Function at 0x410980
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44027c
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x479fcc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x44
push eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x174]
push eax
call fcn.0041b290
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 7
movups xmmword [ebp - 0x70], xmm0
add esp, 0xc
mov word [ebp - 0x70], ax
movups xmmword [ebp - 0x128], xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
push 0x479f4c
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.0040e9f0
push 0
push 0x5c
mov ecx, eax
call fcn.00417860
mov ecx, dword [ebp - 0x8c]
mov esi, eax
cmp ecx, 8
jb 0x410a77
mov edx, dword [ebp - 0xa0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410a6d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41163e
push ecx
push edx
call fcn.004197c3
add esp, 8
xor eax, eax
mov dword [ebp - 0x90], 0
push 0x479f4c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.0040e9f0
cmp esi, 0xffffffff
je 0x410c03
mov ecx, dword [eax + 0x10]
lea edi, [esi + 1]
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
movups xmmword [ebp - 0x88], xmm0
cmp ecx, edi
jb 0x411643
sub ecx, edi
or edx, 0xffffffff
cmp ecx, 0xffffffff
cmovb edx, ecx
cmp dword [eax + 0x14], 8
jb 0x410ae7
mov eax, dword [eax]
lea eax, [eax + edi*2]
push edx
push eax
lea ecx, [ebp - 0x88]
call fcn.004010e0
mov ecx, dword [ebp - 0x5c]
cmp ecx, 8
jb 0x410b31
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410b27
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411648
push ecx
push edx
call fcn.004197c3
add esp, 8
movups xmm0, xmmword [ebp - 0x88]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [ebp - 0x78]
movq qword [ebp - 0x60], xmm0
call fcn.00401370
push 0x479f4c
lea ecx, [ebp - 0x28]
call fcn.0040e9f0
cmp dword [eax + 0x10], esi
xorps xmm0, xmm0
mov byte [ebp - 4], 4
cmovb esi, dword [eax + 0x10]
cmp dword [eax + 0x14], 8
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
jb 0x410b90
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0xa0]
call fcn.004010e0
mov ecx, dword [ebp - 0x2c]
mov eax, 0x60
mov dword [ebp - 0x108], eax
cmp ecx, 8
jb 0x410be2
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410bd8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41164d
push ecx
push edx
call fcn.004197c3
add esp, 8
movups xmm0, xmmword [ebp - 0xa0]
mov byte [ebp - 4], 2
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [ebp - 0x90]
movq qword [ebp - 0x30], xmm0
jmp 0x410d02
mov esi, eax
lea eax, [ebp - 0x70]
cmp eax, esi
je 0x410c78
mov ecx, dword [ebp - 0x5c]
cmp ecx, 8
jb 0x410c46
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410c3c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411652
push ecx
push edx
call fcn.004197c3
add esp, 8
mov dword [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x60], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x28]
call fcn.00401370
push 0x479f34
lea ecx, [ebp - 0x28]
call fcn.0040e9f0
mov esi, eax
lea eax, [ebp - 0x40]
cmp eax, esi
je 0x410d02
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x410cd0
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410cc6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411657
push ecx
push edx
call fcn.004197c3
add esp, 8
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x28]
call fcn.00401370
push 0x479f94
lea ecx, [ebp - 0x28]
call fcn.0040e9f0
mov edi, eax
push 2
xorps xmm0, xmm0
mov byte [ebp - 4], 5
push 0x44b568
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x90], 0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.004010e0
push 0x479f7c
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 6
call fcn.0040e9f0
mov esi, eax
push 1
xorps xmm0, xmm0
mov byte [ebp - 4], 7
push 0x44b570
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], 0
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x74], 0
call fcn.004010e0
push esi
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 8
push eax
push dword [ebp - 0x114]
lea ecx, [ebp - 0xe8]
call fcn.0040eaf0
or dword [ebp - 0x108], 0x10
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x114]
lea ecx, [ebp - 0x100]
call fcn.0040eaf0
or dword [ebp - 0x108], 4
push edi
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0xa
push eax
push dword [ebp - 0x114]
lea ecx, [ebp - 0xb8]
call fcn.0040eaf0
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x44]
or eax, 8
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
cmp ecx, 8
jb 0x410e4b
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410e41
