Function at 0x404ea0
Capabilities:
Create process on windows
Query or enumerate registry value
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x4291e9
mov eax, dword fs:[0]
push eax
sub esp, 0x988
mov eax, dword [0x431570]
xor eax, esp
mov dword [esp + 0x980], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x431570]
xor eax, esp
push eax
lea eax, [esp + 0x99c]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x9a4], eax
xor ecx, ecx
push 0xffffffffffffffff
mov dword [esp + 0x80], eax
mov word [esp + 0x70], cx
push eax
mov ebx, 7
lea eax, [esp + 0x9b4]
lea ecx, [esp + 0x70]
mov dword [esp + 0x88], ebx
call fcn.00409fc0
mov byte [esp + 0x9a4], 1
lea esp, [esp]
mov esi, dword [esp + 0x7c]
lea edi, [esi - 1]
cmp esi, edi
ja 0x404f34
call fcn.00410136
mov esi, dword [esp + 0x7c]
mov edx, dword [esp + 0x80]
mov ebp, dword [esp + 0x6c]
mov eax, ebp
cmp edx, 8
jae 0x404f4a
lea eax, [esp + 0x6c]
cmp word [eax + edi*2], 0x5c
je 0x405038
lea edi, [esi - 1]
cmp esi, edi
ja 0x404f70
call fcn.00410136
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x6c]
mov eax, ebp
cmp edx, 8
jae 0x404f7b
lea eax, [esp + 0x6c]
cmp word [eax + edi*2], 0x2f
je 0x405038
mov dword [esp + 0x18], esi
cmp edx, 8
jb 0x40502f
mov edi, ebp
test ebp, ebp
je 0x404fba
mov eax, ebp
cmp edx, 8
jae 0x404fa4
lea eax, [esp + 0x6c]
cmp eax, edi
ja 0x404fba
mov eax, ebp
cmp edx, 8
jae 0x404fb3
lea eax, [esp + 0x6c]
lea eax, [eax + esi*2]
cmp edi, eax
jbe 0x404fce
call fcn.00410d51
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x6c]
lea eax, [esp + 0x68]
mov ecx, eax
mov ebx, eax
mov dword [esp + 0x2c], edi
cmp ecx, 0xfffffffc
je 0x40500d
mov ecx, ebp
cmp edx, 8
jae 0x404fea
lea ecx, [esp + 0x6c]
mov eax, dword [esp + 0x18]
lea eax, [edi + eax*2 - 2]
lea ecx, [ecx + esi*2]
cmp eax, ecx
ja 0x405008
mov ecx, ebp
cmp edx, 8
jae 0x405004
lea ecx, [esp + 0x6c]
cmp eax, ecx
jae 0x40500d
call fcn.00410d51
mov edx, dword [esp + 0x18]
lea eax, [edi + edx*2 - 2]
push eax
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x74]
call fcn.00407c70
mov ebx, 7
jmp 0x404f20
lea edi, [esp + 0x6c]
jmp 0x404f99
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x38], cx
push ecx
lea eax, [esp + 0x9b4]
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], 0
call fcn.00409fc0
mov byte [esp + 0x9a4], 2
test esi, esi
jle 0x4050c4
lea ebp, [esp + 0x30]
mov edi, edi
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x34]
cmp edx, 8
jb 0x4051d7
mov edi, eax
test eax, eax
je 0x4050aa
mov ecx, eax
cmp edx, 8
jae 0x405092
lea ecx, [esp + 0x34]
cmp ecx, edi
ja 0x4050aa
cmp edx, 8
jae 0x40509f
lea eax, [esp + 0x34]
mov edx, dword [esp + 0x44]
lea eax, [eax + edx*2]
cmp edi, eax
jbe 0x4050af
call fcn.00410d51
push edi
push ebp
lea ecx, [esp + 0x28]
push ecx
lea eax, [esp + 0x3c]
call fcn.00407c70
sub esi, 1
jne 0x405070
xor edi, edi
xor edx, edx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], edi
mov word [esp + 0x50], dx
lea eax, [esp + 0x1c]
push eax
push str.SoftwareJBridge
push 0x80000002
mov byte [esp + 0x9b0], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x405128
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x798]
push edx
push edi
