Function at 0x417694
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x41769c
push ecx
push ebx
push esi
push edi
mov eax, 0x417604
call fcn.004060c8
mov ebx, 0x41ba48
xor eax, eax
push ebp
push 0x41853b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x418399
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x41b945
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, eax
mov eax, 0x41b944
call fcn.0040297c
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0040291c
mov edx, dword [ebp - 0x14]
mov eax, 0x41ba4c
mov ecx, 0x418558
call fcn.00404774
push 0
mov eax, 0x41ba4c
call fcn.00404978
push eax
call sub.kernel32.dll__lopen
mov dword [0x41ba60], eax
push 2
push 0xfffffffffffffffc
mov eax, dword [0x41ba60]
push eax
call sub.kernel32.dll__llseek
mov dword [0x41ba64], eax
push 4
push 0x41ba64
mov eax, dword [0x41ba60]
push eax
call sub.kernel32.dll__lread
push 0
mov eax, dword [0x41ba64]
push eax
mov eax, dword [0x41ba60]
push eax
call sub.kernel32.dll__llseek
mov byte [0x41ba68], 1
mov eax, 0x41ba44
mov edx, 0x418564
call fcn.004044e0
lea eax, [ebp - 0x18]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 4]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 2]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov cl, 2
call fcn.00402d84
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x24]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 7]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
mov cl, 3
call fcn.00402d84
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x2c]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x2c]
mov cl, 4
call fcn.00402d84
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x34]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x34]
mov cl, 5
call fcn.00402d84
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x3c]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 3]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x3c]
mov cl, 6
call fcn.00402d84
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x44]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 5]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x44]
mov cl, 7
call fcn.00402d84
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x50]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 6]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x50]
mov cl, 8
call fcn.00402d84
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x5c]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 2]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x5c]
mov cl, 9
call fcn.00402d84
lea edx, [ebp - 0x5c]
mov eax, 0x41ba44
call fcn.004046f0
push 0x20019
push 0x418578
push dword [0x41ba44]
push 0x41858c
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.004047e8
mov edx, dword [ebp - 0x60]
mov ecx, ebx
mov eax, 0x80000002
call fcn.004170b0
mov ecx, 0x41ba44
mov edx, 0x4185a4
mov eax, dword [ebx]
call fcn.004171f0
mov eax, dword [ebx]
call fcn.00417130
mov eax, 0x41bc38
mov edx, dword [0x41ba44]
call fcn.004044e0
mov eax, dword [0x41ba44]
call fcn.00407970
test al, al
je 0x41794d
cmp dword [0x41ba44], 0
jne 0x41796a
push 0x10
push 0x4185ac
push 0x4185b4
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, 1
call fcn.00404474
lea edx, [ebp - 0x64]
mov eax, dword [0x41ba44]
call fcn.00407a0c
mov edx, dword [ebp - 0x64]
mov eax, 0x41ba50
call fcn.004044e0
mov eax, 0x41ba44
mov edx, 0x418564
call fcn.004044e0
lea eax, [ebp - 0x18]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 4]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 2]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov cl, 2
call fcn.00402d84
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x24]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 7]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
