Function at 0x41561c
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x415624
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x416db4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00403c30
mov eax, dword [ebp - 0x30]
mov edx, 0x416dcc
call fcn.00401d20
jne 0x41566d
push 1
push 0x416dd4
call sub.kernel32.dll_WinExec
call fcn.00401948
lea ecx, [ebp - 0x38]
xor edx, edx
xor eax, eax
call fcn.004149a4
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00404068
mov eax, dword [ebp - 0x34]
call fcn.004040e4
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00403c30
mov eax, dword [ebp - 0x3c]
call fcn.00409410
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, 2
mov edx, 0xffffffde
call fcn.00409314
mov edx, 0x41984c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.0040930c
mov edx, 0x419854
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.0040930c
mov edx, 0x41985c
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.0040930c
mov edx, 0x419864
mov eax, dword [ebp - 0x10]
mov ecx, 8
call fcn.0040930c
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.0040930c
lea edx, [ebp - 0x29]
mov eax, dword [ebp - 0x10]
mov ecx, 1
call fcn.0040930c
cmp byte [ebp - 0x29], 0xf1
je 0x41572b
mov eax, dword [ebp - 0x10]
call fcn.00408648
call fcn.00414c68
mov eax, dword [0x41984c]
mov edx, dword [0x419850]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x415745
call fcn.004013f4
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409314
xor eax, eax
mov al, byte [ebp - 0x2a]
inc eax
push eax
mov eax, 0x419828
mov ecx, 1
mov edx, dword [0x414618]
call fcn.00402710
add esp, 4
xor ebx, ebx
mov bl, byte [ebp - 0x2a]
test ebx, ebx
jl 0x4157a9
inc ebx
xor esi, esi
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x40]
mov eax, dword [0x419828]
test eax, eax
je 0x415798
cmp esi, dword [eax - 4]
jb 0x41579d
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x41577c
mov eax, 0x62
call fcn.00414994
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x419844
mov ecx, 1
mov edx, dword [0x4146f8]
call fcn.00402710
add esp, 4
dec ebx
test ebx, ebx
jl 0x415808
inc ebx
xor esi, esi
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x44]
mov eax, dword [0x419844]
test eax, eax
je 0x4157f7
cmp esi, dword [eax - 4]
jb 0x4157fc
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x4157db
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415900
inc ebx
xor esi, esi
lea eax, [ebp - 0x48]
push eax
mov eax, esi
shl eax, 2
mov edx, dword [0x419844]
test edx, edx
je 0x41582e
cmp eax, dword [edx - 4]
jb 0x415833
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00408fe4
test eax, eax
jns 0x415844
call fcn.004013f4
mov edx, esi
shl edx, 2
add edx, 2
mov ecx, dword [0x419844]
test ecx, ecx
je 0x41585b
cmp edx, dword [ecx - 4]
jb 0x415860
call fcn.004013f4
mov edx, dword [ecx + edx*4]
push edx
mov edx, esi
shl edx, 2
inc edx
mov ecx, dword [0x419844]
test ecx, ecx
je 0x415879
cmp edx, dword [ecx - 4]
jb 0x41587e
call fcn.004013f4
mov edx, dword [ecx + edx*4]
pop ecx
call fcn.00414d00
mov edx, dword [ebp - 0x48]
mov eax, dword [0x419844]
test eax, eax
je 0x415898
cmp esi, dword [eax - 4]
jb 0x41589d
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
mov eax, dword [0x419844]
test eax, eax
je 0x4158b3
cmp esi, dword [eax - 4]
jb 0x4158b8
call fcn.004013f4
cmp dword [eax + esi*4], 0
jne 0x4158f8
mov eax, dword [0x419844]
test eax, eax
je 0x4158cc
cmp esi, dword [eax - 4]
jb 0x4158d1
call fcn.004013f4
lea eax, [eax + esi*4]
mov edx, esi
shl edx, 2
add edx, 3
mov ecx, dword [0x419844]
test ecx, ecx
je 0x4158eb
cmp edx, dword [ecx - 4]
jb 0x4158f0
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415816
push edi
mov eax, 0x419844
mov ecx, 1
mov edx, dword [0x4146f8]
call fcn.00402710
add esp, 4
mov eax, 0x6e
call fcn.0041496c
mov byte [0x418618], al
call fcn.00403d3c
mov ebx, eax
test ebx, ebx
jle 0x415b8a
