Function at 0x415a86
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x59c
mov eax, dword [0x42e0b4]
xor eax, esp
mov dword [esp + 0x598], eax
push ebx
push esi
push edi
mov esi, 0x403600
or dword [esp + 0x4c], 0xffffffff
lea edi, [esp + 0x388]
mov dword [esp + 0x28], ecx
xor eax, eax
mov dword [esp + 0x44], 0xffff
xor ecx, ecx
xor ebx, ebx
movsd dword es:[edi], dword [esi]
inc ebx
push 0x48
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x1f], cl
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x58], ecx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], ecx
mov byte [esp + 0x1e], cl
mov byte [esp + 0x27], cl
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x74]
mov byte [esp + 0x25], cl
stosd dword es:[edi], eax
pop esi
push esi
push ecx
stosd dword es:[edi], eax
mov dword [esp + 0x64], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x88]
push eax
call fcn.00417fbd
add esp, 0xc
mov dword [esp + 0xc], 0x80010
mov dword [esp + 0x80], esi
mov word [esp + 0xb0], bx
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [esp + 0xbc], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [esp + 0xc0], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
cmp dword [esp + 0x28], 0
mov dword [esp + 0xc0], eax
je 0x421628
xor eax, eax
mov byte [esp + 0x37c], bl
mov esi, 0x104
mov dword [esp + 0x378], eax
push esi
push eax
lea eax, [esp + 0x178]
mov dword [esp + 0x388], esi
push eax
call fcn.00417fbd
xor eax, eax
lea ecx, [esp + 0x17c]
add esp, 0xc
cmp byte [esp + 0x37c], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e3f0
test eax, eax
js 0x416005
mov edi, 0x402734
mov esi, 0x4000
push edi
push esi
call fcn.00416e25
push edi
push esi
mov dword [esp + 0x34], eax
call fcn.00416e25
push edi
push esi
mov dword [esp + 0x4c], eax
call fcn.00416e25
push edi
push 0x4000
mov esi, eax
call fcn.00416e25
mov edi, eax
push 0x402734
push 0x4000
mov dword [esp + 0x80], edi
call fcn.00416e25
push 0x402734
push 0x4000
mov dword [esp + 0x80], eax
call fcn.00416e25
push 0x402734
push 0x4000
mov dword [esp + 0x78], eax
call fcn.00416e25
add esp, 0x38
mov ecx, eax
cmp dword [esp + 0x24], 0
mov dword [esp + 0x3c], ecx
je 0x415f9d
mov eax, dword [esp + 0x34]
test eax, eax
je 0x415f9d
test esi, esi
je 0x415f9d
test edi, edi
je 0x415f9d
cmp dword [esp + 0x50], 0
je 0x415f9d
cmp dword [esp + 0x40], 0
je 0x415f9d
test ecx, ecx
je 0x415f9d
xor ecx, ecx
mov dword [esp + 0x64], 5
mov word [edi], cx
mov word [eax], cx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp word [eax], cx
je 0x415cf4
mov ecx, eax
call fcn.0040ab7f
push 0x22
pop edx
mov dword [esp + 0x14], eax
movzx ecx, word [eax]
cmp cx, dx
je 0x421638
lea edx, [esp + 0x14]
push 0x2000
cmp ecx, 0x2f
je 0x416038
push edi
xor ecx, ecx
call fcn.00416162
cmp eax, ebx
je 0x415f9d
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp word [eax], cx
je 0x415cf4
mov ecx, dword [esp + 0x34]
mov edx, 0x2000
push eax
call fcn.0040f3a0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x60], eax
xor eax, eax
cmp word [edi], ax
je 0x421aa3
push 0x22
pop eax
cmp word [edi], ax
je 0x415d1a
push 0x20
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x421abc
mov ecx, dword [esp + 0x3c]
mov edx, 0x2000
push edi
call fcn.0040f3a0
mov ecx, edi
call fcn.00410060
push eax
mov edx, 0x2000
mov ecx, edi
call fcn.0040f3a0
xor eax, eax
mov edx, edi
mov byte [esp + 0x22], al
mov byte [esp + 0x13], al
lea eax, [esp + 0x14]
push eax
push 0x2d
pop ecx
call fcn.0040ed90
cmp eax, 0xffffffff
jne 0x421b0f
mov ecx, dword [esp + 0x50]
mov edx, 0x2000
push edi
call fcn.0040f3a0
push 0x2000
mov edx, edi
mov dword [esp + 0x14c], edi
lea ecx, [esp + 0x114]
call fcn.0040f410
cmp eax, 3
je 0x421aea
test eax, eax
je 0x421af6
push 5
pop ecx
cmp eax, ecx
je 0x421af6
cmp eax, 2
je 0x421b0f
push dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
mov edx, 0x2000
call fcn.0040f3a0
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push 0x40234c
call fcn.0040fc40
mov eax, dword [esp + 0x60]
test eax, eax
je 0x415de9
mov ecx, dword [esp + 0x40]
mov edx, 0x2000
push eax
call fcn.0040fc40
cmp byte [esp + 0x1a], 0
jne 0x421c2f
push 0x44
pop eax
push eax
xor eax, eax
push eax
lea eax, [esp + 0xd0]
push eax
call fcn.00417fbd
add esp, 0xc
push 0x44
pop eax
mov dword [esp + 0xc8], eax
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
cmp byte [esp + 0x13], 0
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x88], eax
jne 0x421c3e
xor ecx, ecx