mov cl, 3
call fcn.00402d84
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x2c]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x2c]
mov cl, 4
call fcn.00402d84
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x34]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x34]
mov cl, 5
call fcn.00402d84
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x3c]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 3]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x3c]
mov cl, 6
call fcn.00402d84
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x44]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 5]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x44]
mov cl, 7
call fcn.00402d84
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x50]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 6]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x50]
mov cl, 8
call fcn.00402d84
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x5c]
call fcn.00402db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41ba44]
mov dl, byte [edx + 2]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x5c]
mov cl, 9
call fcn.00402d84
lea edx, [ebp - 0x5c]
mov eax, 0x41ba44
call fcn.004046f0
xor eax, eax
push ebp
push 0x417b74
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001f
push 0x418578
push dword [0x41ba44]
push 0x41858c
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.004047e8
mov edx, dword [ebp - 0x68]
mov ecx, ebx
mov eax, 0x80000002
call fcn.004170b0
call fcn.00408d00
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x6c]
call fcn.00409938
mov ecx, dword [ebp - 0x6c]
mov edx, 0x4185e0
mov eax, dword [ebx]
call fcn.00417140
mov eax, dword [ebx]
call fcn.00417130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x417b7e
mov eax, 0x41ba44
mov edx, dword [0x41bc38]
call fcn.004044e0
cmp byte [0x41ba68], 0
je 0x417bb6
lea eax, [ebp - 0x70]
mov ecx, 0x4185f4
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0x70]
call fcn.0041747c
test al, al
jne 0x417bba
xor eax, eax
jmp 0x417bbc
mov al, 1
mov byte [0x41ba68], al
lea eax, [ebp - 0x74]
mov ecx, 0x4185f4
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0x74]
call fcn.00407970
test al, al
jne 0x417bfd
push 0x10
push 0x4185ac
push 0x418600
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, 1
call fcn.00404474
lea eax, [ebp - 0x78]
mov ecx, 0x4185f4
mov edx, dword [0x41ba50]
call fcn.00404774
mov edx, dword [ebp - 0x78]
mov eax, 0x41ba6c
call fcn.00402c64
mov eax, 0x41ba6c
call fcn.004029f4
call fcn.0040275c
mov edx, 0x41ba58
mov eax, 0x41ba6c
call fcn.00402f84
mov eax, 0x41ba6c
call fcn.00402ff0
call fcn.0040275c
mov edx, 0x41ba5c
mov eax, 0x41ba6c
call fcn.00402f84
mov eax, 0x41ba6c
call fcn.00402ff0
call fcn.0040275c
mov eax, 0x41ba6c
call fcn.00402d2c
call fcn.0040275c
lea eax, [ebp - 0x7c]
mov ecx, 0x4185f4
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0x7c]
call fcn.004079a4
push dword [0x41ba50]
push 0x418624
push dword [0x41ba58]
push 0x418634
mov eax, 0x41ba54
mov edx, 4
call fcn.004047e8
lea eax, [ebp - 0x80]
mov ecx, 0x418624
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0x80]
call fcn.00407980
test al, al
jne 0x417cf7
lea eax, [ebp - 0x84]
mov ecx, 0x418624
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0x84]
call fcn.00407b28
mov eax, dword [0x41ba54]
call fcn.00407980
test al, al
jne 0x417d0f
mov eax, dword [0x41ba54]
call fcn.00407b28
lea eax, [ebp - 0x88]
mov ecx, 0x4185f4
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0x88]
mov eax, 0x41ba6c
call fcn.00402c64
mov eax, 0x41ba6c
call fcn.00402a00
call fcn.0040275c
mov edx, dword [0x41ba5c]
