Function at 0x40be9c
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x59
push 0
push 0
dec ecx
jne 0x40bea5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00402a4c
mov eax, dword [ebp - 0xc]
call fcn.00402a4c
lea eax, [ebp - 0x41]
mov edx, dword [0x409128]
call fcn.00402cb4
xor eax, eax
push ebp
push 0x40cd73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 0x44]
mov eax, dword [ebp - 4]
call fcn.0040489c
mov eax, dword [ebp - 8]
cmp byte [eax + 0x42], 0
je 0x40bf1b
mov eax, dword [ebp - 8]
add eax, 0x28
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x18]
call fcn.00402618
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + 8]
cmp eax, 5
ja case.0x40bf2d.0
jmp dword [eax*4 + 0x40bf34]
push ebp
mov al, 0xfa
call fcn.0040bdcc
pop ecx
test al, al
je 0x40bf6a
lea edx, [ebp - 0x10]
mov ax, 1
call fcn.004098a0
jmp case.0x40bf2d.0
push ebp
mov al, 0xdd
call fcn.0040bdcc
pop ecx
test al, al
je 0x40bf87
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.004025c4
jmp case.0x40bf2d.0
push ebp
mov al, 0xdb
call fcn.0040bdcc
pop ecx
test al, al
je 0x40bfa5
lea edx, [ebp - 0x10]
mov ax, 2
call fcn.004098a0
jmp case.0x40bf2d.0
push ebp
mov al, 0xd9
call fcn.0040bdcc
pop ecx
test al, al
je 0x40bfc2
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.004099c0
jmp case.0x40bf2d.0
push ebp
mov al, 0xd7
call fcn.0040bdcc
pop ecx
test al, al
je 0x40bfdc
lea eax, [ebp - 0x10]
call fcn.00409438
jmp case.0x40bf2d.0
push ebp
mov al, 0xd8
call fcn.0040bdcc
pop ecx
test al, al
je 0x40bff6
lea eax, [ebp - 0x10]
call fcn.004093e8
jmp case.0x40bf2d.0
push ebp
mov al, 0xd3
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c010
lea eax, [ebp - 0x10]
call fcn.004094e4
jmp case.0x40bf2d.0
push ebp
mov al, 0xd4
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c02a
lea eax, [ebp - 0x10]
call fcn.00409554
jmp case.0x40bf2d.0
push ebp
mov al, 0xcd
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c044
lea eax, [ebp - 0x10]
call fcn.004095f4
jmp case.0x40bf2d.0
push ebp
mov al, 0xce
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c05e
lea eax, [ebp - 0x10]
call fcn.004095a4
jmp case.0x40bf2d.0
push ebp
mov al, 0x6a
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c07b
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00409d64
jmp case.0x40bf2d.0
push ebp
mov al, 0x6b
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c094
push 0
call sub.KERNEL32.DLL_ExitProcess
jmp case.0x40bf2d.0
push ebp
mov al, 0x6c
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c0ab
call fcn.0040aa30
jmp case.0x40bf2d.0
push ebp
mov al, 0x78
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c0d1
mov eax, dword [ebp - 8]
call fcn.0040b250
lea edx, [ebp - 0x10]
mov ax, 0x17
call fcn.00404cb0
jmp case.0x40bf2d.0
push ebp
mov al, 0x79
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c0f0
mov edx, 0xc
mov eax, dword [ebp - 8]
call fcn.0040b364
jmp case.0x40bf2d.0
push ebp
mov al, 0x7a
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c10f
mov edx, 6
mov eax, dword [ebp - 8]
call fcn.0040b364
jmp case.0x40bf2d.0
push ebp
mov al, 0x7b
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c12c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040b520
jmp case.0x40bf2d.0
push ebp
mov al, 0x25
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c176
lea edx, [ebp - 0x4c]
mov ax, 0x8e
call fcn.00404cb0
push dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
push dword [eax + 0x18]
push 0x40cd8c
push dword [ebp - 0xc]
lea eax, [ebp - 0x48]
mov edx, 4
call fcn.00402924
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00409f2c
jmp case.0x40bf2d.0
push ebp
mov al, 0x7c
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c210
mov eax, dword [0x41291c]
mov eax, dword [eax]
call fcn.00409240
mov word [0x413e7c], ax
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x409128]
call fcn.00402e9c
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 9
mov eax, dword [0x41297c]
push eax
push 0
push 0
push 0x409dac
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x413e7c]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