push edi
push str.Proxy32
push eax
mov dword [esp + 0x30], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esp + 0x794], di
jne 0x4051e0
push 0x40000
push str.jBridger
push str.Unable_to_locate_proxy_DLL
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, 8
cmp dword [esp + 0x64], esi
jb 0x405164
mov edx, dword [esp + 0x50]
push edx
call fcn.00410308
add esp, 4
xor eax, eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], edi
mov word [esp + 0x50], ax
cmp dword [esp + 0x48], esi
jb 0x405186
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00410308
add esp, 4
xor edx, edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], edi
mov word [esp + 0x34], dx
cmp dword [esp + 0x80], esi
jb 0x4051ab
mov eax, dword [esp + 0x6c]
push eax
call fcn.00410308
add esp, 4
xor ecx, ecx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x7c], edi
mov word [esp + 0x6c], cx
cmp dword [esp + 0x9c4], esi
jb 0x405bb7
mov edx, dword [esp + 0x9b0]
push edx
jmp 0x405baf
lea edi, [esp + 0x34]
jmp 0x405087
lea eax, [esp + 0x794]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4051f0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x798]
lea esi, [esp + 0x50]
call fcn.0040c040
mov edi, 0xb
mov ebx, dword [esp + 0x60]
dec ebx
or eax, 0xffffffff
lea esi, [esp + 0x4c]
call fcn.00407be0
sub edi, 1
jne 0x405215
mov eax, dword [esp + 0x9b0]
mov ebp, 8
cmp dword [esp + 0x9c4], ebp
jae 0x405247
lea eax, [esp + 0x9b0]
call fcn.00404df0
movzx eax, ax
mov ecx, 0x14c
mov dword [esp + 0x18], eax
cmp ax, cx
jne 0x4053bd
xor ebx, ebx
cmp byte [0x432565], bl
jne 0x4052fa
cmp dword [esp + 0x64], ebp
jb 0x405282
mov edx, dword [esp + 0x50]
push edx
call fcn.00410308
add esp, 4
xor eax, eax
mov esi, 7
mov word [esp + 0x50], ax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], esi
cmp dword [esp + 0x48], ebp
jb 0x4052a9
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00410308
add esp, 4
xor edx, edx
mov word [esp + 0x34], dx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], esi
cmp dword [esp + 0x80], ebp
jb 0x4052ce
mov eax, dword [esp + 0x6c]
push eax
call fcn.00410308
add esp, 4
xor ecx, ecx
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], cx
cmp dword [esp + 0x9c4], ebp
jb 0x405bb7
mov edx, dword [esp + 0x9b0]
push edx
jmp 0x405baf
push 0xb
mov eax, str.auxhost.exe
lea ecx, [esp + 0x50]
call fcn.0040bf60
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x50]
cmp edx, ebp
jb 0x4053b4
mov esi, eax
cmp eax, ebx
je 0x405341
mov ecx, eax
cmp edx, ebp
jae 0x40532a
lea ecx, [esp + 0x50]
cmp ecx, esi
ja 0x405341
cmp edx, ebp
jae 0x405336
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x60]
lea edx, [eax + ecx*2]
cmp esi, edx
jbe 0x405346
call fcn.00410d51
push esi
lea eax, [esp + 0x50]
push eax
push 0x22
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x5c]
call fcn.00407ac0
mov ecx, dword [esp + 0x64]
mov edi, dword [esp + 0x50]
mov eax, edi
cmp ecx, ebp
jae 0x40536e
lea eax, [esp + 0x50]
mov edx, dword [esp + 0x60]
lea esi, [eax + edx*2]
cmp esi, ebx
je 0x405398
mov eax, edi
cmp ecx, ebp
jae 0x405383
lea eax, [esp + 0x50]
cmp eax, esi
ja 0x405398
mov eax, edi
cmp ecx, ebp
jae 0x405391
lea eax, [esp + 0x50]
