Function at 0x4110b0
Capabilities:
Create process on windows

Disassembly:
enter 0xfe0, 1
push ebx
push ecx
push edx
mov dword [ebp - 8], esp
movzx eax, byte [0x4d8cf7]
cmp ax, 0x54
jne 0x4110e1
push 0x4c2d14
push 8
push 9
push 0x49
push 0x10
push 0x4e
push 0
push 0
call fcn.0040cba0
jmp 0x4110ff
cmp ax, 0x45
jne 0x4110ff
push 0x4c2d28
push 8
push 9
push 0x49
push 0x10
push 0x4e
push 0
push 0
call fcn.0040cba0
mov eax, dword [0x4d91ad]
mov dword [ebp - 0x4b4], eax
push 1
push 9
push 0xd
push dword [0x4c2d39]
push 3
push 0x4c2d3d
call fcn.0041f962
movzx eax, byte [0x4d8cf7]
cmp ax, 0x54
jne 0x41122f
push 1
push 8
push 9
sub esp, 8
mov esi, 0x4c2d3e
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4c2d44
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x5b4]
call fcn.00401b30
mov esi, 0x4c2d4a
call fcn.00401af0
mov eax, edi
push eax
push 0x4c2d58
push 0x11
mov eax, dword [ebp - 0x4b4]
call fcn.0041f502
push 2
push 0xc
push 9
sub esp, 8
mov esi, 0x4c2d5e
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4c2d64
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x5b4]
call fcn.00401b30
mov esi, 0x4c2d6a
call fcn.00401af0
mov eax, edi
push eax
push 0x4c2d79
push 0x13
mov eax, dword [ebp - 0x4b4]
call fcn.0041f502
push 1
push 0x2f
push 0xb
push 0x4c2d7d
push 0
push 0
mov eax, dword [ebp - 0x4b4]
call fcn.0041f282
push 0xa
push 0xb
push 0x4c2d99
call fcn.004086e0
push 0xa
push 0xc
push 0x4c2db0
call fcn.004086e0
mov byte [ebp - 0x2a8], 0x21
push 0xb
push 0xe
push 0x4c2dc7
call fcn.004086e0
push 0xb
push 0xf
push 0x4c2dd1
call fcn.004086e0
jmp 0x411330
cmp ax, 0x45
jne 0x411330
push 1
push 8
push 9
sub esp, 8
mov esi, 0x4c2ddb
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4c2de1
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x5b4]
call fcn.00401b30
mov esi, 0x4c2de7
call fcn.00401af0
mov eax, edi
push eax
push 0x4c2df5
push 0x11
mov eax, dword [ebp - 0x4b4]
call fcn.0041f502
push 2
push 0xc
push 9
sub esp, 8
mov esi, 0x4c2dfb
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4c2e01
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x5b4]
call fcn.00401b30
mov esi, 0x4c2e07
call fcn.00401af0
mov eax, edi
push eax
push 0x4c2e16
push 0x13
mov eax, dword [ebp - 0x4b4]
call fcn.0041f502
push 1
push 0x33
push 0xb
push 0x4c2e1b
push 0
push 0
mov eax, dword [ebp - 0x4b4]
call fcn.0041f282
push 0xa
push 0xb
push 0x4c2e33
call fcn.004086e0
push 0xb
push 0xc
push 0x4c2e47
call fcn.004086e0
mov byte [ebp - 0x2a8], 0x1e
push 0xe
push 0xe
push 0x4c2e5a
call fcn.004086e0
push 0xb
push 0xf
push 0x4c2e61
call fcn.004086e0
mov eax, dword [ebp - 0x4b4]
call fcn.0041c112
push 1
mov al, byte [ebp - 0x2a8]
push eax
push 0xb
push 5
push 1
call fcn.0041f130
push 2
mov al, byte [ebp - 0x2a8]
push eax
push 0xc
push 5
push 1
call fcn.0041f130
push 3
push 0x15
push 0xf
push 0x23
push 1
call fcn.0041f130
mov eax, dword [ebp - 0x4b4]
call fcn.0040b572
push 0x15
push 0xe
push 0x32
call fcn.00408810
mov eax, dword [ebp - 0x4b4]
call fcn.00409192
mov dword [ebp - 0x280], 1
mov eax, dword [0x4d886d]
mov dword [ebp - 0x284], eax
movzx eax, byte [ebp - 0x2a8]
push eax
push 0xb
fild dword [ebp - 0x280]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
movzx eax, byte [ebp - 0x2a8]
push eax
push 0xc
fild dword [ebp - 0x284]
sub esp, 8
fstp qword [esp]
wait
push 5
push 0
call fcn.0041f0e0
lea eax, [ebp - 0x10]
push eax
push 0x80
call fcn.004039f0
push dword [ebp - 0x10]
push 0
call fcn.0041f0c0
lea eax, [ebp - 0x5b4]
push eax
push 0x4d8b09
call fcn.00419650
lea esi, [ebp - 0x5b4]
mov edi, 0x4c2e6b
call fcn.004147b0
test al, al
je 0x4114a0
lea eax, [ebp - 0x6b4]
push eax
push 0x4d8b09
call fcn.00419650
lea eax, [ebp - 0x6b4]
push eax
call fcn.0041f040
call fcn.0041a530
test eax, eax
je 0x411483
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x7b4]
push eax
push dword [ebp - 0x10]
call fcn.004039a0
lea eax, [ebp - 0x7b4]
push eax
push 0x32
call fcn.0041a7a0
mov edi, 0x4d8b09
lea esi, [ebp - 0x6b4]
push 0x7f
call fcn.00401950
jmp 0x41149e
lea eax, [ebp - 0x6b4]
push eax
push dword [ebp - 0x10]
call fcn.004039a0
lea eax, [ebp - 0x6b4]
push eax
call fcn.0041f040
jmp 0x4114d6
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x7b4]
push eax
push dword [ebp - 0x10]
call fcn.004039a0
lea eax, [ebp - 0x7b4]
push eax
push 0x32
call fcn.0041a7a0
mov edi, 0x4d8b09
lea esi, [ebp - 0x6b4]
push 0x7f
call fcn.00401950
lea eax, [ebp - 0x10]
push eax
push 0x80
call fcn.004031c0
mov al, byte [0x4d8b09]
mov byte [ebp - 0x294], al
cmp byte [ebp - 0x294], 0
jbe 0x411511
movzx eax, byte [ebp - 0x294]
cmp byte [eax + 0x4d8b09], 0x20
jne 0x411511
dec byte [ebp - 0x294]
jmp 0x4114ef
cmp byte [ebp - 0x294], 0
jbe 0x41153c
movzx eax, byte [ebp - 0x294]
cmp byte [eax + 0x4d8b09], 0x5c
jne 0x41153c
movzx eax, al
mov byte [eax + 0x4d8b09], 0x20
dec byte [ebp - 0x294]
cmp byte [ebp - 0x294], 0x32
ja 0x41156a
push 0x15
push 0xe
lea eax, [ebp - 0x6b4]
