Function at 0x4026c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Enumerate processes
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406bf9
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x40a008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push eax
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 8
mov dword [ebp - 0x2f0], 0x22c
xor esi, esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x40277f
lea eax, [ebp - 0x2f0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40276d
nop word [eax + eax]
push 0x40731c
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
lea eax, [ebp - 0x2f0]
push eax
cmove esi, dword [ebp - 0x2e8]
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402740
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
test esi, esi
je 0x402785
jmp 0x402812
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Plants_vs._Zombies
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 0x2f4], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [ebp - 0x2f4]
test esi, esi
jne 0x402812
push 0x40736c
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wchdir]
push 0x44
lea eax, [ebp - 0x4b8]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x74]
xorps xmm0, xmm0
movups xmmword [ebp - 0x74], xmm0
push eax
lea eax, [ebp - 0x4b8]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x40731c
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402808
push dword [ebp - 0x74]
call edi
push dword [ebp - 0x70]
call edi
mov esi, dword [ebp - 0x6c]
jmp 0x40280a
xor esi, esi
test esi, esi
je 0x40325c
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov cl, byte [0x40b2c4]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [0x40b2c8], eax
test cl, cl
je 0x40283d
mov edx, dword [0x6a9ec0]
jmp 0x40286b
push 0
push 4
lea ecx, [ebp - 0x2f4]
mov dword [ebp - 0x2f4], 0
push ecx
push 0x6a9ec0
push eax
call esi
mov edx, dword [ebp - 0x2f4]
mov cl, byte [0x40b2c4]
mov eax, dword [0x40b2c8]
add edx, 0x350
test cl, cl
jne 0x402888
push 0
push 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push ecx
push edx
push eax
call esi
xor edx, edx
lea ecx, [edx + 4]
call fcn.004012c0
mov dword [0x40b2cc], eax
mov al, byte [0x40b2c4]
test al, al
je 0x4028a8
mov ecx, dword [0x6a9ec0]
jmp 0x4028d5
push 0
push 4
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x2f4], 0
push eax
push 0x6a9ec0
push dword [0x40b2c8]
call esi
mov ecx, dword [ebp - 0x2f4]
mov al, byte [0x40b2c4]
add ecx, 0x33c
test al, al
je 0x4028e3
mov eax, dword [ecx]
jmp 0x402907
push 0
push 4
lea eax, [ebp - 0x2fc]
mov dword [ebp - 0x2fc], 0
push eax
push ecx
push dword [0x40b2c8]
call esi
mov eax, dword [ebp - 0x2fc]
push eax
push 1
push 0x1fffff
mov dword [0x40b2d4], eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edx, dword [0x40b2cc]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x23
lea eax, [edx + 0x530]
mov byte [0x40b2c5], 0
mov dword [0x40ab21], eax
lea ecx, [edx + 0x540]
mov eax, 0x415824
mov byte [0x40b2c4], 0
sub eax, edx
mov dword [0x40ab1a], ecx
mov dword [0x40ab37], eax
lea eax, [edx + 0x500]
push 0x40ab18
push eax
push dword [0x40b2c8]
mov dword [0x40ab2a], ecx
call esi
mov eax, dword [0x40b2cc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add eax, 0xffbea7bb
cmp byte [0x40b2c4], 0
mov dword [0x40ab11], eax
je 0x4029cc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 2
push eax
push 0x40
push 0x400
push 0x415d40
call edi
mov eax, dword [0x40ab10]
mov ecx, 0x415d40
mov dword [ecx], eax
mov ax, word [0x40ab14]
mov word [ecx + 4], ax
mov al, byte [0x40ab16]
mov byte [ecx + 6], al
jmp 0x4029e2
push 0
push 7
push 0x40ab10
push 0x415d40
push dword [0x40b2c8]
call esi
mov edi, dword [ebp - 0x300]
nop dword [eax + eax]
cmp byte [0x40b2c4], 0
je 0x402a00
mov eax, dword [0x6a9ec0]
jmp 0x402a2c
push 0
push 4
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x2f4], 0
push eax
push 0x6a9ec0
push dword [0x40b2c8]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x2f4]
push 0x10
mov dword [ebp - 0x2fc], eax
call fcn.00405e40
mov ecx, eax
xorps xmm0, xmm0
mov dword [ebp - 0x300], ecx
lea eax, [ecx + 8]
mov dword [ebp - 0x68], eax
add esp, 4
or edi, 0x18
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov dword [eax], 1
mov eax, dword [ebp - 0x2fc]
mov dword [ecx + 0xc], eax
add eax, 0x7fc
cmp byte [0x40b2c4], 0
mov dword [ecx + 4], 1
mov dword [ecx], vtable.std::_Ref_count_obj2_class_PVZ::PVZApp_.0
je 0x402a8f
mov edx, dword [eax]
mov dword [ebp - 0x2fc], edx
jmp 0x402ac3
push 0
push 4
