Function at 0x41f080
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485557
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2cb8
call fcn.004839d0
mov eax, dword [0x4ab00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x2ca5], cl
cmp dword [0x4ae1f8], 8
mov eax, 0x4ae1e4
mov dword [0x4ae1f4], 0
xorps xmm0, xmm0
cmovae eax, dword [0x4ae1e4]
xor ecx, ecx
mov word [eax], cx
mov eax, 0x4ae1fc
cmp dword [0x4ae210], 8
mov dword [0x4ae20c], ecx
cmovae eax, dword [0x4ae1fc]
mov word [eax], cx
mov eax, 0x4ae214
cmp dword [0x4ae228], 8
mov dword [0x4ae224], ecx
cmovae eax, dword [0x4ae214]
mov word [eax], cx
cmp dword [0x4adec0], 6
mov dword [0x4ae22c], ecx
movlpd qword [0x4ae510], xmm0
jg 0x41f152
jne 0x41feb5
cmp dword [0x4adec4], 1
jl 0x41feb5
xor eax, eax
mov dword [ebp - 0x2c78], ecx
mov dword [ebp - 0x2c74], 7
mov word [ebp - 0x2c88], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c30], eax
mov dword [ebp - 0x2c2c], 7
mov word [ebp - 0x2c40], ax
mov dword [ebp - 0x2c60], eax
mov dword [ebp - 0x2c5c], 7
mov word [ebp - 0x2c70], ax
mov dword [ebp - 0x2c90], eax
mov dword [ebp - 0x2c8c], 7
mov word [ebp - 0x2ca0], ax
mov dword [ebp - 0x2c48], eax
mov dword [ebp - 0x2c44], 7
mov word [ebp - 0x2c58], ax
push eax
mov dl, 1
mov byte [ebp - 4], 4
mov ecx, str.bcdedit__enum_all
call fcn.00448ec0
mov ecx, dword [0x4af18c]
xor eax, eax
mov esi, dword [0x4af188]
add esp, 4
mov word [ebp - 0x1220], ax
sub ecx, esi
lea edi, [eax + 1]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
jle 0x41f2fb
mov eax, 0x18
mov dword [ebp - 0x2ca4], eax
nop dword [eax]
add eax, esi
cmp dword [eax + 0x14], 8
jb 0x41f22a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1220]
push 0x800
push eax
call fcn.00474910
mov eax, dword [0x4af188]
add esp, 0xc
mov esi, dword [ebp - 0x2ca4]
add eax, 0xffffffe8
add eax, esi
cmp dword [eax + 0x14], 8
jb 0x41f257
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x2c28]
push 0x800
push eax
call fcn.00474910
lea ecx, [ebp - 0x1220]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f275
sub ecx, edx
sar ecx, 1
cmp ecx, 0x19
jb 0x41f2bd
push 3
lea eax, [ebp - 0x2c28]
push 0x499174
push eax
call fcn.0047114f
add esp, 0xc
test eax, eax
jne 0x41f2bd
push 9
lea eax, [ebp - 0x11f0]
push str.current
push eax
call fcn.0047114f
add esp, 0xc
test eax, eax
je 0x41f2f5
mov ecx, dword [0x4af18c]
add esi, 0x18
mov dword [ebp - 0x2ca4], esi
mov eax, 0x2aaaaaab
mov esi, dword [0x4af188]
inc edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x41f2fb
mov eax, dword [ebp - 0x2ca4]
jmp 0x41f220
mov esi, dword [0x4af188]
mov ecx, dword [0x4af18c]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x41f41b
lea eax, [edi + edi*2]
shl eax, 3
mov dword [ebp - 0x2ca4], eax
add eax, esi
cmp dword [eax + 0x14], 8
jb 0x41f332
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1220]
push 0x800
push eax
call fcn.00474910
lea ecx, [ebp - 0x1220]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f350
