Function at 0x40b9b0
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x59
push 0
push 0
dec ecx
jne 0x40b9b9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00402a4c
mov eax, dword [ebp - 0xc]
call fcn.00402a4c
lea eax, [ebp - 0x41]
mov edx, dword [0x408c3c]
call fcn.00402cb4
xor eax, eax
push ebp
push 0x40c881
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 0x44]
mov eax, dword [ebp - 4]
call fcn.004048ec
mov eax, dword [ebp - 8]
cmp byte [eax + 0x42], 0
je 0x40ba2f
mov eax, dword [ebp - 8]
add eax, 0x28
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x18]
call fcn.00402618
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + 8]
cmp eax, 5
ja case.0x40ba41.0
jmp dword [eax*4 + 0x40ba48]
push ebp
mov al, 0xfa
call fcn.0040b8e0
pop ecx
test al, al
je 0x40ba7e
lea edx, [ebp - 0x10]
mov ax, 1
call fcn.004093b4
jmp case.0x40ba41.0
push ebp
mov al, 0xdd
call fcn.0040b8e0
pop ecx
test al, al
je 0x40ba9b
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.004025c4
jmp case.0x40ba41.0
push ebp
mov al, 0xdb
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bab9
lea edx, [ebp - 0x10]
mov ax, 2
call fcn.004093b4
jmp case.0x40ba41.0
push ebp
mov al, 0xd9
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bad6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.004094d4
jmp case.0x40ba41.0
push ebp
mov al, 0xd7
call fcn.0040b8e0
pop ecx
test al, al
je 0x40baf0
lea eax, [ebp - 0x10]
call fcn.00408f4c
jmp case.0x40ba41.0
push ebp
mov al, 0xd8
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bb0a
lea eax, [ebp - 0x10]
call fcn.00408efc
jmp case.0x40ba41.0
push ebp
mov al, 0xd3
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bb24
lea eax, [ebp - 0x10]
call fcn.00408ff8
jmp case.0x40ba41.0
push ebp
mov al, 0xd4
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bb3e
lea eax, [ebp - 0x10]
call fcn.00409068
jmp case.0x40ba41.0
push ebp
mov al, 0xcd
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bb58
lea eax, [ebp - 0x10]
call fcn.00409108
jmp case.0x40ba41.0
push ebp
mov al, 0xce
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bb72
lea eax, [ebp - 0x10]
call fcn.004090b8
jmp case.0x40ba41.0
push ebp
mov al, 0x6a
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bb8f
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00409878
jmp case.0x40ba41.0
push ebp
mov al, 0x6b
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bba8
push 0
call sub.KERNEL32.DLL_ExitProcess
jmp case.0x40ba41.0
push ebp
mov al, 0x6c
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bbbf
call fcn.0040a544
jmp case.0x40ba41.0
push ebp
mov al, 0x78
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bbe5
mov eax, dword [ebp - 8]
call fcn.0040ad64
lea edx, [ebp - 0x10]
mov ax, 0x17
call fcn.00404d00
jmp case.0x40ba41.0
push ebp
mov al, 0x79
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bc04
mov edx, 0xc
mov eax, dword [ebp - 8]
call fcn.0040ae78
jmp case.0x40ba41.0
push ebp
mov al, 0x7a
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bc23
mov edx, 6
mov eax, dword [ebp - 8]
call fcn.0040ae78
jmp case.0x40ba41.0
push ebp
mov al, 0x7b
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bc40
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040b034
jmp case.0x40ba41.0
push ebp
mov al, 0x25
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bc8a
lea edx, [ebp - 0x4c]
mov ax, 0x8e
call fcn.00404d00
push dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
push dword [eax + 0x18]
push 0x40c89c
push dword [ebp - 0xc]
lea eax, [ebp - 0x48]
mov edx, 4
call fcn.00402924
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00409a40
jmp case.0x40ba41.0
push ebp
mov al, 0x7c
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bd24
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x408c3c]
call fcn.00402e9c
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 9
