Function at 0x405920
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x90
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xac]
xor ebp, ebp
and edi, 0xffff
mov dword [esp + 0x38], ebp
cmp edi, 0x23
jg 0x405b21
cmp edi, 0x1a
jge 0x405aff
lea eax, [edi - 4]
cmp eax, 0x15
ja case.0x406bd6.40026
xor ecx, ecx
mov cl, byte [eax + 0x406e44]
jmp dword [ecx*4 + 0x406e14]
mov edx, dword [esp + 0xa4]
push ebp
push ebp
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [esp + 0xa4]
push eax
call fcn.00407340
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x10
mov ecx, dword [esp + 0xa4]
push ecx
call fcn.00407110
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x10
cmp dword [0x41bbb8], ebp
je 0x4059d6
call fcn.004043b0
cmp dword [0x41bbb0], ebp
je 0x4059e3
call fcn.00403040
call fcn.004039c0
call fcn.00404440
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov edx, dword [0x41bbe0]
xor eax, eax
cmp edx, ebp
sete al
cmp eax, ebp
mov dword [0x41bbe0], eax
jne 0x405a37
call fcn.004043b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
call fcn.004046d0
cmp dword [0x41bbe0], ebp
je case.0x406bd6.40026
call fcn.00403e90
call fcn.004042e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
cmp dword [0x41bbb8], ebp
je 0x405a5d
call fcn.004043b0
mov ecx, dword [0x41bbbc]
mov eax, dword [0x41bbac]
xor edx, edx
cmp ecx, ebp
sete dl
cmp eax, ebp
mov dword [0x41bbbc], edx
jne 0x405aab
jmp 0x405aa3
cmp dword [0x41bbb8], ebp
je 0x405a88
call fcn.004043b0
mov ecx, dword [0x41bbc0]
xor eax, eax
cmp ecx, ebp
sete al
mov dword [0x41bbc0], eax
mov eax, dword [0x41bbac]
cmp eax, ebp
jne 0x405aab
cmp dword [0x41bbb0], ebp
je 0x405a2b
call fcn.00403040
jmp 0x405a2b
call fcn.004057d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
call fcn.00405690
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov ecx, dword [0x41bbd0]
add edi, 0xfffffff0
push ecx
push edi
call fcn.00405210
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x10
mov edx, dword [0x41bbcc]
add edi, 0xffffffe6
push edi
push edx
call fcn.00405210
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x10
cmp edi, 0x402
jg 0x406549
je 0x40651c
lea eax, [edi - 0x24]
cmp eax, 0x15
ja case.0x406bd6.40026
xor ecx, ecx
mov cl, byte [eax + 0x406e78]
jmp dword [ecx*4 + 0x406e5c]
mov edx, dword [esp + 0xa4]
mov eax, dword [0x41ba58]
push ebp
push 0x406f20
push edx
push 0x258
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov ecx, dword [esp + 0xa4]
push ecx
call fcn.004073f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41bba4]
mov dword [0x41bba8], 0xffffffff
cmp eax, ebp
je case.0x406bd6.40026
mov edx, dword [eax]
push 0xffffffffffffffff
jmp 0x405beb
mov eax, dword [0x41bba4]
mov dword [0x41bba8], 1
cmp eax, ebp
je case.0x406bd6.40026
mov edx, dword [eax]
push 1
jmp 0x405beb
mov eax, dword [0x41bba4]
mov dword [0x41bba8], ebp
cmp eax, ebp
je case.0x406bd6.40026
mov edx, dword [eax]
push ebp
push eax
call dword [edx + 0xc]
test eax, eax
je case.0x406bd6.40026
mov eax, dword [0x41be38]
mov ecx, dword [eax*4 + 0x416078]
push ecx
call fcn.00406ee0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x10
call fcn.004057b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov ecx, dword [0x41bc70]
lea eax, [edi - 0x2a]
cmp eax, ecx
jne 0x405ccc
cmp dword [0x41bbe0], ebp
je 0x405c4d
call fcn.004043b0
mov eax, dword [0x41bb84]
mov ecx, dword [0x41b150]
push ecx
push 2
mov edx, dword [eax]
push eax
call dword [edx + 0x10]
cmp eax, 0x80040217
jne 0x405c6d
call fcn.00403040
mov eax, dword [0x41bb8c]
cmp eax, ebp
je 0x405a2b
mov edx, dword [eax]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [edx + 0x10]
test eax, eax
jne 0x405a2b
mov eax, dword [esp + 0x18]
mov ecx, 4
mov edi, 0x4146d8
xor edx, edx
lea esi, [eax + 0x2c]
repe cmpsd dword [esi], dword es:[edi]
jne 0x405cc1
mov ecx, dword [eax + 0x44]
mov eax, dword [ecx + 0x38]
cmp eax, ebp
jg 0x405cb0
neg eax
push eax