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jb 0x41f415
cmp word [ebp - 0x1220], 0x2d
je 0x41f415
push 0x10
lea eax, [ebp - 0x1220]
push str.recoverysequence
push eax
call fcn.0047114f
add esp, 0xc
test eax, eax
jne 0x41f3b4
lea ecx, [ebp - 0x1220]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f3a0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x19
ja 0x41f3ea
mov ecx, dword [0x4af18c]
mov eax, 0x2aaaaaab
mov esi, dword [0x4af188]
inc edi
add dword [ebp - 0x2ca4], 0x18
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x41f41b
mov eax, dword [ebp - 0x2ca4]
jmp 0x41f328
lea ecx, [ebp - 0x11f0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f3f3
sub ecx, edx
lea eax, [ebp - 0x11f0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c88]
call fcn.00402430
mov esi, dword [0x4af188]
cmp dword [ebp - 0x2c78], 0
je 0x41fa6c
mov ecx, dword [0x4af18c]
mov eax, 0x2aaaaaab
sub ecx, esi
mov edi, 1
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
jle 0x41f54f
mov eax, 0x18
mov dword [ebp - 0x2ca4], eax
nop dword [eax]
add eax, esi
cmp dword [eax + 0x14], 8
jb 0x41f46a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1220]
push 0x800
push eax
call fcn.00474910
mov eax, dword [0x4af188]
add esp, 0xc
mov esi, dword [ebp - 0x2ca4]
add eax, 0xffffffe8
add eax, esi
cmp dword [eax + 0x14], 8
jb 0x41f497
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x2c28]
push 0x800
push eax
call fcn.00474910
lea ecx, [ebp - 0x1220]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f4b5
sub ecx, edx
sar ecx, 1
cmp ecx, 0x19
jb 0x41f511
push 3
lea eax, [ebp - 0x2c28]
push 0x499174
push eax
call fcn.0047114f
add esp, 0xc
test eax, eax
jne 0x41f511
cmp dword [ebp - 0x2c74], 8
lea eax, [ebp - 0x2c88]
push dword [ebp - 0x2c78]
cmovae eax, dword [ebp - 0x2c88]
push eax
lea eax, [ebp - 0x11f0]
push eax
call fcn.0047114f
add esp, 0xc
test eax, eax
je 0x41f549
mov ecx, dword [0x4af18c]
add esi, 0x18
mov dword [ebp - 0x2ca4], esi
mov eax, 0x2aaaaaab
mov esi, dword [0x4af188]
inc edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x41f54f
mov eax, dword [ebp - 0x2ca4]
jmp 0x41f460
mov esi, dword [0x4af188]
cmp dword [ebp - 0x2c78], 0
je 0x41fa6c
mov ecx, dword [0x4af18c]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x41fa6c
lea eax, [edi + edi*2]
shl eax, 3
mov dword [ebp - 0x2ca4], eax
nop dword [eax]
add eax, esi
cmp dword [eax + 0x14], 8
jb 0x41f59a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1220]
push 0x800
push eax
call fcn.00474910
lea ecx, [ebp - 0x1220]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f5c0
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jb 0x41fa6c
cmp word [ebp - 0x1220], 0x2d
je 0x41fa6c
push 6
lea eax, [ebp - 0x1220]
push str.device
push eax
call fcn.0047114f
add esp, 0xc
test eax, eax
jne 0x41f624
lea ecx, [ebp - 0x1220]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f610
sub ecx, edx
sar ecx, 1
cmp ecx, 0x19
ja 0x41f65e
mov ecx, dword [0x4af18c]
mov eax, 0x2aaaaaab
mov esi, dword [0x4af188]
inc edi