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x2fc], 0
push ecx
push eax
push dword [0x40b2c8]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x300]
mov dword [ebp - 0x2fc], eax
or eax, 0xffffffff
lea edx, [ecx + 4]
lock xadd dword [edx], eax
jne 0x402aea
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x68]
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0x402aea
mov ecx, dword [ebp - 0x300]
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x2fc], 1
je 0x402b00
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4029f0
sub esp, 0xc
mov dword [ebp - 0x300], edi
lea ecx, [ebp - 0x17c]
mov byte [0x40b2c5], 1
push str.main.pak
call fcn.00405490
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x17c]
push ecx
mov word [ebp - 0x68], 1
lea ecx, [ebp - 0xc4]
push dword [ebp - 0x68]
mov eax, dword [eax + 4]
push 0
mov byte [ebp - 0x17], 0
mov eax, dword [ebp + eax - 0x144]
test eax, eax
sete byte [ebp - 0x18]
push dword [ebp - 0x18]
push eax
call fcn.004057d0
sub esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x474]
push str.dlls_1.dll
call fcn.00405490
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x474]
push ecx
mov word [ebp - 0x68], 1
lea ecx, [ebp - 0xac]
push dword [ebp - 0x68]
mov eax, dword [eax + 4]
push 0
mov byte [ebp - 0x17], 0
mov eax, dword [ebp + eax - 0x43c]
test eax, eax
sete byte [ebp - 0x18]
push dword [ebp - 0x18]
push eax
call fcn.004057d0
sub esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3bc]
push str.PlantsVsZombies.exe
call fcn.00405490
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x3bc]
push ecx
mov word [ebp - 0x68], 1
lea ecx, [ebp - 0x94]
push dword [ebp - 0x68]
mov eax, dword [eax + 4]
push 0
mov byte [ebp - 0x17], 0
mov eax, dword [ebp + eax - 0x384]
test eax, eax
sete byte [ebp - 0x18]
push dword [ebp - 0x18]
push eax
call fcn.004057d0
lea edx, [ebp - 0xc4]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.004020f0
mov byte [ebp - 4], 6
mov ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
or ecx, 1
cmp dword [eax + 0x14], 0x10
mov edx, eax
mov dword [ebp - 0x300], ecx
mov dword [ebp - 0x18], ecx
jb 0x402c30
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
cmp eax, 0x20
jne 0x402ee9
sub eax, 4
mov dword [ebp - 0x2fc], str.3c76179f0c5ef7499c2a043502a60d57
mov dword [ebp - 0x2f4], eax
jb 0x402c7e
mov esi, dword [ebp - 0x2fc]
mov eax, dword [edx]
cmp eax, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jne 0x402c83
mov eax, dword [ebp - 0x2f4]
add edx, 4
add dword [ebp - 0x2fc], 4
sub eax, 4
mov dword [ebp - 0x2f4], eax
jae 0x402c51
cmp eax, 0xfffffffc
je 0x402ced
mov edi, dword [ebp - 0x2fc]
mov al, byte [edx]
cmp al, byte [edi]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x402ce6
cmp dword [ebp - 0x2f4], 0xfffffffd
je 0x402ced
mov esi, dword [ebp - 0x2fc]
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jne 0x402ce6
cmp dword [ebp - 0x2f4], 0xfffffffe
je 0x402ced
mov edi, dword [ebp - 0x2fc]
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x402ce6
cmp dword [ebp - 0x2f4], 0xffffffff
je 0x402ced
mov al, byte [edx + 3]
mov edx, dword [ebp - 0x2fc]
cmp al, byte [edx + 3]
je 0x402ced
sbb eax, eax
or eax, 1
jmp 0x402cef
xor eax, eax
test eax, eax
jne 0x402ee9
lea edx, [ebp - 0xac]
lea ecx, [ebp - 0x64]
call fcn.004020f0
mov dword [ebp - 4], 7
mov edx, eax
mov ecx, dword [ebp - 0x300]
or ecx, 2
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x300], ecx
mov dword [ebp - 0x18], ecx
jb 0x402d28
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
cmp eax, 0x20
jne 0x402ee9
sub eax, 4
mov dword [ebp - 0x2fc], str.3fcfeb0296c00015b9de14fc5bf5fb5e
mov dword [ebp - 0x2f4], eax
jb 0x402d7d
nop dword [eax]
mov esi, dword [ebp - 0x2fc]
mov eax, dword [edx]
cmp eax, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jne 0x402d82
mov eax, dword [ebp - 0x2f4]
add edx, 4
add dword [ebp - 0x2fc], 4
sub eax, 4
mov dword [ebp - 0x2f4], eax
jae 0x402d50
cmp eax, 0xfffffffc
je 0x402dec
mov edi, dword [ebp - 0x2fc]
mov al, byte [edx]
cmp al, byte [edi]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x402de5
cmp dword [ebp - 0x2f4], 0xfffffffd
je 0x402dec
mov esi, dword [ebp - 0x2fc]
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jne 0x402de5
cmp dword [ebp - 0x2f4], 0xfffffffe
je 0x402dec
mov edi, dword [ebp - 0x2fc]
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x402de5
cmp dword [ebp - 0x2f4], 0xffffffff
je 0x402dec
mov al, byte [edx + 3]
mov edx, dword [ebp - 0x2fc]
cmp al, byte [edx + 3]
je 0x402dec
sbb eax, eax
or eax, 1
jmp 0x402dee
