Function at 0x4940f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x140d
push 0
push 0
dec ecx
jne 0x4940f9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49525d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x494147
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xa3cc
call fcn.00405fe4
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494151
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fc]
xor edx, edx
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fc]
xor edx, edx
call fcn.00430614
mov ebx, dword [ebp - 8]
lea ebx, [ebx + ebx*4]
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4 + 0xad58], 0
jle 0x494e97
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*4 + 0xad57], 0
jne 0x4941f2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2342c]
mov eax, dword [ebp - 4]
add eax, 0xa3cc
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa3cc
mov edx, 1
call fcn.00406329
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + ebx*4 + 0xad48]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0xa334]
dec edx
mov eax, dword [ebp - 4]
add eax, 0xa3cc
call fcn.00406360
call fcn.0040284c
jmp 0x494244
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x23424]
mov eax, dword [ebp - 4]
add eax, 0xa3cc
call fcn.00405e7a
mov eax, dword [0x4acbbc]
mov byte [eax], 0
mov eax, dword [ebp - 4]
add eax, 0xa3cc
mov edx, 1
call fcn.00406329
call fcn.0040284c
mov eax, dword [ebp - 4]
mov edx, dword [eax + ebx*4 + 0xad48]
dec edx
mov eax, dword [ebp - 4]
add eax, 0xa3cc
call fcn.00406360
call fcn.0040284c
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0xa3cc
mov ecx, 4
call fcn.00405f1c
call fcn.0040284c
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx*4 + 0xad56]
cmp eax, 6
ja case.default.0x494276
jmp dword [eax*4 + 0x49427d]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0x1c]
mov ecx, 0x495274
call fcn.00403dbc
jmp 0x494d32
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push 0x495284
push 0x495294
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403e30
jmp 0x494d32
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa398], 1
jne 0x4943fe
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push 0x4952a4
lea edx, [ebp - 0xa024]
mov eax, dword [ebp - 0x18]
call fcn.00408ca4
push dword [ebp - 0xa024]
mov eax, dword [ebp - 4]
push dword [eax + 0x2383c]
push 0x4952b0
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403e30
xor eax, eax
push ebp
push 0x494374
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, dword [ebp - 0x1c]
call fcn.00405e7a
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, 1
call fcn.00406340
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4943c3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x23844], 0
jne 0x4943db
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x23844], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x23844]
cmp eax, dword [ebp - 0x18]
jge 0x494d32
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x23844], edx
jmp 0x494d32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov edx, 0x4952c0
call fcn.00430614
xor ecx, ecx
xor edx, edx
mov al, 0xff
call fcn.0040782c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov eax, dword [eax + 0x58]
call fcn.004177f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
call fcn.00430828
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
xor edx, edx
call fcn.004304fc
mov eax, dword [ebp - 4]
add eax, 0xa390
call fcn.00403af0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa3ac], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x580]
mov edx, 0x4952c8
call fcn.00486b44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fc]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fc]
mov edx, 0x4952e8
call fcn.00430614
jmp 0x495232
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa39c], 1
jne 0x4945d5
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push 0x4952a4
lea edx, [ebp - 0xa02c]
mov eax, dword [ebp - 0x18]
call fcn.00408ca4
push dword [ebp - 0xa02c]
mov eax, dword [ebp - 4]
push dword [eax + 0x2383c]
push 0x495318
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403e30
xor eax, eax
push ebp
push 0x49454b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, dword [ebp - 0x1c]
call fcn.00405e7a
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, 1
call fcn.00406340
call fcn.0040284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49459a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x23840], 0
jne 0x4945b2
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x23840], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x23840]
cmp eax, dword [ebp - 0x18]
jge 0x494d32
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x23840], edx
jmp 0x494d32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov edx, 0x4952c0
call fcn.00430614
xor ecx, ecx
xor edx, edx
mov al, 0xff