push eax
push 0x4d8b09
push 0x32
call fcn.0041a7a0
lea eax, [ebp - 0x6b4]
push eax
call fcn.00404240
jmp 0x4115e2
push 0x15
push 0xe
lea eax, [ebp - 0x8b4]
push eax
push 0x4d8b09
push 1
push 0x1e
call fcn.00401cd0
lea esi, [ebp - 0x8b4]
lea edi, [ebp - 0x7b4]
call fcn.00401b30
mov esi, 0x4c2e6c
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x6b4]
call fcn.00401b30
lea eax, [ebp - 0x9b4]
push eax
push 0x4d8b09
movzx eax, byte [ebp - 0x294]
sub eax, 0x11
push eax
push 0x12
call fcn.00401cd0
lea esi, [ebp - 0x9b4]
lea edi, [ebp - 0x6b4]
call fcn.00401af0
mov eax, edi
push eax
call fcn.00404240
mov word [ebp - 0x18], 1
mov eax, dword [0x4d91ad]
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x280], 0
jle 0x4116d9
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x280], eax
jg 0x4116d9
lea eax, [ebp - 0x6b8]
push eax
lea eax, [ebp - 0x7b8]
push eax
push 0x15
push 0xe
push 0x32
call fcn.0041a470
lea eax, [ebp - 0x7b8]
push eax
call fcn.00419650
lea esi, [ebp - 0x6b8]
mov edi, 0x4c2e6f
call fcn.004147b0
test al, al
je 0x4116d9
lea eax, [ebp - 0x8b8]
push eax
push 0x23
call fcn.0041a720
lea eax, [ebp - 0x9b8]
push eax
push 0x15
push 0xf
push 0x23
call fcn.0041a470
lea esi, [ebp - 0x9b8]
lea edi, [ebp - 0x8b8]
call fcn.004147b0
test al, al
je 0x4116d9
push 0x4c2e70
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0xbb8]
push eax
lea eax, [ebp - 0xcb8]
push eax
push 0x15
push 0xf
push 0x23
call fcn.0041a470
lea eax, [ebp - 0xcb8]
push eax
call fcn.00419650
lea eax, [ebp - 0xbb8]
push eax
call fcn.0041a8a0
lea eax, [ebp - 0xab8]
push eax
call fcn.0040cb40
cmp eax, 1
jbe 0x4116d9
mov eax, 1
jmp 0x4116de
mov eax, 0
mov byte [ebp - 0x274], al
push 1
push eax
mov eax, dword [ebp - 0x5b8]
call fcn.0041ec52
push 2
cmp word [ebp - 0x18], 3
sete al
push eax
mov eax, dword [ebp - 0x5b8]
call fcn.0041ec52
mov byte [ebp - 0x274], 1
movsx eax, word [ebp - 0x18]
cmp eax, 2
je 0x411721
cmp eax, 1
jne 0x411741
movzx eax, byte [ebp - 0x2a8]
push eax
movsx eax, word [ebp - 0x18]
mov ebx, 0xa
add ebx, eax
push ebx
push 5
call fcn.0041d1e0
mov byte [ebp - 0xc], al
jmp 0x411758
cmp eax, 3
jne 0x411758
push 0x15
push 0xf
push 0x23
push 1
call fcn.0041aee0
mov byte [ebp - 0xc], al
cmp byte [ebp - 0xc], 0x2b
je 0x411d9d
movsx eax, word [ebp - 0x18]
cmp eax, 1
jne 0x4117b9
lea ebx, [ebp - 0x6b8]
push ebx
mov al, byte [ebp - 0x2a8]
push eax
push 0xb
push 5
call fcn.0041a470
lea eax, [ebp - 0x6b8]
push eax
call fcn.0041ae80
mov dword [ebp - 0x280], eax
test eax, eax
jle 0x4117a9
cmp dword [ebp - 0x284], eax
jl 0x4117a9
mov ebx, 1
jmp 0x4117ae
mov ebx, 0
mov byte [ebp - 0x274], bl
jmp 0x411907
cmp eax, 2
jne 0x411816
lea ebx, [ebp - 0x6b8]
push ebx
mov al, byte [ebp - 0x2a8]
push eax
push 0xc
push 5
call fcn.0041a470
lea eax, [ebp - 0x6b8]
push eax
call fcn.0041ae80
mov dword [ebp - 0x284], eax
cmp dword [0x4d886d], eax
jl 0x411806
mov ebx, dword [ebp - 0x280]
cmp dword [ebp - 0x284], ebx
jl 0x411806
mov eax, 1
jmp 0x41180b
mov eax, 0
mov byte [ebp - 0x274], al
jmp 0x411907
cmp eax, 3
jne 0x411907
lea ebx, [ebp - 0x6b8]
push ebx
push 0x23
call fcn.0041a720
lea eax, [ebp - 0x7b8]
push eax
push 0x15
push 0xf
push 0x23
call fcn.0041a470
lea esi, [ebp - 0x7b8]
lea edi, [ebp - 0x6b8]
call fcn.004147b0
mov byte [ebp - 0x274], al
test al, al
je 0x411907
lea ebx, [ebp - 0x6b8]
push ebx
lea eax, [ebp - 0x7b8]
push eax
push 0x15
push 0xf
push 0x23
call fcn.0041a470
lea eax, [ebp - 0x7b8]
push eax
call fcn.00419650
lea edi, [ebp - 0x268]
lea esi, [ebp - 0x6b8]
call fcn.00401940
push 0x4c2e75
mov eax, esi
push eax
mov ebx, edi
push ebx
call fcn.0041a8a0
lea eax, [ebp - 0x6b8]
push eax
call fcn.0040cb40
test eax, eax
ja 0x4118e2
lea esi, [ebp - 0x268]
lea edi, [ebp - 0x7b8]
call fcn.00401b30
mov esi, 0x4c2e7a
call fcn.00401af0
lea edi, [ebp - 0x268]
lea esi, [ebp - 0x7b8]
call fcn.00401940
push 0x15
push 0xf
lea eax, [ebp - 0x7b8]
push eax
lea ebx, [ebp - 0x268]
push ebx
push 0x23
call fcn.0041a7a0
lea eax, [ebp - 0x7b8]
push eax
call fcn.00404240
mov al, byte [ebp - 0xc]
cmp al, 0x11
jne 0x411ae0
cmp dword [ebp - 0x280], 0
jle 0x4119f8
mov ebx, dword [ebp - 0x284]
cmp dword [ebp - 0x280], ebx
jg 0x4119f8
lea eax, [ebp - 0x7b8]
push eax
lea eax, [ebp - 0x8b8]
push eax
push 0x15
push 0xe
push 0x32
call fcn.0041a470
lea eax, [ebp - 0x8b8]
push eax
call fcn.00419650
lea esi, [ebp - 0x7b8]
mov edi, 0x4c2e7f
call fcn.004147b0
test al, al
je 0x4119f8
lea eax, [ebp - 0x9b8]
push eax
push 0x23
call fcn.0041a720
lea ebx, [ebp - 0xab8]
push ebx
push 0x15
push 0xf
push 0x23
call fcn.0041a470
lea esi, [ebp - 0xab8]
lea edi, [ebp - 0x9b8]
call fcn.004147b0
test al, al
je 0x4119f8
push 0x4c2e80
lea eax, [ebp - 0xbb8]
push eax
lea ebx, [ebp - 0xcb8]
push ebx
lea eax, [ebp - 0xdb8]
push eax
push 0x15
push 0xf
push 0x23
call fcn.0041a470
lea eax, [ebp - 0xdb8]
push eax
call fcn.00419650
lea ebx, [ebp - 0xcb8]
push ebx
call fcn.0041a8a0
lea eax, [ebp - 0xbb8]
