Function at 0x4013ef
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, 0xff
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp dword [0x408160], ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_printf]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jne 0x401452
cmp dword [0x40b690], 1
je 0x40145b
lea eax, [ebp - 0x60]
push eax
call fcn.00401690
pop ecx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
xor eax, eax
push eax
push eax
push 0x10
push 1
push eax
push eax
push str.I4TGTID.EXE
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
cmp dword [0x40b690], 1
jne 0x4014a0
cmp word [esi + 4], 0x1a
jne 0x401487
mov eax, dword [esi + 8]
push dword [eax*4 + 0x408164]
push 0x1a
call fcn.004054a2
pop ecx
push eax
push dword [esi]
push str._n____8lx__S__S_n_n
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 0x10
jmp 0x40148f
push str.Unable_to_obtain_win32mac_target._Run_i4target__v_for_debugging_purposes._n
call edi
pop ecx
push str.The_win32mac_Target_ID_is_derived_from_a_permanent_hardware_source_n
call edi
mov dword [esp], str.on_the_system_from_which_the_i4target_program_is_executed._n
call edi
pop ecx
cmp dword [0x408160], ebx
je 0x40166f
cmp dword [0x40ae30], ebx
jne 0x401629
push 0x40882c
push 0
push str._n____s_Target_ID
push 0x1bc5
push 0x4080dc
call fcn.0040172f
add esp, 0x10
push eax
call edi
push str._n____________________
call edi
mov eax, dword [esi + 8]
add esp, 0xc
cmp eax, 3
je 0x4015c4
mov cx, word [esi + 4]
cmp cx, 0x1a
jne 0x4015a1
cmp eax, 0xa
jne 0x40155c
call fcn.00405224
test eax, eax
mov eax, dword [esi + 8]
je 0x40153b
push 0x40b488
push dword [eax*4 + 0x408164]
movzx eax, word [esi + 4]
push eax
call fcn.004054a2
pop ecx
push eax
push dword [esi]
push str._n____8lx__S__S__s_n_n
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 0x14
jmp 0x40166f
push 0x40c280
push dword [eax*4 + 0x408164]
movzx eax, word [esi + 4]
push eax
call fcn.004054a2
pop ecx
push eax
push dword [esi]
push str._n____8lx__S__S__S_n_n
jmp 0x40152d
cmp cx, 0x1a
jne 0x4015a1
cmp eax, 5
jne 0x4015a1
lea eax, [ebp - 0xc]
push eax
call fcn.004053ce
pop ecx
mov eax, dword [esi + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [eax*4 + 0x408164]
movzx eax, word [esi + 4]
push eax
call fcn.004054a2
pop ecx
push eax
push dword [esi]
push str._n____8lx__s__s__08X_08X_08X_n_n
call edi
add esp, 0x1c
jmp 0x40166f
push dword [eax*4 + 0x408164]
movzx eax, cx
push eax
call fcn.004054a2
pop ecx
push eax
push dword [esi]
push str._n____8lx__s__s__n_n
call edi
add esp, 0x10
jmp 0x40166f
mov esi, dword [esi]
push 0
push str._Warning:_i4target_could_not_generate_secure_ID_n
push 0x1be3
push 0x4080dc
call fcn.0040172f
push eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, esi
mov ecx, esi
and eax, 0xff00
and ecx, ebx
or eax, 0x80040
shl eax, 4
or eax, ecx
push eax
mov eax, esi
and eax, 0xff0000
and esi, 0xffc00fff
or eax, 0xc000000
shr eax, 4
or eax, esi
shr eax, 0xc
push eax
push str._____________05X_06X_n
call edi
add esp, 0x24
jmp 0x40166f
push 0xc
push esi
call fcn.00401674
mov ebx, dword [esi]
mov ecx, 0xff
and ebx, ecx
mov edx, dword [esi + 8]
push ebx
movzx ebx, byte [esi + 1]
push ebx
mov bl, byte [esi + 2]
and ebx, ecx
push ebx
movzx ebx, byte [esi + 3]
push ebx
mov bl, byte [esi + 4]
and ebx, ecx
movzx ecx, byte [esi + 5]
movzx eax, al
push ebx
push ecx
push edx
push eax
push dword [edx*4 + 0x408164]
push str._n_s____02x:_02x:_02x:_02x:_02lx:_02lx:_02lx:_02lx____n
call edi
add esp, 0x30
pop edi
pop esi
pop ebx
leave
ret