Function at 0x404136
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fb1b
mov eax, dword fs:[0]
push eax
sub esp, 0xc08
mov eax, dword [0x42a038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xbbc], ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0xa64], 0
mov dword [ebp - 0xa54], 0
mov dword [ebp - 0xa50], 0xf
mov byte [ebp - 0xa64], 0
mov dword [ebp - 4], 0
mov esi, edi
test edi, edi
je 0x403d4d
cmp word [edi], 0
je 0x403d49
nop
add esi, 2
cmp word [esi], 0
jne 0x403d40
sub esi, edi
sar esi, 1
lea eax, [esi + 1]
xor ebx, ebx
push 1
push eax
mov dword [ebp - 0xbc4], ebx
call fcn.0040dadb
mov edx, eax
add esp, 8
mov dword [ebp - 0xbe4], edx
test edx, edx
je 0x404a37
mov ecx, 0xfc
lea eax, [ebp - 0xb68]
nop
mov byte [eax], bl
lea eax, [eax + 1]
sub ecx, 1
jne 0x403d80
test esi, esi
je 0x403d9b
nop
mov al, byte [edi + ecx*2]
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jb 0x403d90
lea eax, [ebp - 0xb68]
push eax
push 4
push esi
push edx
call fcn.004084ec
mov esi, eax
add esp, 0x10
mov dword [ebp - 0xbc0], esi
test esi, esi
je 0x404a29
push 0x4271a8
push esi
call fcn.0040806a
push eax
call fcn.00407ffe
push 0x4271ac
push esi
mov dword [ebp - 0xbc8], eax
call fcn.0040806a
push eax
call fcn.00407ffe
dec eax
add esp, 0x18
cmp eax, 0x19
ja case.0x403df3.7
jmp dword [eax*4 + 0x404a9c]
mov edi, 0x4271b0
mov ebx, 1
jmp 0x4043a4
mov esi, dword [ebp - 0xbbc]
push 1
mov eax, dword [esi + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
jmp 0x40491e
mov esi, dword [ebp - 0xbbc]
push 0
mov eax, dword [esi + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
jmp 0x40491e
mov ebx, dword [ebp - 0xbbc]
mov ecx, dword [ebx + 0x30]
test ecx, ecx
je 0x403e64
mov eax, dword [ecx]
push ecx
call dword [eax + 0x60]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x403e7b
push eax
call fcn.0040d753
add esp, 4
mov dword [ebx + 0xc], 0
mov eax, dword [ebx + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x404a0f
push str.dpwhnfyvlcskr
push esi
call fcn.0040806a
push eax
call fcn.0040823f
add esp, 0xc
xor edi, edi
mov ebx, eax
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x403ee5
lea eax, [esi + 1]
push 1
push eax
call fcn.0040dadb
mov edi, eax
add esp, 8
test edi, edi
je 0x403ee5
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x403ee5
push edi
call fcn.0040d753
add esp, 4
xor edi, edi
xor ebx, ebx
test edi, edi
setne bl
mov dword [ebp - 0xbc4], ebx
jmp 0x40439c
push 0x4271b8
push esi
call fcn.0040806a
push eax
call fcn.0040823f
push str.dpwhnfyvlcskr
push dword [ebp - 0xbc0]
mov esi, eax
call fcn.0040806a
push eax
call fcn.0040823f
add esp, 0x18
push eax
push esi
call fcn.00404b10
xor edi, edi
cmp eax, 1
jne 0x40492b
mov ebx, eax
jmp 0x40492b
push 0x4271b8
push esi
call fcn.0040806a
push eax
call fcn.0040823f
add esp, 0xc
lea ecx, [ebp - 0x21c]
mov esi, eax
xor edi, edi
mov edx, 0x20a
nop
mov byte [ecx], bl
lea ecx, [ecx + 1]
sub edx, 1
jne 0x403f60
mov eax, esi
test esi, esi
je 0x403f7b
cmp byte [esi], bl
je 0x403f79
inc eax
cmp byte [eax], bl
jne 0x403f74
sub eax, esi
push eax
lea edx, [ebp - 0x21c]
mov ecx, esi
call fcn.00406950
add esp, 4
mov eax, edx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403ee5
mov edx, 8
lea ecx, [ebp - 0xa6c]
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x403fc0
lea eax, [ebp - 0xa6c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40404d
mov esi, dword [ebp - 0xa6c]
