Function at 0x4161f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x4161f8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4179fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00403bec
mov eax, dword [ebp - 0x30]
mov edx, 0x417a14
call fcn.00401de4
jne 0x416240
push 1
push 0x417a1c
call sub.kernel32.dll_WinExec
call fcn.00401940
lea ecx, [ebp - 0x38]
xor edx, edx
xor eax, eax
call fcn.00415578
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00404024
mov eax, dword [ebp - 0x34]
call fcn.004040a0
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00403bec
mov eax, dword [ebp - 0x3c]
call fcn.0040947c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffdc
call fcn.00409380
mov edx, 0x419868
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x419870
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x419878
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x419880
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.00409378
mov edx, 0x419898
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
lea edx, [ebp - 0x29]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.00409378
cmp byte [ebp - 0x29], 0xf1
je 0x416343
mov eax, dword [ebp - 0x10]
call fcn.0040867c
xor eax, eax
call fcn.0041563c
push 0x10
push 0x417a28
push 0x417a30
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00401940
mov eax, dword [0x419868]
mov edx, dword [0x41986c]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x41635d
call fcn.004013ec
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409380
xor eax, eax
mov al, byte [ebp - 0x2a]
inc eax
push eax
mov eax, 0x419844
mov ecx, 1
mov edx, dword [0x4151d8]
call fcn.0040269c
add esp, 4
xor ebx, ebx
mov bl, byte [ebp - 0x2a]
test ebx, ebx
jl 0x4163c1
inc ebx
xor esi, esi
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x40]
mov eax, dword [0x419844]
test eax, eax
je 0x4163b0
cmp esi, dword [eax - 4]
jb 0x4163b5
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416394
mov eax, 0x62
call fcn.00415568
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x419860
mov ecx, 1
mov edx, dword [0x4152b8]
call fcn.0040269c
add esp, 4
dec ebx
test ebx, ebx
jl 0x416420
inc ebx
xor esi, esi
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x44]
mov eax, dword [0x419860]
test eax, eax
je 0x41640f
cmp esi, dword [eax - 4]
jb 0x416414
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4163f3
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416518
inc ebx
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x419860]
test edx, edx
je 0x416446
cmp eax, dword [edx - 4]
jb 0x41644b
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00409018
test eax, eax
jns 0x41645c
call fcn.004013ec
mov edx, esi
shl edx, 2
add edx, 2
mov ecx, dword [0x419860]
test ecx, ecx
je 0x416473
cmp edx, dword [ecx - 4]
jb 0x416478
call fcn.004013ec
mov edx, dword [ecx + edx*4]
push edx
mov edx, esi
shl edx, 2
inc edx
mov ecx, dword [0x419860]
test ecx, ecx
je 0x416491
cmp edx, dword [ecx - 4]
jb 0x416496
call fcn.004013ec
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.004158d4
mov edx, dword [ebp - 0x48]
mov eax, dword [0x419860]
test eax, eax
je 0x4164b0
cmp esi, dword [eax - 4]
jb 0x4164b5
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
mov eax, dword [0x419860]
test eax, eax
je 0x4164cb
cmp esi, dword [eax - 4]
jb 0x4164d0
call fcn.004013ec
cmp dword [eax + esi*4], 0
jne 0x416510
mov eax, dword [0x419860]
test eax, eax
je 0x4164e4
cmp esi, dword [eax - 4]
jb 0x4164e9
call fcn.004013ec
lea eax, [eax + esi*4]
mov edx, esi
shl edx, 2
add edx, 3
mov ecx, dword [0x419860]
test ecx, ecx
je 0x416503
cmp edx, dword [ecx - 4]
jb 0x416508
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x41642e
push edi
mov eax, 0x419860
mov ecx, 1
mov edx, dword [0x4152b8]
call fcn.0040269c
add esp, 4
mov eax, 0x6e
call fcn.00415540
mov byte [0x418638], al
