Function at 0x403220
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429e24
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x508
mov eax, dword [0x43b068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x198]
push 1
push 0x437044
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0xf
mov byte [ebp - 0x198], 0
call fcn.00401da0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x168]
push 0
push 0x436f80
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
call fcn.00401da0
mov byte [ebp - 4], 5
lea ecx, [ebx + 0x50]
mov esi, dword [ebx + 0x64]
cmp esi, 0x10
mov edi, dword [ebx + 0x50]
mov edx, dword [ebx + 0x60]
cmovae ecx, edi
push 0
push 0x436f80
call fcn.00402150
add esp, 8
test al, al
je 0x4038f0
mov edx, 4
lea ecx, [ebp - 0x1b0]
call fcn.00403170
mov dword [ebp - 0x45c], eax
mov edx, 4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4cc]
call fcn.00403170
mov dword [ebp - 0x464], eax
mov edx, 5
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4b4]
call fcn.00403170
mov dword [ebp - 0x460], eax
mov edx, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x180]
call fcn.00403170
mov edi, eax
mov byte [ebp - 4], 9
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x4033a2
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x403389
mov eax, dword [edi]
push 1
lea esi, [eax + ecx]
push 0x436ff8
push esi
call fcn.00411520
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x4033c1
push 1
push 0x436ff8
mov byte [ebp - 0x484], 0
mov ecx, edi
push dword [ebp - 0x484]
push 1
call fcn.00401fe0
mov edi, eax
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x47c], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x46c], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x47c]
push dword [ebp - 0x460]
lea ecx, [ebp - 0x514]
call fcn.00407390
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0xb
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x403458
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x40343f
mov eax, dword [edi]
push 1
lea esi, [eax + ecx]
push 0x436ff8
push esi
call fcn.00411520
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x403477
push 1
push 0x436ff8
mov byte [ebp - 0x460], 0
mov ecx, edi
push dword [ebp - 0x460]
push 1
call fcn.00401fe0
mov edi, eax
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x49c], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x48c], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x49c]
push dword [ebp - 0x464]
lea ecx, [ebp - 0x4fc]
call fcn.00407390
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0xd
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x40350e
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x4034f5
mov eax, dword [edi]
push 1
lea esi, [eax + ecx]
push 0x436ff8
push esi
call fcn.00411520
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x40352d
push 1
push 0x436ff8
mov byte [ebp - 0x464], 0
mov ecx, edi
push dword [ebp - 0x464]
push 1
call fcn.00401fe0
mov edi, eax
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x150], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x140], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x150]
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x4e4]
call fcn.00407390
add esp, 4
lea ecx, [ebp - 0x168]
push eax
call fcn.00401b90
mov edx, dword [ebp - 0x4d0]
cmp edx, 0x10
jb 0x4035cd
mov ecx, dword [ebp - 0x4e4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4035c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404605
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4d0], 0xf
mov byte [ebp - 0x4e4], 0
cmp edx, 0x10
jb 0x403626
mov ecx, dword [ebp - 0x150]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40361c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40460a
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
cmp edx, 0x10
jb 0x40367f
mov ecx, dword [ebp - 0x4fc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403675
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40460f
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x488]
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4e8], 0xf
mov byte [ebp - 0x4fc], 0
cmp edx, 0x10
jb 0x4036d8
mov ecx, dword [ebp - 0x49c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4036ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404614
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x500]
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 0xf
mov byte [ebp - 0x49c], 0
cmp edx, 0x10
jb 0x403731
mov ecx, dword [ebp - 0x514]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403727
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404619
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x468]
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x500], 0xf
mov byte [ebp - 0x514], 0
cmp edx, 0x10
jb 0x40378a
mov ecx, dword [ebp - 0x47c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403780