xor eax, eax
test eax, eax
jne 0x402ee9
lea edx, [ebp - 0x94]
lea ecx, [ebp - 0x7c]
call fcn.004020f0
mov ecx, dword [ebp - 0x300]
mov edx, eax
or ecx, 4
cmp dword [eax + 0x14], 0x10
jb 0x402e17
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
cmp eax, 0x20
jne 0x402ee9
sub eax, 4
mov dword [ebp - 0x2fc], str.10d952534a2e32c88ff42ca5f34f6c9c
mov dword [ebp - 0x2f4], eax
jb 0x402e6d
nop dword [eax + eax]
mov esi, dword [ebp - 0x2fc]
mov eax, dword [edx]
cmp eax, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jne 0x402e72
mov eax, dword [ebp - 0x2f4]
add edx, 4
add dword [ebp - 0x2fc], 4
sub eax, 4
mov dword [ebp - 0x2f4], eax
jae 0x402e40
cmp eax, 0xfffffffc
je 0x402edc
mov edi, dword [ebp - 0x2fc]
mov al, byte [edx]
cmp al, byte [edi]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x402ed5
cmp dword [ebp - 0x2f4], 0xfffffffd
je 0x402edc
mov esi, dword [ebp - 0x2fc]
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jne 0x402ed5
cmp dword [ebp - 0x2f4], 0xfffffffe
je 0x402edc
mov edi, dword [ebp - 0x2fc]
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x402ed5
cmp dword [ebp - 0x2f4], 0xffffffff
je 0x402edc
mov al, byte [edx + 3]
mov edx, dword [ebp - 0x2fc]
cmp al, byte [edx + 3]
je 0x402edc
sbb eax, eax
or eax, 1
jmp 0x402ede
xor eax, eax
mov byte [ebp - 0x2f8], 0
test eax, eax
je 0x402ef0
mov byte [ebp - 0x2f8], 1
test cl, 4
je 0x402f4c
mov eax, dword [ebp - 0x68]
and ecx, 0xfffffffb
mov dword [ebp - 0x300], ecx
cmp eax, 0x10
jb 0x402f3a
mov edx, dword [ebp - 0x7c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x402f2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402fdd
push ecx
push edx
call fcn.00405e70
mov ecx, dword [ebp - 0x300]
add esp, 8
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0xf
mov byte [ebp - 0x7c], 0
mov dword [ebp - 4], 6
test cl, 2
je 0x402fab
mov eax, dword [ebp - 0x50]
and ecx, 0xfffffffd
mov dword [ebp - 0x300], ecx
cmp eax, 0x10
jb 0x402f99
mov edx, dword [ebp - 0x64]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x402f89
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402fdd
push ecx
push edx
call fcn.00405e70
mov ecx, dword [ebp - 0x300]
add esp, 8
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 5
test cl, 1
je 0x402fed
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x402fed
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402fe3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402fe3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00405e70
add esp, 8
cmp byte [ebp - 0x2f8], 0
je 0x403266
mov ecx, 0x40749c
call fcn.004015a0
mov ecx, 0x4074b0
mov edi, eax
call fcn.004015a0
mov ecx, 0x407310
mov esi, eax
call fcn.004015a0
mov dword [0x40ab5a], eax
mov edx, 0x34
mov eax, dword [0x40b2cc]
mov ecx, 0x40ab54
mov dword [0x40ab55], 0
mov dword [0x40ab5f], esi
mov dword [0x40ab64], edi
mov dword [0x40ab69], 1
mov dword [0x40ab6e], 0x64
mov dword [0x40ab83], eax
call fcn.00401340
mov esi, eax
call fcn.00401240
mov edx, 0x15
mov dword [0x40ac4d], esi
mov ecx, 0x40ac4c
mov dword [0x40ac52], eax
call fcn.00401340
mov ecx, dword [ebp - 0x80]
cmp ecx, 0x10
jb 0x4030bc
mov edx, dword [ebp - 0x94]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4030b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4033d6
push ecx
push edx
call fcn.00405e70
add esp, 8
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0xf
mov byte [ebp - 0x94], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x3c0], eax
lea ecx, [ebp - 0x3ac]
call fcn.004053b0
lea ecx, [ebp - 0x3a4]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x34c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0x98]
cmp ecx, 0x10
jb 0x403158
mov edx, dword [ebp - 0xac]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40314e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4033d6
push ecx
push edx
call fcn.00405e70
add esp, 8
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0xf
mov byte [ebp - 0xac], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x474]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x478], eax
lea ecx, [ebp - 0x464]
call fcn.004053b0
lea ecx, [ebp - 0x45c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x404]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0xb0]
cmp ecx, 0x10
jb 0x4031f7
mov edx, dword [ebp - 0xc4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4031ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4033d6
push ecx
push edx
call fcn.00405e70
add esp, 8
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0xf
