Function at 0x410470
Capabilities:
Copy file
Get keyboard layout
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x410478
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4115ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0xa0]
call fcn.004094c4
test al, al
je 0x4104b3
push 1
push 0
push 1
push 0x6f
call fcn.00403c88
jmp 0x4104c0
push 1
push 0
push 0
push 0x6f
call fcn.00403c88
mov eax, dword [esi + 0x100]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x4105a1
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.00409b00
cmp dword [ebp - 0x1c], 0
je 0x410599
lea ecx, [ebp - 0x20]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [esi + 0xf8]
mov edx, ebx
call fcn.00409b00
mov edx, dword [ebp - 0x24]
pop eax
call fcn.004032c8
je 0x410599
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xfc]
mov edx, ebx
call fcn.00409b00
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004032c8
je 0x410599
lea ecx, [ebp - 0x30]
mov eax, dword [esi + 0x100]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x38]
mov eax, dword [esi + 0xdc]
mov edx, ebx
call fcn.00409b00
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x411618
call fcn.004031c8
mov edx, dword [ebp - 0x34]
mov eax, 0x80000002
call fcn.00404738
mov edx, 0x411654
pop ecx
call fcn.004048a4
inc ebx
dec edi
jne 0x4104d5
mov ax, word [0x411668]
call fcn.004068b8
test al, al
jne 0x4105fb
mov ax, word [0x41166c]
call fcn.004068b8
test al, al
jne 0x4105fb
mov ax, word [0x411670]
call fcn.004068b8
test al, al
jne 0x4105fb
mov ax, word [0x411674]
call fcn.004068b8
test al, al
jne 0x4105fb
mov ax, word [0x411678]
call fcn.004068b8
test al, al
jne 0x4105fb
mov eax, esi
call fcn.0040dc64
test al, al
je 0x4106a9
call fcn.004054a4
mov dword [ebp - 0x14], eax
mov edx, 0x411684
mov eax, 0x80000001
call fcn.004046d8
mov edx, dword [ebp - 0x14]
call fcn.00404ad8
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x410652
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x3c]
push eax
mov edx, 0x411684
mov eax, 0x80000001
call fcn.00404708
pop edx
call fcn.00404914
inc ebx
dec edi
jne 0x410628
mov eax, dword [ebp - 0x14]
call fcn.004070b4
mov eax, dword [esi + 0xdc]
mov edi, dword [eax + 0x1c]
test edi, edi
jle 0x4106a9
mov ebx, 1
lea ecx, [ebp - 0x40]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.00409b00
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.004077c0
mov eax, dword [ebp - 0x44]
push eax
mov edx, 0x411684
mov eax, 0x80000001
call fcn.00404738
pop edx
pop ecx
call fcn.004048a4
inc ebx
dec edi
jne 0x41066c
mov ax, word [0x41169c]
call fcn.004068b8
test al, al
jne 0x4106d6
mov ax, word [0x4116a0]
call fcn.004068b8
test al, al
jne 0x4106d6
mov ax, word [0x4116a4]
call fcn.004068b8
test al, al
je 0x41074c
mov edi, dword [esi + 0x108]
test edi, edi
jle 0x4106f2
mov edx, 0x411684
mov eax, 0x80000001
call fcn.004048f0
dec edi
jne 0x4106e0
mov eax, dword [esi + 0xdc]
mov edi, dword [eax + 0x1c]
test edi, edi
jle 0x41074c
mov ebx, 1
lea ecx, [ebp - 0x48]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.00409b00
mov eax, dword [ebp - 0x48]
push eax
lea edx, [ebp - 0x50]
mov eax, ebx
call fcn.004077c0
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x4116b0
call fcn.004031c8
mov edx, dword [ebp - 0x4c]
mov eax, 0x80000001
call fcn.00404738
xor edx, edx
pop ecx
call fcn.004048a4
inc ebx
dec edi
jne 0x410704
xor ebx, ebx
lea ecx, [ebp - 0x58]
lea edi, [ebx + 0x100]
mov eax, edi
mov edx, 3
call fcn.00407754
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x4116d4
call fcn.004031c8
mov edx, dword [ebp - 0x54]
mov eax, 0x80000001
call fcn.00404938
test al, al
je 0x4107b0
lea ecx, [ebp - 0x60]
mov eax, edi
mov edx, 3
call fcn.00407754
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
