Function at 0x405d80
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bbcb9
mov eax, dword fs:[0]
push eax
sub esp, 0x8fc
mov eax, dword [0x4fcc8c]
xor eax, esp
mov dword [esp + 0x8f8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fcc8c]
xor eax, esp
push eax
lea eax, [esp + 0x910]
mov dword fs:[0], eax
lea eax, [esp + 0x34]
mov esi, ecx
xor edi, edi
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], edi
call fcn.004076e0
mov dword [esp + 0x918], edi
mov edi, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
mov ecx, edi
sub ecx, esi
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
je 0x40649f
cmp esi, edi
jbe 0x405e04
call fcn.004921da
mov edi, dword [esp + 0x24]
mov ebx, dword [edi]
mov dword [esp + 0x18], ebx
mov ebp, esi
mov esi, dword [edi + 0x10]
mov dword [esp + 0x1c], ebp
cmp dword [edi + 0xc], esi
jbe 0x405e21
call fcn.004921da
mov eax, dword [edi]
xor edi, edi
cmp ebx, edi
je 0x405e2d
cmp ebx, eax
je 0x405e32
call fcn.004921da
cmp ebp, esi
je 0x40649f
cmp ebx, edi
jne 0x405ecc
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x405e53
call fcn.004921da
cmp dword [ebp], edi
je 0x4063f1
cmp ebx, edi
jne 0x405ed3
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x405e71
call fcn.004921da
cmp dword [ebp + 0x18], edi
je 0x4063f1
cmp ebx, edi
jne 0x405ed7
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x405e8f
call fcn.004921da
cmp dword [ebp + 0x34], edi
je 0x4063f1
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x918], 1
cmp ebx, edi
jne 0x405edb
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x405ebd
call fcn.004921da
mov edi, 8
cmp dword [ebp + 0x1c], edi
jb 0x405edf
mov esi, dword [ebp + 8]
jmp 0x405ee2
mov eax, dword [ebx]
jmp 0x405e49
mov eax, dword [ebx]
jmp 0x405e67
mov eax, dword [ebx]
jmp 0x405e85
mov eax, dword [ebx]
jmp 0x405eb3
lea esi, [ebp + 8]
test ebx, ebx
jne 0x405f57
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x405ef7
call fcn.004921da
mov eax, dword [ebp]
lea edx, [esp + 0x20]
push edx
push 0x20019
push 0
push esi
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405f5b
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
test ebx, ebx
jne 0x405fe1
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x405f43
call fcn.004921da
movzx eax, byte [ebp + 0x58]
cmp eax, 3
ja case.default.0x405f50
jmp dword [eax*4 + 0x406a64]
mov eax, dword [ebx]
jmp 0x405eed
test ebx, ebx
jne 0x405fa1
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x405f70
call fcn.004921da
cmp byte [ebp + 0x58], 3
je case.default.0x405f50
lea esi, [esp + 0x18]
call fcn.004080b0
push eax
lea ebx, [esp + 0x38]
call fcn.00407790
call fcn.004080b0
add eax, 0x20
mov ebx, edi
cmp dword [eax + 0x18], ebx
jb 0x405fa5
mov edi, dword [eax + 4]
jmp 0x405fa8
mov eax, dword [ebx]
jmp 0x405f66
lea edi, [eax + 4]
lea esi, [esp + 0x18]
call fcn.004080b0
add eax, 4
cmp dword [eax + 0x18], ebx
jb 0x405fbe
mov eax, dword [eax + 4]
jmp 0x405fc1
add eax, 4
push edi
push eax
push str.Update_Registry_remove_item_______s_s
lea esi, [esp + 0x20]
mov dword [esp + 0x20], str.ALCMUpdator::CheckRegistryInfo
call fcn.004019a0
add esp, 0xc
jmp 0x4063c7
mov eax, dword [ebx]
jmp 0x405f39
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x116]
push edx
mov word [esp + 0x118], cx
call fcn.004982b0
add esp, 0xc
lea esi, [esp + 0x18]
