Function at 0x405620
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5903
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x50a0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xe0], 0
xor eax, eax
push 1
push 0x4e9648
mov byte [ebp - 0xd8], 0
mov byte [ebp - 0xec], 0
mov byte [ebp - 0xf0], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.0040b6e0
cmp dword [ebp + 8], 0
mov ebx, dword [ebp - 0xb8]
mov dword [ebp - 4], 0
mov dword [ebp - 0xe0], 0
jle 0x4059e7
lea edi, [esi + 4]
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], edi
nop
push dword [edi]
push dword [edi - 4]
push 0x4e964c
call fcn.00406300
mov edx, dword [edi - 4]
add esp, 0xc
mov ecx, edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405700
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x58]
call fcn.0040b6e0
mov edx, dword [edi]
xor eax, eax
mov ecx, edx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
jmp 0x405740
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405740
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b6e0
cmp dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x14]
setne byte [ebp - 0xd1]
cmp edx, 8
jb 0x40579e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405794
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062f1
push edx
push ecx
call fcn.004bf4bc
add esp, 8
cmp dword [ebp - 0x44], 8
lea esi, [ebp - 0x58]
mov ebx, dword [ebp - 0x58]
mov edi, dword [ebp - 0x48]
cmovae esi, ebx
cmp edi, 2
jne 0x4057ee
mov ecx, 0x4e9660
mov edx, edi
sub esi, ecx
lea esp, [esp]
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x4057ee
add ecx, 2
sub edx, 1
jne 0x4057c0
mov eax, dword [ebp - 0xd8]
mov ecx, 1
cmp byte [ebp - 0xd1], dl
movzx eax, al
cmovne eax, ecx
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x44]
lea esi, [ebp - 0x58]
cmp eax, 8
cmovae esi, ebx
cmp edi, 2
jne 0x405841
mov ecx, 0x4e9668
mov edx, edi
sub esi, ecx
jmp 0x405810
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x40583e
add ecx, 2
sub edx, 1
jne 0x405810
mov eax, dword [ebp - 0xf0]
mov ecx, 1
cmp byte [ebp - 0xd1], dl
movzx eax, al
cmovne eax, ecx
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x44]
cmp eax, 8
lea esi, [ebp - 0x58]
cmovae esi, ebx
cmp edi, 2
jne 0x405891
mov ecx, 0x4e9670
mov edx, edi
sub esi, ecx
jmp 0x405860
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x40588e
add ecx, 2
sub edx, 1
jne 0x405860
mov eax, dword [ebp - 0xec]
mov ecx, 1
cmp byte [ebp - 0xd1], dl
movzx eax, al
cmovne eax, ecx
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x44]
cmp eax, 8
lea esi, [ebp - 0x58]
cmovae esi, ebx
cmp edi, 2
jne 0x4058c5
mov ecx, 0x4e9678
mov edx, edi
sub esi, ecx
jmp 0x4058b0
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x4058c5
add ecx, 2
sub edx, 1
jne 0x4058b0
mov al, 1
jmp 0x4058c7
xor al, al
mov edi, dword [ebp - 0xe4]
test al, al
je 0x405985
mov edx, dword [edi]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4058f0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b6e0
mov eax, dword [ebp - 0xa4]
cmp eax, 8
jb 0x405949
mov edx, dword [ebp - 0xe8]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40593f
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062f1
push ecx
push edx
call fcn.004bf4bc
add esp, 8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4059c0
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4059b6
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062f1
push ecx
push ebx
call fcn.004bf4bc
add esp, 8
mov eax, dword [ebp - 0xe0]
add edi, 8
add eax, 2
mov dword [ebp - 0xe4], edi
mov dword [ebp - 0xe0], eax
cmp eax, dword [ebp + 8]
jl 0x4056d0
mov ebx, dword [ebp - 0xe8]
mov edi, dword [ebp - 0xa4]
lea esi, [ebp - 0xb8]
cmp edi, 8
cmovae esi, ebx
cmp dword [ebp - 0xa8], 1
jne 0x405a33
mov ecx, 0x4e9680
mov edx, 1
sub esi, ecx
mov edi, edi
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x405a33
add ecx, 2
sub edx, 1
jne 0x405a10
push 0x4e9684
call fcn.00406300
add esp, 4
jmp 0x406291
xor eax, eax
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
call fcn.00406470
add esp, 4
test eax, eax
jns 0x405ab8
mov eax, str.Failed_to_get_x86_path_n
push eax
call fcn.00406300
add esp, 4
jmp 0x406144
xor eax, eax
mov byte [ebp - 4], 6
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x30]
add eax, 0x26
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0xe0], 1
call fcn.0040d650
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
call fcn.0040b480
push 0x26
push str.SynologyActiveBackupforBusinessAgent
lea ecx, [ebp - 0x28]
call fcn.0040b480
push str.uiuiSynology_Active_Backup_for_Business_Agent.exe
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00401920
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x40]
cmp eax, esi
je 0x405bb5
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x405b6b
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405b61
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062dd
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov dword [ebp - 0x30], 0
xor eax, eax
mov word [ebp - 0x40], ax
mov dword [ebp - 0x2c], 7
mov eax, dword [esi]
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x405bef
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405be5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062dd
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x405c41
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405c37
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062dd
push edx
push ecx
call fcn.004bf4bc
add esp, 8
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push 0x4f4730
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x405c73
lea eax, [ebp - 0xdc]
push eax
push 0
push 0
push 0x4f4710
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x405c86
mov eax, str.Failed_to_get_public_desktop_folder_n
push eax
call fcn.00406300
add esp, 4
jmp 0x406144
mov edx, dword [ebp - 0xf4]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405ca5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b6e0