mov eax, 0x41ba6c
call fcn.00404a6c
call fcn.00403208
call fcn.0040275c
mov eax, 0x41ba6c
call fcn.00402d2c
call fcn.0040275c
cmp byte [0x41ba68], 0
je 0x417d9b
lea eax, [ebp - 0x8c]
mov ecx, 0x418640
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x8c]
call fcn.0041747c
test al, al
jne 0x417d9f
xor eax, eax
jmp 0x417da1
mov al, 1
mov byte [0x41ba68], al
cmp byte [0x41ba68], 0
je 0x417dd4
lea eax, [ebp - 0x90]
mov ecx, 0x418654
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x90]
call fcn.0041747c
test al, al
jne 0x417dd8
xor eax, eax
jmp 0x417dda
mov al, 1
mov byte [0x41ba68], al
cmp byte [0x41ba68], 0
je 0x417e0d
lea eax, [ebp - 0x94]
mov ecx, 0x41866c
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x94]
call fcn.0041747c
test al, al
jne 0x417e11
xor eax, eax
jmp 0x417e13
mov al, 1
mov byte [0x41ba68], al
cmp byte [0x41ba68], 0
je 0x417e46
lea eax, [ebp - 0x98]
mov ecx, 0x418680
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x98]
call fcn.0041747c
test al, al
jne 0x417e4a
xor eax, eax
jmp 0x417e4c
mov al, 1
mov byte [0x41ba68], al
cmp byte [0x41ba68], 0
je 0x417e7f
lea eax, [ebp - 0x9c]
mov ecx, 0x418694
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x9c]
call fcn.0041747c
test al, al
jne 0x417e83
xor eax, eax
jmp 0x417e85
mov al, 1
mov byte [0x41ba68], al
lea eax, [ebp - 0xa0]
mov ecx, 0x4186a8
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0xa0]
call fcn.0041747c
test al, al
je 0x417ed0
lea eax, [ebp - 0xa4]
mov ecx, 0x4186bc
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0xa4]
call fcn.0041747c
mov eax, dword [0x41ba60]
push eax
call sub.kernel32.dll__lclose
lea eax, [ebp - 0xac]
mov ecx, 0x4186d0
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
call fcn.00404c10
mov eax, dword [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb4]
mov ecx, 0x418640
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 0xb0]
call fcn.00404c10
mov eax, dword [ebp - 0xb0]
pop edx
call fcn.00417374
lea eax, [ebp - 0xbc]
mov ecx, 0x4186e4
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xbc]
lea eax, [ebp - 0xb8]
call fcn.00404c10
mov eax, dword [ebp - 0xb8]
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x418654
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xc4]
lea eax, [ebp - 0xc0]
call fcn.00404c10
mov eax, dword [ebp - 0xc0]
pop edx
call fcn.00417374
lea eax, [ebp - 0xcc]
mov ecx, 0x4186fc
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xcc]
lea eax, [ebp - 0xc8]
call fcn.00404c10
mov eax, dword [ebp - 0xc8]
push eax
lea eax, [ebp - 0xd4]
mov ecx, 0x41866c
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
call fcn.00404c10
mov eax, dword [ebp - 0xd0]
pop edx
call fcn.00417374
lea eax, [ebp - 0xdc]
mov ecx, 0x418710
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xdc]
lea eax, [ebp - 0xd8]
call fcn.00404c10
mov eax, dword [ebp - 0xd8]
push eax
lea eax, [ebp - 0xe4]
mov ecx, 0x418680
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0xe0]
call fcn.00404c10
mov eax, dword [ebp - 0xe0]
pop edx
call fcn.00417374
lea eax, [ebp - 0xec]
mov ecx, 0x418720
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xec]
lea eax, [ebp - 0xe8]
call fcn.00404c10
mov eax, dword [ebp - 0xe8]
push eax
lea eax, [ebp - 0xf4]
mov ecx, 0x418694
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
call fcn.00404c10
mov eax, dword [ebp - 0xf0]
pop edx
call fcn.00417374
lea eax, [ebp - 0xf8]
mov ecx, 0x4186a8
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0xf8]
call fcn.00407970
test al, al
je 0x41816b
lea eax, [ebp - 0x100]
mov ecx, 0x418730
mov edx, dword [0x41ba50]
call fcn.00404774
mov edx, dword [ebp - 0x100]
lea eax, [ebp - 0xfc]
call fcn.00404c10
mov eax, dword [ebp - 0xfc]
push eax