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00403c30
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00409018
mov eax, dword [ebp - 8]
mov edx, 0x416de8
call fcn.00401d20
jne 0x415967
mov byte [0x418618], 1
mov eax, dword [ebp - 8]
mov edx, 0x416df4
call fcn.00401d20
jne 0x41597d
mov byte [0x41861c], 1
mov eax, dword [ebp - 8]
mov edx, 0x416e00
call fcn.00401d20
jne 0x4159b2
mov eax, 0x6b
mov edx, dword [0x419828]
test edx, edx
je 0x4159a0
cmp eax, dword [edx - 4]
jb 0x4159a5
call fcn.004013f4
lea eax, [edx + eax*4]
mov edx, 0x416e0c
call fcn.00401aa4
mov eax, dword [ebp - 8]
mov edx, 0x416e18
call fcn.00401d20
jne 0x4159e7
mov eax, 0x3f
mov edx, dword [0x419828]
test edx, edx
je 0x4159d5
cmp eax, dword [edx - 4]
jb 0x4159da
call fcn.004013f4
lea eax, [edx + eax*4]
mov edx, 0x416e0c
call fcn.00401aa4
lea eax, [ebp - 0x4c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x4c]
mov edx, 0x416e24
call fcn.00401d20
jne 0x415a56
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00403d8c
mov edx, dword [ebp - 0x50]
mov eax, 0x3a
mov ecx, dword [0x419828]
test ecx, ecx
je 0x415a49
cmp eax, dword [ecx - 4]
jb 0x415a4e
call fcn.004013f4
lea eax, [ecx + eax*4]
call fcn.00401aa4
lea eax, [ebp - 0x58]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x58]
mov edx, 0x416e30
call fcn.00401d20
jne 0x415aaf
mov eax, 0x6a
mov edx, dword [0x419828]
test edx, edx
je 0x415a8f
cmp eax, dword [edx - 4]
jb 0x415a94
call fcn.004013f4
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
lea eax, [ebp - 0x5c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x5c]
mov edx, 0x416e3c
call fcn.00401d20
jne 0x415af0
push 0x41986c
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.00401e30
lea eax, [ebp - 0x60]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00401e30
mov eax, dword [ebp - 0x60]
mov edx, 0x416e48
call fcn.00401d20
jne 0x415b82
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
call fcn.00401bdc
mov ecx, eax
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.00401e30
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00414b48
mov edx, dword [ebp - 0x64]
mov eax, 0x1d
mov ecx, dword [0x419828]
test ecx, ecx
je 0x415b52
cmp eax, dword [ecx - 4]
jb 0x415b57
call fcn.004013f4
mov eax, dword [ecx + eax*4]
call fcn.00401d20
jne 0x415b82
mov eax, 0x1d
mov edx, dword [0x419828]
test edx, edx
je 0x415b75
cmp eax, dword [edx - 4]
jb 0x415b7a
call fcn.004013f4
lea eax, [edx + eax*4]
call fcn.00401a50
inc esi
dec ebx
jne 0x41593c
cmp byte [0x418618], 0
je 0x415bbc
mov eax, 0x1d
mov edx, dword [0x419828]
test edx, edx
je 0x415ba7
cmp eax, dword [edx - 4]
jb 0x415bac
call fcn.004013f4
cmp dword [edx + eax*4], 0
je 0x415bbc
call fcn.00414a68
call fcn.00401948
mov eax, 0x41
mov edx, dword [0x419828]
test edx, edx
je 0x415bd0
cmp eax, dword [edx - 4]
jb 0x415bd5
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x6c]
xor edx, edx
call fcn.00410160
mov edx, dword [ebp - 0x6c]
mov eax, 0x419878
call fcn.00401aa4
push 0x416e50
push 0
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
test eax, eax
jne 0x415c14
push 0x416e50
push 0
push 0
call fcn.00402ae8
jmp 0x415c40
mov eax, dword [0x419878]
call fcn.00401dd4
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
push 9
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.00414a68
call fcn.00401948
mov eax, dword [0x418684]
mov eax, dword [eax]
mov edx, dword [0x419878]
call fcn.0040a770
cmp byte [0x418618], 0
jne 0x415c6f
push 5
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
jmp 0x415c7d
mov eax, dword [0x418684]
mov eax, dword [eax]
xor edx, edx
call fcn.00405f3c
mov eax, 0x32
call fcn.00414994
mov edi, eax
shl edi, 3
sub edi, eax
push edi
mov eax, 0x41981c
mov ecx, 1
mov edx, dword [0x4145b8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415cde
inc ebx
xor esi, esi
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x70]
mov eax, dword [0x41981c]
test eax, eax
je 0x415ccd