push eax
call fcn.0040cb40
cmp eax, 1
jbe 0x4119f8
mov eax, 1
jmp 0x4119fd
mov eax, 0
mov byte [ebp - 0x274], al
test al, al
je 0x411adb
push 0x4d8328
lea ebx, [ebp - 0x9b8]
push ebx
push 0x4d8b09
call fcn.00419650
lea esi, [ebp - 0x9b8]
lea edi, [ebp - 0x8b8]
call fcn.00401b30
mov esi, 0x4c2e85
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x7b8]
call fcn.00401b30
lea eax, [ebp - 0xab8]
push eax
lea ebx, [ebp - 0xbb8]
push ebx
push 0x15
push 0xf
push 0x23
call fcn.0041a470
lea eax, [ebp - 0xbb8]
push eax
call fcn.00419650
lea esi, [ebp - 0xab8]
lea edi, [ebp - 0x7b8]
call fcn.00401af0
mov eax, edi
push eax
call fcn.00401e60
push 0x4d8328
call fcn.00401210
call fcn.0041a530
test eax, eax
sete al
mov byte [ebp - 0x274], al
test al, al
jne 0x411adb
movzx ebx, byte [0x4d8cf7]
mov ax, bx
cmp ax, 0x54
jne 0x411ac6
push 0x4c2e87
push 0x4c2e99
call fcn.004135d0
jmp 0x411adb
cmp ax, 0x45
jne 0x411adb
push 0x4c2e9a
push 0x4c2eb2
call fcn.004135d0
jmp 0x411d9d
cmp al, 0x13
jne 0x411d8f
cmp word [ebp - 0x18], 3
jne 0x411d8d
cmp byte [0x4d8cf7], 0x54
jne 0x411b4f
lea ebx, [ebp - 0x7b8]
push ebx
push 1
push 1
push 0x4c2eb3
lea eax, [ebp - 0x8b8]
push eax
push 0x4d8b09
call fcn.00419650
lea eax, [ebp - 0x8b8]
push eax
push 0x4c2ec1
push 0
lea ebx, [ebp - 0x294]
push ebx
push 0x4c2ec2
call fcn.0041aa00
lea edi, [ebp - 0x268]
lea esi, [ebp - 0x7b8]
call fcn.00401940
jmp 0x411ba0
lea ebx, [ebp - 0x7b8]
push ebx
push 1
push 1
push 0x4c2ed9
lea eax, [ebp - 0x8b8]
push eax
push 0x4d8b09
call fcn.00419650
lea eax, [ebp - 0x8b8]
push eax
push 0x4c2ee4
push 0
lea ebx, [ebp - 0x294]
push ebx
push 0x4c2ee5
call fcn.0041aa00
lea edi, [ebp - 0x268]
lea esi, [ebp - 0x7b8]
call fcn.00401940
cmp byte [ebp - 0x294], 0
jbe 0x411d0a
lea eax, [ebp - 0x7b8]
push eax
lea ebx, [ebp - 0x268]
push ebx
push 1
movzx eax, byte [ebp - 0x294]
dec eax
push eax
call fcn.00401cd0
lea esi, [ebp - 0x7b8]
mov edi, 0x4d8fad
call fcn.004147b0
test al, al
je 0x411d0a
lea eax, [ebp - 0x8b8]
push eax
lea ebx, [ebp - 0x268]
push ebx
push 1
movzx eax, byte [ebp - 0x294]
dec eax
push eax
call fcn.00401cd0
mov edi, 0x4d8b09
lea esi, [ebp - 0x8b8]
push 0x7f
call fcn.00401950
cmp byte [ebp - 0x294], 1
jbe 0x411c3b
push 0x15
push 0xe
mov eax, esi
push eax
push edi
push 0x32
call fcn.0041a7a0
lea ebx, [ebp - 0x8b8]
push ebx
call fcn.00404240
jmp 0x411c55
push 0x15
push 0xe
mov eax, esi
push eax
push 0x32
call fcn.0041a720
lea ebx, [ebp - 0x8b8]
push ebx
call fcn.00404240
lea eax, [ebp - 0x8b8]
push eax
lea ebx, [ebp - 0x268]
push ebx
movzx eax, byte [ebp - 0x294]
inc eax
push eax
movzx eax, byte [ebp - 0x294]
movzx ebx, byte [ebp - 0x268]
sub ebx, eax
push ebx
call fcn.00401cd0
lea edi, [ebp - 0x268]
lea esi, [ebp - 0x8b8]
call fcn.00401940
push 0x4c2efc
mov eax, esi
push eax
mov ebx, edi
push ebx
call fcn.0041a8a0
lea eax, [ebp - 0x8b8]
push eax
call fcn.0040cb40
test eax, eax
ja 0x411ce0
lea esi, [ebp - 0x268]
lea edi, [ebp - 0x9b8]
call fcn.00401b30
mov esi, 0x4c2f01
call fcn.00401af0
lea edi, [ebp - 0x268]
lea esi, [ebp - 0x9b8]
call fcn.00401940
push 0x15
push 0xf
lea eax, [ebp - 0x9b8]
push eax
lea ebx, [ebp - 0x268]
push ebx
push 0x23
call fcn.0041a7a0
lea eax, [ebp - 0x9b8]
push eax
call fcn.00404240
jmp 0x411d8d
lea eax, [ebp - 0x9b8]
push eax
lea ebx, [ebp - 0x268]
push ebx
push 1
movzx eax, byte [ebp - 0x294]
dec eax
push eax
call fcn.00401cd0
lea esi, [ebp - 0x9b8]
mov edi, 0x4d8fad
call fcn.00414a20
test al, al
je 0x411d4c
push 0x4c2f06
push 0x4c2f21
call fcn.004135d0
push 0x15
push 0xe
lea eax, [ebp - 0xab8]
push eax
push 0x4d8b09
push 0x32
call fcn.0041a7a0
lea ebx, [ebp - 0xab8]
push ebx
call fcn.00404240
push 0x15
push 0xf
lea eax, [ebp - 0xab8]
push eax
push 0x32
call fcn.0041a720
lea ebx, [ebp - 0xab8]
push ebx
call fcn.00404240
jmp 0x411d9d
lea ebx, [ebp - 0x18]
push ebx
push eax
push 1
push 3
call fcn.0041a550
mov al, byte [ebp - 0x274]
test al, al
je 0x4115e8
mov esi, 0x4c2f22
movzx eax, byte [ebp - 0xc]
push 0x1f0010
call fcn.0040148e
test al, al
je 0x4115e8
cmp byte [ebp - 0xc], 0x2b
je 0x4135c2
push 0x4d8328
call fcn.00401d90
call fcn.0041a4f0
lea eax, [ebp - 0xcb8]
push eax
push 0x4d8b09
call fcn.00419650
lea esi, [ebp - 0xcb8]
lea edi, [ebp - 0xbb8]
call fcn.00401b30
mov esi, 0x4c2f26
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0xab8]
call fcn.00401b30
lea eax, [ebp - 0xdb8]
push eax
lea ebx, [ebp - 0xeb8]
push ebx
push 0x15
push 0xf
push 0x23
call fcn.0041a470
lea eax, [ebp - 0xeb8]
push eax
call fcn.00419650
lea esi, [ebp - 0xdb8]
lea edi, [ebp - 0xab8]
call fcn.00401af0
lea edi, [ebp - 0x268]
lea esi, [ebp - 0xab8]
call fcn.00401940
call fcn.0041a440
cmp dword [ebp + 0x14], 0
je 0x411e79
lea eax, [ebp - 0x268]
push eax
call dword [ebp + 0x14]
jmp 0x413525
push 0x2e7
call fcn.004039d0
mov dword [0x4dde0b], eax
call fcn.0041a272
lea ebx, [ebp - 0xab8]
push ebx
lea eax, [ebp - 0xbb8]
push eax
lea eax, [ebp - 0xcb8]