call fcn.00403cf8
mov ebx, eax
test ebx, ebx
jle 0x4167a2
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00403bec
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040904c
mov eax, dword [ebp - 8]
mov edx, 0x417a80
call fcn.00401de4
jne 0x41657f
mov byte [0x418638], 1
mov eax, dword [ebp - 8]
mov edx, 0x417a8c
call fcn.00401de4
jne 0x416595
mov byte [0x41863c], 1
mov eax, dword [ebp - 8]
mov edx, 0x417a98
call fcn.00401de4
jne 0x4165ca
mov eax, 0x6b
mov edx, dword [0x419844]
test edx, edx
je 0x4165b8
cmp eax, dword [edx - 4]
jb 0x4165bd
call fcn.004013ec
lea eax, [edx + eax*4]
mov edx, 0x417aa4
call fcn.00401a9c
mov eax, dword [ebp - 8]
mov edx, 0x417ab0
call fcn.00401de4
jne 0x4165ff
mov eax, 0x3f
mov edx, dword [0x419844]
test edx, edx
je 0x4165ed
cmp eax, dword [edx - 4]
jb 0x4165f2
call fcn.004013ec
lea eax, [edx + eax*4]
mov edx, 0x417aa4
call fcn.00401a9c
lea eax, [ebp - 0x4c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x4c]
mov edx, 0x417abc
call fcn.00401de4
jne 0x41666e
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00403d48
mov edx, dword [ebp - 0x50]
mov eax, 0x3a
mov ecx, dword [0x419844]
test ecx, ecx
je 0x416661
cmp eax, dword [ecx - 4]
jb 0x416666
call fcn.004013ec
lea eax, [ecx + eax*4]
call fcn.00401a9c
lea eax, [ebp - 0x58]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x58]
mov edx, 0x417ac8
call fcn.00401de4
jne 0x4166c7
mov eax, 0x6a
mov edx, dword [0x419844]
test edx, edx
je 0x4166a7
cmp eax, dword [edx - 4]
jb 0x4166ac
call fcn.004013ec
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
lea eax, [ebp - 0x5c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x5c]
mov edx, 0x417ad4
call fcn.00401de4
jne 0x416708
push 0x419888
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
lea eax, [ebp - 0x60]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401ef4
mov eax, dword [ebp - 0x60]
mov edx, 0x417ae0
call fcn.00401de4
jne 0x41679a
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
call fcn.00401ca0
mov ecx, eax
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.00401ef4
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00415724
mov edx, dword [ebp - 0x64]
mov eax, 0x1d
mov ecx, dword [0x419844]
test ecx, ecx
je 0x41676a
cmp eax, dword [ecx - 4]
jb 0x41676f
call fcn.004013ec
mov eax, dword [ecx + eax*4]
call fcn.00401de4
jne 0x41679a
mov eax, 0x1d
mov edx, dword [0x419844]
test edx, edx
je 0x41678d
cmp eax, dword [edx - 4]
jb 0x416792
call fcn.004013ec
lea eax, [edx + eax*4]
call fcn.00401a48
inc esi
dec ebx
jne 0x416554
cmp byte [0x418638], 0
je 0x4167d6
mov eax, 0x1d
mov edx, dword [0x419844]
test edx, edx
je 0x4167bf
cmp eax, dword [edx - 4]
jb 0x4167c4
call fcn.004013ec
cmp dword [edx + eax*4], 0
je 0x4167d6
mov al, 1
call fcn.0041563c
call fcn.00401940
mov eax, 0x41
mov edx, dword [0x419844]
test edx, edx
je 0x4167ea
cmp eax, dword [edx - 4]
jb 0x4167ef
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x6c]
xor edx, edx
call fcn.00410828
mov edx, dword [ebp - 0x6c]
mov eax, 0x419894
call fcn.00401a9c
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov edx, dword [0x419894]
call fcn.0040a7dc
cmp byte [0x418638], 0
jne 0x416838
push 5
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
jmp 0x416846
mov eax, dword [0x4186ac]
mov eax, dword [eax]
xor edx, edx
call fcn.00405f8c
mov eax, 0x32
call fcn.00415568
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x419838
mov ecx, 1
mov edx, dword [0x415178]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4168a7
inc ebx
xor esi, esi
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x70]
mov eax, dword [0x419838]
test eax, eax
je 0x416896
cmp esi, dword [eax - 4]
jb 0x41689b
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x41687a
mov eax, 0x60
call fcn.00415568
lea edi, [eax + eax*2]
push edi
mov eax, 0x41985c
mov ecx, 1