mov dword [esp + 0x14], 0x400
call fcn.004080b0
add eax, 0x20
cmp dword [eax + 0x18], edi
jb 0x406026
mov eax, dword [eax + 4]
jmp 0x406029
add eax, 4
push eax
lea eax, [esp + 0x2c]
push eax
lea edi, [esp + 0x1c]
lea esi, [esp + 0x114]
call fcn.0040f5e0
lea esi, [esp + 0x18]
call fcn.004080b0
mov ecx, eax
add ecx, 0x3c
lea esi, [esp + 0x10c]
call fcn.004075e0
test eax, eax
je case.default.0x405f50
lea esi, [esp + 0x18]
call fcn.004080b0
push eax
lea ebx, [esp + 0x38]
call fcn.00407790
call fcn.004080b0
add eax, 0x3c
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x40608b
mov ebx, dword [eax + 4]
jmp 0x40608e
lea ebx, [eax + 4]
lea esi, [esp + 0x18]
call fcn.004080b0
add eax, 0x20
cmp dword [eax + 0x18], ebp
jb 0x4060a4
mov edi, dword [eax + 4]
jmp 0x4060a7
lea edi, [eax + 4]
lea esi, [esp + 0x18]
call fcn.004080b0
add eax, 4
cmp dword [eax + 0x18], ebp
jb 0x4060cc
mov eax, dword [eax + 4]
mov dword [esp + 0x14], str.ALCMUpdator::CheckRegistryInfo
lea esi, [esp + 0x14]
jmp 0x4063b3
add eax, 4
mov dword [esp + 0x14], str.ALCMUpdator::CheckRegistryInfo
lea esi, [esp + 0x14]
jmp 0x4063b3
lea esi, [esp + 0x18]
mov dword [esp + 0x20], 0
call fcn.004080b0
add eax, 0x20
cmp dword [eax + 0x18], edi
jb 0x4060fe
mov eax, dword [eax + 4]
jmp 0x406101
add eax, 4
push eax
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x28]
call fcn.0040f5a0
lea esi, [esp + 0x18]
call fcn.004080b0
add eax, 0x3c
cmp dword [eax + 0x18], edi
jb 0x406126
mov eax, dword [eax + 4]
jmp 0x406129
add eax, 4
push eax
call fcn.00491e8a
add esp, 4
cmp dword [esp + 0x20], eax
je case.default.0x405f50
lea esi, [esp + 0x18]
call fcn.004080b0
push eax
lea ebx, [esp + 0x38]
call fcn.00407790
call fcn.004080b0
add eax, 0x3c
mov ebp, edi
cmp dword [eax + 0x18], ebp
jb 0x40608b
mov ebx, dword [eax + 4]
jmp 0x40608e
push 0x3ff
lea edx, [esp + 0x111]
push 0
push edx
mov byte [esp + 0x118], 0
call fcn.004982b0
add esp, 0xc
lea esi, [esp + 0x18]
mov dword [esp + 0x20], 0x400
call fcn.004080b0
add eax, 0x20
cmp dword [eax + 0x18], edi
jb 0x4061a7
mov eax, dword [eax + 4]
jmp 0x4061aa
add eax, 4
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
lea ecx, [esp + 0x114]
call fcn.0040f2a0
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x110]
push edx
lea ecx, [esp + 0xdc]
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], 0
mov byte [esp + 0xe0], 0
call fcn.0040f0f0
lea esi, [esp + 0x18]
mov byte [esp + 0x918], 2
call fcn.004080b0
add eax, 0x3c
cmp dword [eax + 0x18], edi
jb 0x406215
mov eax, dword [eax + 4]
jmp 0x406218
add eax, 4
lea ecx, [esp + 0xf0]
push ecx
mov ecx, eax
call fcn.0042f000
add esp, 4
lea eax, [esp + 0xd4]
lea edx, [esp + 0xf0]
mov byte [esp + 0x918], 3
call fcn.0040f250
test eax, eax
je 0x4062d0
lea esi, [esp + 0x18]
call fcn.004080b0
push eax
lea ebx, [esp + 0x38]
call fcn.00407790
call fcn.004080b0
add eax, 0x3c
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x406277
mov ebx, dword [eax + 4]
jmp 0x40627a
lea ebx, [eax + 4]
lea esi, [esp + 0x18]
call fcn.004080b0
add eax, 0x20
cmp dword [eax + 0x18], ebp
jb 0x406290
mov edi, dword [eax + 4]
jmp 0x406293
lea edi, [eax + 4]
lea esi, [esp + 0x18]
call fcn.004080b0
add eax, 4
cmp dword [eax + 0x18], ebp
jb 0x4062a9
mov eax, dword [eax + 4]
jmp 0x4062ac
add eax, 4
push ebx
push edi
push eax