cmp esi, dword [eax - 4]
jb 0x415cd2
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415cb1
mov eax, 0x60
call fcn.00414994
lea edi, [eax + eax*2]
push edi
mov eax, 0x419840
mov ecx, 1
mov edx, dword [0x4146d8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415d3b
inc ebx
xor esi, esi
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x74]
mov eax, dword [0x419840]
test eax, eax
je 0x415d2a
cmp esi, dword [eax - 4]
jb 0x415d2f
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415d0e
mov eax, 0x1f
call fcn.00414994
mov edi, eax
add edi, edi
push edi
mov eax, 0x419848
mov ecx, 1
mov edx, dword [0x414718]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415d99
inc ebx
xor esi, esi
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x78]
mov eax, dword [0x419848]
test eax, eax
je 0x415d88
cmp esi, dword [eax - 4]
jb 0x415d8d
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415d6c
mov eax, 0x36
call fcn.00414994
mov edi, eax
shl edi, 3
push edi
mov eax, 0x419818
mov ecx, 1
mov edx, dword [0x414598]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415df8
inc ebx
xor esi, esi
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x7c]
mov eax, dword [0x419818]
test eax, eax
je 0x415de7
cmp esi, dword [eax - 4]
jb 0x415dec
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415dcb
mov eax, 0x43
call fcn.00414994
lea edi, [eax + eax*2]
push edi
mov eax, 0x419820
mov ecx, 1
mov edx, dword [0x4145d8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415e55
inc ebx
xor esi, esi
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x80]
mov eax, dword [0x419820]
test eax, eax
je 0x415e44
cmp esi, dword [eax - 4]
jb 0x415e49
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415e28
mov eax, 0x5d
call fcn.00414994
mov edi, eax
add edi, edi
push edi
mov eax, 0x419824
mov ecx, 1
mov edx, dword [0x4145f8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415eb9
inc ebx
xor esi, esi
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x84]
mov eax, dword [0x419824]
test eax, eax
je 0x415ea8
cmp esi, dword [eax - 4]
jb 0x415ead
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415e86
mov eax, 0x28
call fcn.00414994
mov ebx, eax
mov eax, 0x19
call fcn.00414994
add ebx, eax
mov edi, ebx
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419814
mov ecx, 1
mov edx, dword [0x414578]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415f2e
inc ebx
xor esi, esi
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x88]
mov eax, dword [0x419814]
test eax, eax
je 0x415f1d
cmp esi, dword [eax - 4]
jb 0x415f22
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415efb
mov eax, 0x18
call fcn.00414994
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
push edi
mov eax, 0x419834
mov ecx, 1
mov edx, dword [0x414678]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415f95
inc ebx
xor esi, esi
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x419834]
test eax, eax
je 0x415f84
cmp esi, dword [eax - 4]
jb 0x415f89
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415f62
mov eax, 0x2d
call fcn.00414994
mov edi, eax
add edi, edi
push edi
mov eax, 0x419838
mov ecx, 1
mov edx, dword [0x414698]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x415ff9
inc ebx
xor esi, esi
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x90]
mov eax, dword [0x419838]
test eax, eax
je 0x415fe8
cmp esi, dword [eax - 4]
jb 0x415fed
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x415fc6
mov eax, 0x14
call fcn.00414994
mov edi, eax
add edi, edi
push edi
mov eax, 0x41983c
mov ecx, 1
mov edx, dword [0x4146b8]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x41605d
inc ebx
xor esi, esi
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x94]
mov eax, dword [0x41983c]
test eax, eax
je 0x41604c
cmp esi, dword [eax - 4]
jb 0x416051
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x41602a
mov eax, 0x1a
call fcn.00414994