mov byte [ebp - 0xc4], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x180], eax
lea ecx, [ebp - 0x16c]
call fcn.004053b0
lea ecx, [ebp - 0x164]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x10c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, 1
jmp 0x40491c
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x80]
cmp ecx, 0x10
jb 0x4032a1
mov edx, dword [ebp - 0x94]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403297
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4033d6
push ecx
push edx
call fcn.00405e70
add esp, 8
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0xf
mov byte [ebp - 0x94], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x3c0], eax
lea ecx, [ebp - 0x3ac]
call fcn.004053b0
lea ecx, [ebp - 0x3a4]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x34c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x98]
cmp ecx, 0x10
jb 0x403341
mov edx, dword [ebp - 0xac]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403337
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4033d6
push ecx
push edx
call fcn.00405e70
add esp, 8
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0xf
mov byte [ebp - 0xac], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x474]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x478], eax
lea ecx, [ebp - 0x464]
call fcn.004053b0
lea ecx, [ebp - 0x45c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x404]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0xb0]
cmp ecx, 0x10
jb 0x4033e6
mov edx, dword [ebp - 0xc4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4033dc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4033dc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00405e70
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0xf
mov byte [ebp - 0xc4], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x180], eax
lea ecx, [ebp - 0x16c]
call fcn.004053b0
lea ecx, [ebp - 0x164]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x10c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp byte [0x40b2c4], 0
mov eax, dword [0x40b2cc]
mov dword [0x40accb], eax
lea ecx, [eax + 0x600]
mov dword [ebp - 0x18], ecx
mov dword [0x40acb9], ecx
je 0x4034a4
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push ecx
call edi
mov ecx, dword [ebp - 0x18]
movq xmm0, qword [str.dlls_1.dll]
movq qword [ecx], xmm0
mov ax, word [0x407418]
mov word [ecx + 8], ax
jmp 0x4034b6
push 0
push 0xa
push str.dlls_1.dll
push ecx
push dword [0x40b2c8]
call esi
mov eax, dword [0x40b2cc]
add eax, 0x60a
mov byte [ebp - 0x2f8], 0
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], eax
je 0x4034f5
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push ecx
push 0x40
push 0x400
push eax
call edi
mov ecx, dword [ebp - 0x18]
mov al, byte [ebp - 0x2f8]
mov byte [ecx], al
jmp 0x403509
push 0
push 1
lea ecx, [ebp - 0x2f8]
push ecx
push eax
push dword [0x40b2c8]
call esi
mov edx, 0x18
mov ecx, 0x40acb8
call fcn.00401340
mov ecx, str.init
mov dword [0x40b2d0], eax
call fcn.004021e0
mov ecx, eax
test ecx, ecx
je 0x403565
sar eax, 8
mov edx, 0xe
mov byte [ebp - 0x6b], al
mov eax, ecx
mov byte [ebp - 0x6c], cl
shr ecx, 0x18
sar eax, 0x10
mov byte [ebp - 0x69], cl
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], 0x2e8
mov dword [ebp - 0x70], 0x6806eb00
mov byte [ebp - 0x6a], al
mov word [ebp - 0x68], 0xc3c3
call fcn.00401340
cmp byte [0x40b2c4], 0
mov byte [ebp - 0x2f8], 0x70
je 0x40359b
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x54eba8
call edi
mov al, byte [ebp - 0x2f8]
mov byte [0x54eba8], al
jmp 0x4035b3
push 0
push 1
lea eax, [ebp - 0x2f8]
push eax
push 0x54eba8
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x87e9
je 0x4035e6
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x40bc8c
call edi
mov eax, dword [ebp - 0x18]
mov dword [0x40bc8c], eax
jmp 0x4035fb
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x40bc8c
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov byte [ebp - 0x2f8], 0
je 0x403631
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x40bc90
call edi
mov al, byte [ebp - 0x2f8]
mov byte [0x40bc90], al
jmp 0x403649
push 0
push 1
lea eax, [ebp - 0x2f8]
push eax
push 0x40bc90
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov byte [ebp - 0x304], 0xeb
je 0x40367f
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x42492d
call edi
mov al, byte [ebp - 0x304]
mov byte [0x42492d], al
jmp 0x403697
push 0
push 1
lea eax, [ebp - 0x304]
push eax
push 0x42492d
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x32
je 0x4036cc