push str.Update_Registry_add_item_______s_s:_s
lea esi, [esp + 0x24]
mov dword [esp + 0x24], str.ALCMUpdator::CheckRegistryInfo
call fcn.004019a0
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0xf0]
call fcn.0040f2d0
lea ecx, [esp + 0xd4]
call fcn.0040f2d0
jmp case.default.0x405f50
push 0x3ff
lea edx, [esp + 0x111]
push 0
push edx
mov byte [esp + 0x118], 0
call fcn.004982b0
add esp, 0xc
lea esi, [esp + 0x18]
mov dword [esp + 0x14], 0x400
call fcn.004080b0
add eax, 0x20
cmp dword [eax + 0x18], edi
jb 0x40632a
mov eax, dword [eax + 4]
jmp 0x40632d
add eax, 4
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x114]
call fcn.0040f2a0
test eax, eax
jne case.default.0x405f50
lea esi, [esp + 0x18]
call fcn.004080b0
push eax
lea ebx, [esp + 0x38]
call fcn.00407790
call fcn.004080b0
add eax, 0x3c
mov ebp, edi
cmp dword [eax + 0x18], ebp
jb 0x406372
mov ebx, dword [eax + 4]
jmp 0x406375
lea ebx, [eax + 4]
lea esi, [esp + 0x18]
call fcn.004080b0
add eax, 0x20
cmp dword [eax + 0x18], ebp
jb 0x40638b
mov edi, dword [eax + 4]
jmp 0x40638e
lea edi, [eax + 4]
lea esi, [esp + 0x18]
call fcn.004080b0
add eax, 4
cmp dword [eax + 0x18], ebp
jb 0x4063a4
mov eax, dword [eax + 4]
jmp 0x4063a7
add eax, 4
mov dword [esp + 0x20], str.ALCMUpdator::CheckRegistryInfo
lea esi, [esp + 0x20]
push ebx
push edi
push eax
push str.Update_Registry_add_item_______s_s:_s
call fcn.004019a0
mov ebp, dword [esp + 0x2c]
add esp, 0x10
mov ebx, dword [esp + 0x18]
mov byte [esp + 0x918], 0
mov eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
je 0x4063e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
jmp 0x406476
cmp ebx, edi
jne 0x406415
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x406406
call fcn.004921da
mov esi, 8
cmp dword [ebp + 0x38], esi
jb 0x406419
mov edi, dword [ebp + 0x24]
jmp 0x40641c
mov eax, dword [ebx]
jmp 0x4063fc
lea edi, [ebp + 0x24]
test ebx, ebx
jne 0x40643b
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x406431
call fcn.004921da
cmp dword [ebp + 0x1c], esi
jb 0x40643f
mov esi, dword [ebp + 8]
jmp 0x406442
mov eax, dword [ebx]
jmp 0x406427
lea esi, [ebp + 8]
test ebx, ebx
jne 0x406497
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x406457
call fcn.004921da
mov ecx, dword [ebp]
push edi
push esi
push ecx
push str.Invalid_Registry_Update_Data_0x08_x__path__s__key__s_
lea esi, [esp + 0x24]
mov dword [esp + 0x24], str.ALCMUpdator::CheckRegistryInfo
call fcn.004019a0
add esp, 0x10
test ebx, ebx
jne 0x40649b
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x40648b
call fcn.004921da
mov edi, dword [esp + 0x24]
add ebp, 0x5c
jmp 0x405e10
mov eax, dword [ebx]
jmp 0x40644d
mov eax, dword [ebx]
jmp 0x406481
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
mov ecx, edi
sub ecx, esi
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x4064c9
mov dword [esp + 0x30], eax
jmp 0x40698c
mov dword [esp + 0x24], 0
cmp esi, edi
jbe 0x4064da
call fcn.004921da
mov edi, dword [esp + 0x34]
mov dword [esp + 0x28], edi
mov ebp, esi
mov esi, dword [esp + 0x44]
cmp dword [esp + 0x40], esi
jbe 0x4064f3
call fcn.004921da
test edi, edi
je 0x4064fd
cmp edi, dword [esp + 0x34]
je 0x406502
call fcn.004921da
cmp ebp, esi
je 0x40687f
lea ecx, [esp + 0x4c]
push ecx
call fcn.00407a60
lea edx, [esp + 0xcc]
push 0x10
push edx
mov byte [esp + 0x920], 4
