Function at 0x73a0bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x34
push 0
push 0
dec ecx
jne 0x73a0c4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x73b315
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x739c80]
call fcn.0040999c
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x73a0fc
sub edx, 0xfffffff8
call fcn.00410d98
mov eax, dword [0x8dc9cc]
cmp byte [eax], 1
je 0x73b2c3
mov byte [ebp - 0x37], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x59c]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dword [eax + 0xc], edx
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x36], 0
lea edx, [ebp - 0x35]
mov eax, dword [ebp - 0x34]
call fcn.007395c8
mov eax, dword [ebp - 0x34]
mov edx, dword [eax + 0x510]
mov eax, dword [ebp - 0x34]
add eax, 0x4ac
mov ecx, 0x73b330
call fcn.0040ca8c
cmp byte [ebp - 0x35], 0
jne 0x73a1c1
mov eax, dword [ebp - 0x34]
mov edx, dword [eax + 0x510]
lea eax, [ebp - 0x10]
mov ecx, 0x73b384
call fcn.0040ca8c
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.00430c70
cmp al, 1
jne 0x73a1c1
xor eax, eax
push ebp
push 0x73a1b7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x73b3d0
push 0x73b3d4
mov eax, dword [ebp - 0x10]
call fcn.0040c824
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73a1c1
cmp byte [ebp - 0x35], 0
jne 0x73b2b5
mov eax, 0x3a98
call fcn.004c78cc
lea eax, [ebp - 0x24]
call fcn.0040b8d8
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4ac]
mov dl, 1
call fcn.00430c70
cmp al, 1
jne 0x73a1f5
mov byte [ebp - 0x36], 1
cmp byte [ebp - 0x36], 1
jne 0x73b2b5
mov byte [ebp - 0x38], 0
xor eax, eax
push ebp
push 0x73adc1
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043debc
push eax
push 1
push 0x1000
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x4ac]
mov dl, 1
mov eax, dword [0x4a3554]
call fcn.004ca8e4
mov esi, eax
jmp 0x73ad99
lea edx, [ebp - 0x14]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0xfc]
push eax
xor ecx, ecx
mov edx, 0x73b3fc
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0xfc]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x100]
push eax
xor ecx, ecx
mov edx, 0x73b40c
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x100]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x104]
push eax
mov ecx, 0x73b42c
mov edx, 0x73b468
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x73b494
mov edx, 0x73b4c0
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x10c]
push eax
mov ecx, 0x73b4e0
mov edx, 0x73b568
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x110]
push eax
mov ecx, 0x73b5cc
mov edx, 0x73b61c
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x73b66c
mov edx, 0x73b6b8
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x118]
push eax
mov ecx, 0x73b704
mov edx, 0x73b758
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x11c]
push eax
mov ecx, 0x73b7ac
mov edx, 0x73b7e0
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x120]
push eax
mov ecx, 0x73b80c
mov edx, 0x73b840
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x124]
push eax
mov ecx, 0x73b868
mov edx, 0x73b894
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x128]
push eax
mov ecx, 0x73b8b8
mov edx, 0x73b8d8
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, 0x73b8fc
mov edx, 0x73b92c
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x130]
push eax
mov ecx, 0x73b958
mov edx, 0x73b998
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x134]
push eax
mov ecx, 0x73b9c8
mov edx, 0x73ba04
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x134]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x138]
push eax
mov ecx, 0x73ba40
mov edx, 0x73ba68
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x13c]
push eax
mov ecx, 0x73ba8c
mov edx, 0x73bac4
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x140]
push eax
mov ecx, 0x73bae8
mov edx, 0x73bb10
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x140]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, 0x73bb38
mov edx, 0x73bb64
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x148]
push eax
mov ecx, 0x73bb8c
mov edx, 0x73bba8
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x14]
call fcn.0040bcec
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bbc4
call fcn.0040cdb0
mov edi, eax
test edi, edi
jne 0x73a620
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bc04
call fcn.0040cdb0
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
sete bl
jmp 0x73a622
xor ebx, ebx
test bl, bl
je 0x73a645
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bc2c
call fcn.0040cdb0
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
sete byte [ebp - 0x4d]
jmp 0x73a649
mov byte [ebp - 0x4d], 0
cmp byte [ebp - 0x4d], 0
je 0x73a66e
