Function at 0x40b380
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427baf
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x4322c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [ebp + 0x20], 0x10
mov byte [ebp - 0x9d], bl
jae 0x40b3d2
lea eax, [ebp + 0xc]
push ebx
push 0x8000080
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0xa4], edi
cmp edi, 0xffffffff
jne 0x40b52c
cmp byte [ebp + 0x40], bl
jne 0x40b4f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edi, [ebp - 0xfc]
call fcn.00425eb2
mov esi, eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x64]
push str.File:
push edx
mov byte [ebp - 4], 2
call fcn.00404ce2
push str._rError:
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 3
call fcn.00404c95
push esi
push eax
lea ecx, [ebp - 0x48]
push ecx
mov byte [ebp - 4], 4
call fcn.00404d34
mov esi, 0x10
add esp, 0x28
cmp dword [eax + 0x18], esi
jb 0x40b464
mov eax, dword [eax + 4]
jmp 0x40b467
add eax, 4
push ebx
push str.Failed_to_open_archive_
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x30], esi
jb 0x40b486
mov edx, dword [ebp - 0x44]
push edx
call fcn.0040f964
add esp, 4
mov edi, 0xf
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
cmp dword [ebp - 0x84], esi
jb 0x40b4ab
mov eax, dword [ebp - 0x98]
push eax
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
cmp dword [ebp - 0x4c], esi
jb 0x40b4ce
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
cmp dword [ebp - 0xe4], esi
jb 0x40b4f5
mov edx, dword [ebp - 0xf8]
push edx
call fcn.0040f964
add esp, 4
jmp 0x40b4f5
mov edi, 0xf
mov esi, 0x10
cmp dword [ebp + 0x20], esi
jb 0x40b50b
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040f964
add esp, 4
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], esi
jb 0x40b525
mov ecx, dword [ebp + 0x28]
push ecx
call fcn.0040f964
add esp, 4
xor al, al
jmp 0x40bc25
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebx
push ebx
push edi
call esi
lea esp, [esp]
push 1
push ebx
push 0xffffffffffffffe9
push edi
call esi
cmp eax, 0x16
jbe 0x40b62c
push ebx
lea edx, [ebp - 0x100]
push edx
push 0x16
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x16
lea ecx, [ebp - 0x28]
push str.chunked_installer_tail
push ecx
call fcn.004103f1
add esp, 0xc
test eax, eax
jne 0x40b540
push 1
push ebx
push 0x14
push edi
call esi
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
mov esi, dword [ebp - 0xa4]
lea eax, [ebp - 0x9d]
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 8
call fcn.0040b120
add esp, 4
test al, al
je 0x40bc41
push str.chunked_installer_tail
call fcn.0040f5f0
mov esi, eax
mov eax, dword [ebp - 0x50]
add esp, 4
mov edi, eax
cmp eax, esi
jb 0x40b5d0
mov eax, esi
cmp dword [ebp - 0x4c], 0x10
mov ecx, dword [ebp - 0x60]
jae 0x40b5dc
lea ecx, [ebp - 0x60]
push eax
push str.chunked_installer_tail
push ecx
call fcn.0040df70
add esp, 0xc
cmp eax, ebx
jne 0x40b762
cmp edi, esi
jb 0x40b762
xor eax, eax
cmp edi, esi
setne al
cmp eax, ebx
jne 0x40b762
cmp dword [ebp - 0x4c], 0x10
mov byte [ebp - 0x9d], 1
jb 0x40b585
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.0040f964
add esp, 4
jmp 0x40b585
cmp byte [ebp + 0x40], bl
jne 0x40b722
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edi, [ebp - 0xfc]
call fcn.00425eb2
mov esi, eax
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x64]
push str.File:
push eax
mov byte [ebp - 4], 5
call fcn.00404ce2
push str._rError:
push eax
lea ecx, [ebp - 0x9c]
push ecx
mov byte [ebp - 4], 6
call fcn.00404c95
push esi
push eax
lea edx, [ebp - 0x48]
push edx
mov byte [ebp - 4], 7
call fcn.00404d34
mov esi, 0x10
add esp, 0x28
cmp dword [eax + 0x18], esi
jb 0x40b696
mov eax, dword [eax + 4]
jmp 0x40b699
add eax, 4
push ebx
push str.Failed_to_initialize_archive_
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x30], esi
jb 0x40b6b8
mov eax, dword [ebp - 0x44]
push eax
call fcn.0040f964
add esp, 4
mov edi, 0xf
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
cmp dword [ebp - 0x84], esi
jb 0x40b6dd
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
cmp dword [ebp - 0x4c], esi
jb 0x40b700
mov edx, dword [ebp - 0x60]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
cmp dword [ebp - 0xe4], esi
jb 0x40b727
mov eax, dword [ebp - 0xf8]
push eax
call fcn.0040f964
add esp, 4
jmp 0x40b727
mov edi, 0xf
mov esi, 0x10
cmp dword [ebp + 0x20], esi
jb 0x40b73d
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040f964
add esp, 4
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], esi