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40461e
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x16c]
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0xf
mov byte [ebp - 0x47c], 0
cmp edx, 0x10
jb 0x4037e3
mov ecx, dword [ebp - 0x180]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4037d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404623
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x4a0]
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
cmp edx, 0x10
jb 0x40383c
mov ecx, dword [ebp - 0x4b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403832
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404628
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a0], 0xf
mov byte [ebp - 0x4b4], 0
cmp edx, 0x10
jb 0x403895
mov ecx, dword [ebp - 0x4cc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40388b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40462d
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 0x4b8], 0xf
mov byte [ebp - 0x4cc], 0
cmp edx, 0x10
jb 0x403908
mov ecx, dword [ebp - 0x1b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4038e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404632
push edx
push ecx
call fcn.0040eb70
add esp, 8
jmp 0x403908
push dword [ebx + 0x60]
cmp esi, 0x10
lea eax, [ebx + 0x50]
lea ecx, [ebp - 0x168]
cmovae eax, edi
push eax
call fcn.00401da0
cmp dword [ebp - 0x154], 0x10
lea eax, [ebp - 0x458]
push 0x148
push 0
lea esi, [ebp - 0x168]
cmovae esi, dword [ebp - 0x168]
push eax
call fcn.00411aa0
add esp, 0xc
mov dword [ebp - 0x44c], esi
lea eax, [ebp - 0x448]
push 0x436de0
push 0x14
push eax
call fcn.00413663
add esp, 0xc
mov dword [ebp - 0x454], 0x7a120
push 0x7a120
call fcn.0040eb7e
add esp, 4
mov dword [ebp - 0x458], eax
push dword [ebp - 0x454]
push 0
push eax
call fcn.00411aa0
add esp, 0xc
mov dword [ebp - 0x434], 0xfde9
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
push 0x104
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0x10
push 0
push eax
call fcn.00411aa0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4039f4
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x138]
call fcn.00401da0
push 4
push str..exe
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 0xf
mov byte [ebp - 0x49c], 0
call fcn.00401da0
push ecx
mov byte [ebp - 4], 0x11
call fcn.0040d000
mov edx, eax
lea esi, [edx + 1]
nop dword [eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x403a50
sub edx, esi
push edx
push eax
push ecx
lea ecx, [ebp - 0x49c]
call fcn.00408160
movups xmm1, xmmword [eax]
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
movups xmmword [ebp - 0x47c], xmm1
mov byte [eax], 0
movq qword [ebp - 0x46c], xmm0
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x47c]
cmp dword [ebp - 0x468], 0x10
mov eax, dword [ebp - 0x124]
mov esi, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x46c]
movd edi, xmm1
push ecx
cmovae edx, edi
sub eax, esi
push edx
cmp ecx, eax
ja 0x403af5
cmp dword [ebp - 0x124], 0x10
lea eax, [esi + ecx]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x138]
cmovae eax, dword [ebp - 0x138]
add esi, eax
push esi
call fcn.00411520
mov eax, dword [ebp - 0x46c]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x403b14
mov byte [ebp - 0x45c], 0
push dword [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x138]
call fcn.00401fe0
mov edi, dword [ebp - 0x47c]
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x468]
cmp eax, 0x10
jb 0x403b4e
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x403b44
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404637
push ecx
push edi
call fcn.0040eb70
add esp, 8
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x488]
cmp edx, 0x10
jb 0x403b8c
mov ecx, dword [ebp - 0x49c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403b82
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40463c
push edx
push ecx
call fcn.0040eb70
add esp, 8
cmp dword [ebp - 0x124], 0x10
lea ecx, [ebp - 0x1c8]
lea eax, [ebp - 0x138]
cmovae eax, dword [ebp - 0x138]
push ecx
push eax
call fcn.0041449b
add esp, 8
test eax, eax
jne 0x403bd1
cmp dword [ebp - 0x124], 0x10
lea eax, [ebp - 0x138]
cmovae eax, dword [ebp - 0x138]
push eax
call fcn.00413c8e
add esp, 4
cmp dword [ebp - 0x154], 0x10
lea eax, [ebp - 0x310]
push 0x148
push 0
lea esi, [ebp - 0x168]
cmovae esi, dword [ebp - 0x168]
push eax
call fcn.00411aa0
add esp, 0xc
mov dword [ebp - 0x304], esi
lea eax, [ebp - 0x300]
push 0x436de0
push 0x14
push eax
call fcn.00413663
add esp, 0xc
mov dword [ebp - 0x30c], 0x7a120
push 0x7a120
call fcn.0040eb7e
add esp, 4
mov dword [ebp - 0x310], eax
push dword [ebp - 0x30c]
push 0
push eax
call fcn.00411aa0
add esp, 0xc
mov dword [ebp - 0x2ec], 0xfde9
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], 0
mov byte [ebp - 4], 0x13
lea esi, [ebx + 8]
cmp dword [ebx + 0x1c], 0x10
mov eax, dword [ebp - 0x2e4]
cmovae esi, dword [ebx + 8]
mov dword [ebp - 0x2dc], 0