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bc50
call fcn.0040cdb0
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
sete byte [ebp - 0x55]
jmp 0x73a672
mov byte [ebp - 0x55], 0
cmp byte [ebp - 0x55], 0
je 0x73a697
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bc78
call fcn.0040cdb0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
sete byte [ebp - 0x5d]
jmp 0x73a69b
mov byte [ebp - 0x5d], 0
cmp byte [ebp - 0x5d], 0
je 0x73a6c0
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bca4
call fcn.0040cdb0
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
sete byte [ebp - 0x65]
jmp 0x73a6c4
mov byte [ebp - 0x65], 0
cmp byte [ebp - 0x65], 0
je 0x73a6e9
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bcd0
call fcn.0040cdb0
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
sete byte [ebp - 0x6d]
jmp 0x73a6ed
mov byte [ebp - 0x6d], 0
cmp byte [ebp - 0x6d], 0
je 0x73a712
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bcfc
call fcn.0040cdb0
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
sete byte [ebp - 0x75]
jmp 0x73a716
mov byte [ebp - 0x75], 0
cmp byte [ebp - 0x75], 0
je 0x73a73b
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bd20
call fcn.0040cdb0
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
sete byte [ebp - 0x7d]
jmp 0x73a73f
mov byte [ebp - 0x7d], 0
cmp byte [ebp - 0x7d], 0
je 0x73ad99
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bd44
call fcn.0040cdb0
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x73ad99
cmp byte [ebp - 0x38], 0
jne 0x73a847
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bd68
call fcn.0040cdb0
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jle 0x73a7a2
mov byte [ebp - 0x8d], 1
jmp 0x73a7c8
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bdac
call fcn.0040cdb0
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
setg byte [ebp - 0x8d]
cmp byte [ebp - 0x8d], 0
je 0x73a7da
mov byte [ebp - 0x95], 1
jmp 0x73a800
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bdf0
call fcn.0040cdb0
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
setg byte [ebp - 0x95]
cmp byte [ebp - 0x95], 0
je 0x73a812
mov byte [ebp - 0x9d], 1
jmp 0x73a838
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73be30
call fcn.0040cdb0
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
setg byte [ebp - 0x9d]
cmp byte [ebp - 0x9d], 0
je 0x73a86c
mov byte [ebp - 0x38], 1
jmp 0x73a86c
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73be80
call fcn.0040cdb0
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jle 0x73a86c
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x39], 0
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bf08
call fcn.0040cdb0
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jle 0x73a895
mov byte [ebp - 0x39], 1
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bf58
call fcn.0040cdb0
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jle 0x73a8ba
mov byte [ebp - 0x39], 1
cmp byte [ebp - 0x39], 0
jne 0x73a8f8
lea eax, [ebp - 0x20]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040cc5c
mov eax, dword [ebp - 0x20]
mov edx, 0x73bf9c
call fcn.0040cc24
je 0x73a8f4
mov eax, dword [ebp - 0x20]
mov edx, 0x73bfac
call fcn.0040cc24
jne 0x73a8f8
mov byte [ebp - 0x39], 1
cmp byte [ebp - 0x39], 0
jne 0x73a95d
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bfbc
call fcn.0040cdb0
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jle 0x73a95d
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73bfec
call fcn.0040cdb0
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xa
jle 0x73a95d
dec dword [ebp - 0x40]
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040cc5c
cmp byte [ebp - 0x38], 0
jne 0x73ad99
cmp byte [ebp - 0x39], 0
jne 0x73ad99
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73c000
call fcn.0040cdb0
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jle 0x73ab15
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73c028
call fcn.0040cdb0
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jle 0x73a9c0
mov byte [ebp - 0xc1], 1
jmp 0x73a9e6
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73c044
call fcn.0040cdb0
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
setg byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x73a9f8
mov byte [ebp - 0xc9], 1
jmp 0x73aa1e
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73c060
call fcn.0040cdb0
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
setg byte [ebp - 0xc9]
cmp byte [ebp - 0xc9], 0
je 0x73aa30
mov byte [ebp - 0xd1], 1
jmp 0x73aa56
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73c074
call fcn.0040cdb0
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
setg byte [ebp - 0xd1]
cmp byte [ebp - 0xd1], 0
je 0x73aa6d
