Function at 0x64abc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x64abc8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409650
lea eax, [ebp - 0x20]
mov edx, dword [0x64ab24]
call fcn.0040a96c
mov ebx, 0x67c930
xor eax, eax
push ebp
push 0x64b8d2
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [0x64b8e4]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x64b8f4
mov edx, 0x64b908
mov eax, dword [ebp - 4]
call fcn.0042b7e4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebx]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 7
jne 0x64b848
lea ecx, [ebp - 0x30]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x30]
mov ecx, 1
mov eax, 0x64b91c
call fcn.0040a710
test eax, eax
jle 0x64ac6a
cmp byte [0x67c8ea], 0
jne 0x64b848
lea ecx, [ebp - 0x34]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x34]
mov ecx, 1
mov eax, 0x64b930
call fcn.0040a710
test eax, eax
jle 0x64ac9c
cmp byte [0x67c8ea], 0
je 0x64b848
lea ecx, [ebp - 0x3c]
mov edx, 3
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00422804
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x18]
call fcn.00409994
mov eax, esi
dec ax
je 0x64acd9
dec ax
je 0x64acee
dec ax
je 0x64ad03
dec ax
je 0x64ad18
jmp 0x64ad2b
mov eax, dword [ebp - 0x18]
mov edx, 0x64b944
call fcn.0040a4c8
jne 0x64b848
jmp 0x64ad2b
mov eax, dword [ebp - 0x18]
mov edx, 0x64b978
call fcn.0040a4c8
jne 0x64b848
jmp 0x64ad2b
mov eax, dword [ebp - 0x18]
mov edx, 0x64b9bc
call fcn.0040a4c8
jne 0x64b848
jmp 0x64ad2b
mov eax, dword [ebp - 0x18]
mov edx, 0x64b9f8
call fcn.0040a4c8
jne 0x64b848
cmp si, 5
jne 0x64ad77
lea ecx, [ebp - 0x44]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00422804
mov edx, dword [ebp - 0x40]
mov ecx, 1
mov eax, 0x64ba2c
call fcn.0040a710
test eax, eax
jle 0x64ad77
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x20]
call fcn.00409994
jmp 0x64ad99
lea ecx, [ebp - 0x50]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.006428d8
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x20]
call fcn.00409994
cmp si, 5
jne 0x64ae4c
lea ecx, [ebp - 0x58]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00422804
mov edx, dword [ebp - 0x54]
mov ecx, 1
mov eax, 0x64ba50
call fcn.0040a710
test eax, eax
jle 0x64ae4c
lea ecx, [ebp - 8]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [0x64ba68]
push eax
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x64ba78
mov edx, 0x64ba94
mov eax, dword [ebp - 8]
call fcn.0042b7e4
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 8]
call fcn.006428d8
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 8]
call fcn.00409994
movzx eax, byte [0x64ba68]
push eax
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x64bab8
mov edx, 0x64badc
mov eax, dword [ebp - 8]
call fcn.0042b7e4
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x1c]
call fcn.00409994
jmp 0x64ae71
lea ecx, [ebp - 0x6c]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.006428d8
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x1c]
call fcn.00409994
cmp si, 5
jne 0x64b019
mov eax, dword [ebp - 0x18]
mov edx, 0x64baf8
call fcn.0040a4c8
jne 0x64aef4
push dword [ebp - 0x20]
push 0x64bb30
push dword [ebp - 0x1c]
push 0x64bb44
lea ecx, [ebp - 0x74]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x74]
push 0x64bb58
lea ecx, [ebp - 0x78]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x78]
push 0x64bb6c
lea ecx, [ebp - 0x7c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x7c]
lea eax, [ebp - 0x70]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x70]
mov eax, 0x64bb80
call fcn.00643f34
mov eax, dword [ebp - 0x18]
mov edx, 0x64bbb8
call fcn.0040a4c8
jne 0x64af7f
push dword [ebp - 0x20]
push 0x64bbf0
push dword [ebp - 0x1c]
push 0x64bc04
lea ecx, [ebp - 0x84]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x84]
push 0x64bc18
lea ecx, [ebp - 0x88]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x88]
push 0x64bc2c
lea ecx, [ebp - 0x8c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x8c]
lea eax, [ebp - 0x80]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x80]
mov eax, 0x64bc40
call fcn.00643f34
mov eax, dword [ebp - 0x18]
mov edx, 0x64bc74
call fcn.0040a4c8
jne 0x64b848
push dword [ebp - 0x20]
push 0x64bcac
push dword [ebp - 0x1c]
push 0x64bcc0
lea ecx, [ebp - 0x94]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x94]