mov edx, dword [0x415298]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416904
inc ebx
xor esi, esi
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x74]
mov eax, dword [0x41985c]
test eax, eax
je 0x4168f3
cmp esi, dword [eax - 4]
jb 0x4168f8
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4168d7
mov eax, 0x1f
call fcn.00415568
mov edi, eax
add edi, edi
push edi
mov eax, 0x419864
mov ecx, 1
mov edx, dword [0x4152d8]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416962
inc ebx
xor esi, esi
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x78]
mov eax, dword [0x419864]
test eax, eax
je 0x416951
cmp esi, dword [eax - 4]
jb 0x416956
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416935
mov eax, 0x36
call fcn.00415568
mov edi, eax
shl edi, 3
push edi
mov eax, 0x419834
mov ecx, 1
mov edx, dword [0x415158]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4169c1
inc ebx
xor esi, esi
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x419834]
test eax, eax
je 0x4169b0
cmp esi, dword [eax - 4]
jb 0x4169b5
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416994
mov eax, 0x43
call fcn.00415568
lea edi, [eax + eax*2]
push edi
mov eax, 0x41983c
mov ecx, 1
mov edx, dword [0x415198]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416a1e
inc ebx
xor esi, esi
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x80]
mov eax, dword [0x41983c]
test eax, eax
je 0x416a0d
cmp esi, dword [eax - 4]
jb 0x416a12
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x4169f1
mov eax, 0x5d
call fcn.00415568
mov edi, eax
add edi, edi
push edi
mov eax, 0x419840
mov ecx, 1
mov edx, dword [0x4151b8]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416a82
inc ebx
xor esi, esi
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x84]
mov eax, dword [0x419840]
test eax, eax
je 0x416a71
cmp esi, dword [eax - 4]
jb 0x416a76
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416a4f
mov eax, 0x28
call fcn.00415568
mov ebx, eax
mov eax, 0x19
call fcn.00415568
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419830
mov ecx, 1
mov edx, dword [0x415138]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416af7
inc ebx
xor esi, esi
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x88]
mov eax, dword [0x419830]
test eax, eax
je 0x416ae6
cmp esi, dword [eax - 4]
jb 0x416aeb
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416ac4
mov eax, 0x18
call fcn.00415568
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419850
mov ecx, 1
mov edx, dword [0x415238]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416b5e
inc ebx
xor esi, esi
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x419850]
test eax, eax
je 0x416b4d
cmp esi, dword [eax - 4]
jb 0x416b52
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416b2b
mov eax, 0x2d
call fcn.00415568
mov edi, eax
add edi, edi
push edi
mov eax, 0x419854
mov ecx, 1
mov edx, dword [0x415258]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416bc2
inc ebx
xor esi, esi
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x90]
mov eax, dword [0x419854]
test eax, eax
je 0x416bb1
cmp esi, dword [eax - 4]
jb 0x416bb6
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416b8f
mov eax, 0x14
call fcn.00415568
mov edi, eax
add edi, edi
push edi
mov eax, 0x419858
mov ecx, 1
mov edx, dword [0x415278]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416c26
inc ebx
xor esi, esi
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x94]
mov eax, dword [0x419858]
test eax, eax
je 0x416c15
cmp esi, dword [eax - 4]
jb 0x416c1a
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416bf3
mov eax, 0x1a
call fcn.00415568
mov edi, eax
shl edi, 2
push edi
mov eax, 0x41984c
mov ecx, 1
mov edx, dword [0x415218]
call fcn.0040269c
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x416c8b
inc ebx
xor esi, esi
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x98]
mov eax, dword [0x41984c]