mov edx, 0x4116d4
call fcn.004031c8
mov edx, dword [ebp - 0x5c]
mov eax, 0x80000001
call fcn.004048f0
inc ebx
cmp ebx, 0xc9
jne 0x41074e
mov eax, dword [esi + 0xe4]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x4109b3
inc edi
xor ebx, ebx
lea ecx, [ebp - 0x64]
mov eax, dword [esi + 0xe4]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x64]
call fcn.00407788
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x6c]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.00407754
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
mov edx, 0x4116d4
call fcn.004031c8
mov edx, dword [ebp - 0x68]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x411708
call fcn.004049d0
lea ecx, [ebp - 0x70]
mov eax, dword [esi + 0xec]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x70]
call fcn.00407788
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x78]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.00407754
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0x4116d4
call fcn.004031c8
mov edx, dword [ebp - 0x74]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x411720
call fcn.004049d0
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x80]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x80]
mov ecx, 4
mov edx, 1
call fcn.004033d4
mov eax, dword [ebp - 0x7c]
mov edx, 0x411734
call fcn.004032c8
jne 0x41093f
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x88]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x88]
mov ecx, 8
mov edx, 5
call fcn.004033d4
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x90]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x90]
mov ecx, 8
mov edx, 5
call fcn.004033d4
mov edx, dword [ebp - 0x8c]
pop eax
call fcn.00403184
mov ecx, dword [ebp - 0x84]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409b58
lea ecx, [ebp - 0x94]
mov eax, dword [esi + 0xe8]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0x94]
call fcn.00407788
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 0x9c]
lea eax, [ebx + 0x100]
mov edx, 3
call fcn.00407754
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
mov edx, 0x4116d4
call fcn.004031c8
mov edx, dword [ebp - 0x98]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x411744
call fcn.004049d0
inc ebx
dec edi
jne 0x4107ce
mov ebx, dword [esi + 0x104]
cmp ebx, 0x804
jne 0x4109ce
lea eax, [ebp - 0xc]
mov edx, 0x411758
call fcn.00403090
cmp ebx, 0x404
jne 0x4109e3
lea eax, [ebp - 0xc]
mov edx, 0x411764
call fcn.00403090
cmp ebx, 0x412
jne 0x4109f8
lea eax, [ebp - 0xc]
mov edx, 0x411770
call fcn.00403090
cmp ebx, 0x411
je 0x410a07
mov eax, 3
jmp 0x410a0c
mov eax, 1
mov edi, eax
test edi, edi
jle 0x410b31
mov ebx, 1
lea eax, [esi + 0x468]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00407788
mov dword [ebp - 8], eax
push 4
push 0x41177c
push dword [ebp - 0xc]
lea edx, [ebp - 0xa4]
mov eax, ebx
dec eax
call fcn.004077c0
push dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0xa0]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x411708
call fcn.004049d0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
call fcn.00407788
mov dword [ebp - 8], eax
push 4
push 0x41177c
push dword [ebp - 0xc]
lea edx, [ebp - 0xac]
mov eax, ebx
dec eax
call fcn.004077c0
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0xa8]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x411720
call fcn.004049d0
xor eax, eax
mov dword [ebp - 8], eax
push 4
push 0x41177c
push dword [ebp - 0xc]
lea edx, [ebp - 0xb4]
mov eax, ebx
dec eax
call fcn.004077c0
push dword [ebp - 0xb4]
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0xb0]
mov eax, 0x80000001
call fcn.00404738
lea ecx, [ebp - 8]
mov edx, 0x411744
call fcn.00404990
inc ebx
add dword [ebp - 0x18], 8