lea ecx, [eax + edx*2]
cmp esi, ecx
jbe 0x40539d
call fcn.00410d51
push esi
lea eax, [esp + 0x50]
push eax
push 0x22
lea edx, [esp + 0x2c]
push edx
call fcn.00407ac0
jmp 0x405490
lea esi, [esp + 0x50]
jmp 0x405320
mov ecx, 0x8664
cmp ax, cx
jne 0x405b2b
xor ebx, ebx
cmp byte [0x432566], bl
je 0x40526f
push 0xd
mov eax, str.auxhost64.exe
lea ecx, [esp + 0x50]
call fcn.0040bf60
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x50]
cmp edx, ebp
jb 0x4054cc
mov esi, eax
cmp eax, ebx
je 0x405420
mov ecx, eax
cmp edx, ebp
jae 0x405409
lea ecx, [esp + 0x50]
cmp ecx, esi
ja 0x405420
cmp edx, ebp
jae 0x405415
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x60]
lea edx, [eax + ecx*2]
cmp esi, edx
jbe 0x405425
call fcn.00410d51
push esi
lea eax, [esp + 0x50]
push eax
push 0x22
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x5c]
call fcn.00407ac0
mov ecx, dword [esp + 0x64]
mov edi, dword [esp + 0x50]
mov eax, edi
cmp ecx, ebp
jae 0x40544d
lea eax, [esp + 0x50]
mov edx, dword [esp + 0x60]
lea esi, [eax + edx*2]
cmp esi, ebx
je 0x405477
mov eax, edi
cmp ecx, ebp
jae 0x405462
lea eax, [esp + 0x50]
cmp eax, esi
ja 0x405477
mov eax, edi
cmp ecx, ebp
jae 0x405470
lea eax, [esp + 0x50]
lea ecx, [eax + edx*2]
cmp esi, ecx
jbe 0x40547c
call fcn.00410d51
push esi
lea eax, [esp + 0x50]
push eax
push 0x22
lea edx, [esp + 0x2c]
push edx
call fcn.00407ac0
xor ebx, ebx
mov eax, dword [esp + 0x44]
mov esi, eax
cmp eax, 0x11
jb 0x4054a0
mov esi, 0x11
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x4054ae
lea edx, [esp + 0x34]
mov ecx, str.jamstix2_demo.dll
cmp esi, ebx
jbe 0x4054e9
mov di, word [edx]
cmp di, word [ecx]
jne 0x4054d5
add edx, 2
add ecx, 2
sub esi, 1
jne 0x4054b7
jmp 0x4054e9
lea esi, [esp + 0x50]
jmp 0x4053ff
mov dx, di
cmp dx, word [ecx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
cmp ecx, ebx
jne 0x405593
cmp eax, 0x11
jb 0x405593
xor ecx, ecx
cmp eax, 0x11
setne cl
cmp ecx, ebx
jne 0x405593
cmp dword [esp + 0x64], ebp
jb 0x405515
mov eax, dword [esp + 0x50]
push eax
call fcn.00410308
add esp, 4
xor ecx, ecx
mov esi, 7
mov word [esp + 0x50], cx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], esi
cmp dword [esp + 0x48], ebp
jb 0x40553c
mov edx, dword [esp + 0x34]
push edx
call fcn.00410308
add esp, 4
xor eax, eax
mov word [esp + 0x34], ax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], esi
cmp dword [esp + 0x80], ebp
jb 0x405561
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.00410308
add esp, 4
xor edx, edx
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], dx
cmp dword [esp + 0x9c4], ebp
jb 0x40558c
mov eax, dword [esp + 0x9b0]
push eax
call fcn.00410308
add esp, 4
mov al, 1
jmp 0x405bb9
push str.jamstix2.dll
mov edi, 0xc
lea ecx, [esp + 0x34]
call fcn.0040eeb0
test eax, eax
jne 0x405643
cmp dword [esp + 0x64], ebp
jb 0x4055c1
mov ecx, dword [esp + 0x50]
push ecx
call fcn.00410308
add esp, 4
xor edx, edx
mov esi, 7
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], dx
cmp dword [esp + 0x48], ebp
jb 0x4055e8
mov eax, dword [esp + 0x34]
push eax
call fcn.00410308
add esp, 4
xor ecx, ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], cx
cmp dword [esp + 0x80], ebp