call fcn.00432076
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x54]
mov eax, dword [eax]
push ecx
mov ecx, dword [edx + 4]
lea edx, [esp + ecx + 0x58]
push edx
call eax
add esp, 0x10
test edi, edi
jne 0x4066b9
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x40655b
call fcn.004921da
push 0x4e80b8
push ecx
mov ecx, dword [ebp]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.00407340
add esp, 4
push eax
call fcn.0040bd80
add esp, 8
test edi, edi
jne 0x4066c0
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x406594
call fcn.004921da
push 0x4e80b8
push ecx
lea eax, [ebp + 4]
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.0040c190
add esp, 0xc
push eax
call fcn.0040bd80
add esp, 8
test edi, edi
jne 0x4066c7
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x4065cd
call fcn.004921da
push 0x4e80b8
push ecx
lea edx, [ebp + 0x20]
push edx
lea eax, [esp + 0x58]
push eax
call fcn.0040c190
add esp, 0xc
push eax
call fcn.0040bd80
add esp, 8
test edi, edi
jne 0x4066ce
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x406606
call fcn.004921da
push 0x4e80b8
push ecx
lea ecx, [ebp + 0x3c]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.0040c190
add esp, 0xc
push eax
call fcn.0040bd80
add esp, 8
test edi, edi
jne 0x4066d5
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x40663f
call fcn.004921da
movzx eax, byte [ebp + 0x58]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.00407020
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x116]
push eax
mov word [esp + 0x118], dx
call fcn.004982b0
mov ecx, dword [esp + 0x30]
add esp, 0xc
push ecx
push 0x4e6c70
push str._s_d
lea edx, [esp + 0x118]
push 0x104
push edx
call fcn.00491e56
add esp, 0x14
lea ecx, [esp + 0xf0]
lea eax, [esp + 0x4c]
call fcn.00407b60
mov esi, 8
mov byte [esp + 0x918], 5
cmp dword [eax + 0x18], esi
jb 0x4066dc
mov eax, dword [eax + 4]
jmp 0x4066df
mov eax, dword [edi]
jmp 0x406551
mov eax, dword [edi]
jmp 0x40658a
mov eax, dword [edi]
jmp 0x4065c3
mov eax, dword [edi]
jmp 0x4065fc
mov eax, dword [edi]
jmp 0x406635
add eax, 4
lea ecx, [esp + 0x10c]
push ecx
mov ecx, eax
mov edx, str.SOFTWAREESTsoftALCMUpdateRegInfo
call fcn.00403f70
mov bl, al
cmp dword [esp + 0x108], esi
jb 0x40670e
mov edx, dword [esp + 0xf4]
push edx
call fcn.004913b3
add esp, 4
test bl, bl
je 0x406716
inc dword [esp + 0x24]
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx + 4]
lea eax, [esp + 0x98]
mov dword [esp + 0x20], eax
mov dword [esp + edx + 0x4c], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
test byte [esp + 0x90], 1
lea eax, [esp + 0x50]
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
je 0x406759
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx]
push eax
call fcn.004913b3
add esp, 4
mov edx, dword [esp + 0x60]
mov dword [edx], 0
mov eax, dword [esp + 0x70]
mov dword [eax], 0
mov ecx, dword [esp + 0x80]
mov dword [ecx], 0
mov edx, dword [esp + 0x64]
mov dword [edx], 0
mov eax, dword [esp + 0x74]
mov dword [eax], 0
mov ecx, dword [esp + 0x84]
mov dword [ecx], 0
and dword [esp + 0x90], 0xfffffffe
mov dword [esp + 0x8c], 0
mov dword [esp + 0x50], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [esp + 0x918], 7
mov eax, dword [esp + 0x88]
mov ebx, eax
test eax, eax
je 0x40681b
mov edi, dword [eax]
test edi, edi
je 0x40680e
push 0
lea ecx, [esp + 0x18]