push eax
push dword [ebp + 0x10]
call fcn.004039a0
lea eax, [ebp - 0xcb8]
push eax
call fcn.00419650
lea ebx, [ebp - 0xbb8]
push ebx
push 1
push 0x1f
call fcn.00401cd0
lea edi, [ebp - 0x168]
lea esi, [ebp - 0xab8]
call fcn.00401940
movzx eax, byte [ebp - 0x168]
test eax, eax
jbe 0x411f19
mov byte [ebp - 0x9bc], al
mov byte [ebp - 0x288], 0
inc byte [ebp - 0x288]
movzx eax, byte [ebp - 0x288]
cmp byte [ebp + eax - 0x168], 0x2f
jne 0x411f11
movzx ebx, al
mov byte [ebp + ebx - 0x168], 0x2d
dec byte [ebp - 0x9bc]
jne 0x411eef
lea eax, [ebp - 0x168]
push eax
mov eax, dword [0x4dde0b]
call fcn.0041a152
mov dword [ebp - 0x26c], eax
mov edi, dword [0x4dde0b]
mov eax, dword [ebp - 0x26c]
mov dword [edi + 0x1f], eax
mov byte [ebp - 0x9c0], 0x40
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x28c]
mov byte [ebp + eax - 0x5d], 0
dec byte [ebp - 0x9c0]
jne 0x411f4d
cmp dword [0x4d8a85], 0
jne 0x41200a
push 0x2280
call fcn.004039d0
mov dword [0x4d8a85], eax
mov byte [ebp - 0x270], 1
mov byte [ebp - 0x9c4], 3
mov byte [ebp - 0x288], 0
inc byte [ebp - 0x288]
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
test ebx, ebx
jbe 0x412000
mov byte [ebp - 0x9c8], bl
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx eax, byte [ebp - 0x288]
imul eax, eax, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
lea edi, [esi + ebx]
mov esi, 0x4c2f28
push 0x2d
call fcn.00401950
dec byte [ebp - 0x9c8]
jne 0x411fbc
dec byte [ebp - 0x9c4]
jne 0x411f98
jmp 0x412011
mov byte [ebp - 0x270], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x9cc], eax
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
test ebx, ebx
jbe 0x41207e
mov byte [ebp - 0x9d0], bl
mov byte [ebp - 0x288], 0
inc byte [ebp - 0x288]
movzx eax, byte [ebp - 0x288]
dec eax
push eax
movzx eax, byte [ebp - 0x288]
dec eax
push eax
movzx eax, byte [ebp - 0x288]
movzx ebx, byte [eax + 0x4d887d]
inc ebx
push ebx
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.0041a0c2
dec byte [ebp - 0x9d0]
jne 0x41203b
mov byte [ebp - 0x2ac], 0x20
mov byte [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x27c], eax
mov eax, 0
mov dword [ebp - 0x278], eax
mov byte [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
push eax
mov eax, 0x4d886d
call fcn.0041a082
movzx ebx, byte [0x4d8cfd]
mov ax, bx
cmp ax, 0x20
je 0x4120e3
cmp ax, 0x54
je 0x4120e3
cmp ax, 0x53
jne 0x4128f8
mov byte [ebp - 0x28c], 2
inc dword [ebp - 0x278]
cmp byte [0x4d8cfd], 0x54
jne 0x412417
inc byte [ebp - 0x2a4]
mov byte [ebp - 0x288], 0
inc byte [ebp - 0x288]
movzx eax, byte [ebp - 0x288]
mov bl, byte [eax + 0x4d887d]
mov byte [ebp - 0x2a0], bl
cmp byte [ebp - 0x2a4], 1
jne 0x412176
movzx eax, byte [ebp - 0x288]
movzx ebx, byte [ebp - 0x2a0]
movzx ecx, byte [ebp - 0x28c]
add ecx, ebx
mov cl, byte [ecx + 0x4d8d06]
mov byte [ebp + eax - 0x5d], cl
movzx eax, byte [ebp - 0x288]
movzx ebx, byte [ebp + eax - 0x5d]
mov esi, 0x4c2f29
mov eax, ebx
push 0x2f00b0
call fcn.0040148e
test al, al
jne 0x412176
inc byte [ebp - 0x2a0]
lea eax, [ebp - 0xad0]
push eax
lea ebx, [ebp - 0xbd0]
push ebx
push 0x4d8d06
movzx ecx, byte [ebp - 0x28c]
push ecx
movzx eax, byte [ebp - 0x2a0]
push eax
call fcn.00401cd0
lea eax, [ebp - 0xbd0]
push eax
call fcn.00419ee0
mov edi, 0x4de03f
lea esi, [ebp - 0xad0]
call fcn.00401940
mov esi, edi
mov edi, 0x4c2f2f
call fcn.004147b0
test al, al
je 0x4122a5
mov byte [ebp - 0x290], 0
inc byte [ebp - 0x290]
mov al, byte [ebp - 0x290]
cmp byte [0x4de03f], al
jbe 0x412209
movzx ebx, al
movzx ecx, byte [ebx + 0x4de03f]
mov esi, 0x4c2f30
mov eax, ecx
push 0x2f00b0
call fcn.0040148e
test al, al
je 0x4121d5
movzx eax, byte [ebp - 0x290]
movzx ebx, byte [eax + 0x4de03f]
mov esi, 0x4c2f36
mov eax, ebx
push 0x2f00b0
call fcn.0040148e
test al, al
je 0x412265
movzx eax, byte [ebp - 0x288]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x2a4]
imul eax, ecx, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
lea edi, [esi + ebx]
mov esi, 0x4c2f3c
push 0x2d
call fcn.00401950
jmp 0x4122a5
mov al, byte [ebp - 0x270]
test al, al
je 0x4122a5
movzx ebx, byte [ebp - 0x288]
imul ecx, ebx, 0x2e
movzx eax, byte [ebp - 0x2a4]
imul eax, eax, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
lea edi, [esi + ecx]
mov esi, 0x4de03f
push 0x2d
call fcn.00401950
mov esi, 0x4de03f
mov edi, 0x4c2f3e
call fcn.004147b0
test al, al
je 0x412373
movzx eax, byte [ebp - 0x288]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x2a4]
imul eax, ecx, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
lea esi, [esi + ebx]
mov edi, 0x4c2f3f
call fcn.004147b0
test al, al
je 0x412373
lea eax, [ebp - 0x10]
push eax
movzx ebx, byte [0x4de03f]
inc ebx
push ebx
call fcn.004039f0
push dword [ebp - 0x10]
push 0x4de03f
call fcn.00401a00
mov eax, dword [ebp - 0x278]
dec eax
push eax
movzx eax, byte [ebp - 0x288]
dec eax
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x9cc]
call fcn.00418f32
mov dword [ebp - 0x14], eax