test eax, eax
je 0x416c7a
cmp esi, dword [eax - 4]
jb 0x416c7f
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416c58
mov eax, 0x1a
call fcn.00415568
mov edi, eax
mov eax, 0x39
call fcn.00415568
imul edi, eax
lea eax, [edi + 1]
push eax
mov eax, 0x419848
mov ecx, 1
mov edx, dword [0x4151f8]
call fcn.0040269c
add esp, 4
mov ebx, edi
test ebx, ebx
jle 0x416cfe
mov esi, 1
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x419848]
test eax, eax
je 0x416ced
cmp esi, dword [eax - 4]
jb 0x416cf2
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416ccb
mov eax, dword [0x419878]
mov edx, dword [0x41987c]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416d18
call fcn.004013ec
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409380
cmp byte [0x419898], 0
je 0x416da5
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 2
call fcn.00415578
mov eax, dword [ebp - 8]
call fcn.004094a4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, 0x417af0
call fcn.00405264
push dword [0x419874]
push dword [0x419870]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004157b4
mov eax, dword [ebp - 0x14]
call fcn.0040867c
mov dl, 1
mov eax, dword [0x40c930]
call fcn.0040cd00
mov ebx, eax
lea eax, [ebp - 0xa0]
call fcn.004042b4
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040d18c
mov eax, ebx
call fcn.0040145c
jmp 0x416e1e
xor ebx, ebx
mov bl, byte [ebp - 0x2b]
test ebx, ebx
jle 0x416e1e
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
call fcn.004042b4
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 8]
pop ecx
call fcn.00401cec
mov eax, dword [ebp - 8]
call fcn.004094a4
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0x10]
call fcn.004052cc
mov eax, dword [ebp - 0xac]
call fcn.00409018
mov edi, eax
mov eax, edi
cdq
push edx
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004157b4
mov eax, dword [ebp - 0x14]
call fcn.0040867c
dec ebx
jne 0x416dae
mov eax, dword [ebp - 0x10]
call fcn.0040867c
cmp dword [0x419888], 0
je 0x416ec6
mov byte [0x418634], 0xff
mov eax, 0x1a
call fcn.00415568
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x416eb3
inc ebx
xor esi, esi
mov eax, esi
shl eax, 2
mov edx, dword [0x41984c]
test edx, edx
je 0x416e62
cmp eax, dword [edx - 4]
jb 0x416e67
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0xb0]
call fcn.0040904c
mov eax, dword [ebp - 0xb0]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [0x419888]
call fcn.0040904c
mov eax, dword [ebp - 0xb4]
pop edx
call fcn.00401fd8
test eax, eax
jle 0x416eaf
mov eax, esi
cmp eax, 0xff
jbe 0x416eaa
call fcn.004013ec
mov byte [0x418634], al
inc esi
dec ebx
jne 0x416e4e
cmp byte [0x418634], 0xff
jne 0x416ec6
mov eax, 0x419888
call fcn.00401a48
mov eax, 0x1a
call fcn.00415568
dec eax
jle 0x416f1d
cmp dword [0x419888], 0
jne 0x416f1d
mov edx, dword [0x4186ac]
mov edx, dword [edx]
mov eax, dword [0x418660]
call fcn.0040dc1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405f9c
mov eax, dword [0x418660]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00406fd0
cmp byte [0x418640], 0
jne 0x416f1d
mov al, 1
call fcn.0041563c
call fcn.00401940
mov eax, 0x1a
call fcn.00415568
dec eax
jle 0x416fca
cmp byte [0x418634], 0
jbe 0x416fca
mov eax, 0x419888
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x416f5a
cmp edx, dword [ecx - 4]
jb 0x416f5f
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
mov eax, 0x39
call fcn.00415568
mov ebx, eax
test ebx, ebx
jle 0x416fed
mov esi, 1
mov eax, 0x39
call fcn.00415568
xor edx, edx
mov dl, byte [0x418634]
imul edx
add eax, esi
mov edx, dword [0x419848]
test edx, edx
je 0x416fa1
cmp eax, dword [edx - 4]
jb 0x416fa6
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, dword [0x419848]
test eax, eax
je 0x416fb7
cmp esi, dword [eax - 4]
jb 0x416fbc
call fcn.004013ec
lea eax, [eax + esi*4]
call fcn.00401a9c
inc esi
dec ebx
jne 0x416f7c