add dword [ebp - 0x2ca4], 0x18
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x41fa6c
mov eax, dword [ebp - 0x2ca4]
jmp 0x41f590
lea ecx, [ebp - 0x1220]
mov esi, 0x18
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f670
sub ecx, edx
sar ecx, 1
cmp ecx, esi
jle 0x41f693
cmp word [ebp + esi*2 - 0x1220], 0x5b
je 0x41f693
inc esi
cmp esi, ecx
jl 0x41f683
xor eax, eax
mov edi, esi
cmp word [ebp + esi*2 - 0x1220], 0x5b
cmovne edi, eax
cmp esi, ecx
jge 0x41f6c0
nop word [eax + eax]
cmp word [ebp + esi*2 - 0x1220], 0x5d
je 0x41f6c0
inc esi
cmp esi, ecx
jl 0x41f6b0
xor eax, eax
cmp word [ebp + esi*2 - 0x1220], 0x5d
cmovne esi, eax
test edi, edi
jle 0x41fa6c
cmp esi, edi
jle 0x41fa6c
lea edx, [esi + 1]
cmp ecx, edx
jle 0x41fa6c
dec ecx
cmp ecx, edx
jle 0x41f71d
nop
movzx eax, word [ebp + ecx*2 - 0x1220]
cmp eax, 0x5c
je 0x41f71d
cmp eax, 0x2c
jne 0x41f718
cmp ecx, 0x800
jae 0x41fed8
xor eax, eax
mov word [ebp + ecx*2 - 0x1220], ax
dec ecx
cmp ecx, edx
jg 0x41f6f0
lea eax, [ecx + ecx]
lea edx, [ebp - 0x121e]
mov dword [ebp - 0x2cac], eax
add edx, eax
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x2ca4], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f740
sub ecx, dword [ebp - 0x2ca4]
sar ecx, 1
push ecx
push edx
mov ecx, 0x4ae1fc
call fcn.00402430
mov eax, dword [ebp - 0x2cac]
cmp eax, 0x1000
jae 0x41fed8
xor ecx, ecx
lea edx, [ebp - 0x121e]
add esi, esi
mov word [ebp + eax - 0x1220], cx
add edx, esi
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x2cac], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f790
sub ecx, dword [ebp - 0x2cac]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c70]
call fcn.00402430
cmp esi, 0x1000
jae 0x41fed8
lea edx, [ebp - 0x121e]
xor eax, eax
lea edx, [edx + edi*2]
mov word [ebp + esi - 0x1220], ax
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f7d4
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c40]
call fcn.00402430
cmp dword [ebp - 0x2c2c], 8
lea eax, [ebp - 0x2c40]
push 7
cmovae eax, dword [ebp - 0x2c40]
push str.Device
push eax
call fcn.0047114f
add esp, 0xc
test eax, eax
jne 0x41f8d7
push 0x208
push eax
lea eax, [ebp - 0x1c28]
push eax
call fcn.0046dcc0
add esp, 0xc
lea eax, [ebp - 0x2c40]
cmp dword [ebp - 0x2c2c], 8
cmovae eax, dword [ebp - 0x2c40]
push eax
lea eax, [ebp - 0x1c28]
push 0x104
push eax
call fcn.00474910
add esp, 8
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x1c28]
call fcn.00411de0
add esp, 4
test al, al
je 0x41f8d7
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f880
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x41fed8
xor eax, eax
mov word [ebp + ecx - 0x220], ax
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f8b5
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c40]
call fcn.00402430
cmp dword [0x4ae210], 8
lea ecx, [ebp - 0x2c70]
mov edx, 0x4ae1fc
lea eax, [ebp - 0x2c40]
cmovae edx, dword [0x4ae1fc]
cmp dword [ebp - 0x2c5c], 8
push edx
cmovae ecx, dword [ebp - 0x2c70]
cmp dword [ebp - 0x2c2c], 8
push ecx
cmovae eax, dword [ebp - 0x2c40]
