Function at 0x4018f0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf94
mov eax, dword [0x433c20]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
push edi
mov dword [ebp - 0xe9c], ecx
mov dword [ebp - 0x634], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x630], ax
push 0x206
push 0
lea ecx, [ebp - 0x62e]
push ecx
call fcn.00415580
add esp, 0xc
xor edx, edx
mov word [ebp - 0x420], dx
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00415580
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x840], cx
push 0x206
push 0
lea edx, [ebp - 0x83e]
push edx
call fcn.00415580
add esp, 0xc
mov eax, dword [ebp - 0xe9c]
add eax, 0x5ac
push eax
lea ecx, [ebp - 0x840]
push ecx
call fcn.00402800
add esp, 8
push 0x42e518
push 0x104
lea edx, [ebp - 0x840]
push edx
call fcn.00413166
add esp, 0xc
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
mov ecx, dword [ebp - 0xe9c]
call fcn.00401110
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401ec7
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x5ac
push ecx
lea edx, [ebp - 0x630]
push edx
call fcn.00402800
add esp, 8
mov eax, dword [ebp - 0xe9c]
add eax, 0x18c
push eax
push 0x104
lea ecx, [ebp - 0x630]
push ecx
call fcn.00413166
add esp, 0xc
push 0x42e530
push 0x104
lea edx, [ebp - 0x630]
push edx
call fcn.00413166
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x1ac
push ecx
push 0x10
mov edx, dword [ebp - 0xe9c]
add edx, 0x58c
push edx
call fcn.00413890
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x1ac
push ecx
mov ecx, dword [ebp - 0xe9c]
call fcn.004016b0
mov edx, dword [ebp - 0xe9c]
add edx, 0x1ac
push edx
mov ecx, dword [ebp - 0xe9c]
call fcn.00402760
cmp eax, 1
jne 0x401ab1
jmp 0x402748
xor eax, eax
mov word [ebp - 0xc58], ax
push 0x206
push 0
lea ecx, [ebp - 0xc56]
push ecx
call fcn.00415580
add esp, 0xc
xor edx, edx
mov word [ebp - 0xa48], dx
push 0x206
push 0
lea eax, [ebp - 0xa46]
push eax
call fcn.00415580
add esp, 0xc
mov dword [ebp - 0xa4c], 0
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x1ac
mov dword [ebp - 0xea0], ecx
lea edx, [ebp - 0xc58]
mov dword [ebp - 0xea4], edx
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0xea8], eax
mov ecx, dword [ebp - 0xea0]
mov dx, word [ecx]
mov word [ebp - 0xeaa], dx
mov eax, dword [ebp - 0xea4]
mov cx, word [ebp - 0xeaa]
mov word [eax], cx
mov edx, dword [ebp - 0xea0]
add edx, 2
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0xea4]
add eax, 2
mov dword [ebp - 0xea4], eax
cmp word [ebp - 0xeaa], 0
jne 0x401b23
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x1ac
mov dword [ebp - 0xeb0], ecx
lea edx, [ebp - 0xa48]
mov dword [ebp - 0xeb4], edx
mov eax, dword [ebp - 0xeb4]
mov dword [ebp - 0xeb8], eax
mov ecx, dword [ebp - 0xeb0]
mov dx, word [ecx]
mov word [ebp - 0xeba], dx
mov eax, dword [ebp - 0xeb4]
mov cx, word [ebp - 0xeba]
mov word [eax], cx
mov edx, dword [ebp - 0xeb0]
add edx, 2
mov dword [ebp - 0xeb0], edx
mov eax, dword [ebp - 0xeb4]
add eax, 2
mov dword [ebp - 0xeb4], eax
cmp word [ebp - 0xeba], 0
jne 0x401b95
lea ecx, [ebp - 0xa48]
add ecx, 0xfffffffe
mov dword [ebp - 0xec0], ecx
mov edx, dword [ebp - 0xec0]
