Function at 0x4db0b4
Capabilities:
Copy file
Delete file
Manipulate boot configuration
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x3d
push 0
push 0
dec ecx
jne 0x4db0bd
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 0x19], dl
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
call fcn.0040685c
xor eax, eax
push ebp
push 0x4dc1cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1a], 1
xor edx, edx
push ebp
push 0x4dc095
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 0x19], 0
je 0x4db1b9
push 2
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x410]
call fcn.004a27d4
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
call fcn.0042145c
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x4c]
mov ecx, 0x4dc1f4
call fcn.00406d58
mov eax, dword [ebp - 0x4c]
mov ecx, 0x4dc218
mov edx, 0x4dc238
call fcn.004d642c
lea edx, [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.004209a0
push 2
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x414]
call fcn.004a27d4
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
call fcn.0042145c
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x74]
mov ecx, 0x4dc1f4
call fcn.00406d58
mov eax, dword [ebp - 0x74]
mov ecx, 0x4dc258
mov edx, 0x4dc238
call fcn.004d642c
lea edx, [ebp - 0x5c]
lea eax, [ebp - 8]
call fcn.004209a0
jmp 0x4db1d3
lea eax, [ebp - 4]
mov edx, 0x4dc278
call fcn.004068c8
lea eax, [ebp - 8]
mov edx, 0x4dc2a0
call fcn.004068c8
test bl, bl
jne 0x4db774
mov byte [ebp - 0x1b], 1
call fcn.004d5018
test al, al
jne 0x4db50a
movzx ebx, byte [ebp - 0x19]
xor bl, 1
test bl, bl
je 0x4db295
push 2
lea eax, [ebp - 0x94]
xor edx, edx
call fcn.0042145c
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x98]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x98]
mov edx, 0x4dc2b0
call fcn.00406c98
mov eax, dword [ebp - 0x98]
mov ecx, 0x4dc2d0
mov edx, 0x4dc2ec
call fcn.004d642c
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0xac]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xac]
mov edx, 0x4dc310
call fcn.00406c98
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
call fcn.0042145c
lea edx, [ebp - 0xa8]
pop eax
call fcn.00422954
setne byte [ebp - 0x1b]
movzx eax, byte [ebp - 0x1b]
and al, byte [ebp + 0xc]
je 0x4db2a2
mov byte [ebp - 0x1b], 0
push 0
lea ecx, [ebp - 0xb0]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xb0]
mov edx, 0x4dc2b0
call fcn.00406c98
mov eax, dword [ebp - 0xb0]
call fcn.00406900
push eax
call fcn.0040b4fc
push 0
lea ecx, [ebp - 0xb4]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xb4]
mov edx, 0x4dc328
call fcn.00406c98
mov eax, dword [ebp - 0xb4]
call fcn.00406900
push eax
call fcn.0040b4fc
cmp byte [ebp - 0x1b], 0
je 0x4db371
test bl, bl
je 0x4db371
push 0
lea ecx, [ebp - 0xb8]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xb8]
mov edx, 0x4dc328
call fcn.00406c98
mov eax, dword [ebp - 0xb8]
call fcn.00406900
push eax
lea ecx, [ebp - 0xbc]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xbc]
mov edx, 0x4dc2b0
call fcn.00406c98
mov eax, dword [ebp - 0xbc]
call fcn.00406900
push eax
call fcn.0040b1d0
test bl, bl
je 0x4db3e4
lea ecx, [ebp - 0xd0]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xd0]
mov edx, 0x4dc310
call fcn.00406c98
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0xcc]
call fcn.0042145c
lea eax, [ebp - 0xcc]
push eax
push 2
lea ecx, [ebp - 0xd4]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xd4]
mov edx, 0x4dc2b0
call fcn.00406c98
mov eax, dword [ebp - 0xd4]
mov ecx, 0x4dc2d0
mov edx, 0x4dc2ec
call fcn.004d6694
lea eax, [ebp - 0xe4]
mov edx, dword [ebp - 8]
call fcn.0042145c
lea eax, [ebp - 0xe4]
push eax
push 2
lea ecx, [ebp - 0xe8]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xe8]
mov edx, 0x4dc2b0
call fcn.00406c98