push eax
lea eax, [ebp - 0x1a20]
push 0x4991b4
push eax
call fcn.0040a7d0
add esp, 0x14
lea ecx, [ebp - 0x1a20]
call fcn.004118b0
test al, al
je 0x41fa4a
lea eax, [ebp - 0x2c70]
push eax
lea edx, [ebp - 0x2c40]
lea ecx, [ebp - 0x2cc4]
call fcn.00468c50
add esp, 4
mov ecx, 0x4ae1e4
push eax
call fcn.0040a5e0
mov edx, dword [ebp - 0x2cb0]
cmp edx, 8
jb 0x41f9a2
mov ecx, dword [ebp - 0x2cc4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41f998
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fed3
push edx
push ecx
call fcn.0046ba31
add esp, 8
cmp dword [0x4ae1f8], 8
mov eax, 0x4ae1e4
push dword [0x4ae1f4]
cmovae eax, dword [0x4ae1e4]
mov ecx, 0x4ae214
push eax
call fcn.00402430
cmp dword [0x4ae1f8], 8
lea ecx, [ebp - 0x2c58]
push dword [0x4ae1f4]
mov eax, 0x4ae1e4
cmovae eax, dword [0x4ae1e4]
push eax
call fcn.00402430
lea eax, [ebp - 0x1a20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [0x4ae22c]
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x18
mov dword [0x4ae22c], ecx
mov ecx, esp
push 0x4ae1e4
call fcn.004022e0
call fcn.00411810
add esp, 0x18
push 0
push 0x400
push edx
push eax
call fcn.00483920
push 0
push 0x400
push edx
push eax
call fcn.00483920
mov dword [0x4ae510], eax
mov dword [0x4ae514], edx
jmp 0x41fa6c
cmp dword [0x4ae210], 8
mov eax, 0x4ae1fc
mov dword [0x4ae20c], 0
cmovae eax, dword [0x4ae1fc]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x2c48], 0
jne 0x41fd62
cmp byte [ebp - 0x2ca5], 0
je 0x41fd62
mov eax, dword [0x4ac990]
mov dword [ebp - 0x2ca4], 0
test eax, eax
je 0x41faa2
lea ecx, [ebp - 0x2ca4]
push ecx
call eax
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
nop word [eax + eax]
mov ecx, 0x4ae1fc
push 9
test esi, esi
jne 0x41fac2
push 0x4991c4
jmp 0x41fac7
push str.winre.dat
call fcn.00402430
cmp dword [ebp - 0x2c5c], 8
lea ecx, [ebp - 0x2c70]
lea eax, [ebp - 0x2c40]
cmovae ecx, dword [ebp - 0x2c70]
cmp dword [ebp - 0x2c2c], 8
push ecx
cmovae eax, dword [ebp - 0x2c40]
push eax
lea eax, [ebp - 0x1a20]
push str._s_s
push eax
call fcn.0040a7d0
lea ecx, [ebp - 0x1a20]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fb13
sub ecx, edx
sar ecx, 1
je 0x41fb4d
cmp dword [0x4ae210], 8
lea eax, [ebp - 0x2c58]
push ecx
mov edx, 0x4ae1fc
lea ecx, [ebp - 0x1a20]
cmovae edx, dword [0x4ae1fc]
push eax
call fcn.00412bb0
add esp, 8
cmp dword [ebp - 0x2c48], 0
jne 0x41fd03
cmp dword [ebp - 0x2c2c], 8
lea eax, [ebp - 0x2c40]
cmovae eax, dword [ebp - 0x2c40]
push eax
lea eax, [ebp - 0x1a20]
push str._sRecovery
push eax
call fcn.0040a7d0
add esp, 0xc
cmp dword [ebp - 0x2c30], 0
je 0x41fbb5
cmp dword [0x4ae210], 8
lea eax, [ebp - 0x2c58]
push ecx
mov edx, 0x4ae1fc
lea ecx, [ebp - 0x1a20]
cmovae edx, dword [0x4ae1fc]
push eax
call fcn.00412bb0
add esp, 8
cmp dword [ebp - 0x2c48], 0
jne 0x41fd03
cmp dword [0x4ae210], 8
mov ecx, 0x4ae1fc
mov eax, 0x4ae0a0
cmovae ecx, dword [0x4ae1fc]
cmp dword [0x4ae0b4], 8
push ecx
cmovae eax, dword [0x4ae0a0]
push eax
lea eax, [ebp - 0x1a20]
push str._sSystem32Recovery_s