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41165c
push ecx
push edx
call fcn.004197c3
add esp, 8
movups xmm0, xmmword [ebp - 0xb8]
mov ecx, dword [ebp - 0xec]
mov byte [ebp - 4], 9
movups xmmword [ebp - 0x58], xmm0
movq xmm0, qword [ebp - 0xa8]
movq qword [ebp - 0x48], xmm0
cmp ecx, 8
jb 0x410ea7
mov edx, dword [ebp - 0x100]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410e9d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41165c
push ecx
push edx
call fcn.004197c3
add esp, 8
mov ecx, dword [ebp - 0xd4]
mov byte [ebp - 4], 8
cmp ecx, 8
jb 0x410eeb
mov edx, dword [ebp - 0xe8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410ee1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41165c
push ecx
push edx
call fcn.004197c3
add esp, 8
mov ecx, dword [ebp - 0x74]
mov byte [ebp - 4], 7
cmp ecx, 8
jb 0x410f2c
mov edx, dword [ebp - 0x88]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410f22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41165c
push ecx
push edx
call fcn.004197c3
add esp, 8
mov ecx, dword [ebp - 0xbc]
mov byte [ebp - 4], 6
cmp ecx, 8
jb 0x410f70
mov edx, dword [ebp - 0xd0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410f66
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41165c
push ecx
push edx
call fcn.004197c3
add esp, 8
mov ecx, dword [ebp - 0x8c]
xor eax, eax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 7
mov word [ebp - 0xd0], ax
mov byte [ebp - 4], 5
cmp ecx, 8
jb 0x410fd1
mov edx, dword [ebp - 0xa0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410fc7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41165c
push ecx
push edx
call fcn.004197c3
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp ecx, 8
jb 0x41100f
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411005
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41165c
push ecx
push edx
call fcn.004197c3
add esp, 8
cmp byte [0x47ede6], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4111ef
cmp dword [ebp - 0x60], 0
je 0x4111ef
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x101]
cmovae ecx, dword [ebp - 0x58]
push edx
lea ecx, [ecx + eax*2]
add ecx, 2
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
push ecx
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x7c]
push eax
call fcn.00404c30
mov eax, dword [0x49edfc]
lea ecx, [ebp - 0xe8]
push 0x479fac
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x114], eax
call fcn.0040e9f0
cmp dword [eax + 0x10], 0
mov byte [ebp - 4], 0xe
jne 0x411089
xor esi, esi
jmp 0x4110bc
push 0x479fac
lea ecx, [ebp - 0xb8]
call fcn.0040e9f0
mov esi, eax
mov eax, dword [ebp - 0x108]
or eax, 2
mov byte [ebp - 4], 0xf
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
jb 0x4110bc
mov esi, dword [esi]
mov eax, dword [0x47ede8]
lea ecx, [ebp - 0x28]
or eax, 0x414
mov dword [ebp - 0x12c], eax
xor eax, eax
cmp byte [0x479f02], al
push 0x479f64
setne al
mov dword [ebp - 0x130], eax
call fcn.0040e9f0
mov edx, eax
cmp dword [edx + 0x14], 8
mov dword [ebp - 4], 0x10
jb 0x4110fb
mov edx, dword [edx]
cmp dword [ebp - 0x2c], 8
lea edi, [ebp - 0x128]
push edi
lea edi, [ebp - 0x174]
push edi
push esi
push 0
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x7c]
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
push 0
push dword [ebp - 0x130]
cmovae eax, dword [ebp - 0x70]
push edx
push ecx
push eax
call dword [ebp - 0x114]
test eax, eax
lea ecx, [ebp - 0x28]
sete byte [ebp - 0x101]
call fcn.00401370
mov eax, dword [ebp - 0x108]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xe
test al, 2
je 0x41116f
lea ecx, [ebp - 0xb8]
call fcn.00401370
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0xd
call fcn.00401370
cmp byte [ebp - 0x101], 0
je 0x4111de
push 0x479f7c
lea ecx, [ebp - 0x28]
call fcn.0040e9f0
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x41119e
mov esi, dword [esi]
push 2
call fcn.0041e7a8
push esi
push str._rPsExec_could_not_start__s:_n
push eax
call fcn.004029e0
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.00401370
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
call fcn.00403660
add esp, 4
call esi
lea ecx, [ebp - 0x7c]
mov esi, eax
call fcn.004013e0
jmp 0x41154f
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.004013e0
jmp 0x4113c2
lea eax, [ebp - 0x110]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp byte [0x47ede6], 0
je 0x411271
push dword [ebp - 0x110]
call fcn.00402af0
add esp, 4
mov dword [ebp - 0x10c], eax
test eax, eax
jne 0x411267
push str._rPsExec_could_not_create_a_limited_user_token:_n
push 2
call fcn.0041e7a8
add esp, 4
push eax
