
xor esi, esi
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x74]
mov eax, dword [0x419860]
test eax, eax
je 0x416927
cmp esi, dword [eax - 4]
jb 0x41692c
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x41690b
mov eax, 0x1f
call fcn.0041559c
mov edi, eax
add edi, edi
push edi
mov eax, 0x419868
mov ecx, 1
mov edx, dword [0x41530c]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416996
inc ebx
xor esi, esi
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x78]
mov eax, dword [0x419868]
test eax, eax
je 0x416985
cmp esi, dword [eax - 4]
jb 0x41698a
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416969
mov eax, 0x36
call fcn.0041559c
mov edi, eax
shl edi, 3
push edi
mov eax, 0x419838
mov ecx, 1
mov edx, dword [0x41518c]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4169f5
inc ebx
xor esi, esi
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x419838]
test eax, eax
je 0x4169e4
cmp esi, dword [eax - 4]
jb 0x4169e9
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4169c8
mov eax, 0x43
call fcn.0041559c
lea edi, [eax + eax*2]
push edi
mov eax, 0x419840
mov ecx, 1
mov edx, dword [0x4151cc]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416a52
inc ebx
xor esi, esi
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x80]
mov eax, dword [0x419840]
test eax, eax
je 0x416a41
cmp esi, dword [eax - 4]
jb 0x416a46
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416a25
mov eax, 0x5d
call fcn.0041559c
mov edi, eax
add edi, edi
push edi
mov eax, 0x419844
mov ecx, 1
mov edx, dword [0x4151ec]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416ab6
inc ebx
xor esi, esi
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x84]
mov eax, dword [0x419844]
test eax, eax
je 0x416aa5
cmp esi, dword [eax - 4]
jb 0x416aaa
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416a83
mov eax, 0x28
call fcn.0041559c
mov ebx, eax
mov eax, 0x19
call fcn.0041559c
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419834
mov ecx, 1
mov edx, dword [0x41516c]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416b2b
inc ebx
xor esi, esi
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x88]
mov eax, dword [0x419834]
test eax, eax
je 0x416b1a
cmp esi, dword [eax - 4]
jb 0x416b1f
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416af8
mov eax, 0x18
call fcn.0041559c
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419854
mov ecx, 1
mov edx, dword [0x41526c]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416b92
inc ebx
xor esi, esi
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x419854]
test eax, eax
je 0x416b81
cmp esi, dword [eax - 4]
jb 0x416b86
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416b5f
mov eax, 0x2d
call fcn.0041559c
mov edi, eax
add edi, edi
push edi
mov eax, 0x419858
mov ecx, 1
mov edx, dword [0x41528c]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416bf6
inc ebx
xor esi, esi
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x90]
mov eax, dword [0x419858]
test eax, eax
je 0x416be5
cmp esi, dword [eax - 4]
jb 0x416bea
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416bc3
mov eax, 0x14
call fcn.0041559c
mov edi, eax
add edi, edi
push edi
mov eax, 0x41985c
mov ecx, 1
mov edx, dword [0x4152ac]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416c5a
inc ebx
xor esi, esi
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x94]
mov eax, dword [0x41985c]
test eax, eax
je 0x416c49
cmp esi, dword [eax - 4]
jb 0x416c4e
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416c27
mov eax, 0x1a
call fcn.0041559c
mov edi, eax
shl edi, 2
push edi
mov eax, 0x419850
mov ecx, 1
mov edx, dword [0x41524c]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416cbf
inc ebx
xor esi, esi
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x98]
mov eax, dword [0x419850]
test eax, eax
je 0x416cae
cmp esi, dword [eax - 4]
jb 0x416cb3
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416c8c
mov eax, 0x1a
call fcn.0041559c
mov edi, eax
mov eax, 0x39
call fcn.0041559c
imul edi, eax
lea eax, [edi + 1]
push eax
mov eax, 0x41984c
mov ecx, 1
mov edx, dword [0x41522c]
call fcn.0040269c
add esp, 4
mov ebx, edi
test ebx, ebx
jle 0x416d32
mov esi, 1
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x41984c]
test eax, eax
je 0x416d21
cmp esi, dword [eax - 4]
jb 0x416d26
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416cff
mov eax, dword [0x41987c]
mov edx, dword [0x419880]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416d4c
call fcn.004013ec
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409380
cmp byte [0x41989c], 0
je 0x416dd9