mov eax, dword [ebp - 0xe8]
mov ecx, 0x4dc348
mov edx, 0x4dc2ec
call fcn.004d6694
lea eax, [ebp - 0xf8]
mov edx, dword [ebp - 4]
call fcn.0042145c
lea eax, [ebp - 0xf8]
push eax
push 2
lea ecx, [ebp - 0xfc]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0xfc]
mov edx, 0x4dc310
call fcn.00406c98
mov eax, dword [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x100]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x100]
mov edx, 0x4dc2b0
call fcn.00406c98
mov eax, dword [ebp - 0x100]
mov edx, 0x4dc364
pop ecx
call fcn.004d6694
push 7
lea ecx, [ebp - 0x104]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x104]
mov edx, 0x4dc2b0
call fcn.00406c98
mov eax, dword [ebp - 0x104]
call fcn.00406900
push eax
call fcn.0040b4fc
push 7
lea ecx, [ebp - 0x108]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x108]
mov edx, 0x4dc328
call fcn.00406c98
mov eax, dword [ebp - 0x108]
call fcn.00406900
push eax
call fcn.0040b4fc
jmp 0x4db89b
mov eax, dword [ebp - 0x18]
call fcn.004e3338
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4db5b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1c], 0
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4db5a0
lea ecx, [ebp - 0x10c]
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x10c]
mov eax, 0x4dc394
call fcn.004072dc
test eax, eax
jle 0x4db59a
cmp byte [ebp - 0x19], 0
jne 0x4db58a
lea ecx, [ebp - 0x110]
mov edx, ebx
sub edx, 2
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x110]
mov eax, 0x4dc2d0
call fcn.004072dc
test eax, eax
sete byte [ebp - 0x1b]
cmp byte [ebp + 0xc], 0
je 0x4db594
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1c], 1
jmp 0x4db5a0
dec ebx
cmp ebx, 0xffffffff
jne 0x4db537
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db5bd
mov eax, dword [ebp - 0x20]
call fcn.00404da0
ret
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x47c]
mov edx, 0x4dc5c0
mov eax, 0x4dc5e0
call fcn.004d503c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x47c]
call fcn.00411e78
test al, al
je 0x4db897
xor eax, eax
push ebp
push 0x4db890
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x424]
call fcn.004a27d4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x10]
call fcn.0041122c
mov eax, dword [ebp - 0x18]
push dword [eax + 0x47c]
push 0x4dc5fc
mov eax, dword [ebp - 0x18]
push dword [eax + 0x6b8]
push 0x4dc614
push dword [ebp - 8]
push 0x4dc664
push dword [ebp - 0x10]
push 0x4dc67c
push dword [ebp - 0x10]
push 0x4dc6a8
lea ecx, [ebp - 0x144]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
mov edx, dword [ebp - 0x144]
lea ecx, [ebp - 0x140]
mov eax, dword [ebp - 0x18]
call fcn.004e29c4
mov eax, dword [ebp - 0x140]
mov edx, 1
call fcn.00411ab8
dec eax
lea edx, [ebp - 0x13c]
call fcn.00411820
push dword [ebp - 0x13c]
push 0x4dc6d4
lea eax, [ebp - 0x138]
mov edx, 0xc
call fcn.00406e3c
mov eax, dword [ebp - 0x138]
xor edx, edx
call fcn.004d3640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db897
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x47c]
call fcn.00406900
push eax
call fcn.0040b210
ret
mov byte [ebp - 0x1a], 1
mov eax, dword [ebp - 0x18]
call fcn.004e2f30
test al, al
jne 0x4dc08b
cmp byte [ebp + 0xc], 0
jne 0x4db92c
lea ecx, [ebp - 0x148]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x148]
mov edx, 0x4dc310
call fcn.00406c98
mov ebx, dword [ebp - 0x148]
lea ecx, [ebp - 0x14c]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x14c]
mov edx, 0x4dc6e4
call fcn.00406c98
mov esi, dword [ebp - 0x14c]
mov dword [ebp - 0x150], esi
mov eax, dword [ebp - 0x150]
call fcn.00406900
push eax
mov dword [ebp - 0x154], ebx
mov eax, dword [ebp - 0x154]
call fcn.00406900
push eax
call fcn.0040b49c
cmp eax, 1
sbb eax, eax
inc eax
push 0
lea ecx, [ebp - 0x158]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x158]