jmp case.0x40bf2d.0
push ebp
mov al, 0x7d
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c344
mov dl, 1
mov eax, dword [0x404254]
call fcn.004042d8
mov edi, eax
mov eax, dword [0x412930]
mov edx, 0x67e
call fcn.00404d2c
movzx eax, ax
mov ecx, 3
xor edx, edx
div ecx
mov esi, eax
test si, si
jbe 0x40c333
mov bx, 1
mov edx, 0x80000002
mov eax, edi
call fcn.00404338
lea edx, [ebp - 0x50]
mov ax, 0x2e
call fcn.00404cb0
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x54]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
add ax, 2
call fcn.00404ce0
mov edx, dword [ebp - 0x54]
pop eax
call fcn.0040286c
mov edx, dword [ebp - 0x50]
xor ecx, ecx
mov eax, edi
call fcn.00404364
test al, al
je 0x40c329
lea edx, [ebp - 0x58]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
add ax, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x58]
mov eax, edi
call fcn.0040479c
test al, al
je 0x40c322
lea edx, [ebp - 0x60]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
inc eax
call fcn.00404ce0
push dword [ebp - 0x60]
push 0x40cd9c
lea edx, [ebp - 0x68]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
add ax, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x68]
lea ecx, [ebp - 0x64]
mov eax, edi
call fcn.00404668
push dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00402924
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00409f9c
push 0x5dc
call sub.KERNEL32.DLL_Sleep
mov eax, edi
call fcn.00404318
inc ebx
dec si
jne 0x40c259
lea edx, [ebp - 0x10]
mov ax, 0x17
call fcn.00404cb0
jmp case.0x40bf2d.0
push ebp
mov al, 0x7e
call fcn.0040bdcc
pop ecx
test al, al
je case.0x40bf2d.0
mov eax, dword [ebp - 8]
call fcn.0040bc44
jmp case.0x40bf2d.0
push ebp
mov al, 0xcc
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c38f
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov eax, dword [ebp - 0x6c]
call fcn.0040a8f0
jmp 0x40c456
push ebp
mov al, 0x7f
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c456
mov eax, dword [ebp - 8]
add eax, 0x1c
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x24]
call fcn.00402618
lea ecx, [ebp - 0x70]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 8]
add eax, 0x20
call fcn.00402618
mov eax, dword [0x41291c]
mov eax, dword [eax]
call fcn.00409240
mov word [0x413e7c], ax
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x409128]
call fcn.00402e9c
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 0xa
mov eax, dword [0x41297c]
push eax
push 0
push 0
push 0x40a06c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x413e7c]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
push ebp
mov al, 0x80
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c4a4
push 0
lea ecx, [ebp - 0x74]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [0x4128cc]
mov eax, dword [eax]
call eax
test eax, eax
je 0x40c497
lea edx, [ebp - 0x10]
mov ax, 0x17
call fcn.00404cb0
jmp 0x40c4a4
lea eax, [ebp - 0x10]
mov edx, 0x40cda8
call fcn.0040265c
push ebp
mov al, 0x81
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c4d4
lea ecx, [ebp - 0x78]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x10]
call fcn.00406f4c
jmp case.0x40bf2d.0
push ebp
mov al, 0x82
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c507
lea ecx, [ebp - 0x7c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov edx, dword [ebp - 0x7c]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040b434
jmp case.0x40bf2d.0
push ebp
mov al, 0x84
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c55d
lea ecx, [ebp - 0x80]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov eax, dword [ebp - 0x80]
call fcn.00402a5c
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
je 0x40c54b
lea eax, [ebp - 0x10]
mov edx, 0x40cdc4
call fcn.0040265c
jmp case.0x40bf2d.0
lea eax, [ebp - 0x10]
mov edx, 0x40cde0
call fcn.0040265c
jmp case.0x40bf2d.0
push ebp
mov al, 0x85
call fcn.0040bdcc
pop ecx
test al, al
je case.0x40bf2d.0
mov eax, dword [0x41291c]
mov eax, dword [eax]
call fcn.00409240
mov word [0x413e7c], ax
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x409128]
call fcn.00402e9c