jb 0x40560d
mov edx, dword [esp + 0x6c]
push edx
call fcn.00410308
add esp, 4
xor eax, eax
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], ax
cmp dword [esp + 0x9c4], ebp
jb 0x40558c
mov ecx, dword [esp + 0x9b0]
push ecx
call fcn.00410308
add esp, 4
mov al, 1
jmp 0x405bb9
mov eax, dword [esp + 0x44]
push str.Kontakt_3.dll
mov edi, 0xd
lea ecx, [esp + 0x34]
call fcn.0040eeb0
test eax, eax
jne 0x4056f7
cmp dword [esp + 0x64], ebp
jb 0x405675
mov edx, dword [esp + 0x50]
push edx
call fcn.00410308
add esp, 4
xor eax, eax
mov esi, 7
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], ax
cmp dword [esp + 0x48], ebp
jb 0x40569c
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00410308
add esp, 4
xor edx, edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], dx
cmp dword [esp + 0x80], ebp
jb 0x4056c1
mov eax, dword [esp + 0x6c]
push eax
call fcn.00410308
add esp, 4
xor ecx, ecx
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], cx
cmp dword [esp + 0x9c4], ebp
jb 0x40558c
mov edx, dword [esp + 0x9b0]
push edx
call fcn.00410308
add esp, 4
mov al, 1
jmp 0x405bb9
mov eax, dword [esp + 0x44]
push str.Kontakt_3_8out.dll
mov edi, 0x12
lea ecx, [esp + 0x34]
call fcn.0040eeb0
test eax, eax
je 0x405502
mov eax, dword [esp + 0x44]
push str.Kontakt_3_16out.dll
mov edi, 0x13
lea ecx, [esp + 0x34]
call fcn.0040eeb0
test eax, eax
jne 0x40575f
lea esi, [esp + 0x4c]
call fcn.0040f290
lea esi, [esp + 0x30]
call fcn.0040f290
lea esi, [esp + 0x68]
call fcn.0040f290
lea esi, [esp + 0x9ac]
call fcn.0040f290
mov al, 1
jmp 0x405bb9
mov esi, str.Kontakt_4.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.Kontakt_4_8out.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.Kontakt_4_16out.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.Vocal_WaveShell_VST_1.1.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.WaveShell_VST_5.0.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.WaveShell_VST_5.2.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.WaveShell_VST_5.5.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.WaveShell_VST_5.7.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.WaveShell_VST_5.9.5.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.WaveShell_VST_7.1.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.WaveShell_VST_8.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.BFD2.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.Altiverb_6.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
mov esi, str.Phantom.dll
lea ecx, [esp + 0x30]
call fcn.0040dd90
test al, al
jne 0x405731
xor edi, edi
cmp dword [esp + 0x44], ebx
jbe 0x4058bd
jmp 0x405890
lea eax, [esp + 0x30]
call fcn.00407d50
mov esi, eax
lea eax, [esp + 0x30]
call fcn.00407d50
movzx ecx, word [esi]
push ecx
mov ebp, eax
call fcn.004126c4
inc edi
add esp, 4
mov word [ebp], ax
cmp edi, dword [esp + 0x44]
jb 0x405890
push 0xd
push str.WAVESHELL_VST
lea eax, [esp + 0x38]
call fcn.00407de0
push eax
call fcn.004126f0
add esp, 0xc
test eax, eax
je 0x405731
push str.784567
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov ebp, eax
cmp ebp, ebx
jne 0x40596b
push 0x100
lea edx, [esp + 0x498]
push ebx