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 2
call fcn.004155ac
mov eax, dword [ebp - 8]
call fcn.004094ac
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, 0x417b24
call fcn.00405264
push dword [0x419878]
push dword [0x419874]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004157e8
mov eax, dword [ebp - 0x14]
call fcn.0040867c
mov dl, 1
mov eax, dword [0x40c964]
call fcn.0040cd34
mov ebx, eax
lea eax, [ebp - 0xa0]
call fcn.004042b4
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040d1c0
mov eax, ebx
call fcn.0040145c
jmp 0x416e52
xor ebx, ebx
mov bl, byte [ebp - 0x2b]
test ebx, ebx
jle 0x416e52
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
call fcn.004042b4
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 8]
pop ecx
call fcn.00401cec
mov eax, dword [ebp - 8]
call fcn.004094ac
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov eax, dword [ebp - 0xac]
call fcn.00409018
mov edi, eax
mov eax, edi
cdq
push edx
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004157e8
mov eax, dword [ebp - 0x14]
call fcn.0040867c
dec ebx
jne 0x416de2
mov eax, dword [ebp - 0x10]
call fcn.0040867c
cmp dword [0x41988c], 0
je 0x416efa
mov byte [0x418634], 0xff
mov eax, 0x1a
call fcn.0041559c
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x416ee7
inc ebx
xor esi, esi
mov eax, esi
shl eax, 2
mov edx, dword [0x419850]
test edx, edx
je 0x416e96
cmp eax, dword [edx - 4]
jb 0x416e9b
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0xb0]
call fcn.0040904c
mov eax, dword [ebp - 0xb0]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [0x41988c]
call fcn.0040904c
mov eax, dword [ebp - 0xb4]
pop edx
call fcn.00401fd8
test eax, eax
jle 0x416ee3
mov eax, esi
cmp eax, 0xff
jbe 0x416ede
call fcn.004013ec
mov byte [0x418634], al
inc esi
dec ebx
jne 0x416e82
cmp byte [0x418634], 0xff
jne 0x416efa
mov eax, 0x41988c
call fcn.00401a48
mov eax, 0x1a
call fcn.0041559c
dec eax
jle 0x416f51
cmp dword [0x41988c], 0
jne 0x416f51
mov edx, dword [0x4186ac]
mov edx, dword [edx]
mov eax, dword [0x418660]
call fcn.0040dc50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405f9c
mov eax, dword [0x418660]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00406fd0
cmp byte [0x418640], 0
jne 0x416f51
mov al, 1
call fcn.00415670
call fcn.00401940
mov eax, 0x1a
call fcn.0041559c
dec eax
jle 0x416ffe
cmp byte [0x418634], 0
jbe 0x416ffe
mov eax, 0x41988c
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
mov ecx, dword [0x419850]
test ecx, ecx
je 0x416f8e
cmp edx, dword [ecx - 4]
jb 0x416f93
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
mov eax, 0x39
call fcn.0041559c
mov ebx, eax
test ebx, ebx
jle 0x417021
mov esi, 1
mov eax, 0x39
call fcn.0041559c
xor edx, edx
mov dl, byte [0x418634]
imul edx
add eax, esi
mov edx, dword [0x41984c]
test edx, edx
je 0x416fd5
cmp eax, dword [edx - 4]
jb 0x416fda
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, dword [0x41984c]
test eax, eax
je 0x416feb
cmp esi, dword [eax - 4]
jb 0x416ff0
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416fb0
jmp 0x417021
mov eax, 0x41988c
xor edx, edx
mov ecx, dword [0x419850]
test ecx, ecx
je 0x417014
cmp edx, dword [ecx - 4]
jb 0x417019
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
add edx, 2
mov ecx, dword [0x419850]
test ecx, ecx
je 0x417041
cmp edx, dword [ecx - 4]
jb 0x417046
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
cmp dword [ebp - 8], 0
je 0x417072
mov eax, dword [ebp - 8]
call fcn.00409018
cmp eax, 0xff
jbe 0x417068
call fcn.004013ec
mov edx, dword [0x41867c]
mov byte [edx], al
jmp 0x41707a
mov eax, dword [0x41867c]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
add edx, 3
mov ecx, dword [0x419850]
test ecx, ecx
je 0x41709a
cmp edx, dword [ecx - 4]
jb 0x41709f
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
cmp dword [ebp - 8], 0
je 0x4170cb
mov eax, dword [ebp - 8]
call fcn.00409018
cmp eax, 0xff
jbe 0x4170c1
call fcn.004013ec
mov edx, dword [0x4186ec]
mov byte [edx], al
jmp 0x4170d3
mov eax, dword [0x4186ec]
mov byte [eax], 0x10
mov eax, 0x3d
call fcn.0041559c
call fcn.0040800c
test al, al
je 0x417186
cmp byte [0x418638], 0
jne 0x41717a
push 0x30
mov eax, 0x41
mov edx, dword [0x419848]
test edx, edx
je 0x41710d
cmp eax, dword [edx - 4]
jb 0x417112
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
mov eax, 0x3e
mov edx, dword [0x419848]
test edx, edx
je 0x41712f
cmp eax, dword [edx - 4]
jb 0x417134
call fcn.004013ec
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x41984c]
test edx, edx
je 0x41714b
cmp eax, dword [edx - 4]
jb 0x417150
call fcn.004013ec