lea ecx, [ebp - 0x84]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov edx, dword [ebp - 0x84]
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
lea eax, [ecx + eax - 0x14]
call fcn.00402618
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 0xc
mov eax, dword [0x41297c]
push eax
push 0
push 0
push 0x40a80c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x413e7c]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
jmp case.0x40bf2d.0
push ebp
mov al, 0x86
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c68d
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x88]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 2
call fcn.00403bc0
mov eax, dword [ebp - 0x88]
push eax
lea ecx, [ebp - 0x8c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 8]
pop ecx
call fcn.0040b064
jmp case.0x40bf2d.0
push ebp
mov al, 0x83
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c6c6
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov edx, dword [ebp - 0x90]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040b290
jmp case.0x40bf2d.0
push ebp
mov al, 0x87
call fcn.0040bdcc
pop ecx
test al, al
je 0x40c769
lea ecx, [ebp - 0x194]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 2
call fcn.00403bc0
mov edx, dword [ebp - 0x194]
lea eax, [ebp - 0x190]
mov ecx, 0xff
call fcn.00402840
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x298]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov edx, dword [ebp - 0x298]
lea eax, [ebp - 0x294]
mov ecx, 0xff
call fcn.00402840
lea eax, [ebp - 0x294]
pop edx
call fcn.00403e6c
test al, al
je 0x40c757
lea edx, [ebp - 0x10]
mov ax, 0x17
call fcn.00404cb0
jmp case.0x40bf2d.0
lea eax, [ebp - 0x10]
mov edx, 0x40cdf8
call fcn.0040265c
jmp case.0x40bf2d.0
push ebp
mov al, 0x88
call fcn.0040bdcc
pop ecx
test al, al
je case.0x40bf2d.0
lea edx, [ebp - 0x29c]
mov ax, 2
call fcn.004098a0
lea ecx, [ebp - 0x2a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov edx, dword [ebp - 0x2a0]
mov eax, dword [0x4128d0]
call fcn.00402618
lea ecx, [ebp - 0x2a4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 2
call fcn.00403bc0
mov edx, dword [ebp - 0x2a4]
mov eax, dword [0x4129c0]
call fcn.00402618
mov eax, dword [0x4129c0]
mov eax, dword [eax]
call fcn.00402864
mov edx, dword [0x4129c0]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
jne 0x40c809
mov eax, dword [0x4129c0]
mov eax, dword [eax]
call fcn.00402864
mov edx, eax
dec edx
mov eax, dword [0x4129c0]
call fcn.00402be4
mov eax, dword [0x4129c0]
cmp dword [eax], 0
jne 0x40c822
mov eax, dword [0x4129c0]
mov edx, 0x40ce10
call fcn.00402618
mov eax, dword [0x41291c]
mov eax, dword [eax]
call fcn.00409240
mov word [0x413e7c], ax
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 2
mov eax, dword [0x41297c]
push eax
push 0
push 0
push 0x40b4e0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x413e7c]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
lea edx, [ebp - 0x2a8]
mov ax, 0x8d
call fcn.00404cb0
push dword [ebp - 0x2a8]
lea edx, [ebp - 0x2ac]
xor eax, eax
call fcn.0040496c
push dword [ebp - 0x2ac]
push 0x40ce1c
mov eax, dword [0x4128d0]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00402924
mov eax, dword [ebp - 8]
add eax, 0xc
mov edx, dword [ebp - 0x10]
call fcn.00402618
jmp case.0x40bf2d.0
push ebp
mov al, 0xb7
call fcn.0040bdcc
pop ecx
test al, al
je case.0x40bf2d.0
mov eax, dword [0x41291c]
mov eax, dword [eax]
call fcn.00409240
mov word [0x413e7c], ax
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 1
lea ecx, [ebp - 0x2b4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov eax, dword [ebp - 0x2b4]
call fcn.00403d78
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040df64
lea edx, [ebp - 0x2b0]
call fcn.00403d50
mov edx, dword [ebp - 0x2b0]
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
lea eax, [ecx + eax - 0x14]
call fcn.00402618
lea ecx, [ebp - 0x2b8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 2
call fcn.00403bc0
mov edx, dword [ebp - 0x2b8]
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
lea eax, [ecx + eax - 0x10]
call fcn.00402618
lea ecx, [ebp - 0x2bc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 3