lea ebx, [ebp - 0x10]
push ebx
movzx eax, byte [0x4de03f]
inc eax
push eax
call fcn.004031c0
push dword [ebp - 0x14]
push 0
push 0
push 0
push 2
mov al, byte [0x4c2f41]
push eax
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x4123a7
push 0
mov eax, dword [ebp - 0x278]
dec eax
push eax
movzx eax, byte [ebp - 0x288]
dec eax
push eax
push 0
push 2
mov al, byte [0x4c2f42]
push eax
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
movzx eax, byte [ebp - 0x288]
movzx ebx, byte [eax + 0x4d887d]
inc ebx
add byte [ebp - 0x28c], bl
mov eax, 0x4d886d
call fcn.00418412
cmp al, byte [ebp - 0x288]
ja 0x41210a
movzx eax, byte [ebp - 0x2ac]
test eax, eax
jl 0x4123e5
cmp dword [ebp - 0x278], eax
jge 0x4123f3
mov al, byte [ebp - 0x278]
mov byte [ebp - 0x2ac], al
movzx eax, byte [ebp - 0x2b0]
test eax, eax
jl 0x412404
cmp dword [ebp - 0x278], eax
jle 0x412412
mov al, byte [ebp - 0x278]
mov byte [ebp - 0x2b0], al
jmp 0x4128f3
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
test ebx, ebx
jbe 0x4128f3
mov byte [ebp - 0x9d4], bl
mov byte [ebp - 0x288], 0
inc byte [ebp - 0x288]
lea eax, [ebp - 0xad4]
push eax
push 0x4d8d06
movzx ebx, byte [ebp - 0x28c]
push ebx
movzx ecx, byte [ebp - 0x288]
movzx eax, byte [ecx + 0x4d887d]
push eax
call fcn.00401cd0
mov edi, 0x4de03f
lea esi, [ebp - 0xad4]
call fcn.00401940
movzx eax, byte [ebp - 0x288]
cmp byte [eax + 0x4d88b9], 0
jne 0x4125fc
movzx ebx, al
cmp byte [ebx + 0x4d88b9], 4
je 0x4125e9
cmp byte [0x4de03f], 0xa
jae 0x4124c0
cmp byte [0x4de042], 0x2f
jne 0x4124c0
mov esi, edi
mov edi, 0x4c2f43
call fcn.004147b0
test al, al
jne 0x412513
cmp byte [0x4de03f], 0xa
jne 0x412527
cmp byte [0x4de042], 0x2f
jne 0x412527
cmp byte [0x4de045], 0x2f
jne 0x412527
lea eax, [ebp - 0xad4]
push eax
lea ebx, [ebp - 0xae0]
push ebx
push 0x4de03f
call fcn.0041a010
lea ecx, [ebp - 0xae0]
push ecx
call fcn.00419ee0
lea esi, [ebp - 0xad4]
mov edi, 0x4c2f49
call fcn.004147b0
test al, al
je 0x412527
movzx eax, byte [ebp - 0x288]
mov byte [eax + 0x4d88b9], 2
jmp 0x4125e9
lea eax, [ebp - 0xbe0]
push eax
push 0x4de03f
call fcn.00419ee0
lea esi, [ebp - 0xbe0]
mov edi, 0x4c2f4a
call fcn.004147b0
test al, al
je 0x4125af
push 0x4de03f
call fcn.00419cc0
test al, al
je 0x41256b
movzx eax, byte [ebp - 0x288]
mov byte [eax + 0x4d88b9], 3
jmp 0x4125ad
movzx eax, byte [ebp - 0x288]
mov esi, 0x4c2f4b
movzx eax, byte [eax + 0x4d88b9]
push 0x70000
call fcn.0040148e
test al, al
jne 0x41259e
movzx eax, byte [ebp - 0x288]
mov byte [eax + 0x4d88b9], 4
jmp 0x4125ad
movzx eax, byte [ebp - 0x288]
mov byte [eax + 0x4d88b9], 1
jmp 0x4125e9
movzx eax, byte [ebp - 0x288]
mov esi, 0x4c2f4c
movzx eax, byte [eax + 0x4d88b9]
push 0x70000
call fcn.0040148e
test al, al
jne 0x4125e9
cmp byte [0x4d8cfd], 0x20
jne 0x4125e9
movzx eax, byte [ebp - 0x288]
mov byte [eax + 0x4d88b9], 4
movzx eax, byte [ebp - 0x288]
mov bl, byte [eax + 0x4d88b9]
mov byte [ebp - 0x1c], bl
jmp 0x412609
movzx ebx, al
mov cl, byte [ebx + 0x4d88b9]
mov byte [ebp - 0x1c], cl
mov al, byte [ebp - 0x1c]
cmp al, 3
jne 0x4126b4
mov ebx, dword [ebp - 0x278]
dec ebx
push ebx
movzx ebx, byte [ebp - 0x288]
dec ebx
push ebx
push 0x4de03f
call fcn.0040c140
sub esp, 8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x9cc]
call fcn.004196f2
mov dword [ebp - 0x14], eax
push 0x4c2f4d
push 0x4de03f
call fcn.0040cb40
mov byte [ebp - 0x294], al
cmp al, 0
jbe 0x412688
push dword [ebp - 0x14]
push 0
push 0
push 0
push 3
mov bl, byte [0x4c2f4f]
push ebx
push 1
push 2
push 0x13
push 0
push 4
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x4126af
push dword [ebp - 0x14]
push 0
push 0
push 0
push 3
mov bl, byte [0x4c2f50]
push ebx
push 1
push 2
push 0x13
push 0
push 3
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x4128d0
cmp al, 2
jne 0x4127ec
cmp byte [0x4de042], 0x2f
jne 0x41272e
lea ebx, [ebp - 0xce0]
push ebx
push 0x4de03f
push 1
push 5
call fcn.00401cd0
lea esi, [ebp - 0xce0]
mov edi, 0x4c2f51
call fcn.004147b0
test al, al
je 0x41272e
mov eax, dword [ebp - 0x278]
dec eax
push eax
movzx eax, byte [ebp - 0x288]
dec eax
push eax
push 0x4de03f
call fcn.00419740
mov dword [ebp - 0xce4], eax
fild dword [ebp - 0xce4]
sub esp, 8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x9cc]
call fcn.004196f2
mov dword [ebp - 0x14], eax
jmp 0x412781
mov edi, 0x4de03f
mov esi, 0x4c2f57
call fcn.00401940
lea eax, [ebp - 0x10]
push eax
movzx ebx, byte [0x4de03f]
inc ebx
push ebx
call fcn.004039f0
push dword [ebp - 0x10]
push 0x4de03f
call fcn.00401a00
mov eax, dword [ebp - 0x278]
dec eax
push eax
movzx eax, byte [ebp - 0x288]
dec eax
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x9cc]
call fcn.00418f32
mov dword [ebp - 0x14], eax
cmp byte [0x4de03f], 0xa
jae 0x4127be
cmp byte [0x4de042], 0x2f
jne 0x4127be
push dword [ebp - 0x14]
push 0
push 0
push 0
push 2
mov al, byte [0x4c2f58]
push eax
push 1
push 2
push 0x13
push 0
push 0xa5
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x4127e7