dec edi
jne 0x410a24
mov eax, dword [esi + 0x78]
call fcn.004094c4
test al, al
je 0x410d00
mov eax, dword [esi + 0x7c]
call fcn.00409968
sub eax, 1
jb 0x410b60
je 0x410bed
dec eax
je 0x410c7a
jmp 0x410d3c
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4117d0
mov edx, 0x4117dc
call fcn.004048a4
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4117d0
mov edx, 0x4117ec
call fcn.004048a4
mov ax, word [0x41169c]
call fcn.004068b8
test al, al
jne 0x410bcd
mov ax, word [0x4116a0]
call fcn.004068b8
test al, al
jne 0x410bcd
mov ax, word [0x4116a4]
call fcn.004068b8
test al, al
je 0x410d3c
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4117d0
xor edx, edx
call fcn.004048a4
jmp 0x410d3c
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411758
mov edx, 0x4117dc
call fcn.004048a4
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411758
mov edx, 0x4117ec
call fcn.004048a4
mov ax, word [0x41169c]
call fcn.004068b8
test al, al
jne 0x410c5a
mov ax, word [0x4116a0]
call fcn.004068b8
test al, al
jne 0x410c5a
mov ax, word [0x4116a4]
call fcn.004068b8
test al, al
je 0x410d3c
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411758
xor edx, edx
call fcn.004048a4
jmp 0x410d3c
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411804
mov edx, 0x4117dc
call fcn.004048a4
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411804
mov edx, 0x4117ec
call fcn.004048a4
mov ax, word [0x41169c]
call fcn.004068b8
test al, al
jne 0x410ce3
mov ax, word [0x4116a0]
call fcn.004068b8
test al, al
jne 0x410ce3
mov ax, word [0x4116a4]
call fcn.004068b8
test al, al
je 0x410d3c
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411804
xor edx, edx
call fcn.004048a4
jmp 0x410d3c
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411810
mov edx, 0x4117dc
call fcn.004048a4
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411810
mov edx, 0x4117ec
call fcn.004048a4
mov eax, dword [esi + 0x80]
call fcn.004094c4
test al, al
je 0x410dc2
mov eax, dword [esi + 0x84]
call fcn.00409968
sub eax, 1
jb 0x410d62
je 0x410d82
dec eax
je 0x410da2
jmp 0x410de0
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x4117d0
mov edx, 0x41181c
call fcn.004048a4
jmp 0x410de0
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411758
mov edx, 0x41181c
call fcn.004048a4
jmp 0x410de0
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411804
mov edx, 0x41181c
call fcn.004048a4
jmp 0x410de0
mov edx, 0x4117b0
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411810
mov edx, 0x41181c
call fcn.004048a4
mov ax, word [0x411668]
call fcn.004068b8
test al, al
jne 0x410e36
mov ax, word [0x41166c]
call fcn.004068b8
test al, al
jne 0x410e36
mov ax, word [0x411670]
call fcn.004068b8
test al, al
jne 0x410e36
mov ax, word [0x411674]
call fcn.004068b8
test al, al
jne 0x410e36
mov ax, word [0x411678]
call fcn.004068b8
test al, al
jne 0x410e36
mov eax, esi
call fcn.0040dc64
test al, al
je 0x410e98
mov eax, dword [esi + 0x9c]
call fcn.00409968
test eax, eax
jne 0x410e6e
mov edx, 0x411834
mov eax, 0x80000001
call fcn.00404738
xor ecx, ecx
mov edx, 0x41184c
call fcn.0040486c
push 0x40000000
push 0
call fcn.00403a90
jmp 0x410e98
mov edx, 0x411834
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x10000
mov edx, 0x41184c
call fcn.0040486c
push 0x40010000
push 0
call fcn.00403a90
push 2
push 0
push 0
push 0x5b
call fcn.00403c88
mov ebx, 0x1f
lea eax, [esi + 0x110]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec ebx
jne 0x410eb0
lea eax, [esi + 0x110]
push eax
push 0x1e
call fcn.00403b60
mov ebx, 0x1f
lea edi, [esi + 0x110]
mov eax, dword [edi]
test eax, eax
je 0x410edf
push eax
call fcn.00403c98
add edi, 4
dec ebx
jne 0x410ed3
mov eax, dword [esi + 0xdc]
mov ebx, dword [eax + 0x1c]
cmp ebx, 1