lea eax, [esp + 0x68]
push eax
push ecx
push 2
push ecx
mov byte [esp + 0x23], cl
mov dword [esp + 0x78], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x421c83
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x421adf
push dword [esp + 0x68]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x421c92
lea eax, [esp + 0x68]
push eax
xor eax, eax
push eax
push 2
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x421c9f
xor ecx, ecx
mov dword [esp + 0x6c], 1
push ecx
push ecx
push 4
lea eax, [esp + 0x78]
push eax
push 0x60001
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x421cca
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc4], ebx
cmp eax, 0xffff
jne 0x421cde
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x50]
mov eax, dword [esp + 0x18]
push dword [esp + 0x60]
or eax, 0x400
push eax
push 1
xor eax, eax
push eax
push eax
push dword [esp + 0x60]
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
push ebx
setne byte [esp + 0x18]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ebx, ebx
inc ebx
cmp byte [esp + 0x1a], 0
jne 0x421d04
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp byte [esp + 0x13], 0
mov dword [0x4367a8], eax
jne 0x421dde
cmp byte [esp + 0x14], 0
je 0x421dc3
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x421d13
cmp byte [esp + 0x21], 0
jne 0x421db4
push dword [esp + 0x74]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [esp + 0x70]
test eax, eax
je 0x415f99
cmp byte [esp + 0x23], 0
jne 0x421e74
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor eax, eax
mov ebx, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x415fad
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x40]
test eax, eax
je 0x415fbd
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x50]
test eax, eax
je 0x415fcd
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test edi, edi
je 0x415fd9
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test esi, esi
je 0x415fe5
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x415ff5
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x416005
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [esp + 0x378]
xor ecx, ecx
mov dword [esp + 0x378], ecx
test eax, eax
je 0x416021
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [esp + 0x5a4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416b30
mov esp, ebp
pop ebp
ret
add eax, 2
mov ecx, ebx
push esi
mov dword [esp + 0x1c], eax
call fcn.00416162
cmp eax, ebx
je 0x415f9d
push 0x4026f0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x42169b
push 0x4026d8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217ae
push 0x4026c0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217bb
push 0x4026bc
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217c8
push 0x4026a8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4217e2
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
push 0x44
pop ecx
cmp ax, cx
je 0x4217ef
push 0x40269c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x416151
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x421891
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x421a66
push 0x402694
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41615b
push 0x40268c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4218a9
or dword [esp + 0xac], ebx
or word [esp + 0xb0], 7
mov eax, dword [esp + 0x14]
jmp 0x415c8f
or dword [esp + 0xc], 0x80
jmp 0x416148
or dword [esp + 0xc], 0x40
jmp 0x416148
invalid
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
mov ecx, dword [edx + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x34], 0
je 0x42166a
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
jmp 0x42167b
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push ecx
push 4
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00420230
add esp, 0xc
mov dword [ebp - 0x30], eax
push 0x1388
push 0x21
inc ebp
shr byte [eax - 0x78], 1
adc eax, dword [eax]
add byte [edx + 0x21], ch
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call fcn.0041a940
add esp, 0xc
mov dword [ebp - 0x40], 0x400
push 0x400
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
call ecx
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x400
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00416d73
add esp, 8
mov dword [ebp - 0x10], 0
jmp 0x4216f5
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x30]
jae 0x4217ab
imul esi, dword [ebp - 0x10], 0x28
add esi, dword [ebp - 0x34]
mov ecx, 0xa