test esi, esi
je 0x40404d
lea eax, [esi + 1]
push 1
push eax
call fcn.0040dadb
mov edi, eax
add esp, 8
mov dword [ebp - 0xbc4], edi
test edi, edi
je 0x40404d
mov dword [ebp - 0xb70], 0
nop dword [eax + eax]
push 0
lea eax, [ebp - 0xb70]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40403c
add edi, dword [ebp - 0xb70]
sub esi, dword [ebp - 0xb70]
jne 0x404010
mov edi, dword [ebp - 0xbc4]
jmp 0x40404d
mov eax, dword [ebp - 0xbc4]
push eax
call fcn.0040d753
add esp, 4
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
test edi, edi
setne bl
mov dword [ebp - 0xbc4], ebx
jmp 0x40439c
push 0x4271b8
push esi
call fcn.0040806a
push eax
call fcn.0040823f
add esp, 0xc
lea ecx, [ebp - 0x428]
mov esi, eax
mov edx, 0x20a
mov byte [ecx], bl
lea ecx, [ecx + 1]
sub edx, 1
jne 0x404087
mov eax, esi
test esi, esi
je 0x4040a7
cmp byte [esi], bl
je 0x4040a5
nop dword [eax + eax]
inc eax
cmp byte [eax], bl
jne 0x4040a0
sub eax, esi
push eax
lea edx, [ebp - 0x428]
mov ecx, esi
call fcn.00406950
add esp, 4
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edi, edi
cmp eax, 0xffffffff
je 0x40492b
lea ebx, [edi + 1]
jmp 0x40492b
push 0x4271b8
push esi
call fcn.0040806a
push eax
call fcn.0040823f
add esp, 0xc
lea ecx, [ebp - 0x634]
mov esi, eax
mov edx, 0x20a
mov byte [ecx], bl
lea ecx, [ecx + 1]
sub edx, 1
jne 0x4040f5
mov eax, esi
test esi, esi
je 0x404117
cmp byte [esi], bl
je 0x404115
nop dword [eax]
inc eax
cmp byte [eax], bl
jne 0x404110
sub eax, esi
push eax
lea edx, [ebp - 0x634]
mov ecx, esi
call fcn.00406950
add esp, 4
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403f2a
push 0x4271b8
push esi
call fcn.0040806a
push eax
call fcn.0040823f
push str.dpwhnfyvlcskr
push esi
mov ebx, eax
call fcn.0040806a
push eax
call fcn.0040823f
push 0x4271bc
push esi
mov edi, eax
call fcn.0040806a
add esp, 0x20
test eax, eax
je 0x404188
push 0x4271bc
push esi
call fcn.0040806a
add esp, 8
cmp dword [eax], 5
jne 0x404188
mov esi, 1
jmp 0x40418a
xor esi, esi
mov ecx, 0x20a
lea eax, [ebp - 0xa4c]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x404195
mov ecx, 0x20a
lea eax, [ebp - 0x840]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4041b0
mov eax, edi
test edi, edi
je 0x4041ce
cmp byte [edi], 0
je 0x4041cc
inc eax
cmp byte [eax], 0
jne 0x4041c6
sub eax, edi
push eax
lea edx, [ebp - 0xa4c]
mov ecx, edi
call fcn.00406950
add esp, 4
mov eax, ebx
test ebx, ebx
je 0x4041f8
cmp byte [ebx], 0
je 0x4041f6
nop word [eax + eax]
inc eax
cmp byte [eax], 0
jne 0x4041f0
sub eax, ebx
push eax
lea edx, [ebp - 0x840]
mov ecx, ebx
call fcn.00406950
add esp, 4
lea eax, [ebp - 0xbb8]
mov ecx, 0x3c
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x404214
lea eax, [ebp - 0x840]
mov dword [ebp - 0xbb8], 0x3c
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0xa4c]
mov dword [ebp - 0xba4], eax
lea eax, [ebp - 0xbb8]
push eax
mov dword [ebp - 0xbac], str.open
mov dword [ebp - 0xb9c], 1
mov dword [ebp - 0xbb4], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test esi, esi
je 0x404924
mov eax, dword [ebp - 0xb80]
test eax, eax
je 0x404924
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x404924
lea eax, [ebp - 0xbfc]
push eax
call fcn.00404d40
push eax
lea ecx, [ebp - 0xa64]
call fcn.00405ad0
mov edx, dword [ebp - 0xbe8]
cmp edx, 0x10
jb 0x4042e2
mov ecx, dword [ebp - 0xbfc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4042d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a8b