jl 0x410f1f
push 8
lea ecx, [ebp - 0xb8]
mov edx, ebx
dec edx
mov eax, dword [esi + 0xdc]
call fcn.00409b00
mov eax, dword [ebp - 0xb8]
call fcn.0040337c
push eax
call fcn.00403bf8
dec ebx
test ebx, ebx
jne 0x410ef3
mov ebx, 0x1f
lea eax, [esi + 0x110]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec ebx
jne 0x410f2a
lea eax, [esi + 0x110]
push eax
push 0x1e
call fcn.00403b60
push 1
mov eax, dword [esi + 0x110]
push eax
call fcn.00403a90
push 2
lea eax, [esi + 0x110]
push eax
push 0
push 0x5a
call fcn.00403c88
call fcn.004054a4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00402ff8
mov edx, 0x411860
mov eax, 0x80000002
call fcn.004046d8
mov edx, dword [ebp - 0x10]
call fcn.00404a08
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x41108c
inc edi
xor ebx, ebx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.00409b00
mov eax, dword [ebp - 0xc0]
mov ecx, 1
mov edx, 1
call fcn.004033d4
mov eax, dword [ebp - 0xbc]
mov edx, 0x41189c
call fcn.004032c8
je 0x411084
lea ecx, [ebp - 0xc8]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.00409b00
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0xc4]
mov edx, 0x411618
call fcn.004031c8
mov edx, dword [ebp - 0xc4]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 0xc]
mov edx, 0x4118a8
call fcn.00404808
cmp dword [ebp - 0xc], 0
je 0x41104e
lea eax, [ebp - 0xcc]
call fcn.00404660
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0xc]
call fcn.00403184
mov eax, dword [ebp - 0xcc]
call fcn.004079e4
test al, al
jne 0x411084
lea ecx, [ebp - 0xd4]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.00409b00
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
mov edx, 0x411618
call fcn.004031c8
mov edx, dword [ebp - 0xd0]
mov eax, 0x80000002
call fcn.004048f0
inc ebx
dec edi
jne 0x410f9b
mov eax, dword [ebp - 0x10]
call fcn.004070b4
mov eax, dword [esi + 0x6c]
call fcn.004094c4
test al, al
je 0x411201
mov eax, dword [esi + 0xd4]
call fcn.004094c4
test al, al
je 0x411201
mov ax, word [0x411670]
call fcn.004068b8
test al, al
jne 0x4110e4
mov ax, word [0x411674]
call fcn.004068b8
test al, al
jne 0x4110e4
mov ax, word [0x411668]
call fcn.004068b8
test al, al
je 0x41111d
mov edx, 0x4118bc
mov eax, 0x80000001
call fcn.00404738
xor ecx, ecx
mov edx, 0x4118dc
call fcn.0040486c
mov edx, 0x411904
mov eax, 0x80000001
call fcn.00404738
mov ecx, 4
mov edx, 0x41192c
call fcn.0040486c
mov ax, word [0x411678]
call fcn.004068b8
test al, al
jne 0x411201
mov eax, esi
call fcn.0040dc64
test al, al
jne 0x411201
mov dl, 1
mov eax, 0x411940
call fcn.0040d5a0
mov dl, 1
mov eax, 0x411954
call fcn.0040d5a0
mov dl, 1
mov eax, 0x411968
call fcn.0040d5a0
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x41197c
call fcn.00406728
mov eax, esi
mov edx, 0x41197c
call fcn.0040d86c
test al, al
je 0x4111c9
mov eax, esi
mov ecx, 1
mov edx, 0x411990
call fcn.0040d68c
mov eax, esi
mov ecx, 1
mov edx, 0x41197c
call fcn.0040d68c
mov edx, 0x4119a8
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x41197c
mov edx, 0x41197c
call fcn.004048a4
jmp 0x411201
mov eax, dword [esi + 0x104]
sub eax, 0x404
je 0x4111df
sub eax, 0x400
je 0x4111eb
jmp 0x4111f7
mov eax, 0x4119e0
call fcn.00403ef4
jmp 0x411201
mov eax, 0x4119fc
call fcn.00403ef4
jmp 0x411201
mov eax, 0x411a18
call fcn.00403ef4
mov eax, dword [esi + 0x70]
call fcn.004094c4
test al, al
je 0x4112c6
mov ax, word [0x411670]
call fcn.004068b8
test al, al
jne 0x41123e
mov ax, word [0x411674]
call fcn.004068b8
test al, al
jne 0x41123e
mov ax, word [0x411668]
call fcn.004068b8
test al, al
je 0x411277
mov edx, 0x4118bc
mov eax, 0x80000001
call fcn.00404738
mov ecx, 1
mov edx, 0x4118dc
call fcn.0040486c
mov edx, 0x411904
mov eax, 0x80000001
call fcn.00404738
xor ecx, ecx
mov edx, 0x41192c