mov edi, eax
shl edi, 2
push edi
mov eax, 0x419830
mov ecx, 1
mov edx, dword [0x414658]
call fcn.00402710
add esp, 4
mov ebx, edi
dec ebx
test ebx, ebx
jl 0x4160c2
inc ebx
xor esi, esi
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x98]
mov eax, dword [0x419830]
test eax, eax
je 0x4160b1
cmp esi, dword [eax - 4]
jb 0x4160b6
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x41608f
mov eax, 0x1a
call fcn.00414994
mov edi, eax
mov eax, 0x39
call fcn.00414994
imul edi, eax
lea eax, [edi + 1]
push eax
mov eax, 0x41982c
mov ecx, 1
mov edx, dword [0x414638]
call fcn.00402710
add esp, 4
mov ebx, edi
test ebx, ebx
jle 0x416135
mov esi, 1
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
call fcn.00405310
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x41982c]
test eax, eax
je 0x416124
cmp esi, dword [eax - 4]
jb 0x416129
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416102
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 2
call fcn.004149a4
mov eax, dword [ebp - 8]
call fcn.00409438
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, 0x416e68
call fcn.004052a8
mov eax, dword [0x41985c]
mov edx, dword [0x419860]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x416176
call fcn.004013f4
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.00409314
mov eax, dword [0x419854]
mov edx, dword [0x419858]
test edx, edx
je 0x416197
call fcn.004013f4
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00414bd8
mov eax, dword [ebp - 0x14]
call fcn.00408648
mov eax, dword [ebp - 0x10]
call fcn.00408648
mov dl, 1
mov eax, dword [0x40c8c4]
call fcn.0040cc94
mov ebx, eax
lea eax, [ebp - 0xa0]
call fcn.004042f8
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040d144
mov eax, ebx
call fcn.00401464
cmp dword [0x41986c], 0
je 0x416284
mov byte [0x418614], 0xff
mov eax, 0x1a
call fcn.00414994
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x416271
inc ebx
xor esi, esi
mov eax, esi
shl eax, 2
mov edx, dword [0x419830]
test edx, edx
je 0x416220
cmp eax, dword [edx - 4]
jb 0x416225
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea edx, [ebp - 0xa4]
call fcn.00409018
mov eax, dword [ebp - 0xa4]
push eax
lea edx, [ebp - 0xa8]
mov eax, dword [0x41986c]
call fcn.00409018
mov eax, dword [ebp - 0xa8]
pop edx
call fcn.00401f14
test eax, eax
jle 0x41626d
mov eax, esi
cmp eax, 0xff
jbe 0x416268
call fcn.004013f4
mov byte [0x418614], al
inc esi
dec ebx
jne 0x41620c
cmp byte [0x418614], 0xff
jne 0x416284
mov eax, 0x41986c
call fcn.00401a50
mov eax, 0x1a
call fcn.00414994
dec eax
jle 0x4162d9
cmp dword [0x41986c], 0
jne 0x4162d9
mov edx, dword [0x418684]
mov edx, dword [edx]
mov eax, dword [0x418638]
call fcn.0040dbc0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405f4c
mov eax, dword [0x418638]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00406f9c
cmp byte [0x418620], 0
jne 0x4162d9
call fcn.00414a68
call fcn.00401948
mov eax, 0x1a
call fcn.00414994
dec eax
jle 0x416386
cmp byte [0x418614], 0
jbe 0x416386
mov eax, 0x41986c
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
mov ecx, dword [0x419830]
test ecx, ecx
je 0x416316
cmp edx, dword [ecx - 4]
jb 0x41631b
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
mov eax, 0x39
call fcn.00414994
mov ebx, eax
test ebx, ebx
jle 0x4163a9
mov esi, 1
mov eax, 0x39
call fcn.00414994
xor edx, edx
mov dl, byte [0x418614]
imul edx
add eax, esi
mov edx, dword [0x41982c]
test edx, edx
je 0x41635d
cmp eax, dword [edx - 4]
jb 0x416362
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, dword [0x41982c]
test eax, eax
je 0x416373
cmp esi, dword [eax - 4]
jb 0x416378
call fcn.004013f4
lea eax, [eax + esi*4]
call fcn.00401aa4
inc esi
dec ebx
jne 0x416338
jmp 0x4163a9
mov eax, 0x41986c
xor edx, edx
mov ecx, dword [0x419830]
test ecx, ecx
je 0x41639c
cmp edx, dword [ecx - 4]
jb 0x4163a1
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401aa4