push edx
push ecx
call fcn.0040741b
add esp, 8
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbe8], 0xf
mov byte [ebp - 0xbfc], bl
jmp 0x404377
push 0x4271b8
push esi
call fcn.0040806a
push eax
call fcn.0040823f
add esp, 0xc
push eax
lea eax, [ebp - 0xc14]
push eax
call fcn.00405160
push eax
lea ecx, [ebp - 0xa64]
call fcn.00405ad0
mov edx, dword [ebp - 0xc00]
cmp edx, 0x10
jb 0x404361
mov ecx, dword [ebp - 0xc14]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404357
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a90
push edx
push ecx
call fcn.0040741b
add esp, 8
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc00], 0xf
mov byte [ebp - 0xc14], bl
cmp dword [ebp - 0xa54], ebx
jbe case.0x403df3.7
cmp dword [ebp - 0xa50], 0x10
lea edi, [ebp - 0xa64]
mov ebx, 1
cmovae edi, dword [ebp - 0xa64]
test edi, edi
je 0x40492b
push edi
push str.dpwhnfyvlcskr
push ebx
push 0x4271e4
push dword [ebp - 0xbc8]
push 0x4271a8
push str.s:i__s:b__s:s
call fcn.00409982
add esp, 0x1c
jmp 0x404949
push 0x4271c0
push esi
call fcn.0040806a
push eax
call fcn.00407ffe
push 0x4271b8
push esi
mov ebx, eax
call fcn.0040806a
push eax
call fcn.0040823f
push 0x4271c4
push esi
mov edi, eax
call fcn.0040806a
push eax
call fcn.0040823f
push 0x4271c8
push esi
mov dword [ebp - 0xbd0], eax
call fcn.0040806a
push eax
call fcn.00407ffe
push 0x4271cc
push dword [ebp - 0xbc0]
mov esi, eax
call fcn.0040806a
push eax
call fcn.00407ffe
push 0x4271d0
push dword [ebp - 0xbc0]
mov dword [ebp - 0xbcc], eax
call fcn.0040806a
add esp, 0x44
push eax
call fcn.0040823f
push 0x4271d4
push dword [ebp - 0xbc0]
mov dword [ebp - 0xbdc], eax
call fcn.0040806a
push eax
call fcn.00407ffe
add esp, 0x10
mov dword [ebp - 0xbd8], eax
lea eax, [ebp - 0xb6c]
mov dword [ebp - 0xb6c], 0
push 0
push eax
push 0
push esi
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4044d2
push dword [ebp - 0xbd8]
push dword [ebp - 0xbdc]
push dword [ebp - 0xbcc]
push eax
push dword [ebp - 0xbd0]
push dword [ebp - 0xb6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
mov ecx, 1
test eax, eax
cmove ebx, ecx
jmp 0x4044d4
xor ebx, ebx
mov eax, dword [ebp - 0xb6c]
test eax, eax
je case.0x403df3.7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x403df3.7
push str.dpwhnfyvlcskr
push esi
call fcn.0040806a
push eax
call fcn.0040823f
mov edi, eax
add esp, 0xc
mov esi, edi
test edi, edi
je 0x404517
cmp byte [edi], bl
je 0x404515
nop
inc esi
cmp byte [esi], bl
jne 0x404510
sub esi, edi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x404924
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x404574
lea eax, [esi + 1]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x404574
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
test ecx, ecx
je 0x404574
test esi, esi
je 0x404564
sub edi, ecx
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub esi, 1
jne 0x404556
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x404924
push str.dpwhnfyvlcskr
push esi
call fcn.0040806a
push eax
call fcn.0040823f
push 0x4271d8
push esi
mov edi, eax
call fcn.0040806a
push eax
call fcn.0040823f
push 0x4271dc
push esi
mov dword [ebp - 0xbd0], eax
call fcn.0040806a
push eax
call fcn.00407ffe
mov esi, dword [ebp - 0xbbc]
add esp, 0x24
mov dword [ebp - 0xbcc], eax
mov ebx, 1
mov esi, dword [esi + 8]
test esi, esi
jne 0x4046a6
mov edx, 0xc
lea ecx, [ebp - 0xb7c]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, ebx