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
add ecx, dword [ebp - 0x54]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
mov ecx, 1
test ecx, ecx
je 0x4217a6
cmp dword [ebp - 0x14], 0x400
jae 0x421746
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], edx
jmp 0x42174d
mov dword [ebp - 0x28], 0x400
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42175b
jmp 0x4217a6
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00417331
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
add ecx, dword [ebp - 0x20]
push ecx
call fcn.00417331
add esp, 0xc
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
jmp 0x42172c
jmp 0x4216ec
push 0x1388
add byte [eax], al
push 0x42
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call fcn.0041a940
add esp, 0xc
push 0x5dc
adc dword [ecx - 0x3b7c0001], 0x5dc680c
add byte [eax], al
push 0x12c
sub al, 1
add byte [eax], al
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call fcn.0041a530
add esp, 0xc
mov edx, dword [ebp - 0x38]
sub edx, 2
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add edx, 2
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
add ecx, 2
push ecx
call fcn.00417331
add esp, 0xc
push 0x1388
push 0x4d
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call fcn.0041a940
add esp, 0xc
push 0x3e8
push 0x64
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call fcn.0041a530
add esp, 0xc
mov byte [ebp - 4], 0x4d
mov byte [ebp - 3], 0x5a
push 1
mov edx, 1
imul eax, edx, 0
lea ecx, [ebp + eax - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x50]
push eax
call fcn.00417331
add esp, 0xc
push 1
mov ecx, 1
shl ecx, 0
lea edx, [ebp + ecx - 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
add ecx, 1
push ecx
call fcn.00417331
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x64]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x60]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp + 8]
add ecx, dword [edx + 0x58]
push ecx
call fcn.00417331
add esp, 0xc
push 0x1388
push 0x63
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call fcn.0041a940
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x4218c9
xchg ebx, eax
nop
invalid
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax + 0x2c]
call ecx
add esp, 4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop es
add byte [edx + 3], ch
add dword [eax], eax
add byte [ebx - 0x49f0fb3c], al
enter 0xffffffffffffc985, 0x75
pop es
in al, dx
or byte [ebx - 0x3b7c0f1c], al
add al, 0x55
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
add al, 0x89
insb byte es:[edi], dx
and al, 4
mov ebp, esp
sub esp, 0xa00
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x74]
and ecx, 0x200
or byte [ebx - 0x1e7e8bb8], cl
add byte [edx], al
add byte [eax], al
jne 0x421ebd
mov edx, dword [ebx + 8]
push edx
call fcn.00420a60
add esp, 4
push 0x44
lea eax, [ebp - 0xc0]
push eax
call fcn.00416d73
add esp, 8
push 0x10
lea ecx, [ebp - 0x74]
push ecx
call fcn.00416d73
add esp, 8
mov edx, dword [ebx + 8]
mov eax, dword [edx + 0x74]
and eax, 1
je 0x421c8d
or edi, eax
inc ebp
call 0x421c8b
mov dword [ebp - 0x18], 0
jmp 0x421c94
mov dword [ebp - 0x18], 4
add byte [eax], al
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebx + 8]
mov eax, dword [edx + 0x74]
and eax, 2
je 0x421c24
loopne 0x421ca5
je 0x421cae
mov dword [ebp - 0x1c], 0x8000000
jmp 0x421cb5
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x10]
or ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
movzx edx, byte [ecx]
test edx, edx
je 0x421cd7
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x34], 0
jne 0x421cf0
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
movzx edx, byte [ecx]
test edx, edx
jne 0x421d00
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x34], 0
jne 0x421d00
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call fcn.004199f0
add esp, 4
push 4
push 0x1000
push 0x20a
push 0
adc byte [eax], al
add byte [eax + 0xa], ch
add al, byte [eax]
add byte [edx], ch
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
call edx
mov dword [ebp - 0xc], eax
push 0x20a
mov eax, dword [ebp - 0xc]
push eax
call fcn.00416d73
add esp, 8
push 0x104
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x30]
push ecx
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x104]
call edx
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
mov ecx, dword [ecx]
call fcn.00423900
mov dword [ebp - 8], eax
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call fcn.00423930
