Function at 0x4028a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ba27
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x23c
mov eax, dword [0x4220c0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [0x42413c], eax
push 0x28
call fcn.0040c5e5
add esp, 4
mov dword [ebp - 0x7c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x7c], 0
je 0x402904
mov ecx, dword [ebp - 0x7c]
call fcn.00405400
mov dword [ebp - 0x168], eax
jmp 0x40290e
mov dword [ebp - 0x168], 0
mov ecx, dword [ebp - 0x168]
mov dword [ebp - 0x78], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x78]
mov dword [0x424134], edx
push 0x402560
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00403820
mov dword [ebp - 4], 1
push 0
push str._param1
lea ecx, [ebp - 0x6c]
call fcn.004038e0
test eax, eax
jge 0x40298a
push 0x10
push 0x41e444
push 0x41e468
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x80], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004038a0
mov eax, dword [ebp - 0x80]
jmp 0x4036f9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x84], esp
push str.2242
call fcn.004050f0
mov dword [ebp - 0x16c], eax
mov ecx, dword [0x424134]
call fcn.00405720
call section..text
movzx ecx, al
test ecx, ecx
je 0x4029e0
mov dword [ebp - 0x88], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004038a0
mov eax, dword [ebp - 0x88]
jmp 0x4036f9
call fcn.00402400
lea ecx, [ebp - 0x34]
call fcn.004047e0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [0x424134]
call fcn.004057d0
push 0
push 0x41e4bc
lea ecx, [ebp - 0x34]
call fcn.00403760
test eax, eax
je 0x402a57
push 0x10
push 0x41e4c0
push str.This_file_is_part_of_an_installer_and_not_meant_to_be_launched_separately.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x8c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00404830
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004038a0
mov eax, dword [ebp - 0x8c]
jmp 0x4036f9
mov ecx, 0x4242e8
call fcn.004089b0
push 1
mov ecx, 0x4242e8
call fcn.004089f0
push 5
push 2
mov ecx, 0x4242e8
call fcn.00408a10
mov byte [ebp - 0x59], al
call fcn.004014c0
lea ecx, [ebp - 0x14]
call fcn.004037e0
mov byte [ebp - 4], 3
mov ecx, 0x4242e8
call fcn.00401490
movzx eax, al
test eax, eax
je 0x402be3
mov ecx, 0x4242e8
call fcn.004014a0
movzx ecx, al
test ecx, ecx
jne 0x402b4e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x90], esp
push str.2041
call fcn.004050f0
mov dword [ebp - 0x170], eax
mov ecx, dword [0x424134]
call fcn.00405720
push str.akNjYx8tFzxrQnxZBX9NaDNMeVkEeUhrCXM4GWYXZ3cHegJKThRxPi94HVtdLHg4NXM2V1syUjoyXF8wQT83VSxaaDtNNw0GC0Jb2QsNwEXWFZtez0kOR5eTFdxMiMwCGJWUlcRMyBaG1xVNG8DIVsEZh78Kw
lea ecx, [ebp - 0x94]
call fcn.00403820
mov dword [ebp - 0x174], eax
mov edx, dword [ebp - 0x174]
mov dword [ebp - 0x178], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x178]
push eax
lea ecx, [ebp - 0x14]
call fcn.004038c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94]
call fcn.004038a0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x98], esp
push 0x41e5d8
call fcn.004050f0
mov dword [ebp - 0x17c], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x402bde
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9c], esp
push str.2042
call fcn.004050f0
mov dword [ebp - 0x180], eax
mov ecx, dword [0x424134]
call fcn.00405720
push str.alNjYx89FzxrUnxZBW9NaDNceVkEaUhrCWM4GWYHZ3cHagJKTgRxPi9oHVtdPHg4NWMTVkPeCE2eC9yO3JcEVMXMXQMeVAZaUQWbBoteQJTQwp2Mi9mE0B7A3AoFWwcR3IVTDIQSi1lQ0cnBiAoUmhUd298Ow
lea ecx, [ebp - 0xa0]
call fcn.00403820
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 0x188], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x188]
push edx
lea ecx, [ebp - 0x14]
call fcn.004038c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa0]
call fcn.004038a0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa4], esp
push 0x41e688
call fcn.004050f0
mov dword [ebp - 0x18c], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x402d1d
mov ecx, 0x4242e8
call fcn.004014a0
movzx eax, al
test eax, eax
jne 0x402c8d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa8], esp
push str.2043
call fcn.004050f0
mov dword [ebp - 0x190], eax
mov ecx, dword [0x424134]
call fcn.00405720
push str.a5NjYx79FzxqknxZBK9NaDKceVkFqUhrCKM4GWfHZ3cGqgJKT8RxPi6oHVtc_Hg4NKMTVjPeCE3uHUrRNsdTimQiBI0ycdDqZUdGHIHRoSvHx2ftkOIhu6Zkx01gkrDYZ8SVLnECVf7X9QMZkgJA0Mg
lea ecx, [ebp - 0xac]
call fcn.00403820
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x198], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x198]
push edx
lea ecx, [ebp - 0x14]
call fcn.004038c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xac]
call fcn.004038a0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb0], esp
push str.1838
call fcn.004050f0
mov dword [ebp - 0x19c], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x402d1d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb4], esp
push str.2044
call fcn.004050f0
mov dword [ebp - 0x1a0], eax
mov ecx, dword [0x424134]
call fcn.00405720
push str.ZRNjbxB9FzBkEnxVCi9NZDwceVULKUhnBiM4FWlHZ3sIKgJGQURxMiAoHVdSfHg0OhIXWFV1bgggF2MCU3QLZz4RVAlffDE0GQlCXXZnCzMFE2pfaXYYCwwVcGVjeR8CGilqYEVLDG1PKGMYIVw8bE5i0HQ
