Function at 0x4083c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43784f
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x440374]
xor eax, ebp
mov dword [ebp - 0x38], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x3fc]
call fcn.0040de80
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x400], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], 0
mov eax, dword [0x469fb0]
and eax, 1
jne 0x408487
mov ecx, dword [0x469fb0]
or ecx, 1
mov dword [0x469fb0], ecx
mov byte [ebp - 4], 1
call fcn.004037d0
mov dword [0x469fa8], eax
mov dword [0x469fac], edx
mov byte [ebp - 4], 0
mov dword [ebp - 0x414], 0
mov byte [ebp - 0x25], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x40c], 2
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov eax, dword [0x456a28]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414870
add esp, 4
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jne 0x4084f9
mov dword [ebp - 0x18], 2
jmp 0x4090bf
mov ecx, dword [0x456a28]
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.0040abf0
add esp, 8
push 4
lea ecx, [ebp - 0x3fc]
call fcn.0040bdd0
push 0x407cf0
lea ecx, [ebp - 0x3fc]
call fcn.0040bdb0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x468f40
call fcn.0040aa50
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
je 0x40854f
jmp 0x4090bf
push 0x441cd4
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x3fc]
call fcn.0040fba0
cmp dword [0x441cd4], 0
jne 0x40857a
mov dword [ebp - 0x18], 0x22
jmp 0x4090bf
lea ecx, [ebp - 0x34]
push ecx
call fcn.0040ac40
add esp, 4
mov edx, dword [0x4561d4]
and edx, 0x100
je 0x4085af
lea eax, [ebp - 0x1c]
push eax
push 0x468f40
call fcn.0040b1b0
add esp, 8
mov dword [ebp - 0x40c], 3
push 0x442948
call fcn.00407180
add esp, 4
mov ecx, dword [0x4561d4]
or ecx, 0x10
mov dword [0x4561d4], ecx
mov edx, dword [ebp - 0x1c]
mov dword [0x4561e0], edx
call fcn.00408040
mov dword [ebp - 0x414], 0
jmp 0x4085f4
mov eax, dword [ebp - 0x414]
add eax, 1
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
cmp ecx, dword [0x456a28]
jge 0x408804
call fcn.00403440
movzx edx, al
test edx, edx
je 0x408617
jmp 0x408804
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040bb30
add esp, 8
cmp dword [ebp - 0x14], 0
jne 0x40863c
mov dword [ebp - 0x18], 2
jmp 0x408804
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
lea ecx, [eax + edx*4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x468f40
call fcn.0040aa50
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
je 0x40866b
jmp 0x408804
call fcn.00403790
movzx eax, ax
mov dword [ebp - 0x20], eax
mov cx, word [ebp - 0x20]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx]
push edx
push 0
push 0
mov eax, dword [0x469fac]
push eax
mov ecx, dword [0x469fa8]
push ecx
push 0x2775
call fcn.0040b4a0
add esp, 0x28
mov dx, word [ebp - 0x20]
push edx
call fcn.0040bdf0
add esp, 4
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov dword [edx + 0xc], 1
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov dword [edx + 0x10], 4
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov dword [edx + 0x1c], 0x10000
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x4561e0]
mov dword [edx + 0x20], eax
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x4561e0]
add ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov edx, dword [eax + edx*4]
mov dword [edx + 0x24], ecx
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 0x1c]
push eax
call fcn.00414870
add esp, 4
mov dword [ebp - 0x430], eax
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x430]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
cmp dword [ecx + 8], 0