push 0x64bcd4
lea ecx, [ebp - 0x98]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x98]
push 0x64bce8
lea ecx, [ebp - 0x9c]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x9c]
lea eax, [ebp - 0x90]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x90]
mov eax, 0x64bcfc
call fcn.00643f34
jmp 0x64b848
lea ecx, [ebp - 0xa4]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.00422804
mov ecx, dword [ebp - 0xa0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
mov word [ebp - 0x14], 1
lea ecx, [ebp - 0xa8]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa8]
mov edx, 0x64bd30
call fcn.0040a4c8
jne 0x64b080
mov word [ebp - 0x14], 3
jmp 0x64b0d6
lea ecx, [ebp - 0xac]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xac]
mov edx, 0x64bd50
call fcn.0040a4c8
jne 0x64b0ac
mov word [ebp - 0x14], 2
jmp 0x64b0d6
lea ecx, [ebp - 0xb0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xb0]
mov edx, 0x64bd70
call fcn.0040a4c8
jne 0x64b0d6
mov word [ebp - 0x14], 0
lea ecx, [ebp - 0xb8]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00422804
mov ecx, dword [ebp - 0xb4]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0xbc]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xbc]
mov edx, 0x64bd88
call fcn.0040a4c8
je 0x64b157
lea ecx, [ebp - 0xc0]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc0]
mov edx, 0x64bd9c
call fcn.0040a4c8
je 0x64b157
xor eax, eax
jmp 0x64b159
mov al, 1
mov byte [ebp - 0x12], al
lea ecx, [ebp - 0xc8]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.00422804
mov ecx, dword [ebp - 0xc4]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0xcc]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xcc]
mov edx, 0x64bdac
call fcn.0040a4c8
je 0x64b1dd
lea ecx, [ebp - 0xd0]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xd0]
mov edx, 0x64bdc0
call fcn.0040a4c8
je 0x64b1dd
xor eax, eax
jmp 0x64b1df
mov al, 1
mov byte [ebp - 0x11], al
mov byte [0x67c8eb], 0
mov byte [0x67c8ee], 0
mov esi, dword [ebp - 0x20]
mov eax, esi
test eax, eax
je 0x64b1fe
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jle 0x64b5ff
lea eax, [ebp - 0xd8]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040a500
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd4]
call fcn.00422804
mov eax, dword [ebp - 0xd4]
mov edx, 0x64bdd0
call fcn.0040a4c8
jne 0x64b5ff
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x64bde4
call fcn.0040a710
test eax, eax
jle 0x64b5ff
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x64bdf4
call fcn.0040a710
test eax, eax
jle 0x64b5ff
mov ebx, esi
test ebx, ebx
je 0x64b286
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 0x20]
call fcn.0040a500
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64be04
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040a500
mov ebx, esi
test ebx, ebx
je 0x64b2cd
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x64be14
call fcn.0040a710
mov edx, eax
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0x20]
call fcn.0040a500
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 8]
call fcn.006428d8
mov edx, dword [ebp - 0xdc]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0xc]
call fcn.006428d8
mov edx, dword [ebp - 0xe0]
lea eax, [ebp - 0xc]
call fcn.00409994
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040a4c8
jne 0x64b848
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x64b345
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jle 0x64b848
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00409994
lea eax, [ebp - 0xe8]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0xe4]
call fcn.00422804
mov eax, dword [ebp - 0xe4]
mov edx, 0x64be24
call fcn.0040a4c8
je 0x64b411
lea eax, [ebp - 0xf0]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xf0]
lea edx, [ebp - 0xec]
call fcn.00422804
mov eax, dword [ebp - 0xec]
mov edx, 0x64be3c
call fcn.0040a4c8
je 0x64b411
lea eax, [ebp - 0xf8]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.00422804
mov eax, dword [ebp - 0xf4]
mov edx, 0x64be54
call fcn.0040a4c8
jne 0x64b848
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x64be6c
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.0040a548
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x64b43e
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x10]
call fcn.006428d8