call fcn.004029e0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.00403660
add esp, 4
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov esi, eax
jmp 0x41154f
push dword [ebp - 0x110]
call edi
jmp 0x41127d
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x101]
cmovae ecx, dword [ebp - 0x58]
push edx
lea ecx, [ecx + eax*2]
add ecx, 2
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
push ecx
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x7c]
push eax
call fcn.00404c30
push 0x479fac
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xb
call fcn.0040e9f0
cmp dword [eax + 0x10], 0
mov byte [ebp - 4], 0xc
jne 0x4112cf
xor ecx, ecx
jmp 0x4112ed
push 0x479fac
lea ecx, [ebp - 0x28]
call fcn.0040e9f0
or dword [ebp - 0x108], 1
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x4112ed
mov ecx, dword [ecx]
mov eax, dword [0x47ede8]
lea edx, [ebp - 0x128]
push edx
mov esi, dword [ebp - 0x10c]
lea edx, [ebp - 0x174]
push edx
push ecx
push 0
or eax, 0x414
push eax
push 0
push 0
push 0
push dword [ebp - 0x7c]
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
mov eax, dword [ebp - 0x108]
sete byte [ebp - 0x101]
test al, 1
je 0x41133c
lea ecx, [ebp - 0x28]
call fcn.00401370
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xb
call fcn.00401370
cmp byte [ebp - 0x101], 0
je 0x4113b3
push 0x479f7c
lea ecx, [ebp - 0x28]
call fcn.0040e9f0
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x41136b
mov esi, dword [esi]
push 2
call fcn.0041e7a8
push esi
push str._rPsExec_could_not_start__s:_n
push eax
call fcn.004029e0
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.00401370
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
call fcn.00403660
add esp, 4
push dword [ebp - 0x10c]
call edi
call esi
lea ecx, [ebp - 0x7c]
mov esi, eax
call fcn.004013e0
jmp 0x41154f
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.004013e0
push esi
call edi
cmp dword [0x47ede8], 0x100000
jne 0x4113dc
push dword [ebp - 0x128]
call fcn.004030d0
add esp, 4
mov ax, word [0x479f04]
mov ecx, 0xffff
cmp ax, cx
je 0x41147c
push dword [0x47edec]
movzx eax, ax
push eax
push dword [ebp - 0x124]
call fcn.00403130
add esp, 0xc
test eax, eax
jne 0x411492
push eax
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x124]
call edi
push dword [ebp - 0x128]
call edi
push 0x479f7c
lea ecx, [ebp - 0x28]
call fcn.0040e9f0
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x411444
mov esi, dword [esi]
push 2
call fcn.0041e7a8
push esi
push str._rPsExec_could_not_set_group_affinity__s:_n
push eax
call fcn.004029e0
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.00401370
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
call fcn.00403660
add esp, 4
call esi
mov esi, eax
jmp 0x41154f
mov eax, dword [0x47edec]
test eax, eax
je 0x411492
push eax
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [0x47ede1], 0
jne 0x4114fc
push 0xffffffffffffffff
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [ebp - 0x118]
lea ecx, [ebp - 0x28]
push 0x479f7c
call fcn.0040e9f0
cmp dword [eax + 0x14], 8
jb 0x4114e3
mov eax, dword [eax]
push esi
push eax
push str._s_exited_with_error_code__d._n
call fcn.004036f0
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00401370
jmp 0x411539
push 0x479f7c
lea ecx, [ebp - 0x28]
call fcn.0040e9f0
cmp dword [eax + 0x14], 8
jb 0x411511
mov eax, dword [eax]
push dword [ebp - 0x120]
push eax
push str._s_started_with_process_ID__d._n
call fcn.004036f0
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00401370
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x118], eax
push dword [ebp - 0x124]
call edi
push dword [ebp - 0x128]
call edi
mov esi, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x411589
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41157f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411661
push ecx
push edx
call fcn.004197c3
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp ecx, 8
jb 0x4115d7
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4115cd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411661
push ecx
push edx
call fcn.004197c3
add esp, 8
mov ecx, dword [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp ecx, 8
jb 0x411621
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411617
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411661
push ecx
push edx
call fcn.004197c3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004197d1
mov esp, ebp
pop ebp
ret
call fcn.0041e68f
call fcn.00415430
call fcn.0041e68f
call fcn.0041e68f
call fcn.0041e68f
call fcn.0041e68f
call fcn.0041e68f
call fcn.0041e68f
int3