jne 0x408798
mov dword [ebp - 0x18], 2
jmp 0x408804
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0x1c]
push edx
push 0
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 8]
push eax
call fcn.00415080
add esp, 0xc
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x414]
mov edx, dword [eax + 0x18]
mov dword [ecx*4 + 0x468864], edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
push edx
call fcn.0040a970
add esp, 4
jmp 0x4085e5
call fcn.00403440
movzx eax, al
test eax, eax
je 0x408815
jmp 0x4090bf
push 4
call fcn.004037f0
add esp, 4
cmp dword [0x456a28], 1
jle 0x408985
push 0xffffffffffffffff
push 1
push 0x468864
mov ecx, dword [0x456a28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x414], 0
jmp 0x40885d
mov edx, dword [ebp - 0x414]
add edx, 1
mov dword [ebp - 0x414], edx
mov eax, dword [ebp - 0x414]
cmp eax, dword [0x456a28]
jge 0x40895d
call fcn.00403440
movzx ecx, al
test ecx, ecx
je 0x408880
jmp 0x40895d
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
cmp dword [edx + 0x10], 5
jne 0x4088dc
cmp dword [ebp - 0x18], 1
jne 0x4088dc
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040bb30
add esp, 8
cmp dword [ebp - 0x14], 0
jne 0x4088d5
mov dword [ebp - 0x18], 2
jmp 0x40895d
jmp 0x40895d
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
xor edx, edx
cmp dword [ecx + 0x14], 0x14
sete dl
add edx, 0x2776
mov dword [ebp - 0x420], edx
call fcn.00403790
push eax
mov ax, word [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
push eax
call fcn.004037d0
push edx
push eax
mov ecx, dword [0x469fac]
push ecx
mov edx, dword [0x469fa8]
push edx
mov eax, dword [ebp - 0x420]
push eax
call fcn.0040b4a0
add esp, 0x28
jmp 0x40884e
cmp dword [ebp - 0x18], 1
je 0x408968
jmp 0x4090bf
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x1c]
mov dword [0x4561e0], ecx
jmp 0x4089a7
mov dword [ebp - 0x414], 0
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0x1c]
mov dword [0x468ad4], edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
push eax
call fcn.0040b5a0
add esp, 4
mov dword [ebp - 0x18], eax
call fcn.00403790
push eax
mov cx, word [ebp - 0x20]
push ecx
push 0
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
push eax
mov ecx, dword [0x442874]
push ecx
mov edx, dword [0x442870]
push edx
mov eax, dword [0x469fac]
push eax
mov ecx, dword [0x469fa8]
push ecx
push 0x2778
call fcn.0040b4a0
add esp, 0x28
push 7
call fcn.004037f0
add esp, 4
push 0x10
call fcn.00414870
add esp, 4
mov dword [ebp - 0x434], eax
mov edx, dword [ebp - 0x434]
mov dword [ebp - 0x408], edx
cmp dword [ebp - 0x408], 0
jne 0x408a59
mov dword [ebp - 0x18], 2
jmp 0x4090bf
push 4
lea eax, [ebp - 0x408]
push eax
call fcn.0040abf0
add esp, 8
call fcn.00403790
movzx ecx, ax
mov dword [ebp - 0x20], ecx
call fcn.00403790
push eax
push 0
push 0
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [0x469fac]
push ecx
mov edx, dword [0x469fa8]
push edx
push 0x27d9
call fcn.0040b4a0
add esp, 0x28
mov ax, word [ebp - 0x20]
push eax
call fcn.0040bdf0
add esp, 4
lea ecx, [ebp - 0x3fc]
call fcn.0040ea50
push 4
lea ecx, [ebp - 0x3fc]
call fcn.0040bdd0
push 0x407cf0
lea ecx, [ebp - 0x3fc]
call fcn.0040bdb0
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x468f40
call fcn.0040aa50
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
je 0x408b1b
jmp 0x4090bf
push 0x441cd4
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x3fc]
call fcn.0040fba0
cmp dword [0x441cd4], 0
jne 0x408b46
mov dword [ebp - 0x18], 0x22
jmp 0x4090bf
mov edx, dword [0x441cd4]
mov dword [ebp - 0x2c], edx
mov eax, dword [0x4561d4]
and eax, 0x100
je 0x408ba3
mov ecx, dword [0x441cd4]
sub ecx, dword [0x4561e0]