call fcn.0040782c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov eax, dword [eax + 0x58]
call fcn.004177f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
call fcn.00430828
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
xor edx, edx
call fcn.004304fc
mov eax, dword [ebp - 4]
add eax, 0xa390
call fcn.00403af0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa3ac], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x580]
mov edx, 0x4952c8
call fcn.00486b44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fc]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fc]
mov edx, 0x495328
call fcn.00430614
jmp 0x495232
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa3a0], 1
jne 0x4948c2
push 0
lea edx, [ebp - 0xa020]
mov eax, dword [ebp - 4]
add eax, 0xa3cc
mov ecx, 0x1e
call fcn.00405f1c
call fcn.0040284c
mov dword [ebp - 0x18], 0x1e
lea eax, [ebp - 0xa020]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec dword [ebp - 0x18]
jne 0x4946c3
mov dword [ebp - 0x18], 0xf
lea ebx, [ebp - 0xa020]
lea eax, [ebp - 0xa034]
mov dl, byte [ebx]
call fcn.00403c98
mov edx, dword [ebp - 0xa034]
lea eax, [ebp - 0x20]
call fcn.00403d78
inc ebx
dec dword [ebp - 0x18]
jne 0x4946de
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push dword [ebp - 0x20]
push 0x495358
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403e30
mov eax, dword [ebp - 0x1c]
call fcn.00408f14
test al, al
je 0x494896
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov edx, 0x4952c0
call fcn.00430614
xor ecx, ecx
xor edx, edx
mov al, 0xff
call fcn.0040782c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov eax, dword [eax + 0x58]
call fcn.004177f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
call fcn.00430828
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
xor edx, edx
call fcn.004304fc
mov eax, dword [ebp - 4]
add eax, 0xa390
mov edx, dword [ebp - 0x1c]
call fcn.00403b44
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa3ac], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x580]
mov edx, 0x4952c8
call fcn.00486b44
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa388], edx
mov dword [ebp - 0x18], 1
lea edx, [ebp - 0xa038]
mov eax, dword [ebp - 0x1c]
call fcn.0040902c
mov edx, dword [ebp - 0xa038]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + ecx*4 + 0x23948]
call fcn.00403e80
je 0x494800
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x4947cc
cmp dword [ebp - 0x18], 0x12d
jne 0x495232
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 0x23948], 0
je 0x494854
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x23948]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0xa03c]
call fcn.00403dbc
mov eax, dword [ebp - 0xa03c]
call fcn.00408f14
test al, al
jne 0x494885
lea edx, [ebp - 0xa040]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa390]
call fcn.0040902c
mov edx, dword [ebp - 0xa040]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x23948]
call fcn.00403b44
jmp 0x495232
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x494814
jmp 0x495232
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, dword [ebp - 0x1c]
call fcn.00405e7a
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, 1
call fcn.00406340
call fcn.0040284c
jmp 0x494d32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov edx, 0x4952c0
call fcn.00430614
xor ecx, ecx
xor edx, edx
mov al, 0xff
call fcn.0040782c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov eax, dword [eax + 0x58]
call fcn.004177f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
call fcn.00430828
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
xor edx, edx
call fcn.004304fc
mov eax, dword [ebp - 4]
add eax, 0xa390
call fcn.00403af0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa3ac], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x580]
mov edx, 0x4952c8
call fcn.00486b44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fc]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5fc]
mov edx, 0x495368
call fcn.00430614
jmp 0x495232
push 0
lea edx, [ebp - 0xa020]
mov eax, dword [ebp - 4]
add eax, 0xa3cc
mov ecx, 0x1e
call fcn.00405f1c
call fcn.0040284c
mov dword [ebp - 0x18], 0x1e
lea eax, [ebp - 0xa020]
mov dl, byte [eax]
sub dl, byte [ebp - 0x14]
dec edx
mov byte [eax], dl
inc eax
dec dword [ebp - 0x18]
jne 0x4949a0
mov dword [ebp - 0x18], 0xf
lea ebx, [ebp - 0xa020]
lea eax, [ebp - 0xa044]
mov dl, byte [ebx]
call fcn.00403c98
mov edx, dword [ebp - 0xa044]
lea eax, [ebp - 0x20]
call fcn.00403d78
inc ebx
dec dword [ebp - 0x18]
jne 0x4949bb
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
mov bl, byte [edx + eax*4 + 0xad56]
cmp bl, 5
jne 0x494a0f
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push dword [ebp - 0x20]
push 0x4953a8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403e30
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp bl, 6
jne 0x494a3b
mov eax, dword [ebp - 4]