mov edx, 0x4dc310
call fcn.00406c98
mov eax, dword [ebp - 0x158]
call fcn.00406900
push eax
call fcn.0040b4fc
lea ecx, [ebp - 0x15c]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x15c]
mov edx, 0x4dc310
call fcn.00406c98
mov ecx, dword [ebp - 0x15c]
mov edx, 0x4dc310
mov eax, 0x4dc5e0
call fcn.004d503c
cmp byte [ebp - 0x19], 0
je 0x4db9ce
cmp dword [ebp + 8], 0
je 0x4db9ce
lea ecx, [ebp - 0x160]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x160]
mov edx, 0x4dc310
call fcn.00406c98
mov eax, dword [ebp - 0x160]
mov edx, dword [ebp + 8]
call fcn.004d598c
push 7
lea ecx, [ebp - 0x164]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x164]
mov edx, 0x4dc310
call fcn.00406c98
mov eax, dword [ebp - 0x164]
call fcn.00406900
push eax
call fcn.0040b4fc
call fcn.004d5018
test al, al
je 0x4dbb2a
cmp byte [ebp + 0xc], 0
jne 0x4dba8f
lea ecx, [ebp - 0x168]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x168]
mov edx, 0x4dc700
call fcn.00406c98
mov ebx, dword [ebp - 0x168]
lea ecx, [ebp - 0x16c]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x16c]
mov edx, 0x4dc720
call fcn.00406c98
mov esi, dword [ebp - 0x16c]
mov dword [ebp - 0x150], esi
mov eax, dword [ebp - 0x150]
call fcn.00406900
push eax
mov dword [ebp - 0x154], ebx
mov eax, dword [ebp - 0x154]
call fcn.00406900
push eax
call fcn.0040b49c
cmp eax, 1
sbb eax, eax
inc eax
push 0
lea ecx, [ebp - 0x170]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x170]
mov edx, 0x4dc700
call fcn.00406c98
mov eax, dword [ebp - 0x170]
call fcn.00406900
push eax
call fcn.0040b4fc
lea ecx, [ebp - 0x174]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x174]
mov edx, 0x4dc700
call fcn.00406c98
mov ecx, dword [ebp - 0x174]
mov edx, 0x4dc740
mov eax, 0x4dc5e0
call fcn.004d503c
push 7
lea ecx, [ebp - 0x178]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x178]
mov edx, 0x4dc700
call fcn.00406c98
mov eax, dword [ebp - 0x178]
call fcn.00406900
push eax
call fcn.0040b4fc
cmp byte [ebp + 0xc], 0
jne 0x4dbbab
lea ecx, [ebp - 0x17c]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x17c]
mov edx, 0x4dc754
call fcn.00406c98
mov ebx, dword [ebp - 0x17c]
lea ecx, [ebp - 0x180]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x180]
mov edx, 0x4dc774
call fcn.00406c98
mov esi, dword [ebp - 0x180]
mov dword [ebp - 0x150], esi
mov eax, dword [ebp - 0x150]
call fcn.00406900
push eax
mov dword [ebp - 0x154], ebx
mov eax, dword [ebp - 0x154]
call fcn.00406900
push eax
call fcn.0040b49c
cmp eax, 1
sbb eax, eax
inc eax
push 0
lea ecx, [ebp - 0x184]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x184]
mov edx, 0x4dc754
call fcn.00406c98
mov eax, dword [ebp - 0x184]
call fcn.00406900
push eax
call fcn.0040b4fc
lea ecx, [ebp - 0x188]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x188]
mov edx, 0x4dc754
call fcn.00406c98
mov ecx, dword [ebp - 0x188]
mov edx, 0x4dc794
mov eax, 0x4dc5e0
call fcn.004d503c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3f4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x4dbca0
lea eax, [ebp - 0x18c]
call fcn.004d4ef0
mov edx, dword [ebp - 0x18c]
lea eax, [ebp - 0x14]
mov ecx, 0x4dc7a8
call fcn.00406d58
mov ecx, dword [ebp - 0x14]
mov edx, 0x4dc7c8
mov eax, 0x4dc5e0
call fcn.004d503c
mov eax, dword [ebp - 0x14]
call fcn.00411e78
test al, al
je 0x4dbca0
lea ecx, [ebp - 0x190]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x190]
mov edx, 0x4dc754
call fcn.00406c98
mov eax, dword [ebp - 0x190]
mov edx, dword [ebp - 0x14]
call fcn.004d8cfc
mov eax, dword [ebp - 0x14]
call fcn.00406900
push eax
call fcn.0040b210
cmp byte [ebp - 0x19], 0
je 0x4dc058
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x480]
call fcn.004122e4
mov eax, dword [ebp - 0x194]
call fcn.004d5d04
push 7