mov ax, word [edx + 2]
mov word [ebp - 0xec2], ax
add dword [ebp - 0xec0], 2
cmp word [ebp - 0xec2], 0
jne 0x401bec
mov edi, dword [ebp - 0xec0]
mov ecx, dword [0x42e53c]
mov dword [edi], ecx
mov edx, dword [0x42e540]
mov dword [edi + 4], edx
mov eax, dword [0x42e544]
mov dword [edi + 8], eax
lea ecx, [ebp - 0xc58]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 0
je 0x401cd9
mov edx, dword [ebp - 0xa4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa48]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xc5c], 0
lea ecx, [ebp - 0xc58]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 0
je 0x401cd9
cmp dword [ebp - 0xc5c], 5
jge 0x401cd9
mov edx, dword [ebp - 0xa4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc5c]
add eax, 1
mov dword [ebp - 0xc5c], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401c84
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0xe9c]
add edx, 8
mov dword [ebp - 0xec8], edx
mov eax, dword [ebp - 0xe9c]
add eax, 0x488
mov dword [ebp - 0xecc], eax
mov ecx, dword [ebp - 0xecc]
mov dword [ebp - 0xed0], ecx
mov edx, dword [ebp - 0xec8]
mov ax, word [edx]
mov word [ebp - 0xed2], ax
mov ecx, dword [ebp - 0xecc]
mov dx, word [ebp - 0xed2]
mov word [ecx], dx
mov eax, dword [ebp - 0xec8]
add eax, 2
mov dword [ebp - 0xec8], eax
mov ecx, dword [ebp - 0xecc]
add ecx, 2
mov dword [ebp - 0xecc], ecx
cmp word [ebp - 0xed2], 0
jne 0x401d1d
mov edx, dword [ebp - 0xe9c]
add edx, 0x8a
mov dword [ebp - 0xed8], edx
mov eax, dword [ebp - 0xe9c]
add eax, 0x408
mov dword [ebp - 0xedc], eax
mov ecx, dword [ebp - 0xedc]
mov dword [ebp - 0xee0], ecx
mov edx, dword [ebp - 0xed8]
mov ax, word [edx]
mov word [ebp - 0xee2], ax
mov ecx, dword [ebp - 0xedc]
mov dx, word [ebp - 0xee2]
mov word [ecx], dx
mov eax, dword [ebp - 0xed8]
add eax, 2
mov dword [ebp - 0xed8], eax
mov ecx, dword [ebp - 0xedc]
add ecx, 2
mov dword [ebp - 0xedc], ecx
cmp word [ebp - 0xee2], 0
jne 0x401d94
mov edx, dword [ebp - 0xe9c]
add edx, 0xaa
mov dword [ebp - 0xee8], edx
mov eax, dword [ebp - 0xe9c]
add eax, 0x50a
mov dword [ebp - 0xeec], eax
mov ecx, dword [ebp - 0xeec]
mov dword [ebp - 0xef0], ecx
mov edx, dword [ebp - 0xee8]
mov ax, word [edx]
mov word [ebp - 0xef2], ax
mov ecx, dword [ebp - 0xeec]
mov dx, word [ebp - 0xef2]
mov word [ecx], dx
mov eax, dword [ebp - 0xee8]
add eax, 2
mov dword [ebp - 0xee8], eax
mov ecx, dword [ebp - 0xeec]
add ecx, 2
mov dword [ebp - 0xeec], ecx
cmp word [ebp - 0xef2], 0
jne 0x401e0b
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe9c]
mov cx, word [eax + 0x88]
mov word [edx + 0x508], cx
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe9c]
mov cx, word [eax + 0x12a]
mov word [edx + 0x58a], cx
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [eax + 0x1cc]
mov dword [edx + 0x404], ecx
mov edx, dword [ebp - 0xe9c]
add edx, 0x18c
push edx
push 0x10
mov eax, dword [ebp - 0xe9c]
add eax, 0x9bc
push eax
call fcn.00413890
add esp, 0xc
jmp 0x401fec
push 0x236
push 0
lea ecx, [ebp - 0xe98]
push ecx
call fcn.00415580
add esp, 0xc
lea esi, [ebp - 0xe98]
call fcn.00403d2b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401fec