push eax
call fcn.0040a7d0
add esp, 0x10
lea ecx, [ebp - 0x1a20]
call fcn.004118b0
test al, al
jne 0x41fc6e
xor eax, eax
mov word [ebp - 0x1a20], ax
lea eax, [ebp - 0x1a20]
push 0x400
push eax
push str._SystemDrive_Recovery
call edi
cmp dword [0x4ae210], 8
lea eax, [ebp - 0x2c58]
push ecx
mov edx, 0x4ae1fc
lea ecx, [ebp - 0x1a20]
cmovae edx, dword [0x4ae1fc]
push eax
call fcn.00412bb0
add esp, 8
cmp dword [ebp - 0x2c48], 0
jne 0x41fd03
inc esi
cmp esi, 2
jl 0x41fab0
jmp 0x41fd03
push str.System32Recovery
mov edx, 0x4ae0a0
lea ecx, [ebp - 0x2cc4]
call fcn.0040a830
mov esi, eax
add esp, 4
lea eax, [ebp - 0x2c58]
cmp eax, esi
je 0x41fcc3
mov ecx, eax
call fcn.00402210
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x2c58], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x2c48], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2cb0]
cmp edx, 8
jb 0x41fd03
mov ecx, dword [ebp - 0x2cc4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fcf9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fedd
push edx
push ecx
call fcn.0046ba31
add esp, 8
mov eax, dword [0x4ac98c]
test eax, eax
je 0x41fd14
push dword [ebp - 0x2ca4]
call eax
mov edx, dword [ebp - 0x2c48]
test edx, edx
je 0x41fd40
cmp dword [ebp - 0x2c44], 8
lea eax, [ebp - 0x2c58]
push edx
cmovae eax, dword [ebp - 0x2c58]
mov ecx, 0x4ae214
push eax
call fcn.00402430
jmp 0x41fd62
cmp dword [0x4ae210], 8
mov eax, 0x4ae1fc
mov dword [0x4ae20c], 0
cmovae eax, dword [0x4ae1fc]
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x2c44]
cmp edx, 8
jb 0x41fda2
mov ecx, dword [ebp - 0x2c58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fd98
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fee2
push edx
push ecx
call fcn.0046ba31
add esp, 8
mov edx, dword [ebp - 0x2c5c]
xor eax, eax
mov dword [ebp - 0x2c48], 0
mov dword [ebp - 0x2c44], 7
mov word [ebp - 0x2c58], ax
cmp edx, 8
jb 0x41fdff
mov ecx, dword [ebp - 0x2c70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fdf5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fee7
push edx
push ecx
call fcn.0046ba31
add esp, 8
mov edx, dword [ebp - 0x2c2c]
xor eax, eax
mov dword [ebp - 0x2c60], 0
mov dword [ebp - 0x2c5c], 7
mov word [ebp - 0x2c70], ax
cmp edx, 8
jb 0x41fe5c
mov ecx, dword [ebp - 0x2c40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fe52
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41feec
push edx
push ecx
call fcn.0046ba31
add esp, 8
mov edx, dword [ebp - 0x2c74]
xor eax, eax
mov dword [ebp - 0x2c30], 0
mov dword [ebp - 0x2c2c], 7
mov word [ebp - 0x2c40], ax
cmp edx, 8
jb 0x41feb5
mov ecx, dword [ebp - 0x2c88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41feab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fef1
push edx
push ecx
call fcn.0046ba31
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046b9f0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00471513
call fcn.0046bb60
call fcn.00471513
call fcn.00471513
call fcn.00471513
call fcn.00471513
call fcn.00471513
int3