push 0x4e97dc
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00401920
push str.Synology_Active_Backup_for_Business_Agent.lnk
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 8
push eax
call fcn.00401920
mov esi, eax
add esp, 0x18
lea eax, [ebp - 0xa0]
cmp eax, esi
je 0x405da2
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x405d3d
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405d33
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062e2
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov dword [ebp - 0x90], 0
xor eax, eax
mov word [ebp - 0xa0], ax
mov dword [ebp - 0x8c], 7
mov eax, dword [esi]
mov dword [ebp - 0xa0], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x9c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x94], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x90], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x8c], eax
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00403880
lea ecx, [ebp - 0xd0]
call fcn.00403880
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x405df3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405de9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062e2
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov edx, dword [ebp - 0xdc]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405e12
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b6e0
push 0x4e97dc
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00401920
push str.SynologySynology_Active_Backup_for_Business_Agent.lnk
push eax
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0xa
push eax
call fcn.00401920
mov esi, eax
add esp, 0x18
lea eax, [ebp - 0x88]
cmp eax, esi
je 0x405efa
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x405ea7
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405e9d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062e7
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov dword [ebp - 0x78], 0
xor eax, eax
mov word [ebp - 0x88], ax
mov dword [ebp - 0x74], 7
mov eax, dword [esi]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x84], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x80], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x7c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x78], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x74], eax
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0xd0]
call fcn.00403880
lea ecx, [ebp - 0x58]
call fcn.00403880
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x405f4b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405f41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062e7
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov edx, dword [ebp - 0xdc]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405f70
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b6e0
push 0x4e97e0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00401920
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x70]
cmp eax, esi
je 0x406036
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x405fec
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405fe2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062ec
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov dword [ebp - 0x60], 0
xor eax, eax
mov word [ebp - 0x70], ax
mov dword [ebp - 0x5c], 7
mov eax, dword [esi]
mov dword [ebp - 0x70], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x6c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x64], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0xd0]
call fcn.00403880
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x40607f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406075
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062ec
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov eax, dword [ebp - 0xd8]
test al, al
je 0x406092
cmp byte [ebp - 0xec], 0
je 0x4060ca
cmp dword [ebp - 0x8c], 8
lea ecx, [ebp - 0xa0]
push 0x4e9570
cmovae ecx, dword [ebp - 0xa0]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.00405590
mov eax, dword [ebp - 0xd8]
add esp, 0xc
test al, al
je 0x4060d7
cmp byte [ebp - 0xf0], 0
jne 0x4060d7
test al, al
jne 0x40612e
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406103
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
push 0
cmovae eax, dword [ebp - 0x70]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [ebp - 0x74], 8
lea ecx, [ebp - 0x88]
push 0x4e9570
cmovae ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.00405590
add esp, 0xc
push dword [ebp - 0xf4]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call esi
push dword [ebp - 0xdc]
call esi
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x40617e
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406174
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062f1
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov edx, dword [ebp - 0x74]
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x4061cf
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4061c5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062f1
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov edx, dword [ebp - 0x8c]
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
cmp edx, 8
jb 0x406226
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40621c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062f1
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
cmp edx, 8
jb 0x40627d
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406273
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062f1
push edx
push ecx
call fcn.004bf4bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edi, 8
jb 0x4062c1
lea ecx, [edi*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4062b7
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062f1
push ecx
push ebx
call fcn.004bf4bc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf929
mov esp, ebp
pop ebp
ret
call fcn.004c4cda
call fcn.004c4cda
call fcn.004c4cda
call fcn.004c4cda
call fcn.004c4cda
int3