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
add edx, 2
mov ecx, dword [0x419830]
test ecx, ecx
je 0x4163c9
cmp edx, dword [ecx - 4]
jb 0x4163ce
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
cmp dword [ebp - 8], 0
je 0x4163fa
mov eax, dword [ebp - 8]
call fcn.00408fe4
cmp eax, 0xff
jbe 0x4163f0
call fcn.004013f4
mov edx, dword [0x418654]
mov byte [edx], al
jmp 0x416402
mov eax, dword [0x418654]
mov byte [eax], 0xf
lea eax, [ebp - 8]
xor edx, edx
mov dl, byte [0x418614]
shl edx, 2
add edx, 3
mov ecx, dword [0x419830]
test ecx, ecx
je 0x416422
cmp edx, dword [ecx - 4]
jb 0x416427
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
cmp dword [ebp - 8], 0
je 0x416453
mov eax, dword [ebp - 8]
call fcn.00408fe4
cmp eax, 0xff
jbe 0x416449
call fcn.004013f4
mov edx, dword [0x4186bc]
mov byte [edx], al
jmp 0x41645b
mov eax, dword [0x4186bc]
mov byte [eax], 0x10
mov eax, 0x3d
call fcn.00414994
call fcn.00407fd8
test al, al
je 0x41650c
cmp byte [0x418618], 0
jne 0x416502
push 0x30
mov eax, 0x41
mov edx, dword [0x419828]
test edx, edx
je 0x416495
cmp eax, dword [edx - 4]
jb 0x41649a
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
mov eax, 0x3e
mov edx, dword [0x419828]
test edx, edx
je 0x4164b7
cmp eax, dword [edx - 4]
jb 0x4164bc
call fcn.004013f4
mov ecx, dword [edx + eax*4]
mov eax, 0x34
mov edx, dword [0x41982c]
test edx, edx
je 0x4164d3
cmp eax, dword [edx - 4]
jb 0x4164d8
call fcn.004013f4
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0xac]
call fcn.00401c28
mov eax, dword [ebp - 0xac]
call fcn.00401dd4
push eax
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00414a68
call fcn.00401948
mov eax, 0x63
call fcn.0041496c
test al, al
je 0x41656c
call fcn.00414ed8
test al, al
jne 0x41656c
push 0x30
mov eax, dword [0x419878]
call fcn.00401dd4
push eax
mov eax, 0x55
mov edx, dword [0x41982c]
test edx, edx
je 0x416544
cmp eax, dword [edx - 4]
jb 0x416549
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
call fcn.00414a68
call fcn.00401948
mov eax, 0x64
call fcn.0041496c
test al, al
je 0x4166c3
mov eax, 0x64
mov edx, dword [0x419828]
test edx, edx
je 0x416592
cmp eax, dword [edx - 4]
jb 0x416597
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.0040382c
fstp qword [ebp - 0x20]
wait
call fcn.00414d60
fstp qword [ebp - 0x28]
wait
mov eax, 0x55
call fcn.0041496c
test al, al
je 0x4165c5
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
jb 0x4165e6
mov eax, 0x55
call fcn.0041496c
test al, al
jne 0x4166c3
fld qword [ebp - 0x28]
fcomp qword [ebp - 0x20]
fnstsw ax
sahf
je 0x4166c3
lea eax, [ebp - 8]
mov edx, 0x56
mov ecx, dword [0x41982c]
test ecx, ecx
je 0x4165fd
cmp edx, dword [ecx - 4]
jb 0x416602
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
mov eax, 2
call fcn.0041496c
test al, al
je 0x416650
mov esi, 4
push dword [ebp - 8]
push 0x416e78
mov eax, 0x57
mov edx, dword [0x41982c]
test edx, edx
je 0x416639
cmp eax, dword [edx - 4]
jb 0x41663e
call fcn.004013f4
push dword [edx + eax*4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00401c9c
jmp 0x416652
xor esi, esi
or esi, 0x30
test esi, esi
jns 0x41665e
call fcn.004013f4
push esi
mov eax, dword [0x419878]
call fcn.00401dd4
push eax
mov eax, dword [ebp - 8]
call fcn.00401dd4
push eax
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x4166b9
push 1
push 0
push 0
mov eax, 2
mov edx, dword [0x419828]
test edx, edx
je 0x4166a2
cmp eax, dword [edx - 4]
jb 0x4166a7
call fcn.004013f4
mov eax, dword [edx + eax*4]
call fcn.00401dd4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00414a68
call fcn.00401948
mov eax, 0x67
call fcn.0041496c
test al, al
je 0x41679d
lea eax, [ebp - 8]
mov edx, 0x68
mov ecx, dword [0x419828]
test ecx, ecx
je 0x4166ec
cmp edx, dword [ecx - 4]
jb 0x4166f1
call fcn.004013f4
mov edx, dword [ecx + edx*4]
call fcn.00401ae8
mov eax, 0x69
call fcn.00414994
cmp eax, 2
jge 0x416777
mov ebx, 1
xor esi, esi
jmp 0x41676d
mov esi, ebx
mov eax, 0x69