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x4098c0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
jmp case.0x40ba41.0
push ebp
mov al, 0x7d
call fcn.0040b8e0
pop ecx
test al, al
je 0x40be58
mov dl, 1
mov eax, dword [0x4042a4]
call fcn.00404328
mov edi, eax
mov eax, dword [0x411258]
mov edx, 0x67e
call fcn.00404d7c
movzx eax, ax
mov ecx, 3
xor edx, edx
div ecx
mov esi, eax
test si, si
jbe 0x40be47
mov bx, 1
mov edx, 0x80000002
mov eax, edi
call fcn.00404388
lea edx, [ebp - 0x50]
mov ax, 0x2e
call fcn.00404d00
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x54]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
add ax, 2
call fcn.00404d30
mov edx, dword [ebp - 0x54]
pop eax
call fcn.0040286c
mov edx, dword [ebp - 0x50]
xor ecx, ecx
mov eax, edi
call fcn.004043b4
test al, al
je 0x40be3d
lea edx, [ebp - 0x58]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
add ax, 3
call fcn.00404d30
mov edx, dword [ebp - 0x58]
mov eax, edi
call fcn.004047ec
test al, al
je 0x40be36
lea edx, [ebp - 0x60]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
inc eax
call fcn.00404d30
push dword [ebp - 0x60]
push 0x40c8ac
lea edx, [ebp - 0x68]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
add ax, 3
call fcn.00404d30
mov edx, dword [ebp - 0x68]
lea ecx, [ebp - 0x64]
mov eax, edi
call fcn.004046b8
push dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00402924
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00409ab0
push 0x5dc
call sub.KERNEL32.DLL_Sleep
mov eax, edi
call fcn.00404368
inc ebx
dec si
jne 0x40bd6d
lea edx, [ebp - 0x10]
mov ax, 0x17
call fcn.00404d00
jmp case.0x40ba41.0
push ebp
mov al, 0x7e
call fcn.0040b8e0
pop ecx
test al, al
je case.0x40ba41.0
mov eax, dword [ebp - 8]
call fcn.0040b758
jmp case.0x40ba41.0
push ebp
mov al, 0xcc
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bea3
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov eax, dword [ebp - 0x6c]
call fcn.0040a404
jmp 0x40bf6a
push ebp
mov al, 0x7f
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bf6a
mov eax, dword [ebp - 8]
add eax, 0x1c
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x24]
call fcn.00402618
lea ecx, [ebp - 0x70]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 8]
add eax, 0x20
call fcn.00402618
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x408c3c]
call fcn.00402e9c
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 0xa
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x409b80
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
push ebp
mov al, 0x80
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bfb8
push 0
lea ecx, [ebp - 0x74]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [0x4111f4]
mov eax, dword [eax]
call eax
test eax, eax
je 0x40bfab
lea edx, [ebp - 0x10]
mov ax, 0x17
call fcn.00404d00
jmp 0x40bfb8
lea eax, [ebp - 0x10]
mov edx, 0x40c8b8
call fcn.0040265c
push ebp
mov al, 0x81
call fcn.0040b8e0
pop ecx
test al, al
je 0x40bfe8
lea ecx, [ebp - 0x78]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x10]
call fcn.00406a64
jmp case.0x40ba41.0
push ebp
mov al, 0x82
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c01b
lea ecx, [ebp - 0x7c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov edx, dword [ebp - 0x7c]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040af48
jmp case.0x40ba41.0
push ebp
mov al, 0x84
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c071
lea ecx, [ebp - 0x80]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov eax, dword [ebp - 0x80]
call fcn.00402a5c
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
je 0x40c05f
lea eax, [ebp - 0x10]
mov edx, 0x40c8d4
call fcn.0040265c
jmp case.0x40ba41.0
lea eax, [ebp - 0x10]
mov edx, 0x40c8f0
call fcn.0040265c
jmp case.0x40ba41.0
push ebp
mov al, 0x85
call fcn.0040b8e0
pop ecx
test al, al
je case.0x40ba41.0
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x408c3c]
call fcn.00402e9c
lea ecx, [ebp - 0x84]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov edx, dword [ebp - 0x84]