mov eax, dword [ecx + 0x34]
push eax
call fcn.00402ea0
mov eax, dword [esp + 0x20]
add esp, 8
push eax
call fcn.00412d0f
jmp 0x405a2b
cmp eax, dword [0x41bc74]
jne 0x405cfa
cmp dword [0x41bbe0], ebp
je 0x405ce1
call fcn.004043b0
mov eax, dword [0x41bb84]
mov edx, dword [0x41b150]
push edx
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
jmp 0x4062b1
cmp eax, dword [0x41bc78]
jne 0x405d28
cmp dword [0x41bbe0], ebp
je 0x405d0f
call fcn.004043b0
mov eax, dword [0x41bb84]
mov edx, dword [0x41b150]
push edx
push 4
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
jmp 0x4062b1
cmp eax, dword [0x41bc7c]
jne 0x405da5
mov eax, dword [0x41bb94]
lea edx, [esp + 0x18]
push edx
push 0x4147e0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jne case.0x406bd6.40026
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push ebp
mov edx, dword [0x41b150]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push ebp
push ebp
push eax
push ecx
push 0x41bb94
push 1
push ebp
push 0x1e
push 0x1e
push edx
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
cmp eax, dword [0x41bc94]
jne 0x405ee1
cmp dword [0x41bbe0], ebp
je 0x405dbe
call fcn.004043b0
cmp dword [0x41bca8], ebp
je 0x405dcb
call fcn.00403040
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x41bb94]
mov edx, dword [eax]
push 0x4145a8
push ecx
push 0x414758
push 0x4146b8
push eax
call dword [edx + 0x18]
test eax, eax
je 0x405e1b
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x41bb94]
mov edx, dword [eax]
push 0x4145a8
push ecx
push 0x414778
push 0x4146b8
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x4147e0
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jne 0x405ed2
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
push ebp
push ebp
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ebp
push edx
mov edx, dword [0x41b150]
lea ecx, [esp + 0x20]
push eax
push ecx
push 1
push ebp
push 0x1e
push 0x1e
push edx
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov eax, dword [0x41bb8c]
cmp eax, ebp
je 0x405ebd
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x405ebd
mov eax, dword [esp + 0x18]
mov ecx, 4
mov edi, 0x4146d8
xor edx, edx
lea esi, [eax + 0x2c]
repe cmpsd dword [esi], dword es:[edi]
jne 0x405eb7
mov ecx, dword [eax + 0x44]
mov eax, dword [ecx + 0x38]
cmp eax, ebp
jg 0x405ea6
neg eax
push eax
mov eax, dword [ecx + 0x34]
push eax
call fcn.00402ea0
mov eax, dword [esp + 0x20]
add esp, 8
push eax
call fcn.00412d0f
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x405fba
cmp eax, dword [0x41bc98]
jne 0x405fdf
cmp dword [0x41bbe0], ebp
je 0x405eff
call fcn.004043b0
call fcn.00403040
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x41bb94]
mov edx, dword [eax]
push 0x4145a8
push ecx
push 0x414758
push 0x4146a8
push eax
call dword [edx + 0x18]
test eax, eax
je 0x405f4f
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x41bb94]
mov edx, dword [eax]
push 0x4145a8
push ecx
push 0x414778
push 0x4146a8
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x4147e0
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jne 0x405fb0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
push ebp
push ebp
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ebp
push edx
mov edx, dword [0x41b150]
lea ecx, [esp + 0x20]
push eax
push ecx
push 1
push ebp
push 0x1e
push 0x1e
push edx
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
cmp dword [0x41bbe0], ebp
je case.0x406bd6.40026
call fcn.00403e90
call fcn.004042e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
cmp eax, dword [0x41bc80]
jne 0x4060b4
mov eax, dword [0x41bb70]
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x41bb94]
mov ecx, dword [eax]
push 0x414548
push edx
push 0x414758
push 0x4146b8
push eax
call dword [ecx + 0x18]
test eax, eax
je 0x40603b
mov eax, dword [0x41bb70]
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x41bb94]
mov ecx, dword [eax]
push 0x414548
push edx
push 0x414778
push 0x4146b8