jne 0x4045e4
mov al, byte [edi]
mov ecx, 0x1266
test al, al
je 0x404611
nop dword [eax]
movsx eax, al
lea ecx, [ecx + ecx*8]
add ecx, eax
lea edi, [edi + 1]
mov al, byte [edi]
test al, al
jne 0x404600
mov edx, dword [ebp - 0xbd0]
mov dword [ebp - 0xb78], ecx
mov ecx, 0x1266
mov al, byte [edx]
test al, al
je 0x404639
movsx eax, al
lea ecx, [ecx + ecx*8]
add ecx, eax
lea edx, [edx + 1]
mov al, byte [edx]
test al, al
jne 0x404628
lea eax, [ebp - 0xb7c]
mov dword [ebp - 0xb7c], ecx
push eax
push 0x4053d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0xb74]
test esi, esi
je case.0x403df3.7
xor edi, edi
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x404675
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0xbcc]
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x4046ba
inc edi
cmp edi, 5
jl 0x404661
jmp case.0x403df3.7
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
jne 0x40465f
mov ebx, 2
jmp case.0x403df3.7
mov eax, dword [ebp - 0xbbc]
mov ebx, 3
mov dword [eax + 8], esi
jmp case.0x403df3.7
push str.dpwhnfyvlcskr
push esi
call fcn.0040806a
push 0x4271d4
push esi
mov dword [ebp - 0xbdc], eax
call fcn.0040806a
push eax
call fcn.00407ffe
mov edi, eax
push 0x4271dc
push esi
mov dword [ebp - 0xbcc], edi
call fcn.0040806a
push eax
call fcn.00407ffe
push 0x4271e0
push esi
mov dword [ebp - 0xbd8], eax
call fcn.0040806a
push eax
call fcn.00407ffe
push 0x1c
push edi
mov dword [ebp - 0xbd0], eax
xor ebx, ebx
call fcn.0040dadb
mov esi, eax
add esp, 0x34
mov dword [ebp - 0xbd4], esi
test esi, esi
je 0x4047e4
mov eax, dword [ebp - 0xbd0]
test eax, eax
je 0x404751
mov dword [0x42ca94], eax
mov ebx, dword [ebp - 0xbcc]
xor edi, edi
test ebx, ebx
jle 0x4047c1
add esi, 8
push edi
push dword [ebp - 0xbdc]
mov dword [esi - 8], 1
call fcn.00407e45
push eax
call fcn.00407ffe
inc edi
mov word [esi - 4], ax
add esp, 0xc
mov dword [esi], 0
lea esi, [esi + 0x1c]
cmp edi, ebx
jl 0x404760
mov esi, dword [ebp - 0xbd4]
mov edi, dword [sym.imp.USER32.dll_SendInput]
push 0x1c
push esi
push ebx
call edi
push dword [ebp - 0xbd8]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esi + 8]
mov ecx, ebx
mov dword [eax], 2
lea eax, [eax + 0x1c]
sub ecx, 1
jne 0x4047b1
jmp 0x4047d9
mov edi, dword [sym.imp.USER32.dll_SendInput]
push 0x1c
push esi
push ebx
call edi
push dword [ebp - 0xbd8]
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1c
push esi
push ebx
call edi
mov ebx, 1
mov dword [0x42ca94], 0
test esi, esi
je case.0x403df3.7
push esi
call fcn.0040d753
add esp, 4
jmp case.0x403df3.7
push str.dpwhnfyvlcskr
push esi
call fcn.0040806a
push eax
call fcn.0040823f
mov edi, eax
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x404831
push 4
push 1
call fcn.0040dadb
add esp, 8
jmp 0x404924
cmp byte [edi], bl
je 0x40483a
inc esi
cmp byte [esi], bl
jne 0x404835
sub esi, edi
push 4
lea eax, [esi + 1]
push eax
call fcn.0040dadb
add esp, 8
mov edx, eax
test esi, esi
je 0x404924
push esi
mov ecx, edi
call fcn.00406950
mov ebx, dword [ebp - 0xbbc]
xor esi, esi
push 0x420f45
push 0x10
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0xc], edx
mov dword [ebp - 0xbd4], eax
call fcn.00407175
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4048ad
mov dword [edi + 8], 1
mov dword [edi], vtable.Microsoft::WRL::RuntimeClass_struct_Microsoft::WRL::RuntimeClassFlags_2___struct_ICoreWebView2CreateCoreWebView2ControllerCompletedHandler_.0