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xc], 5
mov byte [ebp - 0x37], 1
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73c088
call fcn.0040cdb0
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jle 0x73aa97
mov byte [ebp - 0xdd], 1
jmp 0x73aabd
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73c0a4
call fcn.0040cdb0
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
setg byte [ebp - 0xdd]
cmp byte [ebp - 0xdd], 0
je 0x73aacf
mov byte [ebp - 0xe5], 1
jmp 0x73aaf5
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x73c0c0
call fcn.0040cdb0
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
setg byte [ebp - 0xe5]
cmp byte [ebp - 0xe5], 0
je 0x73ab15
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xc], 0
jne 0x73ab11
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xc], 2
mov byte [ebp - 0x37], 1
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x73c0dc
call fcn.0040ca8c
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x14c]
push eax
mov ecx, 0x73c0f0
mov edx, 0x73c110
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x150]
push eax
mov ecx, 0x73c130
mov edx, 0x73c160
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x154]
call dword [eax - 0x47]
nop
sal dword [ebx], 0xba
invalid
sal dword [ebx], 0x8b
inc ebp
in al, dx
call fcn.0043a6dc
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x158]
push eax
mov ecx, 0x73c1f8
mov edx, 0x73c224
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x15c]
push eax
mov ecx, 0x73c250
mov edx, 0x73c27c
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x15c]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x160]
push eax
mov ecx, 0x73c2a8
mov edx, 0x73c2d8
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x160]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x164]
push eax
mov ecx, 0x73c308
mov edx, 0x73c338
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x168]
push eax
mov ecx, 0x73c368
mov edx, 0x73c390
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x16c]
push eax
mov ecx, 0x73c3b8
mov edx, 0x73c3e8
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x170]
push eax
mov ecx, 0x73c418
mov edx, 0x73c44c
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x174]
push eax
mov ecx, 0x73c480
mov edx, 0x73c4ac
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x178]
push eax
mov ecx, 0x73c4d8
mov edx, 0x73c504
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x14]
call fcn.0040bcec
movzx eax, byte [0x73b3ec]
push eax
lea eax, [ebp - 0x17c]
push eax
mov ecx, 0x73c530
mov edx, 0x73c55c
mov eax, dword [ebp - 0x14]
call fcn.0043a6dc
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 0x14]
call fcn.0040bcec
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x59c]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
test al, al
je 0x73a23a
test esi, esi
setne al
cmp al, 1
jne 0x73adb7
mov eax, esi
call fcn.004099cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73add9
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x59c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x73b225
push 0
push 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
call fcn.004ba080
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
call fcn.004baef4
push 0
push 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
call fcn.004ba080
call fcn.0043d69c
mov ecx, eax
mov eax, dword [ebp - 0x34]
mov edx, dword [eax + 0x4a4]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x59c]
mov ebx, dword [eax]
call dword [ebx + 0x8c]
push 0
push 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
call fcn.004ba080
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp edx, 0
jne 0x73ae72
cmp eax, 0
jbe 0x73b225
jmp 0x73ae78
jle 0x73b225
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, eax
lea eax, [ebp - 0x24]
xor ecx, ecx
call fcn.0040c438
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
lea eax, [ebp - 0x24]
call fcn.0040be88
mov edx, eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
mov eax, dword [eax + 4]
pop ecx
call fcn.00407720
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x4a4]
call fcn.004baef4
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x34]
mov edx, dword [edx + 0x4a8]
call fcn.0040c28c
je 0x73b225
mov eax, dword [0x8dd8ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
je 0x73af19
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax - 4]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 9
jne 0x73b225
mov eax, dword [ebp - 0x34]
add eax, 0x4a8
mov edx, dword [ebp - 0x24]
call fcn.0040bd48
mov eax, dword [ebp - 0x44]
add eax, 0x14
mov edx, dword [ebp - 0x24]
call fcn.0040bd48
mov eax, dword [0x8dc9cc]
cmp byte [eax], 0
jne 0x73af5f
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x73af58