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
lea eax, [ecx + eax - 0x14]
call fcn.00402618
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 0xc
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x40a320
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
jmp case.0x40ba41.0
push ebp
mov al, 0x86
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c1a1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x88]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 2
call fcn.00403c10
mov eax, dword [ebp - 0x88]
push eax
lea ecx, [ebp - 0x8c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 8]
pop ecx
call fcn.0040ab78
jmp case.0x40ba41.0
push ebp
mov al, 0x83
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c1da
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov edx, dword [ebp - 0x90]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040ada4
jmp case.0x40ba41.0
push ebp
mov al, 0x87
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c27d
lea ecx, [ebp - 0x194]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 2
call fcn.00403c10
mov edx, dword [ebp - 0x194]
lea eax, [ebp - 0x190]
mov ecx, 0xff
call fcn.00402840
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x298]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov edx, dword [ebp - 0x298]
lea eax, [ebp - 0x294]
mov ecx, 0xff
call fcn.00402840
lea eax, [ebp - 0x294]
pop edx
call fcn.00403ebc
test al, al
je 0x40c26b
lea edx, [ebp - 0x10]
mov ax, 0x17
call fcn.00404d00
jmp case.0x40ba41.0
lea eax, [ebp - 0x10]
mov edx, 0x40c908
call fcn.0040265c
jmp case.0x40ba41.0
push ebp
mov al, 0x88
call fcn.0040b8e0
pop ecx
test al, al
je case.0x40ba41.0
lea edx, [ebp - 0x29c]
mov ax, 2
call fcn.004093b4
lea ecx, [ebp - 0x2a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov edx, dword [ebp - 0x2a0]
mov eax, dword [0x4111f8]
call fcn.00402618
lea ecx, [ebp - 0x2a4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 2
call fcn.00403c10
mov edx, dword [ebp - 0x2a4]
mov eax, dword [0x4112e8]
call fcn.00402618
mov eax, dword [0x4112e8]
mov eax, dword [eax]
call fcn.00402864
mov edx, dword [0x4112e8]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
jne 0x40c31d
mov eax, dword [0x4112e8]
mov eax, dword [eax]
call fcn.00402864
mov edx, eax
dec edx
mov eax, dword [0x4112e8]
call fcn.00402be4
mov eax, dword [0x4112e8]
cmp dword [eax], 0
jne 0x40c336
mov eax, dword [0x4112e8]
mov edx, 0x40c920
call fcn.00402618
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 2
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x40aff4
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
lea edx, [ebp - 0x2a8]
mov ax, 0x8d
call fcn.00404d00
push dword [ebp - 0x2a8]
lea edx, [ebp - 0x2ac]
xor eax, eax
call fcn.004049bc
push dword [ebp - 0x2ac]
push 0x40c92c
mov eax, dword [0x4111f8]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00402924
mov eax, dword [ebp - 8]
add eax, 0xc
mov edx, dword [ebp - 0x10]
call fcn.00402618
jmp case.0x40ba41.0
push ebp
mov al, 0xb7
call fcn.0040b8e0
pop ecx
test al, al
je case.0x40ba41.0
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 1
lea ecx, [ebp - 0x2b4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov eax, dword [ebp - 0x2b4]
call fcn.00403dc8
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040da48
lea edx, [ebp - 0x2b0]
call fcn.00403da0
mov edx, dword [ebp - 0x2b0]
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
lea eax, [ecx + eax - 0x14]
call fcn.00402618
lea ecx, [ebp - 0x2b8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 2
call fcn.00403c10
mov edx, dword [ebp - 0x2b8]
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
lea eax, [ecx + eax - 0x10]
call fcn.00402618
lea ecx, [ebp - 0x2bc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 3
call fcn.00403c10
mov edx, dword [ebp - 0x2bc]
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