jb 0x40b525
mov edx, dword [ebp + 0x28]
push edx
call fcn.0040f964
add esp, 4
xor al, al
jmp 0x40bc25
mov edi, 0xf
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
mov esi, dword [ebp - 0xa4]
lea edx, [ebp - 0x9d]
push edx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 9
call fcn.0040b120
add esp, 4
test al, al
je 0x40bc4d
push str.value
call fcn.0040f5f0
mov esi, eax
mov eax, dword [ebp - 0x50]
add esp, 4
mov edi, eax
cmp eax, esi
jb 0x40b7ae
mov eax, esi
cmp dword [ebp - 0x4c], 0x10
mov ecx, dword [ebp - 0x60]
jae 0x40b7ba
lea ecx, [ebp - 0x60]
push eax
push str.value
push ecx
call fcn.0040df70
add esp, 0xc
cmp eax, ebx
jne 0x40b91e
cmp edi, esi
jb 0x40b91e
xor eax, eax
cmp edi, esi
setne al
cmp eax, ebx
jne 0x40b91e
mov edi, 0xf
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
mov esi, dword [ebp - 0xa4]
lea eax, [ebp - 0x9d]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xa
call fcn.0040b120
add esp, 4
test al, al
je 0x40bc6b
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xdc], bl
call fcn.00403554
push 0xffffffffffffffff
mov byte [ebp - 4], 0xb
push ebx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xb0], ebx
mov byte [ebp - 0xc0], bl
call fcn.00403554
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0xe0]
push eax
push ecx
lea ebx, [ebp - 0x128]
mov byte [ebp - 4], 0xc
call fcn.004041f0
mov esi, 0x10
cmp dword [ebp - 0xac], esi
jb 0x40b89f
mov edx, dword [ebp - 0xc0]
push edx
call fcn.0040f964
add esp, 4
xor eax, eax
mov dword [ebp - 0xac], 0xf
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xc0], al
cmp dword [ebp - 0xc8], esi
jb 0x40b8ce
mov eax, dword [ebp - 0xdc]
push eax
call fcn.0040f964
add esp, 4
cmp dword [ebp - 0x30], esi
jb 0x40b8df
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.0040f964
add esp, 4
xor ebx, ebx
mov esi, 0x10
cmp dword [ebp - 0x68], esi
jb 0x40b8f7
mov edx, dword [ebp - 0x7c]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
cmp dword [ebp - 0x4c], esi
jb 0x40b585
mov eax, dword [ebp - 0x60]
push eax
call fcn.0040f964
add esp, 4
jmp 0x40b585
push str.file
call fcn.0040f5f0
mov esi, eax
mov eax, dword [ebp - 0x50]
add esp, 4
mov edi, eax
cmp eax, esi
jb 0x40b938
mov eax, esi
cmp dword [ebp - 0x4c], 0x10
mov ecx, dword [ebp - 0x60]
jae 0x40b944
lea ecx, [ebp - 0x60]
push eax
push str.file
push ecx
call fcn.0040df70
add esp, 0xc
cmp eax, ebx
jne 0x40bb82
cmp edi, esi
jb 0x40bb82
xor eax, eax
cmp edi, esi
setne al
cmp eax, ebx
jne 0x40bb82
mov edi, 0xf
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
mov esi, dword [ebp - 0xa4]
lea edx, [ebp - 0x9d]
push edx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xe
call fcn.0040b120
add esp, 4
test al, al
je 0x40bc8c
lea eax, [ebp - 0x9d]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040b120
add esp, 4
test al, al
je 0x40bd00
cmp dword [ebp - 0x6c], ebx
je 0x40ba95
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x80]
push ecx
mov esi, edi
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xdc], bl
call fcn.00403554
push 0xffffffffffffffff
mov byte [ebp - 4], 0xf
push ebx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xb0], ebx
mov byte [ebp - 0xc0], bl
call fcn.00403554
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0xe0]
push eax
push ecx
lea ebx, [ebp - 0x1c]
mov byte [ebp - 4], 0x10
call fcn.004041f0
mov esi, 0x10
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0xac], esi
jb 0x40ba64
mov edx, dword [ebp - 0xc0]
push edx
call fcn.0040f964
add esp, 4
xor eax, eax
mov dword [ebp - 0xac], 0xf
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xc0], al
cmp dword [ebp - 0xc8], esi
jb 0x40ba93
mov eax, dword [ebp - 0xdc]
push eax
call fcn.0040f964
add esp, 4
xor ebx, ebx
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp + 0x24]
push edx
lea eax, [ebp - 0xfc]
push eax
call fcn.00404d34
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x11
call fcn.00403554
mov edi, 0x10
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0xe4], edi
jb 0x40badc
mov ecx, dword [ebp - 0xf8]
push ecx
call fcn.0040f964
add esp, 4
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x30], edi
jae 0x40bae7
lea eax, [ebp - 0x44]
push ebx
push 0x8000080
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40bd74
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x84], edi
jae 0x40bb1d
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x88]
push ebx