lea eax, [ebp - 0x108]
mov ecx, 0x4186a8
mov edx, dword [0x41ba50]
call fcn.00404774
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.00404c10
mov eax, dword [ebp - 0x104]
pop edx
call fcn.00417374
lea eax, [ebp - 0x10c]
mov ecx, 0x4186a8
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0x10c]
call fcn.004079a4
lea eax, [ebp - 0x110]
mov ecx, 0x4186bc
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x110]
call fcn.00407970
test al, al
je 0x418216
lea eax, [ebp - 0x118]
mov ecx, 0x418744
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
call fcn.00404c10
mov eax, dword [ebp - 0x114]
push eax
lea eax, [ebp - 0x120]
mov ecx, 0x4186bc
mov edx, dword [0x41ba54]
call fcn.00404774
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
call fcn.00404c10
mov eax, dword [ebp - 0x11c]
pop edx
call fcn.00417374
lea eax, [ebp - 0x124]
mov ecx, 0x4186bc
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x124]
call fcn.004079a4
lea eax, [ebp - 0x128]
mov ecx, 0x418640
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x128]
call fcn.004079a4
lea eax, [ebp - 0x12c]
mov ecx, 0x418654
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x12c]
call fcn.004079a4
lea eax, [ebp - 0x130]
mov ecx, 0x41866c
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x130]
call fcn.004079a4
lea eax, [ebp - 0x134]
mov ecx, 0x418680
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x134]
call fcn.004079a4
lea eax, [ebp - 0x138]
mov ecx, 0x418694
mov edx, dword [0x41ba54]
call fcn.00404774
mov eax, dword [ebp - 0x138]
call fcn.004079a4
cmp byte [0x41ba68], 0
jne 0x4182e1
push 0x10
push 0x4185ac
push 0x418750
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, 1
call fcn.00404474
lea eax, [ebp - 0x13c]
mov ecx, 0x418778
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0x13c]
call fcn.004079a4
lea eax, [ebp - 0x140]
mov ecx, 0x41878c
mov edx, dword [0x41ba50]
call fcn.00404774
mov eax, dword [ebp - 0x140]
call fcn.004079a4
lea edx, [ebp - 0x144]
mov eax, 1
call fcn.0040291c
mov eax, dword [ebp - 0x144]
mov edx, 0x4187a0
call fcn.00404874
je 0x418358
push 0x40
push 0x4187a4
push 0x4187b0
push 0
call sub.user32.dll_MessageBoxA_1
push dword [0x41ba44]
push 0x4187dc
push dword [0x41ba58]
push 0x418558
mov eax, 0x41ba44
mov edx, 4
call fcn.004047e8
push 1
mov eax, 0x41ba44
call fcn.00404978
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4183d2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418545
lea eax, [ebp - 0x144]
mov edx, 0xa
call fcn.004044b0
lea eax, [ebp - 0x11c]
call fcn.00404ac4
lea eax, [ebp - 0x118]
call fcn.0040448c
lea eax, [ebp - 0x114]
call fcn.00404ac4
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004044b0
lea eax, [ebp - 0x104]
call fcn.00404ac4
lea eax, [ebp - 0x100]
call fcn.0040448c
lea eax, [ebp - 0xfc]
call fcn.00404ac4
lea eax, [ebp - 0xf8]
mov edx, 2
call fcn.004044b0
lea eax, [ebp - 0xf0]
call fcn.00404ac4
lea eax, [ebp - 0xec]
call fcn.0040448c
lea eax, [ebp - 0xe8]
call fcn.00404ac4
lea eax, [ebp - 0xe4]
call fcn.0040448c
lea eax, [ebp - 0xe0]
call fcn.00404ac4
lea eax, [ebp - 0xdc]
call fcn.0040448c
lea eax, [ebp - 0xd8]
call fcn.00404ac4
lea eax, [ebp - 0xd4]
call fcn.0040448c
lea eax, [ebp - 0xd0]
call fcn.00404ac4
lea eax, [ebp - 0xcc]
call fcn.0040448c
lea eax, [ebp - 0xc8]
call fcn.00404ac4
lea eax, [ebp - 0xc4]
call fcn.0040448c
lea eax, [ebp - 0xc0]
call fcn.00404ac4
lea eax, [ebp - 0xbc]
call fcn.0040448c
lea eax, [ebp - 0xb8]
call fcn.00404ac4
lea eax, [ebp - 0xb4]
call fcn.0040448c
lea eax, [ebp - 0xb0]
call fcn.00404ac4
lea eax, [ebp - 0xac]
call fcn.0040448c
lea eax, [ebp - 0xa8]
call fcn.00404ac4
lea eax, [ebp - 0xa4]
mov edx, 0x12
call fcn.004044b0
lea eax, [ebp - 0x14]
call fcn.0040448c
ret