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xb8]
call fcn.00401cec
mov eax, dword [ebp - 0xb8]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
mov al, 1
call fcn.00415670
call fcn.00401940
mov eax, 0x63
call fcn.00415574
test al, al
je 0x4171e8
call fcn.00415ae0
test al, al
jne 0x4171e8
push 0x30
mov eax, dword [0x419898]
call fcn.00401e98
push eax
mov eax, 0x55
mov edx, dword [0x41984c]
test edx, edx
je 0x4171be
cmp eax, dword [edx - 4]
jb 0x4171c3
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
mov al, 1
call fcn.00415670
call fcn.00401940
mov eax, 0x64
call fcn.00415574
test al, al
je 0x417341
mov eax, 0x64
mov edx, dword [0x419848]
test edx, edx
je 0x41720e
cmp eax, dword [edx - 4]
jb 0x417213
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.004037fc
fstp qword [ebp - 0x20]
wait
call fcn.00415968
fstp qword [ebp - 0x28]
wait
mov eax, 0x55
call fcn.00415574
test al, al
je 0x417241
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jb 0x417262
mov eax, 0x55
call fcn.00415574
test al, al
jne 0x417341
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
je 0x417341
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x417279
cmp edx, dword [ecx - 4]
jb 0x41727e
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
mov eax, 2
call fcn.00415574
test al, al
je 0x4172cc
mov esi, 4
push dword [ebp - 8]
push 0x417b34
mov eax, 0x57
mov edx, dword [0x41984c]
test edx, edx
je 0x4172b5
cmp eax, dword [edx - 4]
jb 0x4172ba
call fcn.004013ec
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401d60
jmp 0x4172ce
xor esi, esi
or esi, 0x30
test esi, esi
jns 0x4172da
call fcn.004013ec
push esi
mov eax, dword [0x419898]
call fcn.00401e98
push eax
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x417335
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x419848]
test edx, edx
je 0x41731e
cmp eax, dword [edx - 4]
jb 0x417323
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov al, 1
call fcn.00415670
call fcn.00401940
mov eax, 0x67
call fcn.00415574
test al, al
je 0x41741b
lea eax, [ebp - 8]
mov edx, 0x68
mov ecx, dword [0x419848]
test ecx, ecx
je 0x41736a
cmp edx, dword [ecx - 4]
jb 0x41736f
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
mov eax, 0x69
call fcn.0041559c
cmp eax, 2
jge 0x4173f5
mov ebx, 1
xor esi, esi
jmp 0x4173eb
mov esi, ebx
mov eax, 0x69
call fcn.0041559c
sub eax, 1
jb 0x4173a4
je 0x4173b8
jmp 0x4173c2
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
jmp 0x4173c2
mov eax, dword [ebp - 8]
call fcn.00415eb4
mov ebx, eax
test ebx, ebx
je 0x4173eb
mov eax, dword [0x4186ac]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x28]
je 0x4173eb
mov eax, dword [0x419830]
mov eax, dword [eax + 0x18]
cmp ebx, dword [eax + 0x28]
je 0x4173eb
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
je 0x41741b
cmp ebx, esi
jne 0x41738f
jmp 0x41741b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040904c
call fcn.0040c800
cmp al, 3
jbe 0x417413
mov eax, dword [ebp - 0xc]
call fcn.004160b4
jmp 0x41741b
mov eax, dword [ebp - 0xc]
call fcn.00415fa4
mov eax, 1
call fcn.00415574
test al, al
je 0x417881
cmp byte [0x418638], 0
jne 0x417881
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
xor edx, edx
call fcn.004035b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.00408028
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040ad54
call fcn.0040a974
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
pop edx
call fcn.0040b764
mov edx, dword [0x4186a8]
mov dword [edx], eax
mov eax, 3
call fcn.00415574
test al, al
je 0x417522
mov eax, 6
call fcn.00415574
xor al, 1
push eax
mov eax, 4
call fcn.0041559c
push eax
mov eax, 5
call fcn.0041559c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e58
pop edx
pop ecx
call fcn.00415bc8
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.004035b4
jmp 0x4176a8
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418680]
mov dword [edx], eax
lea ecx, [ebp - 0xbc]
xor edx, edx
mov eax, 6
call fcn.004155ac
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 7
call fcn.0041559c
sub eax, 1
jb 0x417574
je 0x417597
dec eax
je 0x4175f2
jmp 0x4176a8
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.004035b4
jmp 0x4176a8
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a9d0
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e58
mov edx, eax
mov eax, dword [0x418680]
mov eax, dword [eax]
pop ecx
call fcn.0040b93c
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.004035b4
jmp 0x4176a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
mov edx, dword [0x418680]
mov edx, dword [edx]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xd0], eax