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f2c0
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f2c0
mov dword [ecx], eax
jmp 0x4036e1
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f2c0
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x40371c
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f308
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f308
mov dword [ecx], eax
jmp 0x403734
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f308
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403769
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f350
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f350
mov dword [ecx], eax
jmp 0x40377e
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f350
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x4037b9
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f374
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f374
mov dword [ecx], eax
jmp 0x4037d1
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f374
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403806
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f398
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f398
mov dword [ecx], eax
jmp 0x40381b
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f398
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x7d
je 0x403856
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f3bc
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f3bc
mov dword [ecx], eax
jmp 0x40386e
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f3bc
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x4038a3
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f3e0
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f3e0
mov dword [ecx], eax
jmp 0x4038b8
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f3e0
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x4038f3
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f404
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f404
mov dword [ecx], eax
jmp 0x40390b
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f404
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403940
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f428
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f428
mov dword [ecx], eax
jmp 0x403955
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f428
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403990
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f44c
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f44c
mov dword [ecx], eax
jmp 0x4039a8
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f44c
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x4039dd
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f470
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f470
mov dword [ecx], eax
jmp 0x4039f2
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f470
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403a2d
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f494
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f494
mov dword [ecx], eax
jmp 0x403a45
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f494
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403a7a
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f4b8
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f4b8
mov dword [ecx], eax
jmp 0x403a8f
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f4b8
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403aca
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f4dc
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f4dc
mov dword [ecx], eax
jmp 0x403ae2
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f4dc
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403b17
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f500
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f500
mov dword [ecx], eax
jmp 0x403b2c
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f500
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403b67
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f524
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f524
mov dword [ecx], eax
jmp 0x403b7f
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f524
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0xc8
je 0x403bb4
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f548
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f548
mov dword [ecx], eax
jmp 0x403bc9
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f548