push dword [eax + 0x237e8]
push dword [ebp - 0x20]
push 0x4953b8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403e30
mov eax, dword [ebp - 0x1c]
call fcn.00408f14
test al, al
je 0x494cac
mov dword [ebp - 0x18], 1
lea edx, [ebp - 0xa048]
mov eax, dword [ebp - 0x1c]
call fcn.0040902c
mov edx, dword [ebp - 0xa048]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + ecx*4 + 0x23df8]
call fcn.00403e80
jne 0x494b66
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ebx, dword [eax + edx*4 + 0x242a8]
test ebx, ebx
je 0x494acc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
push ebx
call sub.user32.dll_IsWindow
test eax, eax
je 0x494acc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x242a8]
push eax
call sub.user32.dll_SetForegroundWindow
push 9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x242a8]
push eax
call sub.user32.dll_ShowWindow
jmp 0x495232
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x237e8]
call fcn.00403f34
push eax
push 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x23df8]
call fcn.00403f34
push eax
push 0x4953c0
mov eax, dword [0x4acb28]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x494b76
lea edx, [ebp - 0xa04c]
mov eax, dword [ebp - 0x1c]
call fcn.0040902c
mov edx, dword [ebp - 0xa04c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x23df8]
call fcn.00403b44
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x2475c], edx
mov eax, dword [ebp - 4]
call fcn.004a64f4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x24760], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov dl, 1
call fcn.004519f4
jmp 0x495232
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x494a52
cmp dword [ebp - 0x18], 0x12d
jne 0x495232
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 0x23df8], 0
je 0x494bce
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x23df8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0xa050]
call fcn.00403dbc
mov eax, dword [ebp - 0xa050]
call fcn.00408f14
test al, al
jne 0x494c97
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x2475c], edx
lea edx, [ebp - 0xa054]
mov eax, dword [ebp - 0x1c]
call fcn.0040902c
mov edx, dword [ebp - 0xa054]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x23df8]
call fcn.00403b44
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x237e8]
call fcn.00403f34
push eax
push 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x23df8]
call fcn.00403f34
push eax
push 0x4953c0
mov eax, dword [0x4acb28]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x494c68
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x24760], edx
mov eax, dword [ebp - 4]
call fcn.004a64f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov dl, 1
call fcn.004519f4
jmp 0x495232
push 0
mov ecx, 0x4953c8
mov edx, 0x4953d0
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044eb9c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4 + 0x23df8]
call fcn.00403af0
jmp 0x495232
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x494b8a
jmp 0x495232
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, dword [ebp - 0x1c]
call fcn.00405e7a
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, 1
call fcn.00406340
call fcn.0040284c
jmp 0x494d32
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x23451
call fcn.00403d14
push 0
push 0x4953f8
push dword [ebp - 0x20]
push 0x495428
push 0x495438
push 0x49544c
lea eax, [ebp - 0xa058]
mov edx, 5
call fcn.00403e30
mov eax, dword [ebp - 0xa058]
call fcn.00403f34
mov edx, eax
mov ecx, 0x4953c8
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044eb9c
jmp 0x495232
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*4 + 0xad56]
test al, al
je 0x494d53
mov edx, dword [ebp - 8]
lea edx, [edx + edx*4]
mov ecx, dword [ebp - 4]
cmp al, 1
jne 0x494d7a
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, dword [ebp - 0x1c]
call fcn.00405e7a
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov edx, 1
call fcn.00406340
call fcn.0040284c
mov dword [ebp - 0x10], 0xa000
xor ebx, ebx
jmp 0x494e66
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0xad58]
sub eax, ebx
cmp eax, 0xa000
jle 0x494dc4
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xa020]
mov eax, dword [ebp - 4]
add eax, 0xa3cc
mov ecx, 0xa000
call fcn.00405f1c
call fcn.0040284c
jmp 0x494deb
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 8]
lea edx, [edx + edx*4]
mov ecx, dword [ebp - 4]
mov ecx, eax
lea edx, [ebp - 0xa020]
mov eax, dword [ebp - 4]
add eax, 0xa3cc
call fcn.00405f1c
call fcn.0040284c
cmp dword [ebp - 0x14], 0
jle 0x494e46
cmp dword [ebp - 0x14], 0x3c
jge 0x494e30
mov eax, dword [ebp - 0x14]
add eax, 0x400
test eax, eax
jle 0x494e46
mov dword [ebp - 0x18], 1
lea edx, [ebp - 0xa020]
mov cl, byte [ebp - 0x14]
sub byte [edx], cl
mov cl, byte [ebp - 0x14]
mov esi, 0x2800
sub esi, dword [ebp - 0x18]
sub byte [ebp + esi - 0xa021], cl
inc dword [ebp - 0x18]
inc edx
dec eax
jne 0x494e10