mov ecx, dword [0x42ca9c]
test ecx, ecx
je 0x4048a2
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov dword [edi + 0xc], ebx
mov esi, edi
mov dword [edi], method.Microsoft::WRL::RuntimeClass_struct_Microsoft::WRL::RuntimeClassFlags_2___struct_ICoreWebView2CreateCoreWebView2ControllerCompletedHandler_.virtual_0
mov dword [ebp - 0xbe0], esi
mov ecx, dword [ebp - 0xbd4]
push esi
mov byte [ebp - 4], 1
push dword [ebx + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
mov byte [ebp - 4], 0
test esi, esi
je 0x404924
mov eax, dword [esi]
push esi
mov dword [ebp - 0xbe0], 0
call dword [eax + 8]
jmp 0x404924
mov eax, dword [0x42c884]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x4048f3
push eax
call esi
mov eax, dword [0x42c880]
test eax, eax
je 0x4048ff
push eax
call esi
mov ebx, dword [ebp - 0xbbc]
push 0
mov eax, dword [ebx + 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, 1
xor edi, edi
push ebx
push 0x4271e4
push dword [ebp - 0xbc8]
push 0x4271a8
push 0x4271e8
call fcn.00409982
add esp, 0x14
mov ebx, eax
push 0x200
push ebx
call fcn.00409926
add esp, 8
mov dword [ebp - 0xbc8], eax
test eax, eax
je 0x4049d5
cmp byte [eax], 0
mov esi, eax
je 0x404976
nop
inc esi
cmp byte [esi], 0
jne 0x404970
sub esi, eax
push 2
lea eax, [esi + 1]
push eax
call fcn.0040dadb
mov edx, eax
add esp, 8
mov dword [ebp - 0xbd4], edx
test edx, edx
je 0x4049c6
push esi
mov esi, dword [ebp - 0xbc8]
mov ecx, esi
call fcn.00406950
mov eax, dword [ebp - 0xbbc]
add esp, 4
mov ecx, dword [eax + 0x18]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x84]
push dword [ebp - 0xbd4]
call fcn.0040d753
add esp, 4
jmp 0x4049cc
mov esi, dword [ebp - 0xbc8]
push esi
call fcn.0040d753
add esp, 4
test ebx, ebx
je 0x4049f3
cmp dword [ebx + 4], 0xffffffff
je 0x4049f3
mov eax, dword [ebx + 4]
add eax, 0xffffffff
mov dword [ebx + 4], eax
jne 0x4049f3
push ebx
call fcn.00407f0b
add esp, 4
cmp dword [ebp - 0xbc4], 0
je 0x404a09
test edi, edi
je 0x404a09
push edi
call fcn.0040d753
add esp, 4
mov esi, dword [ebp - 0xbc0]
cmp dword [esi + 4], 0xffffffff
je 0x404a29
mov eax, dword [esi + 4]
add eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x404a29
push esi
call fcn.00407f0b
add esp, 4
push dword [ebp - 0xbe4]
call fcn.0040d753
add esp, 4
mov edx, dword [ebp - 0xa50]
cmp edx, 0x10
jb 0x404a6d
mov ecx, dword [ebp - 0xa64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a63
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a95
push edx
push ecx
call fcn.0040741b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406f4d
mov esp, ebp
pop ebp
ret 4
call fcn.0040da8a
call fcn.0040da8a
call fcn.0040da8a
nop
cli
cmp eax, 1040777280
inc eax
add byte [0x5100403e], ch
inc eax
add byte [edx - 0x8ffbfc2], dl
inc eax
add byte [ecx], ch
dec ecx
inc eax
add byte [ecx], ch
dec ecx
inc eax
add byte [edi + edi], bh
inc eax
add byte [esi + 0x40], ah
inc eax
add ah, dl
inc eax
inc eax
add byte [esi], dh
inc ecx
inc eax
add byte [eax - 0x5ffbfbe], dl
inc edx
inc eax
add byte [ecx], ch
dec ecx
inc eax
add byte [ecx], ch
dec ecx
inc eax
add byte [ecx], ch
dec ecx
inc eax
add byte [ecx], ch
dec ecx
inc eax
add ch, cl
inc ebx
inc eax
add byte [ecx], ch
dec ecx
inc eax
add byte [ecx], ch
dec ecx
inc eax
add dh, ch
inc esp
inc eax
add byte [edi + 0x45], bh
inc eax
add ch, cl
inc esi
inc eax
add byte [eax + ecx*2], al
inc eax
add cl, ah
dec eax
inc eax
add ah, cl
int3