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403c04
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f56c
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f56c
mov dword [ecx], eax
jmp 0x403c1c
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f56c
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403c51
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f590
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f590
mov dword [ecx], eax
jmp 0x403c66
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f590
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403ca1
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f5b4
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f5b4
mov dword [ecx], eax
jmp 0x403cb9
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f5b4
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403cee
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f5d8
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f5d8
mov dword [ecx], eax
jmp 0x403d03
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f5d8
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403d3e
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f620
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f620
mov dword [ecx], eax
jmp 0x403d56
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f620
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403d8b
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f644
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f644
mov dword [ecx], eax
jmp 0x403da0
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f644
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403ddb
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f668
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f668
mov dword [ecx], eax
jmp 0x403df3
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f668
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403e28
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f68c
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f68c
mov dword [ecx], eax
jmp 0x403e3d
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f68c
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x4b
je 0x403e78
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f6b0
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f6b0
mov dword [ecx], eax
jmp 0x403e90
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f6b0
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403ec5
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f71c
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f71c
mov dword [ecx], eax
jmp 0x403eda
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f71c
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403f15
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f740
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f740
mov dword [ecx], eax
jmp 0x403f2d
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f740
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403f62
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f764
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f764
mov dword [ecx], eax
jmp 0x403f77
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f764
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x403fb2
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f788
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f788
mov dword [ecx], eax
jmp 0x403fca
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f788
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x403fff
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f7ac
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f7ac
mov dword [ecx], eax
jmp 0x404014
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f7ac
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x40404f
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f7d0
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f7d0
mov dword [ecx], eax
jmp 0x404067
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f7d0
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x40409c
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f7f4
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f7f4
mov dword [ecx], eax
jmp 0x4040b1
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f7f4
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x4040ec
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f818
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f818
mov dword [ecx], eax