mov edx, dword [ebp - 0xfc]
lea eax, [ebp - 0x10]
call fcn.00409994
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0x100]
call fcn.00422804
mov eax, dword [ebp - 0x100]
mov edx, 0x64be7c
call fcn.0040a4c8
jne 0x64b4e8
cmp byte [0x67c8e2], 0
jne 0x64b4e8
push 0x40040
lea edx, [ebp - 0x108]
mov eax, dword [0x67c8a4]
call fcn.005418f8
mov eax, dword [ebp - 0x108]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x67644c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.00422804
mov eax, dword [ebp - 0x10c]
mov edx, 0x64be8c
call fcn.0040a4c8
jne 0x64b56f
cmp dword [ebp - 0x10], 0
je 0x64b568
cmp byte [0x67c8e2], 0
jne 0x64b568
push 0x40030
lea edx, [ebp - 0x114]
mov eax, dword [0x67c8a4]
call fcn.005418f8
mov eax, dword [ebp - 0x114]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x67644c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x67c8eb], 1
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00422804
mov eax, dword [ebp - 0x118]
mov edx, 0x64be9c
call fcn.0040a4c8
jne 0x64b848
cmp dword [ebp - 0x10], 0
je 0x64b5f3
cmp byte [0x67c8e2], 0
jne 0x64b5f3
push 0x40030
lea edx, [ebp - 0x120]
mov eax, dword [0x67c8a4]
call fcn.005418f8
mov eax, dword [ebp - 0x120]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x67644c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x67c8ee], 1
jmp 0x64b848
mov eax, dword [ebp - 0x20]
cmp eax, 0x64beac
jne 0x64b60d
mov al, 1
jmp 0x64b632
cmp dword [ebp - 0x20], 0
je 0x64b61c
mov eax, 0x64bec8
test eax, eax
jne 0x64b620
xor eax, eax
jmp 0x64b632
mov edx, 0x64bee4
mov eax, dword [ebp - 0x20]
call fcn.004229a4
test eax, eax
sete al
test al, al
je 0x64b763
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x64bf00
call fcn.0040a710
test eax, eax
jle 0x64b67c
movzx eax, byte [0x64b8e4]
push eax
lea eax, [ebp - 0x124]
push eax
xor ecx, ecx
mov edx, 0x64bf10
mov eax, dword [ebp - 0x1c]
call fcn.0042b7e4
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x1c]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241d0
test al, al
je 0x64b848
mov byte [ebp - 0x25], 0
mov dl, 1
mov eax, dword [0x48fe84]
call fcn.004b3834
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x64b720
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x128]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x128]
mov ecx, 1
mov eax, 0x64bf20
call fcn.0040a710
test eax, eax
jle 0x64b71c
mov byte [ebp - 0x25], 1
lea ecx, [ebp - 0x130]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.006428d8
mov ecx, dword [ebp - 0x12c]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x64b6be
cmp byte [ebp - 0x25], 0
je 0x64b756
xor eax, eax
push ebp
push 0x64b74c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b756
mov eax, dword [ebp - 0x24]
call fcn.004078f0
jmp 0x64b848
mov eax, dword [ebp - 0x20]
cmp eax, 0x64bf30
jne 0x64b771
mov al, 1
jmp 0x64b796
cmp dword [ebp - 0x20], 0
je 0x64b780
mov eax, 0x64bf64
test eax, eax
jne 0x64b784
xor eax, eax
jmp 0x64b796
mov edx, 0x64bf98
mov eax, dword [ebp - 0x20]
call fcn.004229a4
test eax, eax
sete al
test al, al
je 0x64b7af
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
jmp 0x64b848
mov eax, dword [ebp - 0x20]
cmp eax, 0x64bfcc
jne 0x64b7bd
mov al, 1
jmp 0x64b7e2
cmp dword [ebp - 0x20], 0
je 0x64b7cc
mov eax, 0x64c004
test eax, eax
jne 0x64b7d0
xor eax, eax
jmp 0x64b7e2
mov edx, 0x64c03c
mov eax, dword [ebp - 0x20]
call fcn.004229a4
test eax, eax
sete al
test al, al
je 0x64b7f5
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoW
jmp 0x64b848
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.004241d0
test al, al
je 0x64b821
movzx eax, word [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x11]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor eax, eax
call fcn.006490ac
jmp 0x64b83c
movzx eax, word [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.0040a13c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b8dc
lea eax, [ebp - 0x130]
mov edx, 4
call fcn.004095cc
lea eax, [ebp - 0x120]
call fcn.0040956c
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x114]
call fcn.0040956c
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x108]
call fcn.0040956c
lea eax, [ebp - 0x104]
mov edx, 0x37
call fcn.004095cc
lea eax, [ebp - 0x20]
mov edx, dword [0x64ab24]
call fcn.0040aa44
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004095cc
ret