lea ecx, [ebp - 0xb8]
call fcn.00403820
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1a8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004038c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb8]
call fcn.004038a0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbc], esp
push str.1837
call fcn.004050f0
mov dword [ebp - 0x1ac], eax
mov ecx, dword [0x424134]
call fcn.00405720
push ecx
mov ecx, esp
mov dword [ebp - 0xc0], esp
lea edx, [ebp - 0x14]
push edx
call fcn.00403800
mov dword [ebp - 0x1b0], eax
call fcn.00402170
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x68], eax
cmp dword [0x424140], 0
je 0x402e3b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc4], esp
push str.1804
call fcn.004050f0
mov dword [ebp - 0x1b8], eax
mov ecx, dword [0x424134]
call fcn.00405720
cmp dword [ebp - 0x68], 0
jne 0x402e13
call dword [0x424128]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x402dbd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc8], esp
push str.1806
call fcn.004050f0
mov dword [ebp - 0x1bc], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x402e11
cmp dword [ebp - 0x74], 1
jne 0x402deb
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xcc], esp
push str.1807
call fcn.004050f0
mov dword [ebp - 0x1c0], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x402e11
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd0], esp
push str.1808
call fcn.004050f0
mov dword [ebp - 0x1c4], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x402e39
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd4], esp
push str.1914
call fcn.004050f0
mov dword [ebp - 0x1c8], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x402e61
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd8], esp
push str.1805
call fcn.004050f0
mov dword [ebp - 0x1cc], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xdc], esp
push str.1763
call fcn.004050f0
mov dword [ebp - 0x1d0], eax
mov ecx, dword [0x424134]
call fcn.00405720
push 3
mov ecx, 0x4242e8
call fcn.004089f0
push 0
push 0x401620
push 0
push 0x82
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x402ef5
call fcn.004022f0
mov dword [ebp - 0xe0], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004038a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00404830
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004038a0
mov eax, dword [ebp - 0xe0]
jmp 0x4036f9
mov byte [ebp - 4], 8
cmp dword [0x42419c], 0
jne 0x402f54
fld qword [0x424148]
fmul qword [0x41e9e8]
call fcn.00417990
push eax
fld qword [0x424150]
fmul qword [0x41e9e0]
call fcn.00417990
push eax
fld qword [0x424148]
fmul qword [0x41e9d8]
call fcn.00417990
push eax
fld qword [0x424150]
fmul qword [0x41e9c8]
call fcn.00417990
push eax
mov edx, dword [ebp - 0x38]
push edx
call dword [0x424124]
jmp 0x402f89
mov dword [ebp - 4], 3
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x258
push 4
mov ecx, 0x4242e8
call fcn.00408a10
mov byte [ebp - 0x59], al
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe8], esp
push str.1860
call fcn.004050f0
mov dword [ebp - 0x1d8], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xec], esp
push str.1773
call fcn.004050f0
mov dword [ebp - 0x1dc], eax
mov ecx, dword [0x424134]
call fcn.00405720
call dword [0x424128]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x60], 0x789
cmp dword [ebp - 0x3c], 9
jge 0x40301c
mov eax, dword [ebp - 0x3c]
add eax, 0x780
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x70]
call fcn.004037e0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x60]
push ecx
push 0x41e83c
lea edx, [ebp - 0x70]
push edx
call fcn.00404590
add esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.00403960
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xf0], esp
push eax
call fcn.004050f0
mov dword [ebp - 0x1e0], eax
mov ecx, dword [0x424134]
call fcn.00405720
cmp dword [ebp - 0x3c], 3
jle 0x4030ba
call fcn.004022f0
mov dword [ebp - 0xf4], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.004038a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004038a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00404830
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004038a0
mov eax, dword [ebp - 0xf4]
jmp 0x4036f9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xf8], esp
push str.1764
call fcn.004050f0
mov dword [ebp - 0x1e4], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xfc], esp
push str.1861
call fcn.004050f0
mov dword [ebp - 0x1e8], eax
mov ecx, dword [0x424134]
call fcn.00405720
mov byte [0x424198], 1
mov dword [ebp - 0x64], 0
mov byte [ebp - 4], 0xb
cmp dword [0x42419c], 0
jne 0x40313b
push 0x32c8
call dword [0x42412c]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x64], eax
jmp 0x403170
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x64], 0
jne 0x4032b5
push 5
mov ecx, 0x4242e8
call fcn.004089f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x41e858
call fcn.004050f0
mov dword [ebp - 0x1f4], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x108], esp
push 0x41e860