sub edx, 0xffffffd8
xor eax, eax
call fcn.004c776c
xor eax, eax
push ebp
push 0x73afb3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x184]
mov edx, dword [ebp - 0x44]
mov edx, dword [edx + 0x14]
call fcn.0040c8f4
mov eax, dword [ebp - 0x184]
push eax
call fcn.00608f44
lea ecx, [ebp - 0x180]
pop edx
call fcn.00608d30
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 0x28]
mov ecx, 0
call fcn.0040c4b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73afc5
cmp dword [ebp - 0x28], 0
je 0x73b225
call fcn.00433e5c
fstp qword [ebp - 0xf8]
wait
push dword [ebp - 0xf4]
push dword [ebp - 0xf8]
lea edx, [ebp - 0x18]
mov eax, dword [0x8dd7e8]
call fcn.00434e58
lea eax, [ebp - 0x188]
push eax
mov ecx, 2
mov edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0040cc5c
push dword [ebp - 0x188]
push 0x73c588
lea eax, [ebp - 0x18c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.0040cc5c
push dword [ebp - 0x18c]
push 0x73c588
lea eax, [ebp - 0x190]
push eax
mov ecx, 4
mov edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0040cc5c
push dword [ebp - 0x190]
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.0040cb14
lea eax, [ebp - 0x2c]
call fcn.008575bc
mov eax, dword [ebp - 0x44]
add eax, 0x10
call fcn.0040b8d8
mov eax, dword [ebp - 0x44]
push dword [eax + 0x10]
push 0x73c598
lea eax, [ebp - 0x194]
push eax
mov eax, dword [0x8dd8ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
mov ecx, 1
mov edx, 1
call fcn.0040c31c
push dword [ebp - 0x194]
push 0x73c5c4
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, 4
call fcn.0040c1c4
mov eax, dword [ebp - 0x44]
push dword [eax + 0x10]
mov eax, dword [0x8dd8ec]
mov eax, dword [eax]
push dword [eax + 0x48c]
push 0x73c5e8
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, 3
call fcn.0040c1c4
mov eax, dword [ebp - 0x44]
push dword [eax + 0x10]
lea eax, [ebp - 0x19c]
mov edx, dword [ebp - 0x1c]
mov ecx, 0
call fcn.0040c4b4
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x198]
call fcn.00517a04
push dword [ebp - 0x198]
push 0x73c5e8
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, 3
call fcn.0040c1c4
mov eax, dword [ebp - 0x44]
push dword [eax + 0x10]
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x2c]
call fcn.00517a04
push dword [ebp - 0x1a0]
push 0x73c5e8
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, 3
call fcn.0040c1c4
mov eax, dword [ebp - 0x44]
push dword [eax + 0x10]
lea edx, [ebp - 0x1a4]
mov eax, dword [ebp - 0x28]
call fcn.00517a04
push dword [ebp - 0x1a4]
push 0x73c5f8
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, 3
call fcn.0040c1c4
mov eax, 1
call fcn.004c78cc
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 0x10]
mov edx, dword [0x9781f4]
call fcn.0040c28c
je 0x73b225
mov eax, 0x9781f4
mov edx, dword [ebp - 0x44]
mov edx, dword [edx + 0x10]
call fcn.0040bd48
mov eax, dword [0x8dc9cc]
cmp byte [eax], 0
jne 0x73b1d7
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x73b1d0
sub edx, 0xffffffdc
xor eax, eax
call fcn.004c776c
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x10], 0
je 0x73b225
push 0x73c618
mov eax, dword [ebp - 0x44]
push dword [eax + 0x10]
push 0x73c62c
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, 3
call fcn.0040c1c4
mov eax, 5
call fcn.004c78cc
mov eax, dword [0x8dc9cc]
cmp byte [eax], 0
jne 0x73b225
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x73b21e
sub edx, 0xffffffe0
xor eax, eax
call fcn.004c776c
cmp byte [ebp - 0x37], 1
jne 0x73b284
mov eax, dword [ebp - 0x34]
cmp byte [eax + 0x4b9], 2
je 0x73b2b5
mov eax, dword [ebp - 0x34]
mov byte [eax + 0x4b9], 2
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xc], 0
jg 0x73b254
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xc], 9
jle 0x73b267
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xc], 1
mov eax, dword [0x8dc9cc]
cmp byte [eax], 0
jne 0x73b2b5
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x73b27b
sub edx, 0xffffffe4
xor eax, eax
call fcn.004c776c
jmp 0x73b2b5
mov eax, dword [ebp - 0x34]
cmp byte [eax + 0x4b9], 1
je 0x73b2b5
mov eax, dword [ebp - 0x34]
mov byte [eax + 0x4b9], 1
mov eax, dword [0x8dc9cc]
cmp byte [eax], 0
jne 0x73b2b5
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x73b2ae
sub edx, 0xffffffe8
xor eax, eax
call fcn.004c776c
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x59c]
mov edx, dword [eax]
call dword [edx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73b31c
lea eax, [ebp - 0x1a4]
mov edx, 5
call fcn.0040b94c
lea eax, [ebp - 0x190]
mov edx, 0x26
call fcn.0040b914
lea eax, [ebp - 0x30]
call fcn.00410d80
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040b94c
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.0040b914
pop eax
jmp eax