jmp 0x404104
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f818
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x404139
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f83c
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f83c
mov dword [ecx], eax
jmp 0x40414e
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f83c
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x96
je 0x404189
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f860
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f860
mov dword [ecx], eax
jmp 0x4041a1
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f860
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x4041d6
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f884
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f884
mov dword [ecx], eax
jmp 0x4041eb
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f884
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x404226
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f8a8
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f8a8
mov dword [ecx], eax
jmp 0x40423e
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f8a8
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x404273
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f8cc
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f8cc
mov dword [ecx], eax
jmp 0x404288
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f8cc
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x4042c3
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f8f0
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f8f0
mov dword [ecx], eax
jmp 0x4042db
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f8f0
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x404310
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f914
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f914
mov dword [ecx], eax
jmp 0x404325
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f914
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x270f
je 0x404360
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f938
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f938
mov dword [ecx], eax
jmp 0x404378
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f938
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x270f
je 0x4043ad
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f95c
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f95c
mov dword [ecx], eax
jmp 0x4043c2
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f95c
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x2ee
je 0x4043fd
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f330
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f330
mov dword [ecx], eax
jmp 0x404415
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f330
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x2ee
je 0x40444a
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f600
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f600
mov dword [ecx], eax
jmp 0x40445f
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f600
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x2ee
je 0x40449a
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f6fc
call edi
mov eax, dword [ebp - 0x2f4]
mov ecx, 0x69f6fc
mov dword [ecx], eax
jmp 0x4044b2
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x69f6fc
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x2ee
je 0x4044e7
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x69f864
call edi
mov eax, dword [ebp - 0x18]
mov ecx, 0x69f864
mov dword [ecx], eax
jmp 0x4044fc
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x69f864
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x1f4
je 0x404535
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x45e1a7
call edi
mov eax, dword [ebp - 0x2f4]
mov dword [0x45e1a7], eax
jmp 0x40454d
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x45e1a7
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x18], 0x3e8
je 0x404580
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x45e215
call edi
mov eax, dword [ebp - 0x18]
mov dword [0x45e215], eax
jmp 0x404595
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x45e215
push dword [0x40b2c8]
call esi
cmp byte [0x40b2c4], 0
mov dword [ebp - 0x2f4], 0x1f4
je 0x4045ce
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 2
push eax
push 0x40
push 0x400
push 0x45e445
call edi
mov eax, dword [ebp - 0x2f4]
mov dword [0x45e445], eax
jmp 0x4045e6
push 0
push 4
lea eax, [ebp - 0x2f4]
push eax