call fcn.0040486c
mov ax, word [0x411678]
call fcn.004068b8
test al, al
jne 0x4112c6
mov eax, esi
call fcn.0040dc64
test al, al
jne 0x4112c6
mov eax, esi
mov ecx, 1
mov edx, 0x41197c
call fcn.0040d68c
mov eax, esi
mov edx, 0x41197c
call fcn.0041b0e4
xor edx, edx
mov eax, 0x411968
call fcn.0040d5a0
xor edx, edx
mov eax, 0x411954
call fcn.0040d5a0
mov eax, dword [esi + 0x70]
call fcn.004094c4
test al, al
je 0x411552
mov eax, dword [esi + 0xd4]
call fcn.004094c4
test al, al
je 0x411552
mov ax, word [0x411678]
call fcn.004068b8
test al, al
jne 0x411552
mov eax, esi
call fcn.0040dc64
test al, al
jne 0x411552
mov eax, esi
mov edx, 0x411990
call fcn.0040d86c
test al, al
jne 0x41145f
lea eax, [ebp - 0xd8]
call fcn.00404660
lea eax, [ebp - 0xd8]
mov edx, 0x411990
call fcn.00403184
mov eax, dword [ebp - 0xd8]
call fcn.004079e4
test al, al
jne 0x41145f
lea eax, [ebp - 0xdc]
call fcn.00407a34
lea eax, [ebp - 0xdc]
mov edx, 0x411990
call fcn.00403184
mov eax, dword [ebp - 0xdc]
call fcn.004079e4
test al, al
je 0x4113cc
push 0xffffffffffffffff
lea eax, [ebp - 0xe0]
call fcn.00404660
lea eax, [ebp - 0xe0]
mov edx, 0x411990
call fcn.00403184
mov eax, dword [ebp - 0xe0]
call fcn.0040337c
push eax
lea eax, [ebp - 0xe4]
call fcn.00407a34
lea eax, [ebp - 0xe4]
mov edx, 0x411990
call fcn.00403184
mov eax, dword [ebp - 0xe4]
call fcn.0040337c
push eax
call fcn.00403960
lea eax, [ebp - 0xe8]
call fcn.00407a34
lea eax, [ebp - 0xe8]
mov edx, 0x411a38
call fcn.00403184
mov eax, dword [ebp - 0xe8]
call fcn.004079e4
test al, al
je 0x41144b
push 0xffffffffffffffff
lea eax, [ebp - 0xec]
call fcn.00404660
lea eax, [ebp - 0xec]
mov edx, 0x411a38
call fcn.00403184
mov eax, dword [ebp - 0xec]
call fcn.0040337c
push eax
lea eax, [ebp - 0xf0]
call fcn.00407a34
lea eax, [ebp - 0xf0]
mov edx, 0x411a38
call fcn.00403184
mov eax, dword [ebp - 0xf0]
call fcn.0040337c
push eax
call fcn.00403960
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x411990
call fcn.00406728
mov eax, esi
mov edx, 0x411990
call fcn.0040d86c
test al, al
jne 0x411483
push 5
push 5
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x411990
call fcn.00406728
mov eax, esi
mov edx, 0x411990
call fcn.0040d86c
test al, al
jne 0x4114d6
call fcn.004045c0
test eax, eax
jne 0x4114d6
mov eax, dword [esi + 0x104]
sub eax, 0x404
je 0x4114b2
sub eax, 0x400
je 0x4114be
jmp 0x4114ca
mov eax, 0x411a50
call fcn.00403ef4
jmp 0x4114e7
mov eax, 0x411af8
call fcn.00403ef4
jmp 0x4114e7
mov eax, 0x411ba0
call fcn.00403ef4
jmp 0x4114e7
mov eax, esi
mov ecx, 1
mov edx, 0x411990
call fcn.0040d68c
mov ax, word [0x41169c]
call fcn.004068b8
test al, al
jne 0x411514
mov ax, word [0x4116a0]
call fcn.004068b8
test al, al
jne 0x411514
mov ax, word [0x4116a4]
call fcn.004068b8
test al, al
je 0x411534
mov edx, 0x4119a8
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x411990
mov edx, 0x411990
call fcn.004048a4
jmp 0x411552
mov edx, 0x4119a8
mov eax, 0x80000001
call fcn.00404738
mov ecx, 0x411990
mov edx, 0x411990
call fcn.004048a4
mov eax, dword [esi + 0xd4]
call fcn.004094c4
test al, al
jne 0x4115bb
mov eax, esi
mov edx, 0x411990
call fcn.0040d86c
test al, al
je 0x41157d
mov eax, esi
mov edx, 0x411990
call fcn.0041b0e4
mov eax, esi
mov edx, 0x41197c
call fcn.0040d86c
test al, al
je 0x411599
mov eax, esi
mov edx, 0x41197c
call fcn.0041b0e4
mov eax, esi
mov ecx, 1
mov edx, 0x41197c
call fcn.0040d68c
mov eax, esi
mov ecx, 1
mov edx, 0x411990
call fcn.0040d68c
mov eax, 0x80000002
call fcn.004048e4
mov eax, 0x80000001
call fcn.004048e4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040dc8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411606
lea eax, [ebp - 0xf0]
mov edx, 0x36
call fcn.0040301c
lea eax, [ebp - 0xc]
call fcn.00402ff8
ret