lea edx, [ebp - 0xd8a]
mov dword [ebp - 0xef8], edx
mov eax, dword [ebp - 0xe9c]
add eax, 0x408
mov dword [ebp - 0xefc], eax
mov ecx, dword [ebp - 0xefc]
mov dword [ebp - 0xf00], ecx
mov edx, dword [ebp - 0xef8]
mov ax, word [edx]
mov word [ebp - 0xf02], ax
mov ecx, dword [ebp - 0xefc]
mov dx, word [ebp - 0xf02]
mov word [ecx], dx
mov eax, dword [ebp - 0xef8]
add eax, 2
mov dword [ebp - 0xef8], eax
mov ecx, dword [ebp - 0xefc]
add ecx, 2
mov dword [ebp - 0xefc], ecx
cmp word [ebp - 0xf02], 0
jne 0x401f1e
mov edx, dword [ebp - 0xe9c]
mov ax, word [ebp - 0xd8e]
mov word [edx + 0x508], ax
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ebp - 0xd94]
mov word [ecx + 0x58a], dx
mov esi, dword [ebp - 0xe9c]
add esi, 0x488
mov edx, dword [ebp - 0xd92]
call fcn.00404038
mov esi, dword [ebp - 0xe9c]
add esi, 0x50a
mov edx, dword [ebp - 0xd98]
call fcn.00404038
lea eax, [ebp - 0xd6a]
push eax
push 0x10
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x58c
push ecx
call fcn.00413890
add esp, 0xc
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe90]
mov dword [edx + 0x404], eax
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.00415580
add esp, 0xc
push 0
mov ecx, dword [ebp - 0xe9c]
call fcn.00401110
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x402205
mov dword [ebp - 0xf08], 0x42e548
mov eax, dword [ebp - 0xe9c]
add eax, 0x50a
mov dword [ebp - 0xf0c], eax
mov ecx, dword [ebp - 0xf0c]
mov dword [ebp - 0xf10], ecx
mov edx, dword [ebp - 0xf08]
mov ax, word [edx]
mov word [ebp - 0xf12], ax
mov ecx, dword [ebp - 0xf0c]
mov dx, word [ebp - 0xf12]
mov word [ecx], dx
mov eax, dword [ebp - 0xf08]
add eax, 2
mov dword [ebp - 0xf08], eax
mov ecx, dword [ebp - 0xf0c]
add ecx, 2
mov dword [ebp - 0xf0c], ecx
cmp word [ebp - 0xf12], 0
jne 0x402052
mov edx, dword [ebp - 0xe9c]
add edx, 0x28a
mov dword [ebp - 0xf18], edx
mov eax, dword [ebp - 0xe9c]
add eax, 0x408
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf1c]
mov dword [ebp - 0xf20], ecx
mov edx, dword [ebp - 0xf18]
mov ax, word [edx]
mov word [ebp - 0xf22], ax
mov ecx, dword [ebp - 0xf1c]
mov dx, word [ebp - 0xf22]
mov word [ecx], dx
mov eax, dword [ebp - 0xf18]
add eax, 2
mov dword [ebp - 0xf18], eax
mov ecx, dword [ebp - 0xf1c]
add ecx, 2
mov dword [ebp - 0xf1c], ecx
cmp word [ebp - 0xf22], 0
jne 0x4020c9
mov edx, dword [ebp - 0xe9c]
add edx, 0x208
mov dword [ebp - 0xf28], edx
mov eax, dword [ebp - 0xe9c]
add eax, 0x488
mov dword [ebp - 0xf2c], eax
mov ecx, dword [ebp - 0xf2c]
mov dword [ebp - 0xf30], ecx
mov edx, dword [ebp - 0xf28]
mov ax, word [edx]
mov word [ebp - 0xf32], ax
mov ecx, dword [ebp - 0xf2c]
mov dx, word [ebp - 0xf32]
mov word [ecx], dx
mov eax, dword [ebp - 0xf28]
add eax, 2
mov dword [ebp - 0xf28], eax
mov ecx, dword [ebp - 0xf2c]
add ecx, 2
mov dword [ebp - 0xf2c], ecx
cmp word [ebp - 0xf32], 0
jne 0x402140
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe9c]
mov cx, word [eax + 0x288]
mov word [edx + 0x508], cx
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe9c]
mov cx, word [eax + 0x32a]
mov word [edx + 0x58a], cx
mov edx, dword [ebp - 0xe9c]
mov eax, dword [0x434fc8]