push 0x45e445
push dword [0x40b2c8]
call esi
mov ecx, str.onDialogButtonDepress
call fcn.004021e0
mov ecx, eax
mov dword [ebp - 0x6c], 0x5464a0
sar eax, 8
mov byte [ebp - 0x37], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x38], cl
shr ecx, 0x18
mov byte [ebp - 0x36], al
lea eax, [ebp - 0x48]
push 0x20
mov byte [ebp - 0x35], cl
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 9
mov dword [ebp - 0x48], 0x242474ff
mov dword [ebp - 0x44], 0x2c2474ff
mov dword [ebp - 0x40], 0x2e8
mov dword [ebp - 0x3c], 0x6806eb00
mov dword [ebp - 0x34], 0x8c483c3
mov dword [ebp - 0x30], 0x474c084
mov dword [ebp - 0x2c], 0x8c261
call fcn.00402360
mov ecx, str.onDialogDraw
call fcn.004021e0
mov ecx, eax
mov dword [ebp - 0x6c], 0x457995
sar eax, 8
mov byte [ebp - 0x1a], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x1b], cl
shr ecx, 0x18
mov byte [ebp - 0x19], al
lea eax, [ebp - 0x28]
push 0x15
mov byte [ebp - 0x18], cl
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 5
mov dword [ebp - 0x28], 0x2474ff57
mov dword [ebp - 0x24], 0x2e828
mov dword [ebp - 0x20], 0x6eb0000
mov byte [ebp - 0x1c], 0x68
mov dword [ebp - 0x17], 0x8c483c3
call fcn.00402360
mov ecx, str.onDrawUITop
call fcn.004021e0
mov ecx, eax
mov dword [ebp - 0x6c], 0x41acdf
sar eax, 8
mov byte [ebp - 0x1b], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x1c], cl
shr ecx, 0x18
mov byte [ebp - 0x1a], al
lea eax, [ebp - 0x28]
push 0x14
mov byte [ebp - 0x19], cl
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 5
mov dword [ebp - 0x28], 0x282474ff
mov dword [ebp - 0x24], 0x2e8
mov dword [ebp - 0x20], 0x6806eb00
mov dword [ebp - 0x18], 0x4c483c3
call fcn.00402360
mov ecx, str.onNewGame
call fcn.004021e0
mov ecx, eax
mov dword [ebp - 0x6c], 0x44f8d8
sar eax, 8
mov byte [ebp - 0x17], al
mov eax, ecx
mov dword [ebp - 0x70], 5
mov dword [ebp - 0x20], 0x2e8
mov dword [ebp - 0x1c], 0x6806eb00
mov byte [ebp - 0x18], cl
sar eax, 0x10
shr ecx, 0x18
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x20]
push 0xd
mov byte [ebp - 0x15], cl
lea ecx, [ebp - 0x70]
push eax
mov byte [ebp - 0x14], 0xc3
call fcn.00402360
mov ecx, str.onGameObjectsUpdate
call fcn.004021e0
mov ecx, eax
mov dword [ebp - 0x6c], 0x4130d0
sar eax, 8
mov byte [ebp - 0x1a], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x1b], cl
shr ecx, 0x18
mov byte [ebp - 0x19], al
lea eax, [ebp - 0x24]
push 0x11
mov byte [ebp - 0x18], cl
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 5
mov dword [ebp - 0x24], 0x2e853
mov dword [ebp - 0x20], 0x6eb0000
mov byte [ebp - 0x1c], 0x68
mov dword [ebp - 0x17], 0x4c483c3
call fcn.00402360
mov ecx, str.onPlantRemove
call fcn.004021e0
mov ecx, eax
mov dword [ebp - 0x6c], 0x4679b9
sar eax, 8
mov byte [ebp - 0x1a], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x1b], cl
shr ecx, 0x18
mov byte [ebp - 0x19], al
lea eax, [ebp - 0x24]
push 0x11
mov byte [ebp - 0x18], cl
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x24], 0x2e855
mov dword [ebp - 0x20], 0x6eb0000
mov byte [ebp - 0x1c], 0x68
mov dword [ebp - 0x17], 0x4c483c3
call fcn.00402360
mov ecx, str.onProjectileHitZombie
call fcn.004021e0
mov ecx, eax
mov dword [ebp - 0x6c], 0x46ce74
sar eax, 8
mov byte [ebp - 0x32], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x33], cl
shr ecx, 0x18
mov byte [ebp - 0x31], al
lea eax, [ebp - 0x44]
push 0x19
mov byte [ebp - 0x30], cl
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 6
mov dword [ebp - 0x44], 0x3d
mov dword [ebp - 0x40], 0x50127400
mov dword [ebp - 0x3c], 0x2e855
mov dword [ebp - 0x38], 0x6eb0000
mov byte [ebp - 0x34], 0x68
mov dword [ebp - 0x2f], 0x8c483c3
call fcn.00402360
mov ecx, str.onZombieHit
call fcn.004021e0
mov ecx, eax
sar eax, 8
mov byte [ebp - 0x55], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x56], cl
shr ecx, 0x18
mov byte [ebp - 0x54], al
lea eax, [ebp - 0x64]
push 0x1a
mov byte [ebp - 0x53], cl
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 0x6c], 0x5317c0
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x64], 0x242474ff
mov dword [ebp - 0x60], 0x2e85650
mov dword [ebp - 0x5c], 0xeb000000
mov word [ebp - 0x58], 0x6806
mov dword [ebp - 0x52], 0xcc483c3
mov dword [ebp - 0x4e], 0x24244489
call fcn.00402360
push dword [0x40b2c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x40b2c4], 0
mov eax, dword [0x40b2cc]
je 0x404906
push 0
push eax
call fcn.00405e70
add esp, 8
jmp 0x40491a
push 0x8000
push 0
push eax
push dword [0x40b2c8]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00405e32
mov esp, ebp
pop ebp
ret