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x4147e0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jne 0x40609b
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push ebp
push ebp
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push ebp
push eax
mov eax, dword [0x41b150]
lea edx, [esp + 0x20]
push ecx
push edx
push 1
push ebp
push 0x1e
push 0x1e
push eax
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
cmp eax, dword [0x41bc84]
jne 0x40618a
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x41bb94]
mov edx, dword [eax]
push 0x414538
push ecx
push 0x414758
push 0x4146b8
push eax
call dword [edx + 0x18]
test eax, eax
je 0x406110
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x41bb94]
mov edx, dword [eax]
push 0x414538
push ecx
push 0x414778
push 0x4146b8
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x4147e0
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jne 0x406171
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
push ebp
push ebp
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ebp
push edx
mov edx, dword [0x41b150]
lea ecx, [esp + 0x20]
push eax
push ecx
push 1
push ebp
push 0x1e
push 0x1e
push edx
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
cmp eax, dword [0x41bc88]
jne 0x406207
mov eax, dword [0x41bb98]
lea edx, [esp + 0x14]
push edx
push 0x4147e0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jne case.0x406bd6.40026
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push ebp
mov edx, dword [0x41b150]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push ebp
push ebp
push eax
push ecx
push 0x41bb98
push 1
push ebp
push 0x1e
push 0x1e
push edx
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
cmp eax, dword [0x41bc9c]
jne 0x4062d1
cmp dword [0x41bbe0], ebp
je 0x406220
call fcn.004043b0
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x41bb98]
mov edx, dword [eax]
push 0x4145a8
push ecx
push 0x414768
push 0x4146b8
push eax
call dword [edx + 0x18]
lea ecx, [esp + 0x14]
mov eax, dword [esp + 0x10]
push ecx
push 0x4147e0
push eax
mov edx, dword [eax]
call dword [edx]
test eax, eax
jne 0x4062a7
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
push ebp
push ebp
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ebp
push edx
mov edx, dword [0x41b150]
lea ecx, [esp + 0x20]
push eax
push ecx
push 1
push ebp
push 0x1e
push 0x1e
push edx
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
cmp dword [0x41bbe0], ebp
je case.0x406bd6.40026
call fcn.004042e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
cmp eax, dword [0x41bc8c]
jne 0x4063ed
mov eax, dword [0x41bb70]
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x41bb94]
mov ecx, dword [eax]
push 0x414548
push edx
push 0x414758
push 0x4146b8
push eax
call dword [ecx + 0x18]
test eax, eax
je 0x40632d
mov eax, dword [0x41bb70]
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x41bb94]
mov ecx, dword [eax]
push 0x414548
push edx
push 0x414778
push 0x4146b8
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0x4145d8
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [0x41bb70]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
push 0x414548
push edx
push ebp
push 0x414658
push eax
call dword [ecx + 0x18]
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push 0x4147e0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x4063c0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push ebp
push ebp
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push ebp
push eax
mov eax, dword [0x41b150]
lea edx, [esp + 0x20]
push ecx
push edx
push 1
push ebp
push 0x1e
push 0x1e
push eax
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
cmp eax, dword [0x41bc90]
jne 0x406499
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x41bb98]
mov edx, dword [eax]
push 0x414528
push ecx
push 0x414768
push 0x4146b8
push eax
call dword [edx + 0x18]
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
push 0x4147e0