jmp 0x494e46
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x494e46
lea edx, [ebp - 0xa020]
mov cl, byte [ebp - 0x14]
sub byte [edx], cl
inc edx
dec eax
jne 0x494e3d
push 0
lea edx, [ebp - 0xa020]
mov eax, dword [ebp - 4]
add eax, 0xa7b0
mov ecx, dword [ebp - 0x10]
call fcn.00405f80
call fcn.0040284c
add ebx, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa000
jne 0x494e85
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp ebx, dword [edx + eax*4 + 0xad58]
jl 0x494d88
mov eax, dword [ebp - 4]
add eax, 0xa7b0
call fcn.00405fe4
call fcn.0040284c
mov ebx, dword [ebp - 8]
lea ebx, [ebx + ebx*4]
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx*4 + 0xad56]
sub al, 1
jb 0x494fe8
sub al, 4
jb 0x4950a3
sub al, 2
jae 0x4951da
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 0x23df8], 0
je 0x494f0a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x23df8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0xa05c]
call fcn.00403dbc
mov eax, dword [ebp - 0xa05c]
call fcn.00408f14
test al, al
jne 0x494fd3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x2475c], edx
lea edx, [ebp - 0xa060]
mov eax, dword [ebp - 0x1c]
call fcn.0040902c
mov edx, dword [ebp - 0xa060]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x23df8]
call fcn.00403b44
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x237e8]
call fcn.00403f34
push eax
push 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*4 + 0x23df8]
call fcn.00403f34
push eax
push 0x4953c0
mov eax, dword [0x4acb28]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x494fa4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x24760], edx
mov eax, dword [ebp - 4]
call fcn.004a64f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x608]
mov dl, 1
call fcn.004519f4
jmp 0x495232
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4 + 0x23df8]
call fcn.00403af0
push 0
mov ecx, 0x4953c8
mov edx, 0x4953d0
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044eb9c
jmp 0x495232
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x494ec6
jmp 0x495232
cmp dword [ebp - 0xc], 0
jne 0x495005
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0xc], 1
jne 0x495022
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x428]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
cmp dword [ebp - 0xc], 5
jne 0x49503f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4a0]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov edx, 0x49545c
call fcn.00430614
mov cl, 0x40
mov dl, 0x80
xor eax, eax
call fcn.0040782c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov eax, dword [eax + 0x58]
call fcn.004177f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
call fcn.00430828
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
xor edx, edx
call fcn.004304fc
jmp 0x495232
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov edx, 0x4952c0
call fcn.00430614
xor ecx, ecx
xor edx, edx
mov al, 0xff
call fcn.0040782c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x518]
mov eax, dword [eax + 0x58]
call fcn.004177f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
mov dl, 1
call fcn.004304fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x574]
call fcn.00430828
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
xor edx, edx
call fcn.004304fc
mov eax, dword [ebp - 4]
add eax, 0xa390
mov edx, dword [ebp - 0x1c]
call fcn.00403b44
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa3ac], edx
mov eax, dword [ebp - 4]
cmp byte [eax + ebx*4 + 0xad56], 4
jne 0x4951af
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
cmp dword [eax + edx*4 + 0x23948], 0
je 0x495175
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 0x23948]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0xa064]
call fcn.00403dbc
mov eax, dword [ebp - 0xa064]
call fcn.00408f14
test al, al
jne 0x4951a3
lea edx, [ebp - 0xa068]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa390]
call fcn.0040902c
mov edx, dword [ebp - 0xa068]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4 + 0x23948]
call fcn.00403b44
jmp 0x4951af
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12d
jne 0x495135
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x580]
mov edx, 0x4952c8
call fcn.00486b44
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa388], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xa26c], edx
jmp 0x495232
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, 0x23451
call fcn.00403d14
push 0
push 0x4953f8
push dword [ebp - 0x20]
push 0x495428
push 0x495438
push 0x49544c
lea eax, [ebp - 0xa06c]
mov edx, 5
call fcn.00403e30
mov eax, dword [ebp - 0xa06c]
call fcn.00403f34
mov edx, eax
mov ecx, 0x4953c8
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044eb9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495264
lea eax, [ebp - 0xa06c]
mov edx, 0x13
call fcn.00403b14
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00403b14
ret