je 0x408b7d
mov edx, dword [0x441cd4]
sub edx, dword [0x4561e0]
mov dword [ebp - 0x450], edx
jmp 0x408b88
mov eax, dword [0x441cd4]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x2c], ecx
xor edx, edx
cmp dword [ebp - 0x1c], 0
setne dl
add edx, 2
mov dword [ebp - 0x40c], edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x2c]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x2c]
shr ecx, 2
mov dword [ebp - 0x41c], ecx
mov word [ebp - 0x418], 0
mov byte [ebp - 0x25], 0
jmp 0x408be8
mov dx, word [ebp - 0x418]
add dx, 1
mov word [ebp - 0x418], dx
movsx eax, word [ebp - 0x418]
cmp eax, 4
jge 0x408e0f
movzx ecx, byte [ebp - 0x25]
test ecx, ecx
jne 0x408e0f
call fcn.00403440
movzx edx, al
test edx, edx
je 0x408c15
jmp 0x408e0f
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
lea edx, [ecx + eax*4]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x468f40
call fcn.0040aa50
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
je 0x408c45
jmp 0x408e0f
movsx ecx, word [ebp - 0x418]
test ecx, ecx
jne 0x408c7a
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0x24]
add edx, 1
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x20], edx
jmp 0x408ca4
movsx ecx, word [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + ecx*4 - 4]
mov ecx, dword [eax + 0x24]
add ecx, 1
movsx edx, word [ebp - 0x418]
mov eax, dword [ebp - 0x408]
mov edx, dword [eax + edx*4]
mov dword [edx + 0x20], ecx
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x41c]
add eax, dword [edx + 0x20]
cmp eax, dword [ebp - 0x2c]
jb 0x408d0b
movsx ecx, word [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x441cd4]
sub ecx, dword [eax + 0x20]
movsx edx, word [ebp - 0x418]
mov eax, dword [ebp - 0x408]
mov edx, dword [eax + edx*4]
mov dword [edx + 0x1c], ecx
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
mov edx, dword [ecx + eax*4]
mov dword [edx + 0x24], 0
mov byte [ebp - 0x25], 1
jmp 0x408d5d
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x41c]
mov dword [edx + 0x1c], eax
movsx ecx, word [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + ecx*4]
movsx ecx, word [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov ecx, dword [edx + ecx*4]
mov edx, dword [eax + 0x20]
add edx, dword [ecx + 0x1c]
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x24], edx
movsx ecx, word [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
cmp dword [0x456a28], 1
jle 0x408da2
movsx edx, word [ebp - 0x418]
mov eax, dword [ebp - 0x408]
mov ecx, dword [eax + edx*4]
movsx edx, word [ebp - 0x418]
mov eax, dword [ecx + 0x18]
mov dword [edx*4 + 0x468864], eax
jmp 0x408dc3
movsx ecx, word [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + ecx*4]
movsx ecx, word [ebp - 0x418]
mov edx, dword [eax + 0x18]
mov dword [ecx*4 + 0x468868], edx
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
mov edx, dword [ecx + eax*4]
mov dword [edx + 0x10], 7
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
mov edx, dword [ecx + eax*4]
mov dword [edx + 0xc], 1
movsx eax, word [ebp - 0x418]
mov ecx, dword [ebp - 0x408]
mov edx, dword [ecx + eax*4]
push edx
call fcn.0040a970
add esp, 4
jmp 0x408bd6
cmp dword [0x456a28], 1
jle 0x408e27
movsx eax, word [ebp - 0x418]
mov dword [ebp - 0x454], eax
jmp 0x408e37
movsx ecx, word [ebp - 0x418]
add ecx, 1
mov dword [ebp - 0x454], ecx
mov edx, dword [ebp - 0x454]
mov dword [ebp - 0x24], edx
call fcn.00403440
movzx eax, al
test eax, eax
je 0x408e51
jmp 0x4090bf
push 0xffffffffffffffff
push 1
push 0x468864
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.00403440
movzx edx, al
test edx, edx
je 0x408e75
jmp 0x4090bf
mov dword [ebp - 0x1c], 0