push edx
call fcn.004158e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_create_semaphore...___Error__d
lea eax, [esp + 0x49c]
push 0x80
push eax
call fcn.00411f72
add esp, 0x10
push ebx
push str.jBridger
lea ecx, [esp + 0x49c]
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esi, [esp + 0x4c]
call fcn.0040f290
lea esi, [esp + 0x30]
call fcn.0040f290
lea esi, [esp + 0x68]
call fcn.0040f290
lea esi, [esp + 0x9ac]
call fcn.0040f290
jmp 0x405bb7
push 0x40c
lea edx, [esp + 0x88]
push ebx
push edx
call fcn.004158e0
add esp, 0xc
push ebx
push ebx
push 0x80
lea eax, [esp + 0x6a0]
or esi, 0xffffffff
push eax
push esi
lea eax, [esp + 0x9c0]
mov byte [esp + 0x498], bl
mov dword [esp + 0x4a0], esi
mov dword [esp + 0x49c], esi
call fcn.00407de0
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x694]
push ecx
lea edx, [esp + 0x88]
push 0x400
push edx
call fcn.00412727
mov eax, 0x8664
add esp, 0xc
cmp word [esp + 0x18], ax
jne 0x4059ee
push 0x42cf84
jmp 0x4059f3
push 0x42cf8c
push 0x40c
push ebx
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x40c
push ebx
push ebx
mov edi, eax
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
jne 0x405a68
push 0x200
lea ecx, [esp + 0x498]
push ebx
push ecx
call fcn.004158e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MapViewOfFile_..____error__d
lea edx, [esp + 0x49c]
push 0x100
push edx
call fcn.00411f72
add esp, 0x10
push ebx
push str.jBridge
lea eax, [esp + 0x49c]
push eax
jmp 0x405938
push 0x40c
lea ecx, [esp + 0x88]
push ecx
push esi
call fcn.00412790
add esp, 0xc
lea eax, [esp + 0x4c]
call fcn.00407de0
push 1
push ebx
push str.ANALYZE
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x4e20
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
cmp eax, 0x102
jne 0x405ace
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call ebx
mov byte [0x437cf3], 1
jmp 0x40593f
mov edx, dword [esi + 0x404]
mov eax, dword [esi + 0x408]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esi + 0x400]
mov dword [0x432568], edx
mov dword [0x43256c], eax
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call ebp
lea esi, [esp + 0x4c]
call fcn.0040f290
lea esi, [esp + 0x30]
call fcn.0040f290
lea esi, [esp + 0x68]
call fcn.0040f290
lea esi, [esp + 0x9ac]
call fcn.0040f290
mov al, bl
jmp 0x405bb9
cmp dword [esp + 0x64], ebp
jb 0x405b3e
mov ecx, dword [esp + 0x50]
push ecx
call fcn.00410308
add esp, 4
xor esi, esi
xor edx, edx
mov edi, 7
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], esi
mov word [esp + 0x50], dx
cmp dword [esp + 0x48], ebp
jb 0x405b67
mov eax, dword [esp + 0x34]
push eax
call fcn.00410308
add esp, 4
xor ecx, ecx
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], esi
mov word [esp + 0x34], cx
cmp dword [esp + 0x80], ebp
jb 0x405b8c
mov edx, dword [esp + 0x6c]
push edx
call fcn.00410308
add esp, 4
xor eax, eax
mov dword [esp + 0x80], edi
mov dword [esp + 0x7c], esi
mov word [esp + 0x6c], ax
cmp dword [esp + 0x9c4], ebp
jb 0x405bb7
mov ecx, dword [esp + 0x9b0]
push ecx
call fcn.00410308
add esp, 4
xor al, al
mov ecx, dword [esp + 0x99c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x980]
xor ecx, esp
call fcn.004102f9
add esp, 0x994
ret