mov dword [edx + 0x404], eax
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0xe9c]
call fcn.00401410
push 0x42e564
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.00413166
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xe9c]
mov dword [ecx + 4], 0x504d534d
mov edx, 0x51
mov eax, dword [ebp - 0xe9c]
mov word [eax + 0x88], dx
mov ecx, 0x2b70
mov edx, dword [ebp - 0xe9c]
mov word [edx + 0x12a], cx
mov dword [ebp - 0xf38], 0x42e57c
mov eax, dword [ebp - 0xe9c]
add eax, 0xaa
mov dword [ebp - 0xf3c], eax
mov ecx, dword [ebp - 0xf3c]
mov dword [ebp - 0xf40], ecx
mov edx, dword [ebp - 0xf38]
mov ax, word [edx]
mov word [ebp - 0xf42], ax
mov ecx, dword [ebp - 0xf3c]
mov dx, word [ebp - 0xf42]
mov word [ecx], dx
mov eax, dword [ebp - 0xf38]
add eax, 2
mov dword [ebp - 0xf38], eax
mov ecx, dword [ebp - 0xf3c]
add ecx, 2
mov dword [ebp - 0xf3c], ecx
cmp word [ebp - 0xf42], 0
jne 0x40225d
mov dword [ebp - 0xf48], 0x42e598
mov edx, dword [ebp - 0xe9c]
add edx, 8
mov dword [ebp - 0xf4c], edx
mov eax, dword [ebp - 0xf4c]
mov dword [ebp - 0xf50], eax
mov ecx, dword [ebp - 0xf48]
mov dx, word [ecx]
mov word [ebp - 0xf52], dx
mov eax, dword [ebp - 0xf4c]
mov cx, word [ebp - 0xf52]
mov word [eax], cx
mov edx, dword [ebp - 0xf48]
add edx, 2
mov dword [ebp - 0xf48], edx
mov eax, dword [ebp - 0xf4c]
add eax, 2
mov dword [ebp - 0xf4c], eax
cmp word [ebp - 0xf52], 0
jne 0x4022ca
mov dword [ebp - 0xf58], 0x42e5b4
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x8a
mov dword [ebp - 0xf5c], ecx
mov edx, dword [ebp - 0xf5c]
mov dword [ebp - 0xf60], edx
mov eax, dword [ebp - 0xf58]
mov cx, word [eax]
mov word [ebp - 0xf62], cx
mov edx, dword [ebp - 0xf5c]
mov ax, word [ebp - 0xf62]
mov word [edx], ax
mov ecx, dword [ebp - 0xf58]
add ecx, 2
mov dword [ebp - 0xf58], ecx
mov edx, dword [ebp - 0xf5c]
add edx, 2
mov dword [ebp - 0xf5c], edx
cmp word [ebp - 0xf62], 0
jne 0x40233a
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [0x434fc8]
mov dword [eax + 0x1cc], ecx
cmp dword [ebp - 8], 0
jne 0x4023ad
cmp dword [ebp - 4], 0
jne 0x4023ad
cmp dword [ebp - 0x424], 0
je 0x40247b
mov edx, dword [ebp - 0xe9c]
add edx, 0x408
push edx
mov eax, dword [ebp - 0xe9c]
add eax, 0x8a
push eax
call fcn.00402820
add esp, 8
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x488
push ecx
mov edx, dword [ebp - 0xe9c]
add edx, 8
push edx
call fcn.00402840
add esp, 8
mov eax, dword [ebp - 0xe9c]
add eax, 0x50a
push eax
mov ecx, dword [ebp - 0xe9c]
add ecx, 0xaa
push ecx
call fcn.00402840
add esp, 8
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe9c]
mov cx, word [eax + 0x508]
mov word [edx + 0x88], cx
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe9c]
mov cx, word [eax + 0x58a]
mov word [edx + 0x12a], cx
mov edx, dword [ebp - 0xe9c]
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [eax + 0x404]
mov dword [edx + 0x1cc], ecx
mov edx, dword [ebp - 0xe9c]
cmp dword [edx + 0x404], 0
jne 0x40247b
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [0x434fc8]
mov dword [eax + 0x1cc], ecx
mov dword [ebp - 0xf68], 0x42e5c0
mov edx, dword [ebp - 0xe9c]
add edx, 0xaa
mov dword [ebp - 0xf6c], edx