push eax
mov edx, dword [eax]
call dword [edx]
test eax, eax
jne 0x406480
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
push ebp
push ebp
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push ebp
push edx
mov edx, dword [0x41b150]
lea ecx, [esp + 0x28]
push eax
push ecx
push 1
push ebp
push 0x1e
push 0x1e
push edx
call dword [sym.imp.OLEPRO32.DLL_OleCreatePropertyFrame]
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov edx, dword [0x41bcb0]
cmp eax, edx
jle case.0x406bd6.40026
mov ecx, dword [0x41bcb4]
lea esi, [ecx + edx]
cmp eax, esi
jg case.0x406bd6.40026
xor esi, esi
cmp ecx, ebp
jle 0x4064f4
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, edi
xor ecx, ecx
sub eax, edx
mov edx, dword [0x41bcb8]
sub eax, 0x2b
cmp esi, eax
setne cl
dec ecx
and ecx, 8
or ch, 4
push ecx
push esi
push edx
call ebx
mov eax, dword [0x41bcb4]
mov edx, dword [0x41bcb0]
inc esi
cmp esi, eax
jl 0x4064c4
mov ecx, dword [0x41bcac]
test ecx, ecx
je case.0x406bd6.40026
sub edi, edx
sub edi, 0x2b
push edi
call fcn.0040f760
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41ba5c]
cmp eax, ebp
je case.0x406bd6.40026
mov ecx, dword [esp + 0xb0]
push ecx
push eax
call fcn.00410690
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x10
cmp edi, 0x9c50
jg 0x406bc7
je 0x406ba6
cmp edi, 0x9c4a
jg 0x406a98
je 0x406a77
cmp edi, 0x9c45
jg 0x406a23
je 0x4069ec
sub edi, 0x8001
je 0x40686d
sub edi, 0x1c41
je 0x406619
sub edi, 2
jne case.0x406bd6.40026
mov eax, dword [0x41bb94]
lea ecx, [esp + 0x38]
push ecx
push 0x414558
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl case.0x406bd6.40026
mov eax, dword [0x41bb70]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x41bb94]
push ebp
push ebp
push ebp
push 0x414668
mov dword [esp + 0x2c], ebp
mov edx, dword [eax]
push 1
push ecx
push eax
call dword [edx + 0x2c]
test eax, eax
jl 0x406600
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
push 8
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x10]
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x38]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41bccc]
lea ecx, [esp + 0x24]
push ecx
push 0x414470
mov edx, dword [eax]
push eax
call dword [edx]
mov edx, dword [0x41bd78]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [0x41bd78]
mov eax, dword [esp + 0x24]
push edx
mov edx, dword [0x41bce0]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [esp + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [0x41bb94]
mov eax, dword [0x41bb70]
push 0x41bb8c
push 0x4145a8
mov edx, dword [eax]
push ecx
push 0x414778
push 0x4146b8
push eax
call dword [edx + 0x18]
mov eax, dword [0x41bb8c]
cmp eax, ebp
je 0x4066ed
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [edx + 0x10]
test eax, eax
jne 0x4066e2
mov edx, dword [esp + 0x1c]
mov ecx, 4
mov edi, 0x4146d8
xor eax, eax
lea esi, [edx + 0x2c]
repe cmpsd dword [esi], dword es:[edi]
jne 0x4066d1
mov eax, dword [edx + 0x44]
mov esi, dword [eax + 0x38]
mov ecx, dword [eax + 0x34]
cmp esi, ebp
mov dword [esp + 0x14], ecx
jg 0x4066d5
push edx
neg esi
call fcn.00412d0f
mov eax, dword [0x41bb8c]
jmp 0x4066f1
mov esi, dword [esp + 0x24]
push edx
call fcn.00412d0f
mov eax, dword [0x41bb8c]
jmp 0x4066f1
mov esi, dword [esp + 0x24]
mov eax, dword [0x41bb8c]
jmp 0x4066f1
mov esi, dword [esp + 0x24]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [0x41bd78]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x58], esi
mov dword [esp + 0x50], 0x28
mov eax, dword [esp + 0x14]
mov word [esp + 0x5c], 1
imul esi, eax
mov dword [esp + 0x54], eax
mov word [esp + 0x5e], 0x18
lea ebx, [esi + esi*2]
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebp
lea ecx, [ebx + 0x32]
mov dword [esp + 0x6c], ebp
push ecx
push 0x42
mov dword [esp + 0x78], ebp
mov dword [esp + 0x7c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x41be3c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0xa
lea esi, [esp + 0x50]