push dword [ebp - 0x14]
push 0
push 0
push 0
push 2
mov al, byte [0x4c2f59]
push eax
push 1
push 2
push 0x13
push 0
push 0xa4
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x4128d0
lea ebx, [ebp - 0xde0]
push ebx
push 0x4de03f
call fcn.00419650
mov edi, 0x4de03f
lea esi, [ebp - 0xde0]
call fcn.00401940
mov esi, edi
mov edi, 0x4c2f5a
call fcn.004147b0
test al, al
je 0x41289c
lea eax, [ebp - 0x10]
push eax
movzx ebx, byte [0x4de03f]
inc ebx
push ebx
call fcn.004039f0
push dword [ebp - 0x10]
push 0x4de03f
call fcn.00401a00
mov eax, dword [ebp - 0x278]
dec eax
push eax
movzx eax, byte [ebp - 0x288]
dec eax
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x9cc]
call fcn.00418f32
mov dword [ebp - 0x14], eax
lea ebx, [ebp - 0x10]
push ebx
movzx eax, byte [0x4de03f]
inc eax
push eax
call fcn.004031c0
push dword [ebp - 0x14]
push 0
push 0
push 0
push 1
mov al, byte [0x4c2f5b]
push eax
push 0
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x4128d0
push 0
mov eax, dword [ebp - 0x278]
dec eax
push eax
movzx eax, byte [ebp - 0x288]
dec eax
push eax
push 0
push 1
mov al, byte [0x4c2f5c]
push eax
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
movzx eax, byte [ebp - 0x288]
movzx ebx, byte [eax + 0x4d887d]
inc ebx
add byte [ebp - 0x28c], bl
dec byte [ebp - 0x9d4]
jne 0x412439
jmp 0x412d23
cmp ax, 0x43
jne 0x412b10
inc dword [ebp - 0x278]
lea eax, [ebp - 0xde0]
push eax
lea ebx, [ebp - 0xee0]
push ebx
lea ecx, [ebp - 0xfe0]
push ecx
push 0x4d8d06
movzx eax, byte [0x4d89fe]
inc eax
push eax
movzx eax, byte [0x4d89fe]
movzx ebx, byte [0x4d89fd]
sub ebx, eax
dec ebx
push ebx
call fcn.00401cd0
lea ebx, [ebp - 0xfe0]
push ebx
call fcn.00419650
lea eax, [ebp - 0xee0]
push eax
call fcn.004195d0
mov edi, 0x4de03f
lea esi, [ebp - 0xde0]
call fcn.00401940
mov esi, edi
mov edi, 0x4c2f5d
call fcn.004147b0
test al, al
je 0x4129f3
lea eax, [ebp - 0x10]
push eax
movzx ebx, byte [0x4de03f]
inc ebx
push ebx
call fcn.004039f0
push dword [ebp - 0x10]
push 0x4de03f
call fcn.00401a00
mov eax, dword [ebp - 0x278]
dec eax
push eax
push 0
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x9cc]
call fcn.00418f32
mov dword [ebp - 0x14], eax
lea ebx, [ebp - 0x10]
push ebx
movzx eax, byte [0x4de03f]
inc eax
push eax
call fcn.004031c0
push dword [ebp - 0x14]
push 0
push 0
push 0
push 2
mov al, byte [0x4c2f5e]
push eax
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x412a1f
push 0
mov eax, dword [ebp - 0x278]
dec eax
push eax
push 0
push 0
push 2
mov al, byte [0x4c2f5f]
push eax
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
dec ebx
movzx eax, bl
test eax, eax
jbe 0x412adc
mov byte [ebp - 0xce4], al
mov byte [ebp - 0x288], 0
inc byte [ebp - 0x288]
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
dec ebx
movzx eax, byte [ebp - 0x288]
test eax, eax
jl 0x412a68
cmp ebx, eax
jle 0x412a9e
push 0
mov eax, dword [ebp - 0x278]
dec eax
push eax
mov al, byte [ebp - 0x288]
push eax
push 0
push 2
mov bl, byte [0x4c2f60]
push ebx
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x412ad0
push 0
mov eax, dword [ebp - 0x278]
dec eax
push eax
mov al, byte [ebp - 0x288]
push eax
push 0
push 2
mov bl, byte [0x4c2f61]
push ebx
push 1
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
dec byte [ebp - 0xce4]
jne 0x412a46
mov eax, dword [ebp - 0x278]
dec eax
push eax
mov eax, dword [ebp - 0x278]
dec eax
push eax
push 0
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
dec ebx
push ebx
mov eax, dword [ebp - 0x9cc]
call fcn.00418432
jmp 0x412d23
cmp ax, 0x45
jne 0x412d23
inc dword [ebp - 0x278]
lea eax, [ebp - 0xde4]
push eax
lea ebx, [ebp - 0xee4]
push ebx
lea ecx, [ebp - 0xfe4]
push ecx
push 0x4d8d06
movzx eax, byte [0x4d89fe]
inc eax
push eax
movzx eax, byte [0x4d89fe]
movzx ebx, byte [0x4d89fd]
sub ebx, eax
dec ebx
push ebx
call fcn.00401cd0
lea ebx, [ebp - 0xfe4]
push ebx
call fcn.00419650
lea eax, [ebp - 0xee4]
push eax
call fcn.004195d0
mov edi, 0x4de03f
lea esi, [ebp - 0xde4]
call fcn.00401940
mov esi, edi
mov edi, 0x4c2f62
call fcn.004147b0
test al, al
je 0x412c0b
lea eax, [ebp - 0x10]
push eax
movzx ebx, byte [0x4de03f]
inc ebx
push ebx
call fcn.004039f0
push dword [ebp - 0x10]
push 0x4de03f
call fcn.00401a00
mov eax, dword [ebp - 0x278]
dec eax
push eax
push 0
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x9cc]
call fcn.00418f32
mov dword [ebp - 0x14], eax
lea ebx, [ebp - 0x10]
push ebx
movzx eax, byte [0x4de03f]
inc eax
push eax
call fcn.004031c0
push dword [ebp - 0x14]
push 0
push 0
push 0
push 5
mov al, byte [0x4c2f63]
push eax
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x412c37
push 0
mov eax, dword [ebp - 0x278]
dec eax
push eax
push 0
push 0
push 5
mov al, byte [0x4c2f64]
push eax
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
dec ebx
movzx eax, bl
test eax, eax
jbe 0x412cf4
mov byte [ebp - 0xce8], al
mov byte [ebp - 0x288], 0
inc byte [ebp - 0x288]
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