jmp 0x416fed
mov eax, 0x419888
xor edx, edx
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x416fe0
cmp edx, dword [ecx - 4]
jb 0x416fe5
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401a9c
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
add edx, 2
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x41700d
cmp edx, dword [ecx - 4]
jb 0x417012
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
cmp dword [ebp - 8], 0
je 0x41703e
mov eax, dword [ebp - 8]
call fcn.00409018
cmp eax, 0xff
jbe 0x417034
call fcn.004013ec
mov edx, dword [0x41867c]
mov byte [edx], al
jmp 0x417046
mov eax, dword [0x41867c]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418634]
shl edx, 2
add edx, 3
mov ecx, dword [0x41984c]
test ecx, ecx
je 0x417066
cmp edx, dword [ecx - 4]
jb 0x41706b
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
cmp dword [ebp - 8], 0
je 0x417097
mov eax, dword [ebp - 8]
call fcn.00409018
cmp eax, 0xff
jbe 0x41708d
call fcn.004013ec
mov edx, dword [0x4186ec]
mov byte [edx], al
jmp 0x41709f
mov eax, dword [0x4186ec]
mov byte [eax], 0x10
mov eax, 0x3d
call fcn.00415568
call fcn.0040800c
test al, al
je 0x417152
cmp byte [0x418638], 0
jne 0x417146
push 0x30
mov eax, 0x41
mov edx, dword [0x419844]
test edx, edx
je 0x4170d9
cmp eax, dword [edx - 4]
jb 0x4170de
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
mov eax, 0x3e
mov edx, dword [0x419844]
test edx, edx
je 0x4170fb
cmp eax, dword [edx - 4]
jb 0x417100
call fcn.004013ec
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x419848]
test edx, edx
je 0x417117
cmp eax, dword [edx - 4]
jb 0x41711c
call fcn.004013ec
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xb8]
call fcn.00401cec
mov eax, dword [ebp - 0xb8]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
mov al, 1
call fcn.0041563c
call fcn.00401940
mov eax, 0x63
call fcn.00415540
test al, al
je 0x4171b4
call fcn.00415aac
test al, al
jne 0x4171b4
push 0x30
mov eax, dword [0x419894]
call fcn.00401e98
push eax
mov eax, 0x55
mov edx, dword [0x419848]
test edx, edx
je 0x41718a
cmp eax, dword [edx - 4]
jb 0x41718f
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
mov al, 1
call fcn.0041563c
call fcn.00401940
mov eax, 0x64
call fcn.00415540
test al, al
je 0x41730d
mov eax, 0x64
mov edx, dword [0x419844]
test edx, edx
je 0x4171da
cmp eax, dword [edx - 4]
jb 0x4171df
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.004037fc
fstp qword [ebp - 0x20]
wait
call fcn.00415934
fstp qword [ebp - 0x28]
wait
mov eax, 0x55
call fcn.00415540
test al, al
je 0x41720d
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jb 0x41722e
mov eax, 0x55
call fcn.00415540
test al, al
jne 0x41730d
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
je 0x41730d
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x419848]
test ecx, ecx
je 0x417245
cmp edx, dword [ecx - 4]
jb 0x41724a
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
mov eax, 2
call fcn.00415540
test al, al
je 0x417298
mov esi, 4
push dword [ebp - 8]
push 0x417b00
mov eax, 0x57
mov edx, dword [0x419848]
test edx, edx
je 0x417281
cmp eax, dword [edx - 4]
jb 0x417286
call fcn.004013ec
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401d60
jmp 0x41729a
xor esi, esi
or esi, 0x30
test esi, esi
jns 0x4172a6
call fcn.004013ec
push esi
mov eax, dword [0x419894]
call fcn.00401e98
push eax
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
mov eax, dword [0x4186ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x417301
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x419844]
test edx, edx
je 0x4172ea
cmp eax, dword [edx - 4]
jb 0x4172ef
call fcn.004013ec
mov eax, dword [edx + eax*4]
call fcn.00401e98
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov al, 1
call fcn.0041563c
call fcn.00401940
mov eax, 0x67
call fcn.00415540
test al, al
je 0x4173e7
lea eax, [ebp - 8]
mov edx, 0x68