lea eax, [ecx + eax - 0xc]
call fcn.00402618
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x40d958
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
jmp case.0x40ba41.0
push ebp
mov al, 0x89
call fcn.0040b8e0
pop ecx
test al, al
je case.0x40ba41.0
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 8]
call fcn.00409878
lea ecx, [ebp - 0x2c4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 4
call fcn.00403c10
mov eax, dword [ebp - 0x2c4]
call fcn.00403dc8
mov esi, eax
test si, si
jbe case.0x40ba41.0
mov bx, 1
cmp bx, 5
ja 0x40c605
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x408c3c]
call fcn.00402e9c
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 8
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x40b798
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
inc ebx
dec si
jne 0x40c577
push ebp
mov al, 0xda
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c656
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040265c
mov edx, dword [ebp - 4]
mov eax, 0x40c938
call fcn.00402b9c
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.00402af8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040dc20
lea eax, [ebp - 0x10]
call fcn.004025c4
push ebp
mov al, 0x8a
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c69f
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040265c
mov bx, 1
cmp bx, 5
ja 0x40c693
movzx eax, bx
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4 + 0x458]
mov ecx, dword [eax + 0x454]
mov edx, dword [ebp - 0x14]
call fcn.00409a40
inc ebx
cmp bx, 6
jne 0x40c672
jmp 0x40c811
push ebp
mov al, 0xc3
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c773
lea edx, [ebp - 0x2c8]
mov ax, 4
call fcn.004093b4
mov dl, 1
mov eax, dword [0x40ddb8]
call fcn.0040de28
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x48], ebx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x90], eax
lea eax, [ebx + 0x8c]
mov edx, dword [ebp - 4]
call fcn.00402618
mov eax, dword [0x411244]
mov eax, dword [eax]
call fcn.00408d54
mov word [0x412e70], ax
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
lea eax, [edx + eax - 0x29]
lea edx, [ebp - 0x41]
mov ecx, dword [0x408c3c]
call fcn.00402e9c
movzx eax, word [0x412e70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov edx, dword [0x411244]
mov edx, dword [edx]
mov byte [edx + eax - 0x29], 4
mov eax, dword [0x4112a4]
push eax
push 0
push 0
push 0x40b8bc
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
movzx edx, word [0x412e70]
lea edx, [edx + edx*4]
lea edx, [edx + edx*8]
mov ecx, dword [0x411244]
mov ecx, dword [ecx]
mov dword [ecx + edx - 0x28], eax
jmp 0x40c811
push ebp
mov al, 0xc2
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c791
lea edx, [ebp - 0x10]
mov ax, 4
call fcn.004093b4
jmp 0x40c811
push ebp
mov al, 0x8b
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c7b4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x454]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00409a40
jmp 0x40c811
push ebp
mov al, 0x8c
call fcn.0040b8e0
pop ecx
test al, al
je 0x40c811
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x454]
push eax
mov eax, dword [0x4112b8]
mov eax, dword [eax]
call eax
lea ecx, [ebp - 0x2cc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.00403c10
mov eax, dword [ebp - 0x2cc]
call fcn.00403dc8
mov ebx, eax
test bx, bx
jne 0x40c800
mov bx, 0x1e
movzx eax, bx
imul eax, eax, 0x3e8
push eax
call sub.KERNEL32.DLL_Sleep
jmp 0x40c825
cmp dword [ebp - 0x10], 0
je 0x40c825
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00409ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c888
lea eax, [ebp - 0x2cc]
mov edx, 0xe
call fcn.004025e8
lea eax, [ebp - 0x194]
call fcn.004025c4
lea eax, [ebp - 0x90]
mov edx, 0x13
call fcn.004025e8
lea eax, [ebp - 0x41]
mov edx, dword [0x408c3c]
call fcn.00402d78
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004025e8
lea eax, [ebp - 4]
call fcn.004025c4
ret