dec ebx
movzx eax, byte [ebp - 0x288]
test eax, eax
jl 0x412c80
cmp ebx, eax
jle 0x412cb6
push 0
mov eax, dword [ebp - 0x278]
dec eax
push eax
mov al, byte [ebp - 0x288]
push eax
push 0
push 5
mov bl, byte [0x4c2f65]
push ebx
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
jmp 0x412ce8
push 0
mov eax, dword [ebp - 0x278]
dec eax
push eax
mov al, byte [ebp - 0x288]
push eax
push 0
push 5
mov bl, byte [0x4c2f66]
push ebx
push 1
push 2
push 0x13
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
dec byte [ebp - 0xce8]
jne 0x412c5e
mov eax, dword [ebp - 0x278]
dec eax
push eax
mov eax, dword [ebp - 0x278]
dec eax
push eax
push 0
mov eax, 0x4d886d
call fcn.00418412
movzx ebx, al
dec ebx
push ebx
mov eax, dword [ebp - 0x9cc]
call fcn.00418432
movsx eax, word [ebp + 0xc]
cmp eax, dword [ebp - 0x27c]
jne 0x412d4e
mov edi, dword [ebp - 0x9cc]
mov bx, word [ebp + 8]
mov word [edi + 0x27], bx
mov eax, dword [ebp - 0x9cc]
mov bx, word [ebp - 0x278]
mov word [eax + 0x25], bx
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x284], eax
jg 0x4120aa
cmp byte [ebp - 0x2a4], 0
jbe 0x4134e0
mov dword [ebp - 0x278], 1
push 0
mov eax, 0x4d886d
call fcn.00418412
push eax
push 1
push 1
push 0x4c2f67
lea edi, [ebp - 0xd08]
call fcn.00401403
lea esi, [ebp - 0xd08]
lea edi, [ebp - 0xd14]
push 0x90000
call fcn.004013e0
lea esi, [ebp - 0xd14]
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x2a4], 3
jne 0x4132c9
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
mov edi, dword [0x4d8a85]
lea esi, [edi + ebx + 0xb52]
mov edi, 0x4c2f87
call fcn.00414a20
test al, al
jne 0x412e0e
mov eax, 0x4d886d
call fcn.00418412
cmp al, byte [ebp - 0x28c]
ja 0x412dce
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
mov edi, dword [0x4d8a85]
lea esi, [edi + ebx + 0xb52]
mov edi, 0x4c2f89
call fcn.00414a20
test al, al
je 0x4132c9
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
mov byte [ebp - 0x288], 0
mov edi, 0x4de03f
mov esi, 0x4c2f8b
call fcn.00401940
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
mov ecx, dword [0x4d8a85]
lea esi, [ecx + ebx + 0xb52]
mov edi, 0x4c2f8c
call fcn.00414a20
test al, al
je 0x4130ae
mov al, byte [ebp - 0x28c]
mov byte [ebp - 0x294], al
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
mov edi, dword [0x4d8a85]
lea esi, [edi + ebx - 0x2e]
mov edi, 0x4c2f8e
call fcn.004147b0
test al, al
je 0x412edb
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
mov esi, dword [0x4d8a85]
mov edi, 0x4de03f
lea esi, [esi + ebx - 0x2e]
call fcn.00401940
inc byte [ebp - 0x294]
movzx eax, byte [ebp - 0x294]
imul ebx, eax, 0x2e
mov edi, dword [0x4d8a85]
lea esi, [edi + ebx + 0xb52]
mov edi, 0x4c2f8f
call fcn.00414a20
test al, al
je 0x412f8f
movzx eax, byte [ebp - 0x294]
movzx ebx, byte [ebp + eax - 0x5d]
mov esi, 0x4c2f91
mov eax, ebx
push 0x2f00b0
call fcn.0040148e
test al, al
jne 0x412f8f
movzx eax, byte [ebp - 0x294]
imul ebx, eax, 0x2e
mov edi, dword [0x4d8a85]
lea esi, [edi + ebx - 0x2e]
mov edi, 0x4c2f97
call fcn.004147b0
test al, al
je 0x412f8f
mov esi, 0x4de03f
lea edi, [ebp - 0xde8]
call fcn.00401b30
movzx eax, byte [ebp - 0x294]
imul ebx, eax, 0x2e
mov ecx, dword [0x4d8a85]
lea esi, [ecx + ebx - 0x2e]
call fcn.00401af0
mov edi, 0x4de03f
lea esi, [ebp - 0xde8]
call fcn.00401940
movzx eax, byte [ebp - 0x294]
imul ebx, eax, 0x2e
mov edi, dword [0x4d8a85]
lea esi, [edi + ebx + 0xb52]
mov edi, 0x4c2f98
call fcn.004147b0
test al, al
jne 0x412fee
movzx eax, byte [ebp - 0x294]
movzx ebx, byte [ebp + eax - 0x5d]
mov esi, 0x4c2f9a
mov eax, ebx
push 0x2f00b0
call fcn.0040148e
test al, al
jne 0x412fee
mov eax, 0x4d886d
call fcn.00418412
cmp al, byte [ebp - 0x294]
ja 0x412edb
lea eax, [ebp - 0x10]
push eax
movzx ebx, byte [0x4de03f]
inc ebx
push ebx
call fcn.004039f0
push dword [ebp - 0x10]
push 0x4de03f
call fcn.00401a00
movzx eax, byte [ebp - 0x2ac]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x9cc]
call fcn.00418f32
mov dword [ebp - 0x14], eax
lea ebx, [ebp - 0x10]
push ebx
movzx eax, byte [0x4de03f]
inc eax
push eax
call fcn.004031c0
push dword [ebp - 0x14]
push 0
push 0
push 0
push 2
mov al, byte [0x4c2fa0]
push eax
push 0
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
movzx ebx, byte [ebp - 0x2ac]
dec ebx
push ebx
movzx eax, byte [ebp - 0x2ac]
push eax
movzx ebx, byte [ebp - 0x28c]
dec ebx
push ebx
movzx ebx, byte [ebp - 0x294]
dec ebx
push ebx
mov eax, dword [ebp - 0x9cc]
call fcn.00418432
mov bl, byte [ebp - 0x294]
mov byte [ebp - 0x28c], bl
jmp 0x4132a9
inc byte [ebp - 0x288]
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x288]
imul eax, ecx, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
lea esi, [esi + ebx]
mov edi, 0x4c2fa1
call fcn.004147b0
test al, al
je 0x413198
mov esi, 0x4de03f
mov edi, 0x4c2fa2
call fcn.004147b0
test al, al
je 0x413168
lea edi, [ebp - 0xee8]
call fcn.00401b30
mov esi, 0x4c2fa3
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0xde8]