mov ecx, dword [0x419844]
test ecx, ecx
je 0x417336
cmp edx, dword [ecx - 4]
jb 0x41733b
call fcn.004013ec
mov edx, dword [ecx + edx*4]
call fcn.00401ae0
mov eax, 0x69
call fcn.00415568
cmp eax, 2
jge 0x4173c1
mov ebx, 1
xor esi, esi
jmp 0x4173b7
mov esi, ebx
mov eax, 0x69
call fcn.00415568
sub eax, 1
jb 0x417370
je 0x417384
jmp 0x41738e
mov eax, dword [ebp - 8]
call fcn.00401e98
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
jmp 0x41738e
mov eax, dword [ebp - 8]
call fcn.00415e80
mov ebx, eax
test ebx, ebx
je 0x4173b7
mov eax, dword [0x4186ac]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x28]
je 0x4173b7
mov eax, dword [0x41982c]
mov eax, dword [eax + 0x18]
cmp ebx, dword [eax + 0x28]
je 0x4173b7
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
je 0x4173e7
cmp ebx, esi
jne 0x41735b
jmp 0x4173e7
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040904c
call fcn.0040c7fc
cmp al, 3
jbe 0x4173df
mov eax, dword [ebp - 0xc]
call fcn.00416080
jmp 0x4173e7
mov eax, dword [ebp - 0xc]
call fcn.00415f70
mov eax, 1
call fcn.00415540
test al, al
je 0x41784d
cmp byte [0x418638], 0
jne 0x41784d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf0
xor edx, edx
call fcn.004035b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.00408028
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040ad50
call fcn.0040a970
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac28
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac00
pop edx
call fcn.0040b760
mov edx, dword [0x4186a8]
mov dword [edx], eax
mov eax, 3
call fcn.00415540
test al, al
je 0x4174ee
mov eax, 6
call fcn.00415540
xor al, 1
push eax
mov eax, 4
call fcn.00415568
push eax
mov eax, 5
call fcn.00415568
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac28
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac00
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb94
call fcn.00408e58
pop edx
pop ecx
call fcn.00415b94
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf0
pop edx
call fcn.004035b4
jmp 0x417674
xor edx, edx
xor eax, eax
call fcn.0040b760
mov edx, dword [0x418680]
mov dword [edx], eax
lea ecx, [ebp - 0xbc]
xor edx, edx
mov eax, 6
call fcn.00415578
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040bc34
mov eax, 7
call fcn.00415568
sub eax, 1
jb 0x417540
je 0x417563
dec eax
je 0x4175be
jmp 0x417674
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf0
pop edx
call fcn.004035b4
jmp 0x417674
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a9cc
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb94
call fcn.00408e58
mov edx, eax
mov eax, dword [0x418680]
mov eax, dword [eax]
pop ecx
call fcn.0040b938
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf0
pop edx
call fcn.004035b4
jmp 0x417674
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac28
mov edx, dword [0x418680]
mov edx, dword [edx]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xd0], eax
fild dword [ebp - 0xd0]
fdiv dword [0x417b04]
call fcn.00401290
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4175f9
call fcn.004013ec
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac00
mov edx, dword [0x418680]
mov edx, dword [edx]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xd4], eax
fild dword [ebp - 0xd4]
fdiv dword [0x417b04]
call fcn.00401290
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x417635
call fcn.004013ec
push eax
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.0040bb94
call fcn.00408e58
mov edx, eax
mov eax, dword [0x418680]
mov eax, dword [eax]
pop ecx
call fcn.0040b888
mov eax, dword [0x4186a8]
mov eax, dword [eax]
call fcn.004072c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040adf0
pop edx
call fcn.004035b4
mov eax, 8
mov edx, dword [0x419844]
test edx, edx
je 0x417688
cmp eax, dword [edx - 4]
jb 0x41768d
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd8]
xor edx, edx