call fcn.0043212e
mov eax, dword [edi + 4]
test eax, eax
jbe 0x4067ec
cmp eax, 0xffffffff
jae 0x4067ec
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x14]
and esi, edi
call fcn.00432156
test esi, esi
je 0x40680e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
push ebx
call fcn.004913b3
mov edi, dword [esp + 0x2c]
add esp, 4
lea ecx, [esp + 0x54]
mov byte [esp + 0x918], 6
call fcn.004320a6
mov byte [esp + 0x918], 0
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx + 4]
lea eax, [esp + 0x98]
mov dword [esp + edx + 0x4c], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
push eax
mov dword [esp + 0x9c], vtable.std::ios_base.0
call fcn.00431fcb
add esp, 4
test edi, edi
jne 0x40687b
call fcn.004921da
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x406873
call fcn.004921da
add ebp, 0x5c
jmp 0x4064e4
mov eax, dword [edi]
jmp 0x406869
mov ecx, dword [esp + 0x44]
sub ecx, dword [esp + 0x40]
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp dword [esp + 0x24], ecx
jne 0x406984
cmp dword [0x5046b4], 0
mov dword [esp + 0x20], reloc.WSOCK32.dll_accept
je 0x4068d4
lea edx, [esp + 0x20]
push edx
call fcn.004ad164
test eax, eax
jge 0x4068d4
lea ebx, [esp + 0x34]
call fcn.00407740
or eax, 0xffffffff
jmp 0x406a3c
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x2c], ebp
lea eax, [esp + 0x14]
push eax
push 0x20006
push ebp
mov byte [esp + 0x924], 8
mov ecx, dword [esp + 0x2c]
push str.SOFTWAREESTsoftALCMUpdateRegInfo
push ecx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x406964
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push ebp
push str.UpdateCount
push edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406957
push esi
push 0x4e80bc
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], str.ALCMUpdator::CheckRegistryInfo
call fcn.004019a0
add esp, 8
mov dword [esp + 0x30], 1
cmp edi, ebp
je 0x406964
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp dword [0x5046b4], ebp
je 0x406977
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebp
je 0x40698e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40698e
mov dword [esp + 0x30], 0xffffffff
xor ebp, ebp
cmp dword [esp + 0x40], ebp
je 0x406a1f
mov ebx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
cmp esi, ebx
je 0x406a12
add esi, 0x54
mov edi, 7
lea esp, [esp]
cmp dword [esi], 8
jb 0x4069c1
mov ecx, dword [esi - 0x14]
push ecx
call fcn.004913b3
add esp, 4
xor edx, edx
mov dword [esi], edi
mov dword [esi - 4], ebp
mov word [esi - 0x14], dx
cmp dword [esi - 0x1c], 8
jb 0x4069de
mov eax, dword [esi - 0x30]
push eax
call fcn.004913b3
add esp, 4
xor ecx, ecx
mov dword [esi - 0x1c], edi
mov dword [esi - 0x20], ebp
mov word [esi - 0x30], cx
cmp dword [esi - 0x38], 8
jb 0x4069fc
mov edx, dword [esi - 0x4c]
push edx
call fcn.004913b3
add esp, 4
xor eax, eax
mov dword [esi - 0x38], edi
mov dword [esi - 0x3c], ebp
mov word [esi - 0x4c], ax
add esi, 0x5c
lea ecx, [esi - 0x54]
cmp ecx, ebx
jne 0x4069b0
mov edx, dword [esp + 0x40]
push edx
call fcn.004913b3
add esp, 4
mov eax, dword [esp + 0x34]
push eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
call fcn.004913b3
mov eax, dword [esp + 0x34]
add esp, 4
mov ecx, dword [esp + 0x910]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8f8]
xor ecx, esp
call fcn.004913be
add esp, 0x908
ret