call fcn.00401b30
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx eax, cl
imul eax, eax, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
lea esi, [esi + ebx]
lea edi, [ebp - 0xde8]
call fcn.00401af0
mov edi, 0x4de03f
lea esi, [ebp - 0xde8]
call fcn.00401940
jmp 0x413198
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx eax, cl
imul eax, eax, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
mov edi, 0x4de03f
lea esi, [esi + ebx]
call fcn.00401940
cmp byte [ebp - 0x288], 3
jb 0x4130ae
lea eax, [ebp - 0x10]
push eax
movzx ebx, byte [0x4de03f]
inc ebx
push ebx
call fcn.004039f0
push dword [ebp - 0x10]
push 0x4de03f
call fcn.00401a00
movzx eax, byte [ebp - 0x2ac]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x9cc]
call fcn.00418f32
mov dword [ebp - 0x14], eax
lea ebx, [ebp - 0x10]
push ebx
movzx eax, byte [0x4de03f]
inc eax
push eax
call fcn.004031c0
push dword [ebp - 0x14]
push 0
push 0
push 0
push 2
mov al, byte [0x4c2fa5]
push eax
push 0
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
movzx ebx, byte [ebp - 0x2ac]
dec ebx
push ebx
movzx eax, byte [ebp - 0x2ac]
inc eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
mov eax, dword [ebp - 0x9cc]
call fcn.00418432
mov al, byte [ebp - 0x28c]
push eax
push 1
push 0
push 0x4c2fa6
lea edi, [ebp - 0xd28]
call fcn.00401403
lea ebx, [ebp - 0xd28]
push ebx
lea esi, [ebp - 0x68]
lea edi, [ebp - 0xd08]
push 0x200a0920
call fcn.00401509
mov esi, edi
lea edi, [ebp - 0xd34]
push 0x90000
call fcn.004013e0
lea esi, [ebp - 0xd34]
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, 0x4d886d
call fcn.00418412
cmp al, byte [ebp - 0x28c]
ja 0x412e41
mov dword [ebp - 0x278], 3
mov byte [ebp - 0x28c], 0
inc byte [ebp - 0x28c]
movzx eax, byte [ebp - 0x28c]
lea esi, [ebp - 0x68]
push 0x3f0101
call fcn.0040148e
test al, al
je 0x4134ca
mov eax, dword [ebp - 0x278]
dec eax
mov byte [ebp - 0x288], al
mov edi, 0x4de03f
mov esi, 0x4c2fc6
call fcn.00401940
inc byte [ebp - 0x288]
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx ecx, byte [ebp - 0x288]
imul eax, ecx, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
lea esi, [esi + ebx]
mov edi, 0x4c2fc7
call fcn.004147b0
test al, al
je 0x4133f9
mov esi, 0x4de03f
mov edi, 0x4c2fc8
call fcn.004147b0
test al, al
je 0x4133c9
lea edi, [ebp - 0xee8]
call fcn.00401b30
mov esi, 0x4c2fc9
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0xde8]
call fcn.00401b30
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx eax, cl
imul eax, eax, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
lea esi, [esi + ebx]
lea edi, [ebp - 0xde8]
call fcn.00401af0
mov edi, 0x4de03f
lea esi, [ebp - 0xde8]
call fcn.00401940
jmp 0x4133f9
movzx eax, byte [ebp - 0x28c]
imul ebx, eax, 0x2e
movzx eax, cl
imul eax, eax, 0xb80
mov edi, dword [0x4d8a85]
lea esi, [edi + eax - 0xbae]
mov edi, 0x4de03f
lea esi, [esi + ebx]
call fcn.00401940
mov al, byte [ebp - 0x288]
cmp byte [ebp - 0x2a4], al
ja 0x41330f
lea ebx, [ebp - 0x10]
push ebx
movzx ecx, byte [0x4de03f]
inc ecx
push ecx
call fcn.004039f0
push dword [ebp - 0x10]
push 0x4de03f
call fcn.00401a00
movzx eax, byte [ebp - 0x2ac]
add eax, dword [ebp - 0x278]
sub eax, 2
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x9cc]
call fcn.00418f32
mov dword [ebp - 0x14], eax
lea ebx, [ebp - 0x10]
push ebx
movzx eax, byte [0x4de03f]
inc eax
push eax
call fcn.004031c0
push dword [ebp - 0x14]
push 0
push 0
push 0
push 2
mov al, byte [0x4c2fcb]
push eax
push 0
push 0
push 0x10
push 0
push 0
mov eax, dword [ebp - 0x9cc]
call fcn.004184c2
movzx ebx, byte [ebp - 0x2ac]
add ebx, dword [ebp - 0x278]
sub ebx, 2
push ebx
movzx eax, byte [ebp - 0x2b0]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
movzx eax, byte [ebp - 0x28c]
dec eax
push eax
mov eax, dword [ebp - 0x9cc]
call fcn.00418432
mov eax, 0x4d886d
call fcn.00418412
cmp al, byte [ebp - 0x28c]
ja 0x4132d0
lea eax, [ebp - 0x268]
push eax
mov eax, dword [0x4dde0b]
call fcn.00415662
mov bl, byte [ebp - 0x270]
test bl, bl
je 0x413510
push dword [0x4d8a85]
call fcn.004031b0
mov eax, 0
mov dword [0x4d8a85], eax
mov eax, dword [0x4dde0b]
call fcn.004154c2
push dword [0x4dde0b]
call fcn.004031b0
call fcn.00415490
push 1
mov eax, dword [0x4d91ad]
call fcn.00415402
test al, al
je 0x4135c2
lea eax, [ebp - 0x10]
push eax
movzx ebx, byte [ebp - 0x268]
mov ecx, 0xd
add ecx, ebx
add ecx, 2
push ecx
call fcn.004039f0
push dword [ebp - 0x10]
mov esi, 0x4c2fcc
lea edi, [ebp - 0xde8]
call fcn.00401b30
lea esi, [ebp - 0x268]
call fcn.00401af0
mov eax, edi
push eax
call fcn.00401a00
push 0
push dword [ebp - 0x10]
call sub.kernel32.dll_WinExec
mov dword [ebp - 0x278], eax
lea ebx, [ebp - 0x10]
push ebx
movzx eax, byte [ebp - 0x268]
mov ecx, 0xd
add ecx, eax
add ecx, 2
push ecx
call fcn.004031c0
cmp dword [ebp - 0x278], 0x1f
jg 0x4135c2
push 0x4c2fda
push 0x4c2fed
call fcn.004135d0
call fcn.00402d80
pop edx
pop ecx
pop ebx
leave
ret 0x10