call fcn.00410828
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040a7dc
mov eax, 9
mov edx, dword [0x419844]
test edx, edx
je 0x4176c2
cmp eax, dword [edx - 4]
jb 0x4176c7
call fcn.004013ec
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xdc]
xor edx, edx
call fcn.00410828
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a7dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040adb8
mov ebx, eax
mov eax, 0xa
call fcn.00415568
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408a10
mov eax, 0xb
mov edx, dword [0x419844]
test edx, edx
je 0x417721
cmp eax, dword [edx - 4]
jb 0x417726
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403604
mov eax, 0xc
call fcn.00415568
mov edx, eax
mov eax, ebx
call fcn.00403594
mov eax, 0xd
call fcn.00415568
mov edx, eax
cmp edx, 0xff
jbe 0x41775c
call fcn.004013ec
mov eax, ebx
call fcn.004035f4
mov eax, 0xe
call fcn.00415568
mov edx, eax
mov eax, ebx
call fcn.00408a44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040adb8
mov ebx, eax
mov eax, 0xf
call fcn.00415568
mov edx, eax
mov eax, ebx
call fcn.00408a44
mov eax, 0x10
call fcn.00415568
mov edx, eax
mov eax, ebx
call fcn.00403594
mov eax, 0x11
call fcn.00415568
mov edx, eax
cmp edx, 0xff
jbe 0x4177c2
call fcn.004013ec
mov eax, ebx
call fcn.004035f4
mov eax, 0x12
call fcn.00415568
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.00408a10
mov eax, 0x13
mov edx, dword [0x419844]
test edx, edx
je 0x4177f5
cmp eax, dword [edx - 4]
jb 0x4177fa
call fcn.004013ec
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.00403604
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac28
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ac28
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ac00
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ac00
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.00408028
jmp 0x417858
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405f9c
mov eax, 0x31
call fcn.00415540
test al, al
je 0x41789b
xor edx, edx
xor eax, eax
call fcn.0040b760
mov edx, dword [0x4186a4]
mov dword [edx], eax
lea ecx, [ebp - 0xe0]
xor edx, edx
mov eax, 4
call fcn.00415578
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x4186a4]
mov eax, dword [eax]
call fcn.0040bc34
mov eax, 0x3f
call fcn.00415540
test al, al
je 0x4178de
xor edx, edx
xor eax, eax
call fcn.0040b760
mov edx, dword [0x418688]
mov dword [edx], eax
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, 5
call fcn.00415578
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x418688]
mov eax, dword [eax]
call fcn.0040bc34
mov eax, 0x70
call fcn.00415540
test al, al
je 0x417921
xor edx, edx
xor eax, eax
call fcn.0040b760
mov edx, dword [0x418690]
mov dword [edx], eax
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, 7
call fcn.00415578
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x418690]
mov eax, dword [eax]
call fcn.0040bc34
mov eax, 0x58
call fcn.00415540
test al, al
jne 0x41794b
mov eax, 0x59
call fcn.00415540
test al, al
jne 0x41794b
mov eax, 0x5a
call fcn.00415540
test al, al
je 0x417980
xor edx, edx
xor eax, eax
call fcn.0040b760
mov edx, dword [0x4186bc]
mov dword [edx], eax
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, 8
call fcn.00415578
mov edx, dword [ebp - 0xec]
mov eax, dword [0x4186bc]
mov eax, dword [eax]
call fcn.0040bc34
mov eax, 0x1d
call fcn.00415540
test al, al
je 0x4179c3
xor edx, edx
xor eax, eax
call fcn.0040b760
mov edx, dword [0x4186f8]
mov dword [edx], eax
lea ecx, [ebp - 0xf0]
xor edx, edx
mov eax, 9
call fcn.00415578
mov edx, dword [ebp - 0xf0]
mov eax, dword [0x4186f8]
mov eax, dword [eax]
call fcn.0040bc34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417a05
lea eax, [ebp - 0xf0]
mov edx, 7
call fcn.00401a6c
lea eax, [ebp - 0xbc]
mov edx, 0x24
call fcn.00401a6c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401a6c
ret