mov edi, eax
mov dword [0x41be40], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x41be40]
mov esi, dword [0x41bce0]
mov ecx, ebx
mov eax, ecx
lea edi, [edx + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x50]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x41bce0]
push ecx
push edx
call fcn.00402870
add esp, 8
mov esi, dword [0x41be40]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0xc0000000
push str.c:oneframe.bmp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov word [esp + 0x40], 0x4d42
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
lea edx, [ecx + eax*4]
mov eax, dword [esi]
mov word [esp + 0x4a], bp
mov word [esp + 0x4c], bp
lea ecx, [edx + eax + 0xe]
mov dword [esp + 0x46], ecx
mov edx, dword [esi + 0x20]
mov eax, dword [esi]
lea ecx, [eax + edx*4 + 0xe]
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x48]
push 0xe
push eax
push edi
mov dword [esp + 0x5e], ecx
call ebx
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x3c]
push ebp
push ecx
lea eax, [edx*4 + 0x28]
push eax
push esi
push edi
call ebx
mov edx, dword [esi + 0x14]
mov eax, dword [0x41bce0]
lea ecx, [esp + 0x3c]
push ebp
push ecx
push edx
push eax
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x41be40]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [0x41be40]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov ecx, dword [0x41bd88]
mov eax, dword [0x41be0c]
mov ebp, dword [0x41be08]
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x4069be
test eax, eax
je 0x4069be
mov eax, dword [0x41af94]
dec eax
test eax, eax
mov dword [0x41af94], eax
jle 0x4068ad
mov dword [0x41bd88], 1
jmp 0x4068c1
mov eax, dword [0x416708]
mov dword [0x41bd88], 0
mov dword [0x41af94], eax
call fcn.00401020
push 0
push 0
push 2
push 0
push 1
push 0x40000000
call fcn.00401060
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4069be
xor ecx, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], ecx
lea edx, [ebp + 0x36]
mov dword [esp + 0x30], ecx
mov word [esp + 0x28], 0x4d42
mov word [esp + 0x34], cx
mov dword [esp + 0x10], ecx
push ecx
push eax
lea ecx, [esp + 0x30]
push 0xe
push ecx
push esi
mov dword [esp + 0x3e], edx
mov dword [esp + 0x46], 0x36
call ebx
mov edx, dword [0x41abd4]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
mov eax, dword [0x41abd8]
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x7c], edx
push edi
push ecx
lea edx, [esp + 0x80]
push 0x28
push edx
push esi
mov dword [esp + 0x8c], 0x28
mov dword [esp + 0x94], eax
mov word [esp + 0x98], 1
mov word [esp + 0x9a], 0x18
mov dword [esp + 0x24], edi
call ebx
lea eax, [esp + 0x10]
push edi
mov ecx, dword [esp + 0x20]
push eax
push ebp
push ecx
push esi
mov dword [esp + 0x24], edi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xa
lea esi, [esp + 0x78]
mov edi, 0x41be10
mov dword [0x41ade4], 1
rep movsd dword es:[edi], dword [esi]
push 1
push 0
push 0
call fcn.00401060
mov edx, dword [esp + 0xb0]
push eax
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41bdf4]
cmp eax, ebp
jne 0x406a17
mov eax, dword [0x41ba58]
push ebp
push 0x406f50
push ebp
push 0x66
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp eax, ebp
mov dword [0x41bdf4], eax
je case.0x406bd6.40026
push 0x43
push ebp
push ebp
push ebp
push ebp
push ebp
jmp 0x406dfb
sub edi, 0x9c48
je 0x406a5e
dec edi
jne case.0x406bd6.40026
push 1
push ebp
push ebp
call fcn.00401060
mov ecx, dword [esp + 0xb0]
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
pop edi
pop esi
pop ebp
mov dword [0x41bd88], 1
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41bd90]
xor edx, edx
cmp eax, ebp
pop edi
sete dl
pop esi
pop ebp
mov dword [0x41bd90], edx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
add edi, 0xffff63b5
cmp edi, 4
ja case.0x406bd6.40026
jmp dword [edi*4 + 0x406e90]
mov ecx, dword [0x41bd8c]
xor eax, eax
cmp ecx, ebp
pop edi
sete al
pop esi
mov dword [0x41bd8c], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41bd94]