call fcn.00403bc0
mov edx, dword [ebp - 0x2bc]
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
lea eax, [ecx + eax - 0xc]
call fcn.00402618
mov eax, dword [0x41297c]
push eax
push 0
push 0
push 0x40de74
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x413e7c]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
jmp case.0x40bf2d.0
push ebp
mov al, 0x89
call fcn.0040bdcc
pop ecx
test al, al
je case.0x40bf2d.0
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 8]
call fcn.00409d64
lea ecx, [ebp - 0x2c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 4
call fcn.00403bc0
mov eax, dword [ebp - 0x2c4]
call fcn.00403d78
mov esi, eax
test si, si
jbe case.0x40bf2d.0
mov bx, 1
cmp bx, 2
ja 0x40caf1
mov eax, dword [0x41291c]
mov eax, dword [eax]
call fcn.00409240
mov word [0x413e7c], ax
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x409128]
call fcn.00402e9c
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 8
mov eax, dword [0x41297c]
push eax
push 0
push 0
push 0x40bc84
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x413e7c]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
inc ebx
dec si
jne 0x40ca63
push ebp
mov al, 0xda
call fcn.0040bdcc
pop ecx
test al, al
je 0x40cb42
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040265c
mov edx, dword [ebp - 4]
mov eax, 0x40ce28
call fcn.00402b9c
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.00402af8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040e13c
lea eax, [ebp - 0x10]
call fcn.004025c4
push ebp
mov al, 0x8a
call fcn.0040bdcc
pop ecx
test al, al
je 0x40cb91
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040265c
mov bx, 1
cmp bx, 2
ja 0x40cb85
movzx eax, bx
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4 + 0x458]
mov ecx, dword [eax + 0x454]
movzx edx, bx
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00409f2c
inc ebx
cmp bx, 3
jne 0x40cb5e
jmp 0x40cd03
push ebp
mov al, 0xc3
call fcn.0040bdcc
pop ecx
test al, al
je 0x40cc65
lea edx, [ebp - 0x2c8]
mov ax, 4
call fcn.004098a0
mov dl, 1
mov eax, dword [0x40e2d4]
call fcn.0040e344
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x48], ebx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x90], eax
lea eax, [ebx + 0x8c]
mov edx, dword [ebp - 4]
call fcn.00402618
mov eax, dword [0x41291c]
mov eax, dword [eax]
call fcn.00409240
mov word [0x413e7c], ax
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x409128]
call fcn.00402e9c
movzx eax, word [0x413e7c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x41291c]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 4
mov eax, dword [0x41297c]
push eax
push 0
push 0
push 0x40bda8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x413e7c]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x41291c]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
jmp 0x40cd03
push ebp
mov al, 0xc2
call fcn.0040bdcc
pop ecx
test al, al
je 0x40cc83
lea edx, [ebp - 0x10]
mov ax, 4
call fcn.004098a0
jmp 0x40cd03
push ebp
mov al, 0x8b
call fcn.0040bdcc
pop ecx
test al, al
je 0x40cca6
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x454]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00409f2c
jmp 0x40cd03
push ebp
mov al, 0x8c
call fcn.0040bdcc
pop ecx
test al, al
je 0x40cd03
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x454]
push eax
mov eax, dword [0x412990]
mov eax, dword [eax]
call eax
lea ecx, [ebp - 0x2cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403bc0
mov eax, dword [ebp - 0x2cc]
call fcn.00403d78
mov ebx, eax
test bx, bx
jne 0x40ccf2
mov bx, 0x1e
movzx eax, bx
imul eax, eax, 0x3e8
push eax
call sub.KERNEL32.DLL_Sleep
jmp 0x40cd17
cmp dword [ebp - 0x10], 0
je 0x40cd17
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00409f9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd7a
lea eax, [ebp - 0x2cc]
mov edx, 0xe
call fcn.004025e8
lea eax, [ebp - 0x194]
call fcn.004025c4
lea eax, [ebp - 0x90]
mov edx, 0x13
call fcn.004025e8
lea eax, [ebp - 0x41]
mov edx, dword [0x409128]
call fcn.00402d78
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004025e8
lea eax, [ebp - 4]
call fcn.004025c4
ret