lea edx, [ebp - 0x198]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x480]
call fcn.00412320
mov eax, dword [ebp - 0x198]
call fcn.00406900
push eax
call fcn.0040b4fc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x480]
mov cl, 1
mov eax, dword [ebp - 0x18]
call fcn.004decec
mov dl, 1
mov eax, dword [0x4277e4]
call fcn.00433160
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4dbf25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3c8]
mov edx, dword [eax]
call dword [edx + 0xec]
push eax
lea eax, [ebp - 0x1a8]
call fcn.004d4ec4
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x480]
mov dword [ebp - 0x1a0], eax
lea edx, [ebp - 0x1a4]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.004dea20
xor al, 1
push eax
push 0x4dc7e8
mov eax, dword [ebp + 8]
push eax
push 0
push 0
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1b4]
call fcn.004d4ec4
mov eax, dword [ebp - 0x1b4]
lea edx, [ebp - 0x1b0]
call fcn.004123e0
mov edx, dword [ebp - 0x1b0]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
call fcn.004e2ac0
mov ecx, dword [ebp - 0x1ac]
mov edx, 0x4dc800
mov eax, dword [ebp - 0x18]
call fcn.004e1d54
mov edx, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x1b8]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x1b8]
mov edx, 0x4dc818
call fcn.00406c98
mov edx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x1c8]
call fcn.004d4ec4
mov eax, dword [ebp - 0x1c8]
lea edx, [ebp - 0x1c4]
call fcn.004123e0
mov edx, dword [ebp - 0x1c4]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
call fcn.004e2ac0
mov eax, dword [ebp - 0x1c0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3c8]
mov edx, dword [eax]
call dword [edx + 0xec]
push eax
lea eax, [ebp - 0x1cc]
call fcn.004d4ec4
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x480]
mov dword [ebp - 0x1a0], eax
lea edx, [ebp - 0x1a4]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.004dea20
xor al, 1
push eax
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x1d0]
mov ecx, 0x4dc834
mov edx, dword [ebp - 0xc]
call fcn.00406d58
mov ecx, dword [ebp - 0x1d0]
mov edx, 0x4dc848
mov eax, dword [ebp - 0x18]
call fcn.004e1d54
mov edx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x1d4]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x1d4]
mov edx, 0x4dc860
call fcn.00406c98
mov edx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbf2c
mov eax, dword [ebp - 0x24]
call fcn.00404da0
ret
push 7
lea ecx, [ebp - 0x1f0]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004e21b8
lea eax, [ebp - 0x1f0]
mov edx, 0x4dc754
call fcn.00406c98
mov eax, dword [ebp - 0x1f0]
call fcn.00406900
push eax
call fcn.0040b4fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dc0a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc1d9
lea eax, [ebp - 0x1f0]
mov edx, 0x13
call fcn.0040686c
lea eax, [ebp - 0x19c]
mov edx, 0x12
call fcn.0040686c
lea eax, [ebp - 0x14c]
mov edx, 6
call fcn.0040686c
lea eax, [ebp - 0x134]
call fcn.00406864
lea eax, [ebp - 0x130]
mov edx, 0xe
call fcn.0040686c
lea eax, [ebp - 0xf8]
call fcn.0041c1d8
lea eax, [ebp - 0xe8]
call fcn.00406864
lea eax, [ebp - 0xe4]
call fcn.0041c1d8
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.0040686c
lea eax, [ebp - 0xcc]
call fcn.0041c1d8
lea eax, [ebp - 0xbc]
mov edx, 5
call fcn.0040686c
lea eax, [ebp - 0xa8]
call fcn.0041c1d8
lea eax, [ebp - 0x98]
call fcn.00406864
lea eax, [ebp - 0x94]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 0x74]
call fcn.00406864
lea eax, [ebp - 0x70]
call fcn.00406864
lea eax, [ebp - 0x6c]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 0x4c]
call fcn.00406864
lea eax, [ebp - 0x48]
call fcn.00406864
lea eax, [ebp - 0x44]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040686c
lea eax, [ebp + 8]
call fcn.00406864
ret