call fcn.00414994
sub eax, 1
jb 0x416726
je 0x41673a
jmp 0x416744
mov eax, dword [ebp - 8]
call fcn.00401dd4
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
jmp 0x416744
mov eax, dword [ebp - 8]
call fcn.004152ac
mov ebx, eax
test ebx, ebx
je 0x41676d
mov eax, dword [0x418684]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x28]
je 0x41676d
mov eax, dword [0x419810]
mov eax, dword [eax + 0x18]
cmp ebx, dword [eax + 0x28]
je 0x41676d
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
je 0x41679d
cmp ebx, esi
jne 0x416711
jmp 0x41679d
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00409018
call fcn.0040c790
cmp al, 3
jbe 0x416795
mov eax, dword [ebp - 0xc]
call fcn.004154ac
jmp 0x41679d
mov eax, dword [ebp - 0xc]
call fcn.0041539c
mov eax, 1
call fcn.0041496c
test al, al
je 0x416c03
cmp byte [0x418618], 0
jne 0x416c03
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ad84
xor edx, edx
call fcn.00403674
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.00407ff4
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
mov edx, eax
pop ecx
pop eax
call fcn.0040ace4
call fcn.0040a904
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040abbc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab94
pop edx
call fcn.0040b6f4
mov edx, dword [0x418680]
mov dword [edx], eax
mov eax, 3
call fcn.0041496c
test al, al
je 0x4168a4
mov eax, 6
call fcn.0041496c
xor al, 1
push eax
mov eax, 4
call fcn.00414994
push eax
mov eax, 5
call fcn.00414994
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040abbc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab94
push eax
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040bb28
call fcn.00408e24
pop edx
pop ecx
call fcn.00414fc0
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.00407290
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ad84
pop edx
call fcn.00403674
jmp 0x416a2a
xor edx, edx
xor eax, eax
call fcn.0040b6f4
mov edx, dword [0x418658]
mov dword [edx], eax
lea ecx, [ebp - 0xb0]
xor edx, edx
mov eax, 6
call fcn.004149a4
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x418658]
mov eax, dword [eax]
call fcn.0040bbc8
mov eax, 7
call fcn.00414994
sub eax, 1
jb 0x4168f6
je 0x416919
dec eax
je 0x416974
jmp 0x416a2a
mov eax, dword [0x418658]
mov eax, dword [eax]
call fcn.00407290
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ad84
pop edx
call fcn.00403674
jmp 0x416a2a
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a960
lea eax, [ebp - 0xc0]
push eax
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040bb28
call fcn.00408e24
mov edx, eax
mov eax, dword [0x418658]
mov eax, dword [eax]
pop ecx
call fcn.0040b8cc
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.00407290
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ad84
pop edx
call fcn.00403674
jmp 0x416a2a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040abbc
mov edx, dword [0x418658]
mov edx, dword [edx]
sub eax, dword [edx + 0x18]
mov dword [ebp - 0xc4], eax
fild dword [ebp - 0xc4]
fdiv dword [0x416e7c]
call fcn.00401298
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4169af
call fcn.004013f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab94
mov edx, dword [0x418658]
mov edx, dword [edx]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0xc8], eax
fild dword [ebp - 0xc8]
fdiv dword [0x416e7c]
call fcn.00401298
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4169eb
call fcn.004013f4
push eax
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.0040bb28
call fcn.00408e24
mov edx, eax
mov eax, dword [0x418658]
mov eax, dword [eax]
pop ecx
call fcn.0040b81c
mov eax, dword [0x418680]
mov eax, dword [eax]
call fcn.00407290
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ad84
pop edx
call fcn.00403674
mov eax, 8
mov edx, dword [0x419828]
test edx, edx
je 0x416a3e
cmp eax, dword [edx - 4]
jb 0x416a43
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xcc]