mov ecx, dword [ebx + 8]
mov edx, dword [ecx + 0x78]
mov eax, dword [edx + 0x18]
and eax, 0x200
je 0x421d91
mov ecx, dword [ebx + 8]
mov edx, dword [ecx + 0x78]
add edx, 0xa9c
mov dword [ebp - 0x20], edx
jmp 0x421d97
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
push 0x4f
push 1
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
add ecx, 0xe0
mov edx, dword [ebp - 0x24]
call fcn.00417696
add esp, 8
mov ecx, dword [ebx + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
imul ecx, dword [eax + 0x21c], 0xc8
mov dword [ebp - 0x4c], ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebx + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 0xa4]
mov ecx, dword [ebp - 8]
call fcn.004237a0
add esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x421e0c
invalid
add al, byte [eax]
add al, cl
add byte [eax], al
add byte [ecx + 0x558db44d], cl
mov word [edx - 0x73], ss
test dword [eax - 1], eax
invalid
invalid
xor al, al
jmp 0x422112
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x34]
or edx, 2
mov eax, dword [ebp - 8]
mov dword [eax + 0x34], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call fcn.0041a950
add esp, 4
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebx + 8]
mov edx, dword [edx + 0x78]
mov ecx, dword [ebp - 8]
call fcn.00423960
add esp, 0xc
movzx eax, al
mov dword [ebp - 0x64], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ecx]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call fcn.00423910
mov ecx, dword [ebx + 8]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call fcn.00423920
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x74]
mov dword [ecx + 4], edx
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0x70]
dec ebp
nop
mov dword [eax + 8], ecx
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
movzx edx, byte [ecx]
test edx, edx
je 0x421e92
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x34], 0
jne 0x421eab
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
movzx edx, byte [ecx]
test edx, edx
jne 0x421ebb
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x34], 0
jne 0x421ebb
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call fcn.004199a0
add esp, 4
jmp 0x421f0f
mov edx, dword [ebx + 8]
mov eax, dword [edx + 0x78]
mov ecx, dword [eax + 0xcd0]
push ecx
push 0
push 0x1fffff
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xcc]
call edx
mov ecx, dword [ebx + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebx + 8]
mov eax, dword [edx + 0x78]
mov ecx, dword [eax + 0xcd4]
push ecx
push 0
push 0x1fffff
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xd0]
call edx
mov ecx, dword [ebx + 8]
mov dword [ecx + 8], eax
push 0x670
lea edx, [ebp - 0xa00]
push edx
call fcn.00416d73
add esp, 8
mov dword [ebp - 0x9d0], 0x10002
push 0x2cc
lea eax, [ebp - 0x390]
push eax
call fcn.00416d73
add esp, 8
mov dword [ebp - 0x390], 0x10002
mov ecx, dword [ebx + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x34], 0
je 0x421f61
lea eax, [ebp - 0xa00]
mov dword [ebp - 0x28], eax
jmp 0x421f6a
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x50], edx
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x34], 0
je 0x421f81
mov byte [ebp - 1], 1
jmp 0x421f85
mov byte [ebp - 1], 0
movzx edx, byte [ebp - 1]
push edx
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebx + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call fcn.0041a120
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x421fb3
xor al, al
jmp 0x422112
mov ecx, dword [ebx + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x34], 0
je 0x422093
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x34], 0
je 0x421fd6
mov dword [ebp - 0x2c], 0x10
jmp 0x421fdd
mov dword [ebp - 0x2c], 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x54], edx
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
cmp dword [ecx + 0x34], 0
je 0x421ff7
mov dword [ebp - 0x30], 8
jmp 0x421ffe
mov dword [ebp - 0x30], 4
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
add eax, dword [ebp - 0x978]
adc ecx, dword [ebp - 0x974]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x38]
mov dword [edx + 0x30], eax
mov ecx, dword [ebp - 0x34]
mov dword [edx + 0x34], ecx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov edx, dword [ebp - 0x58]
push edx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebx + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp - 0x2ec]
add eax, 8
xor ecx, ecx