call fcn.004050f0
mov dword [ebp - 0x1f8], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10c], esp
push 0x41e868
call fcn.004050f0
mov dword [ebp - 0x1fc], eax
mov ecx, dword [0x424134]
call fcn.00405720
push 0x4650
push 8
mov ecx, 0x4242e8
call fcn.00408a10
mov byte [ebp - 0x59], al
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x110], esp
push 0x41e870
call fcn.004050f0
mov dword [ebp - 0x200], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x114], esp
push 0x41e878
call fcn.004050f0
mov dword [ebp - 0x204], eax
mov ecx, dword [0x424134]
call fcn.00405720
mov byte [0x424198], 0
call fcn.004022f0
mov dword [ebp - 0x118], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.004038a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004038a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00404830
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004038a0
mov eax, dword [ebp - 0x118]
jmp 0x4036f9
mov dword [0x4241a4], 1
mov byte [0x424198], 0
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00401530
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0xfa0
push 1
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40333b
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x403311
push 5
mov ecx, 0x4242e8
call fcn.004089f0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x11c], esp
push str.1862
call fcn.004050f0
mov dword [ebp - 0x208], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.1834
call fcn.004050f0
mov dword [ebp - 0x20c], eax
mov ecx, dword [0x424134]
call fcn.00405720
cmp dword [0x4241a4], 1
jne 0x4033c7
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x124], esp
push str.1841
call fcn.004050f0
mov dword [ebp - 0x210], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x4034c0
cmp dword [0x4241a4], 2
jne 0x4033fb
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push str.1842
call fcn.004050f0
mov dword [ebp - 0x214], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x4034c0
cmp dword [0x4241a4], 3
jne 0x40342f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push str.1843
call fcn.004050f0
mov dword [ebp - 0x218], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x4034c0
cmp dword [0x4241a4], 4
jne 0x403460
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x130], esp
push str.1844
call fcn.004050f0
mov dword [ebp - 0x21c], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x4034c0
cmp dword [0x4241a4], 5
jne 0x403491
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.1845
call fcn.004050f0
mov dword [ebp - 0x220], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x4034c0
cmp dword [0x4241a4], 6
jne 0x4034c0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push str.1846
call fcn.004050f0
mov dword [ebp - 0x224], eax
mov ecx, dword [0x424134]
call fcn.00405720
cmp dword [0x4241a0], 1
jne 0x4034f4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x13c], esp
push str.1901
call fcn.004050f0
mov dword [ebp - 0x228], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x403585
cmp dword [0x4241a0], 2
jne 0x403525
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x140], esp
push str.1902
call fcn.004050f0
mov dword [ebp - 0x22c], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x403585
cmp dword [0x4241a0], 3
jne 0x403556
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x144], esp
push str.1903
call fcn.004050f0
mov dword [ebp - 0x230], eax
mov ecx, dword [0x424134]
call fcn.00405720
jmp 0x403585
cmp dword [0x4241a0], 4
jne 0x403585
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x148], esp
push str.1904
call fcn.004050f0
mov dword [ebp - 0x234], eax
mov ecx, dword [0x424134]
call fcn.00405720
movzx ecx, byte [0x42419a]
test ecx, ecx
je 0x4035dc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14c], esp
push str.1849
call fcn.004050f0
mov dword [ebp - 0x238], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x150], esp
push str.1864
call fcn.004050f0
mov dword [ebp - 0x23c], eax
mov ecx, dword [0x424134]
call fcn.00405720
push 0x2bf20
push 8
mov ecx, 0x4242e8
call fcn.00408a10
mov byte [ebp - 0x59], al
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x154], esp
push str.1766
call fcn.004050f0
mov dword [ebp - 0x240], eax
mov ecx, dword [0x424134]
call fcn.00405720
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x158], esp
push str.1912
call fcn.004050f0
mov dword [ebp - 0x244], eax
mov ecx, dword [0x424134]
call fcn.00405720
mov byte [ebp - 4], 0xd
cmp dword [0x42419c], 0
jne 0x40364f
call dword [0x424108]
jmp 0x403684
mov dword [ebp - 4], 0xa
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.1913
call fcn.004050f0
mov dword [ebp - 0x24c], eax
mov ecx, dword [0x424134]
call fcn.00405720
call fcn.004022f0
mov dword [ebp - 0x164], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.004038a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004038a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00404830
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004038a0
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0040bfa4
mov esp, ebp
pop ebp
ret 0x10