xor edx, edx
call fcn.00410160
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040a770
mov eax, 9
mov edx, dword [0x419828]
test edx, edx
je 0x416a78
cmp eax, dword [edx - 4]
jb 0x416a7d
call fcn.004013f4
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0xd0]
xor edx, edx
call fcn.00410160
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040a770
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0040ad4c
mov ebx, eax
mov eax, 0xa
call fcn.00414994
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.004089dc
mov eax, 0xb
mov edx, dword [0x419828]
test edx, edx
je 0x416ad7
cmp eax, dword [edx - 4]
jb 0x416adc
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.004036c4
mov eax, 0xc
call fcn.00414994
mov edx, eax
mov eax, ebx
call fcn.00403654
mov eax, 0xd
call fcn.00414994
mov edx, eax
cmp edx, 0xff
jbe 0x416b12
call fcn.004013f4
mov eax, ebx
call fcn.004036b4
mov eax, 0xe
call fcn.00414994
mov edx, eax
mov eax, ebx
call fcn.00408a10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ad4c
mov ebx, eax
mov eax, 0xf
call fcn.00414994
mov edx, eax
mov eax, ebx
call fcn.00408a10
mov eax, 0x10
call fcn.00414994
mov edx, eax
mov eax, ebx
call fcn.00403654
mov eax, 0x11
call fcn.00414994
mov edx, eax
cmp edx, 0xff
jbe 0x416b78
call fcn.004013f4
mov eax, ebx
call fcn.004036b4
mov eax, 0x12
call fcn.00414994
mov ecx, eax
mov eax, ebx
mov edx, 4
call fcn.004089dc
mov eax, 0x13
mov edx, dword [0x419828]
test edx, edx
je 0x416bab
cmp eax, dword [edx - 4]
jb 0x416bb0
call fcn.004013f4
mov edx, dword [edx + eax*4]
mov eax, ebx
call fcn.004036c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040abbc
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040abbc
sub ebx, eax
sub ebx, 8
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040ab94
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040ab94
pop edx
sub edx, eax
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
pop ecx
call fcn.00407ff4
jmp 0x416c0e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00405f4c
mov eax, 0x31
call fcn.0041496c
test al, al
je 0x416c51
xor edx, edx
xor eax, eax
call fcn.0040b6f4
mov edx, dword [0x41867c]
mov dword [edx], eax
lea ecx, [ebp - 0xd4]
xor edx, edx
mov eax, 4
call fcn.004149a4
mov edx, dword [ebp - 0xd4]
mov eax, dword [0x41867c]
mov eax, dword [eax]
call fcn.0040bbc8
mov eax, 0x3f
call fcn.0041496c
test al, al
je 0x416c94
xor edx, edx
xor eax, eax
call fcn.0040b6f4
mov edx, dword [0x418660]
mov dword [edx], eax
lea ecx, [ebp - 0xd8]
xor edx, edx
mov eax, 5
call fcn.004149a4
mov edx, dword [ebp - 0xd8]
mov eax, dword [0x418660]
mov eax, dword [eax]
call fcn.0040bbc8
mov eax, 0x70
call fcn.0041496c
test al, al
je 0x416cd7
xor edx, edx
xor eax, eax
call fcn.0040b6f4
mov edx, dword [0x418668]
mov dword [edx], eax
lea ecx, [ebp - 0xdc]
xor edx, edx
mov eax, 7
call fcn.004149a4
mov edx, dword [ebp - 0xdc]
mov eax, dword [0x418668]
mov eax, dword [eax]
call fcn.0040bbc8
mov eax, 0x58
call fcn.0041496c
test al, al
jne 0x416d01
mov eax, 0x59
call fcn.0041496c
test al, al
jne 0x416d01
mov eax, 0x5a
call fcn.0041496c
test al, al
je 0x416d36
xor edx, edx
xor eax, eax
call fcn.0040b6f4
mov edx, dword [0x418694]
mov dword [edx], eax
lea ecx, [ebp - 0xe0]
xor edx, edx
mov eax, 8
call fcn.004149a4
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x418694]
mov eax, dword [eax]
call fcn.0040bbc8
mov eax, 0x1d
call fcn.0041496c
test al, al
je 0x416d79
xor edx, edx
xor eax, eax
call fcn.0040b6f4
mov edx, dword [0x4186c4]
mov dword [edx], eax
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, 9
call fcn.004149a4
mov edx, dword [ebp - 0xe4]
mov eax, dword [0x4186c4]
mov eax, dword [eax]
call fcn.0040bbc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416dbb
lea eax, [ebp - 0xe4]
mov edx, 7
call fcn.00401a74
lea eax, [ebp - 0xb0]
mov edx, 0x21
call fcn.00401a74
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401a74
ret