mov eax, dword [ebp - 0xf6c]
mov dword [ebp - 0xf70], eax
mov ecx, dword [ebp - 0xf68]
mov dx, word [ecx]
mov word [ebp - 0xf72], dx
mov eax, dword [ebp - 0xf6c]
mov cx, word [ebp - 0xf72]
mov word [eax], cx
mov edx, dword [ebp - 0xf68]
add edx, 2
mov dword [ebp - 0xf68], edx
mov eax, dword [ebp - 0xf6c]
add eax, 2
mov dword [ebp - 0xf6c], eax
cmp word [ebp - 0xf72], 0
jne 0x4024a3
mov ecx, dword [ebp - 0xe9c]
movzx edx, word [ecx + 8]
test edx, edx
je 0x40250a
mov eax, dword [ebp - 0xe9c]
movzx ecx, word [eax + 0x88]
test ecx, ecx
jg 0x402514
jmp 0x402748
mov edx, dword [ebp - 0xe9c]
mov dword [edx + 4], 0x504d534d
mov eax, dword [ebp - 0xe9c]
add eax, 0x9bc
mov dword [ebp - 0xf78], eax
mov ecx, dword [ebp - 0xf78]
add ecx, 2
mov dword [ebp - 0xf7c], ecx
mov edx, dword [ebp - 0xf78]
mov ax, word [edx]
mov word [ebp - 0xf7e], ax
add dword [ebp - 0xf78], 2
cmp word [ebp - 0xf7e], 0
jne 0x402541
mov ecx, dword [ebp - 0xf78]
sub ecx, dword [ebp - 0xf7c]
sar ecx, 1
mov dword [ebp - 0xf84], ecx
je 0x4025b9
mov edx, dword [ebp - 0xe9c]
add edx, 0x9bc
push edx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x4025b9
mov eax, dword [ebp - 0xe9c]
add eax, 0x9bc
push eax
push 0x10
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x18c
push ecx
call fcn.00413890
add esp, 0xc
mov edx, dword [ebp - 0xe9c]
movzx eax, word [edx + 0x18c]
test eax, eax
jne 0x4025e4
push 0x42e5dc
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x18c
push ecx
call fcn.00402820
add esp, 8
mov edx, dword [ebp - 0xe9c]
movzx eax, word [edx + 0x1ac]
test eax, eax
jne 0x40268d
push 0x42e5ec
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x1ac
push ecx
call fcn.00402820
add esp, 8
mov edx, dword [ebp - 0xe9c]
add edx, 0x58c
mov dword [ebp - 0xf88], edx
mov eax, dword [ebp - 0xf88]
add eax, 2
mov dword [ebp - 0xf8c], eax
mov ecx, dword [ebp - 0xf88]
mov dx, word [ecx]
mov word [ebp - 0xf8e], dx
add dword [ebp - 0xf88], 2
cmp word [ebp - 0xf8e], 0
jne 0x402634
mov eax, dword [ebp - 0xf88]
sub eax, dword [ebp - 0xf8c]
sar eax, 1
mov dword [ebp - 0xf94], eax
je 0x40268d
mov ecx, dword [ebp - 0xe9c]
add ecx, 0x58c
push ecx
mov edx, dword [ebp - 0xe9c]
add edx, 0x1ac
push edx
call fcn.00402820
add esp, 8
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [0x434fc4]
mov dword [eax + 0x1d0], ecx
mov edx, dword [ebp - 0xe9c]
cmp dword [edx + 0x1cc], 0
jne 0x4026c0
mov eax, dword [ebp - 0xe9c]
mov ecx, dword [0x434fc8]
mov dword [eax + 0x1cc], ecx
mov ecx, dword [ebp - 0xe9c]
call fcn.00401460
test eax, eax
jne 0x4026d3
jmp 0x402748
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0xe9c]
add eax, 0x1ac
push eax
mov ecx, dword [ebp - 0xe9c]
call fcn.004016b0
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp - 0xe9c]
add edx, 0x7b4
push edx
mov eax, 0x32
call fcn.004040c5
add esp, 8
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0xe9c]
call fcn.00401730
push 1
push 0
push 0x42e5fc
lea ecx, [ebp - 0x420]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x634], 1
mov eax, dword [ebp - 0x634]
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00413157
mov esp, ebp
pop ebp
ret