test eax, eax
je 0x403ca3
push eax
call fcn.0040e940
add esp, 4
mov dword [ebp - 0x2e4], 0
push esi
lea ecx, [ebp - 0x310]
call fcn.00401750
test eax, eax
je 0x404280
mov edx, dword [ebp - 0x2e8]
xor eax, eax
cmp dword [ebp - 0x2dc], eax
mov dword [ebp - 0x140], eax
cmove edx, eax
mov dword [ebp - 0x13c], 0xf
mov ecx, edx
mov byte [ebp - 0x150], al
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403ce3
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x150]
call fcn.00401da0
mov byte [ebp - 4], 0x14
mov esi, dword [ebp - 0x140]
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x150]
cmp esi, 4
jbe 0x4040c8
cmp edx, 0x10
lea eax, [ebp - 0x150]
cmovae eax, ecx
cmp byte [eax], 0x6c
jne 0x4040c8
cmp edx, 0x10
lea eax, [ebp - 0x150]
cmovae eax, ecx
cmp byte [eax + 1], 0x6e
jne 0x4040c8
cmp edx, 0x10
lea eax, [ebp - 0x150]
cmovae eax, ecx
cmp byte [eax + 2], 0x6b
jne 0x4040c8
cmp edx, 0x10
lea eax, [ebp - 0x150]
cmovae eax, ecx
cmp byte [eax + 3], 0x3a
jne 0x4040c8
push 4
push str.lnk:
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0xf
mov byte [ebp - 0x47c], 0
call fcn.00401da0
lea edx, [ebp - 0x47c]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x150]
call fcn.004030f0
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x468]
cmp edx, 0x10
jb 0x403def
mov ecx, dword [ebp - 0x47c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403de5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404641
push edx
push ecx
call fcn.0040eb70
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x45c], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x436f80
mov byte [ecx], 0
call fcn.00401da0
sub esp, 0x18
mov byte [ebp - 4], 0x16
lea eax, [ebx + 0x38]
mov dword [ebp - 0x464], esp
mov ecx, esp
push eax
call fcn.00406a50
sub esp, 0x18
mov byte [ebp - 4], 0x17
lea eax, [ebx + 0x20]
mov dword [ebp - 0x460], esp
mov ecx, esp
push eax
call fcn.00406a50
sub esp, 0x18
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x150]
mov ecx, esp
push eax
call fcn.00406a50
mov esi, dword [ebp - 0x480]
mov ecx, esi
mov byte [ebp - 4], 0x14
call fcn.00403220
mov edx, dword [ebp - 0x13c]
add esp, 0x60
cmp edx, 0x10
jb 0x403eaa
mov ecx, dword [ebp - 0x150]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403ea0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404646
push edx
push ecx
call fcn.0040eb70
add esp, 8
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
call fcn.00401110
mov edx, dword [ebp - 0x124]
cmp edx, 0x10
jb 0x403f0a
mov ecx, dword [ebp - 0x138]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403f00
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40464b
push edx
push ecx
call fcn.0040eb70
add esp, 8
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
call fcn.00401110
mov edx, dword [ebp - 0x154]
cmp edx, 0x10
jb 0x403f6a
mov ecx, dword [ebp - 0x168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403f60
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404650
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov edx, dword [ebp - 0x184]
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
cmp edx, 0x10
jb 0x403fbf
mov ecx, dword [ebp - 0x198]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403fb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404655
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x403ff3
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403fe9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40465a
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov edx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp edx, 0x10
jb 0x404039
mov ecx, dword [ebx + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40402f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40465f
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov edx, dword [ebx + 0x4c]
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0xf
mov byte [ebx + 0x20], 0
cmp edx, 0x10
jb 0x40407f
mov ecx, dword [ebx + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404075
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404664
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov edx, dword [ebx + 0x64]
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0xf
mov byte [ebx + 0x38], 0
cmp edx, 0x10
jb 0x4045e5
mov ecx, dword [ebx + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4045db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404669
jmp 0x4045db
cmp esi, 3
jae 0x40424e
cmp edx, 0x10
lea eax, [ebp - 0x150]
cmovae eax, ecx
cmp byte [eax], 0x65
jne 0x40424e
mov esi, dword [ebp - 0x480]
mov ecx, esi
push 1
push 0x437048
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.00401da0
mov edx, dword [ebp - 0x13c]
cmp edx, 0x10
jb 0x404145
mov ecx, dword [ebp - 0x150]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40413b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40466e
push edx
push ecx
call fcn.0040eb70
add esp, 8