mov eax, dword [0x441cd4]
add eax, 1
push eax
call fcn.00414870
add esp, 4
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0x400], ecx
cmp dword [ebp - 0x400], 0
jne 0x408eb4
mov dword [ebp - 0x18], 2
jmp 0x4090bf
mov edx, dword [0x441cd4]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x400]
push eax
call fcn.00415080
add esp, 0xc
mov ecx, dword [ebp - 0x400]
mov dword [ebp - 0x10], ecx
cmp dword [0x456a28], 1
jle 0x408eea
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov word [ebp - 0x418], 0xffff
jmp 0x408f07
mov ax, word [ebp - 0x418]
add ax, 1
mov word [ebp - 0x418], ax
movsx ecx, word [ebp - 0x418]
mov edx, dword [ebp - 0x24]
sub edx, 1
cmp ecx, edx
jge 0x4090b7
call fcn.00403440
movzx eax, al
test eax, eax
je 0x408f2d
jmp 0x4090b7
movsx ecx, word [ebp - 0x418]
test ecx, ecx
jge 0x408f4f
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x404], ecx
jmp 0x408f65
movsx edx, word [ebp - 0x418]
mov eax, dword [ebp - 0x408]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x404], ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x404]
mov ecx, dword [eax + 0x1c]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x404]
mov ecx, dword [eax + 8]
push ecx
call fcn.0040b140
add esp, 0x10
mov edx, dword [ebp - 0x404]
cmp dword [edx + 0x14], 1
je 0x4090b2
mov dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x404]
cmp dword [eax + 0x24], 0
je 0x408fc0
mov ecx, dword [ebp - 0x404]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x424], edx
jmp 0x408fcb
mov eax, dword [0x441cd4]
mov dword [ebp - 0x424], eax
mov ecx, dword [ebp - 0x404]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0x404]
add edx, dword [eax + 0x1c]
cmp edx, dword [ebp - 0x424]
jae 0x4090b2
mov cx, word [0x468ab8]
add cx, 1
mov word [0x468ab8], cx
mov edx, dword [ebp - 0x404]
mov eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x404]
add eax, dword [ecx + 0x1c]
mov edx, dword [ebp - 0x404]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x404]
mov ecx, dword [ebp - 0x424]
sub ecx, dword [eax + 0x20]
mov edx, dword [ebp - 0x404]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 0x404]
mov dword [eax + 0x10], 7
mov ecx, dword [ebp - 0x404]
mov dword [ecx + 0xc], 1
mov edx, dword [ebp - 0x404]
cmp dword [edx + 8], 0
je 0x40907f
mov eax, dword [ebp - 0x404]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x43c], ecx
mov edx, dword [ebp - 0x43c]
push edx
call fcn.00414bfe
add esp, 4
mov eax, dword [ebp - 0x404]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x404]
push ecx
call fcn.0040a970
add esp, 4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x404]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov cx, word [ebp - 0x418]
sub cx, 1
mov word [ebp - 0x418], cx
jmp 0x408ef5
xor edx, edx
jne 0x4084ad
mov eax, dword [ebp - 0x414]
sub eax, dword [0x456a28]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x414]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x400], 0
je 0x409178
cmp dword [ebp - 0x1c], 0
je 0x409178
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
cmp dword [edx + ecx*4], 0
je 0x409178
mov eax, dword [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 4]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.00410160
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
je 0x409138
jmp 0x40932f
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x400]
push edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.0040fe70
add esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
je 0x409161
jmp 0x40932f
cmp dword [ebp - 0x30], 0
je 0x409178
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x30], 0
call fcn.00403440