xor ecx, ecx
cmp eax, ebp
pop edi
sete cl
pop esi
pop ebp
mov dword [0x41bd94], ecx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov edx, dword [0x41bd98]
xor eax, eax
cmp edx, ebp
sete al
cmp eax, ebp
mov dword [0x41bd98], eax
jne case.0x406bd6.40026
mov ecx, 0x20
mov eax, 0x40
mov edi, 0x41ae6c
mov dword [0x41bdf0], ebp
rep stosd dword es:[edi], eax
mov ecx, 0x20
mov edi, 0x41bce4
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x547ec8]
cmp eax, ebp
jne 0x406b6b
mov edx, dword [0x41ba58]
push ebp
push 0x40adf0
push ebp
push 0x25d
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp eax, ebp
mov dword [0x547ec8], eax
je case.0x406bd6.40026
push eax
call fcn.0040b5b0
add esp, 4
mov eax, dword [0x547ec8]
push 0x43
push ebp
push ebp
push ebp
push ebp
push ebp
jmp 0x406dfb
mov eax, dword [0x41bd9c]
xor ecx, ecx
cmp eax, ebp
pop edi
sete cl
pop esi
pop ebp
mov dword [0x41bd9c], ecx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41670c]
xor edx, edx
cmp eax, ebp
pop edi
sete dl
pop esi
pop ebp
mov dword [0x41670c], edx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
add edi, 0xffff63af
cmp edi, 0xc
ja case.0x406bd6.40026
jmp dword [edi*4 + 0x406ea4]
mov eax, dword [0x57f0a4]
cmp eax, ebp
jne 0x406c0b
mov eax, dword [0x41ba58]
push ebp
push 0x410a40
push ebp
push 0x263
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp eax, ebp
mov dword [0x57f0a4], eax
je case.0x406bd6.40026
push eax
call fcn.00410b30
mov ecx, dword [0x57f0a4]
add esp, 4
push 0x43
push ebp
push ebp
push ebp
push ebp
push ebp
push ecx
jmp 0x406dfc
mov eax, dword [0x416710]
xor edx, edx
cmp eax, ebp
pop edi
sete dl
pop esi
pop ebp
mov dword [0x416710], edx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov ecx, dword [0x41bda4]
xor eax, eax
cmp ecx, ebp
pop edi
sete al
pop esi
mov dword [0x41bda4], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41bda0]
xor ecx, ecx
cmp eax, ebp
pop edi
sete cl
pop esi
pop ebp
mov dword [0x41bda0], ecx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41bda8]
xor edx, edx
cmp eax, ebp
pop edi
sete dl
pop esi
pop ebp
mov dword [0x41bda8], edx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x57f090]
cmp eax, ebp
jne 0x406cd9
mov eax, dword [0x41ba58]
push ebp
push 0x40fba0
push ebp
push 0x261
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp eax, ebp
mov dword [0x57f090], eax
je case.0x406bd6.40026
push eax
call fcn.0040fe60
mov ecx, dword [0x57f090]
add esp, 4
push 0x43
push ebp
push ebp
push ebp
push ebp
push ebp
push ecx
jmp 0x406dfc
mov eax, dword [0x41bdac]
xor edx, edx
cmp eax, ebp
pop edi
sete dl
pop esi
pop ebp
mov dword [0x41bdac], edx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov ecx, dword [0x41bdb0]
xor eax, eax
cmp ecx, ebp
pop edi
sete al
pop esi
mov dword [0x41bdb0], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x41bdb4]
xor ecx, ecx
cmp eax, ebp
pop edi
sete cl
pop esi
pop ebp
mov dword [0x41bdb4], ecx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x54cad8]
cmp eax, ebp
jne 0x406d83
mov edx, dword [0x41ba58]
push ebp
push 0x40dbe0
push ebp
push 0x262
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp eax, ebp
mov dword [0x54cad8], eax
je case.0x406bd6.40026
push eax
call fcn.0040e530
add esp, 4
mov eax, dword [0x54cad8]
push 0x43
push ebp
push ebp
push ebp
push ebp
push ebp
jmp 0x406dfb
mov eax, dword [0x41bdb8]
xor ecx, ecx
cmp eax, ebp
pop edi
sete cl
pop esi
pop ebp
mov dword [0x41bdb8], ecx
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10
mov eax, dword [0x57f780]
cmp eax, ebp
jne 0x406de6
mov edx, dword [0x41ba58]
push ebp
push 0x4124d0
push ebp
push 0x264
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp eax, ebp
mov dword [0x57f780], eax
je case.0x406bd6.40026
push eax
call fcn.00412710
add esp, 4
mov eax, dword [0x57f780]
push 0x43
push ebp
push ebp
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret 0x10