push dword [ebp - 0x310]
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
call fcn.0040e940
add esp, 4
push dword [ebp - 0x2e8]
call fcn.0040e940
add esp, 4
push dword [ebp - 0x2e4]
call fcn.0040e940
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
add esp, 4
call edi
mov edx, dword [ebp - 0x124]
cmp edx, 0x10
jb 0x4041cc
mov ecx, dword [ebp - 0x138]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4041c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404673
push edx
push ecx
call fcn.0040eb70
add esp, 8
push dword [ebp - 0x458]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
call fcn.0040e940
add esp, 4
push dword [ebp - 0x430]
call fcn.0040e940
add esp, 4
push dword [ebp - 0x42c]
call fcn.0040e940
add esp, 4
call edi
lea ecx, [ebp - 0x168]
call fcn.00401b40
lea ecx, [ebp - 0x198]
call fcn.00401b40
lea ecx, [ebx + 8]
call fcn.00401b40
lea ecx, [ebx + 0x20]
call fcn.00401b40
lea ecx, [ebx + 0x38]
call fcn.00401b40
lea ecx, [ebx + 0x50]
call fcn.00401b40
jmp 0x4045e5
mov byte [ebp - 4], 0x13
cmp edx, 0x10
jb 0x404280
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404276
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404678
push edx
push ecx
call fcn.0040eb70
add esp, 8
cmp dword [ebx + 0x1c], 0x10
lea esi, [ebx + 8]
mov eax, dword [ebp - 0x42c]
cmovae esi, dword [ebx + 8]
mov dword [ebp - 0x424], 0
test eax, eax
je 0x4042b2
push eax
call fcn.0040e940
add esp, 4
mov dword [ebp - 0x42c], 0
push esi
lea ecx, [ebp - 0x458]
call fcn.00401750
test eax, eax
je 0x4044a3
cmp dword [ebp - 0x124], 0x10
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x458]
cmovae eax, dword [ebp - 0x138]
push eax
call fcn.00401a40
cmp dword [ebx + 0x34], 0x10
lea ecx, [ebx + 0x20]
mov edx, dword [ebx + 0x30]
cmovae ecx, dword [ebx + 0x20]
push 0
push 0x436f80
call fcn.00402150
add esp, 8
test al, al
jne 0x404332
lea eax, [ebx + 0x20]
mov edx, 0x43700c
push eax
lea ecx, [ebp - 0x1b0]
call fcn.00407530
add esp, 4
lea ecx, [ebx + 0x20]
push eax
call fcn.00401b90
lea ecx, [ebp - 0x1b0]
call fcn.00401b40
lea eax, [ebp - 0x138]
mov edx, str._c_start__I_____
push eax
lea ecx, [ebp - 0x4b4]
call fcn.00407530
add esp, 4
push 0x437010
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x4cc]
call fcn.00407490
add esp, 4
lea ecx, [ebx + 0x20]
mov byte [ebp - 4], 0x1a
push ecx
mov edx, eax
lea ecx, [ebp - 0x180]
call fcn.004072f0
add esp, 4
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x4b8]
cmp edx, 0x10
jb 0x4043bb
mov ecx, dword [ebp - 0x4cc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4043b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40467d
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 0x4b8], 0xf
mov byte [ebp - 0x4cc], 0
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x4a0]
cmp edx, 0x10
jb 0x404414
mov ecx, dword [ebp - 0x4b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40440a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404682
push edx
push ecx
call fcn.0040eb70
add esp, 8
cmp dword [ebp - 0x16c], 0x10
lea eax, [ebp - 0x180]
push 0
cmovae eax, dword [ebp - 0x180]
push 0
push eax
push str.C:WindowsSystem32cmd.exe
push 0
push 0
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a0], 0xf
mov byte [ebp - 0x4b4], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0x43704c
lea ecx, [ebp - 0x198]
call fcn.00401da0
mov edx, dword [ebp - 0x16c]
cmp edx, 0x10
jb 0x4044a3
mov ecx, dword [ebp - 0x180]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404499
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404687
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov esi, dword [ebp - 0x480]
movups xmm0, xmmword [ebp - 0x198]
push dword [ebp - 0x310]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x188]
movq qword [esi + 0x10], xmm0
call fcn.0040e940
add esp, 4
push dword [ebp - 0x2e8]
call fcn.0040e940
add esp, 4
push dword [ebp - 0x2e4]
call fcn.0040e940
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
add esp, 4
call edi
mov edx, dword [ebp - 0x124]
cmp edx, 0x10
jb 0x40453a
mov ecx, dword [ebp - 0x138]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404530
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40468c
push edx
push ecx
call fcn.0040eb70
add esp, 8
push dword [ebp - 0x458]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
call fcn.0040e940
add esp, 4
push dword [ebp - 0x430]
call fcn.0040e940
add esp, 4
push dword [ebp - 0x42c]
call fcn.0040e940
add esp, 4
call edi
mov edx, dword [ebp - 0x154]
cmp edx, 0x10
jb 0x4045bb
mov ecx, dword [ebp - 0x168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4045b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404691
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
jmp 0x403fbf
push edx
push ecx
call fcn.0040eb70
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040e92f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
call fcn.00413612
int3