lea edx, [ebp - 0x100]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x84], edi
jb 0x40bb52
mov edx, dword [ebp - 0x98]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x84], 0xf
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
cmp dword [ebp - 0x30], edi
jb 0x40b8e1
mov eax, dword [ebp - 0x44]
push eax
call fcn.0040f964
add esp, 4
jmp 0x40b8e1
push str.stub
call fcn.0040f5f0
mov ecx, dword [ebp - 0x50]
add esp, 4
push eax
push str.stub
push ecx
push ebx
lea ecx, [ebp - 0x64]
call fcn.004038f6
test eax, eax
jne 0x40b8e1
mov esi, 0x10
cmp dword [ebp - 0x68], esi
jb 0x40bbc0
mov edx, dword [ebp - 0x7c]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
cmp dword [ebp - 0x4c], esi
jb 0x40bbde
mov eax, dword [ebp - 0x60]
push eax
call fcn.0040f964
add esp, 4
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x10
cmp dword [ebp + 0x20], esi
jb 0x40bc01
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], esi
jb 0x40bc1f
mov eax, dword [ebp + 0x28]
push eax
call fcn.0040f964
add esp, 4
mov al, byte [ebp - 0x9d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fca4
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x4c], 0x10
jb 0x40bbde
mov ecx, dword [ebp - 0x60]
push ecx
jmp 0x40bbd6
mov esi, 0x10
cmp dword [ebp - 0x68], esi
jb 0x40bc63
mov edx, dword [ebp - 0x7c]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x68], edi
jmp 0x40bbc7
mov esi, 0x10
cmp dword [ebp - 0x30], esi
jb 0x40bc81
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
jmp 0x40bc52
mov esi, 0x10
cmp dword [ebp - 0x84], esi
jb 0x40bca8
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
cmp dword [ebp - 0x30], esi
jb 0x40bccb
mov edx, dword [ebp - 0x44]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
cmp dword [ebp - 0x68], esi
jb 0x40bce5
mov eax, dword [ebp - 0x7c]
push eax
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
cmp dword [ebp - 0x4c], esi
jb 0x40bbde
mov ecx, dword [ebp - 0x60]
push ecx
jmp 0x40bbd6
mov esi, 0x10
cmp dword [ebp - 0x84], esi
jb 0x40bd1c
mov edx, dword [ebp - 0x98]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
cmp dword [ebp - 0x30], esi
jb 0x40bd3f
mov eax, dword [ebp - 0x44]
push eax
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
cmp dword [ebp - 0x68], esi
jb 0x40bd59
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
cmp dword [ebp - 0x4c], esi
jb 0x40bbde
mov edx, dword [ebp - 0x60]
push edx
jmp 0x40bbd6
cmp byte [ebp + 0x40], bl
jne 0x40be7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edi, [ebp - 0xc4]
call fcn.00425eb2
mov esi, eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0xfc]
push str.File:
push ecx
mov byte [ebp - 4], 0x12
call fcn.00404ce2
push str._rError:
push eax
lea edx, [ebp - 0x11c]
push edx
mov byte [ebp - 4], 0x13
call fcn.00404c95
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x14
call fcn.00404d34
mov edi, 0x10
add esp, 0x28
cmp dword [eax + 0x18], edi
jb 0x40bde1
mov eax, dword [eax + 4]
jmp 0x40bde4
add eax, 4
push ebx
push str.Failed_to_extract_file_
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x14], edi
jb 0x40be03
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0040f964
add esp, 4
mov esi, 0xf
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
cmp dword [ebp - 0x104], edi
jb 0x40be28
mov edx, dword [ebp - 0x118]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x108], ebx
mov byte [ebp - 0x118], bl
cmp dword [ebp - 0xe4], edi
jb 0x40be51
mov eax, dword [ebp - 0xf8]
push eax
call fcn.0040f964
add esp, 4
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xe8], ebx
mov byte [ebp - 0xf8], bl
cmp dword [ebp - 0xac], edi
jb 0x40be81
mov ecx, dword [ebp - 0xc0]
push ecx
call fcn.0040f964
add esp, 4
jmp 0x40be81
mov esi, 0xf
cmp dword [ebp - 0x84], edi
jb 0x40be98
mov edx, dword [ebp - 0x98]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x98], bl
cmp dword [ebp - 0x30], edi
jb 0x40bebb
mov eax, dword [ebp - 0x44]
push eax
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
cmp dword [ebp - 0x68], edi
jb 0x40bed5
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
cmp dword [ebp - 0x4c], edi
jb 0x40beef
mov edx, dword [ebp - 0x60]
push edx
call fcn.0040f964
add esp, 4
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
cmp dword [ebp + 0x20], edi
jb 0x40bf09
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040f964
add esp, 4
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40b525
mov ecx, dword [ebp + 0x28]
push ecx
call fcn.0040f964
add esp, 4
xor al, al
jmp 0x40bc25