fild dword [ebp - 0xd0]
fdiv dword [0x417b38]
call fcn.00401290
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x41762d
call fcn.004013ec
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
mov edx, dword [0x418680]
mov edx, dword [edx]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xd4], eax
fild dword [ebp - 0xd4]
fdiv dword [0x417b38]
call fcn.00401290
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x417669
call fcn.004013ec
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb98
call fcn.00408e58
mov edx, eax
mov eax, dword [0x418680]
mov eax, dword [eax]
pop ecx
call fcn.0040b88c
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf4
pop edx
call fcn.004035b4
mov eax, 8
mov edx, dword [0x419848]
test edx, edx
je 0x4176bc
cmp eax, dword [edx - 4]
jb 0x4176c1
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd8]
xor edx, edx
call fcn.0041085c
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040a7e0
mov eax, 9
mov edx, dword [0x419848]
test edx, edx
je 0x4176f6
cmp eax, dword [edx - 4]
jb 0x4176fb
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xdc]
xor edx, edx
call fcn.0041085c
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a7e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040adbc
mov ebx, eax
mov eax, 0xa
call fcn.0041559c
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408a10
mov eax, 0xb
mov edx, dword [0x419848]
test edx, edx
je 0x417755
cmp eax, dword [edx - 4]
jb 0x41775a
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403604
mov eax, 0xc
call fcn.0041559c
mov edx, eax
mov eax, ebx
call fcn.00403594
mov eax, 0xd
call fcn.0041559c
mov edx, eax
cmp edx, 0xff
jbe 0x417790
call fcn.004013ec
mov eax, ebx
call fcn.004035f4
mov eax, 0xe
call fcn.0041559c
mov edx, eax
mov eax, ebx
call fcn.00408a44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040adbc
mov ebx, eax
mov eax, 0xf
call fcn.0041559c
mov edx, eax
mov eax, ebx
call fcn.00408a44
mov eax, 0x10
call fcn.0041559c
mov edx, eax
mov eax, ebx
call fcn.00403594
mov eax, 0x11
call fcn.0041559c
mov edx, eax
cmp edx, 0xff
jbe 0x4177f6
call fcn.004013ec
mov eax, ebx
call fcn.004035f4
mov eax, 0x12
call fcn.0041559c
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408a10
mov eax, 0x13
mov edx, dword [0x419848]
test edx, edx
je 0x417829
cmp eax, dword [edx - 4]
jb 0x41782e
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403604
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac2c
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ac2c
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac04
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ac04
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.00408028
jmp 0x41788c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405f9c
mov eax, 0x31
call fcn.00415574
test al, al
je 0x4178cf
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x4186a4]
mov dword [edx], eax
lea ecx, [ebp - 0xe0]
xor edx, edx
mov eax, 4
call fcn.004155ac
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x4186a4]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x3f
call fcn.00415574
test al, al
je 0x417912
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418688]
mov dword [edx], eax
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, 5
call fcn.004155ac
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x70
call fcn.00415574
test al, al
je 0x417955
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x418690]
mov dword [edx], eax
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, 7
call fcn.004155ac
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x418690]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x58
call fcn.00415574
test al, al
jne 0x41797f
mov eax, 0x59
call fcn.00415574
test al, al
jne 0x41797f
mov eax, 0x5a
call fcn.00415574
test al, al
je 0x4179b4
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x4186bc]
mov dword [edx], eax
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, 8
call fcn.004155ac
mov edx, dword [ebp - 0xec]
mov eax, dword [0x4186bc]
mov eax, dword [eax]
call fcn.0040bc38
mov eax, 0x1d
call fcn.00415574
test al, al
je 0x4179f7
xor edx, edx
xor eax, eax
call fcn.0040b764
mov edx, dword [0x4186f8]
mov dword [edx], eax
lea ecx, [ebp - 0xf0]
xor edx, edx
mov eax, 9
call fcn.004155ac
mov edx, dword [ebp - 0xf0]
mov eax, dword [0x4186f8]
mov eax, dword [eax]
call fcn.0040bc38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417a39
lea eax, [ebp - 0xf0]
mov edx, 7
call fcn.00401a6c
lea eax, [ebp - 0xbc]
mov edx, 0x24
call fcn.00401a6c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401a6c
ret