movzx edx, al
test edx, edx
je 0x409189
jmp 0x40932f
cmp dword [ebp - 0x18], 1
jne 0x40919b
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jae 0x409282
mov cx, word [0x468ab8]
add cx, 1
mov word [0x468ab8], cx
mov dword [ebp - 0x428], 0
cmp dword [ebp - 0x18], 0x22
jne 0x4091ca
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov dword [ebp - 0x428], eax
jmp 0x4091f3
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
cmp dword [edx + ecx*4], 0
je 0x4091f3
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov dword [ebp - 0x428], eax
call fcn.00403790
push eax
mov cx, word [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x428]
push ecx
call fcn.004037d0
push edx
push eax
mov edx, dword [0x469fac]
push edx
mov eax, dword [0x469fa8]
push eax
push 0x27da
call fcn.0040b4a0
add esp, 0x28
mov ecx, dword [0x4561d4]
and ecx, 2
je 0x40923e
jmp 0x40932f
push 9
call fcn.004037f0
add esp, 4
mov edx, dword [0x4561d4]
or edx, 0x100
mov dword [0x4561d4], edx
mov dword [ebp - 0x18], 2
push 0x64
push 0x64
mov eax, dword [0x4428a8]
push eax
call fcn.00409a70
add esp, 0xc
push 2
call fcn.004037f0
add esp, 4
jmp 0x40932f
call fcn.00403790
push eax
mov cx, word [ebp - 0x20]
push ecx
push 0
mov edx, dword [0x441cd4]
push edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push ecx
call fcn.004037d0
push edx
push eax
mov edx, dword [0x469fac]
push edx
mov eax, dword [0x469fa8]
push eax
push 0x27db
call fcn.0040b4a0
add esp, 0x28
mov ecx, dword [0x4561d4]
and ecx, 2
je 0x4092ca
jmp 0x40932f
push 8
call fcn.004037f0
add esp, 4
mov edx, dword [0x4561d4]
and edx, 0x40
je 0x4092f6
push 0
push 0x69
push 0x464
mov eax, dword [0x4561d0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x409327
push 5
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x69
push 0x111
mov edx, dword [0x4561d0]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
jne 0x4084a6
mov dword [ebp - 0x414], 0
jmp 0x40934a
mov ecx, dword [ebp - 0x414]
add ecx, 1
mov dword [ebp - 0x414], ecx
cmp dword [ebp - 0x410], 0
je 0x40937b
mov edx, dword [ebp - 0x414]
cmp edx, dword [0x456a28]
jge 0x40937b
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
lea edx, [ecx + eax*4]
push edx
call fcn.0040ac40
add esp, 4
jmp 0x40933b
mov dword [ebp - 0x414], 0
jmp 0x409396
mov eax, dword [ebp - 0x414]
add eax, 1
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x408], 0
je 0x4093c2
cmp dword [ebp - 0x414], 4
jge 0x4093c2
mov ecx, dword [ebp - 0x414]
mov edx, dword [ebp - 0x408]
lea eax, [edx + ecx*4]
push eax
call fcn.0040ac40
add esp, 4
jmp 0x409387
lea ecx, [ebp - 0x34]
push ecx
call fcn.0040ac40
add esp, 4
cmp dword [ebp - 0x410], 0
je 0x4093fc
mov edx, dword [ebp - 0x410]
mov dword [ebp - 0x440], edx
mov eax, dword [ebp - 0x440]
push eax
call fcn.00414bfe
add esp, 4
mov dword [ebp - 0x410], 0
cmp dword [ebp - 0x408], 0
je 0x40942a
mov ecx, dword [ebp - 0x408]
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x444]
push edx
call fcn.00414bfe
add esp, 4
mov dword [ebp - 0x408], 0
cmp dword [ebp - 0x400], 0
je 0x409458
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
push ecx
call fcn.00414bfe
add esp, 4
mov dword [ebp - 0x400], 0
cmp dword [ebp - 0x30], 0
je 0x40946f
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x30], 0
call fcn.0040bbd0
cmp eax, 8
je 0x409489
call fcn.00403440
movzx eax, al
test eax, eax
je 0x4084a6
cmp dword [0x468890], 0
je 0x40949f
mov ecx, dword [0x468890]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x44c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3fc]
call fcn.0040ec20
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.00415063
mov esp, ebp
pop ebp
ret