Function at 0x402110
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451262
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x320], ecx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2fc], eax
xor eax, eax
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 7
mov word [ebp - 0x8c], ax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], edi
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x30c], eax
mov byte [ebp - 4], 1
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2c]
cmp esi, eax
je 0x4021f2
mov ecx, esi
call fcn.004012a0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2f0]
mov dword [esi], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x40220e
push 0x23
push 0x462c98
mov ecx, esi
call fcn.004013e0
xor bl, bl
jmp 0x402c91
cmp dword [ecx + 0x10], 0
jne 0x402223
push 2
push 0x462ce0
call fcn.004015a0
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov edx, ebx
cmp ecx, 8
jb 0x40222f
mov edx, dword [ebx]
lea esi, [eax + eax]
cmp word [edx + esi - 2], 0x2f
je 0x402254
mov eax, ebx
cmp ecx, 8
jb 0x402243
mov eax, dword [ebx]
cmp word [eax + esi - 2], 0x5c
je 0x402254
push 0x2f
mov ecx, ebx
call fcn.004032c0
mov edx, dword [ebp - 0x2f0]
lea ecx, [ebp - 0x74]
call fcn.004085b0
mov ebx, eax
mov eax, dword [ebp - 0x2ec]
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x2e4], 1
mov dword [ebp - 0x2f4], eax
cmp dword [eax + 0x14], 8
jb 0x40228e
mov ecx, dword [eax]
mov dword [ebp - 0x2f4], ecx
mov esi, dword [eax + 0x10]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
sub eax, edx
mov dword [ebp - 0x308], esi
mov dword [ebp - 0x2e8], edx
cmp esi, eax
ja 0x40236a
cmp dword [ebx + 0x14], 8
lea eax, [edx + esi]
mov dword [ebx + 0x10], eax
mov edx, ebx
mov dword [ebp - 0x2f8], ebx
jb 0x4022c9
mov edx, dword [ebx]
mov dword [ebp - 0x2f8], edx
lea eax, [esi + esi]
mov dword [ebp - 0x318], eax
add eax, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2e8]
jbe 0x402302
add eax, eax
mov dword [ebp - 0x2e4], eax
add eax, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2e4]
ja 0x402304
cmp edx, ecx
ja 0x4022fa
xor esi, esi
jmp 0x402304
mov esi, edx
sub esi, ecx
sar esi, 1
jmp 0x402304
add eax, eax
add eax, 2
mov dword [ebp - 0x2e8], esi
push eax
mov eax, dword [ebp - 0x318]
push edx
add eax, edx
push eax
call fcn.00433ea0
add esp, 0xc
add esi, esi
push esi
push dword [ebp - 0x2f4]
push dword [ebp - 0x2f8]
call fcn.00433920
mov edx, dword [ebp - 0x308]
add esp, 0xc
mov ecx, dword [ebp - 0x2e8]
mov eax, edx
sub eax, ecx
add eax, eax
push eax
lea eax, [ecx + edx]
mov ecx, dword [ebp - 0x2f4]
lea eax, [ecx + eax*2]
push eax
mov eax, dword [ebp - 0x2f8]
add eax, esi
push eax
call fcn.00433920
add esp, 0xc
jmp 0x402384
push esi
push ecx
push ecx
mov byte [ebp - 0x308], 0
mov ecx, ebx
push dword [ebp - 0x308]
push esi
call fcn.00404dd0
mov ebx, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebx]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x2c]
push 0x462ce4
mov dword [ebp - 0x2e4], 0xb
call fcn.00403680
mov ecx, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ecx]
mov dword [ebp - 0x44], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
mov dword [ebp - 4], 4
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x2e4], 0x1f
jb 0x402449
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x2dc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4025b2
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x402470
cmp word [ebp - 0x2b0], 0x2e
je 0x402585
test byte [ebp - 0x2dc], 0x10
jne 0x402585
xor eax, eax
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
lea edx, [ecx + 2]
jmp 0x4024b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4024b0
sub ecx, edx
lea eax, [ebp - 0x2b0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x5c]
call fcn.004013e0
mov dword [ebp - 4], 5
cmp dword [ebp - 0x304], edi
je 0x402525
mov eax, dword [ebp - 0x5c]
mov edx, 7
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi], eax
mov eax, dword [ebp - 0x58]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x50]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x4c]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x48]
mov dword [edi + 0x14], eax
xor eax, eax
add edi, 0x18
mov word [ebp - 0x5c], ax
mov dword [ebp - 0x310], edi
jmp 0x40254a
lea eax, [ebp - 0x5c]
push eax
push edi
lea ecx, [ebp - 0x314]
call fcn.004016d0
mov eax, dword [ebp - 0x30c]
mov edi, dword [ebp - 0x310]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x304], eax
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x402585
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40257b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402cea
push edx
push ecx
call fcn.0041b677
add esp, 8
lea eax, [ebp - 0x2dc]
push eax
push esi
call ebx
test eax, eax
jne 0x402470
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x300], eax
cmp eax, edi
je 0x4025b2
mov bl, 1
jmp 0x4025b4
xor bl, bl
mov dword [ebp - 4], 3
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x4025f5
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4025eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402cea
push edx
push ecx
call fcn.0041b677
add esp, 8
xor eax, eax
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp edx, 8
jb 0x40264a
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402640
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402cef
push edx
push ecx
call fcn.0041b677
add esp, 8
xor eax, eax
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 8
jb 0x40269f
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402695
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402cf4
push edx
push ecx
call fcn.0041b677
add esp, 8
test bl, bl
je 0x402b97
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0x5c]
call fcn.004035a0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x2e0]
cmp dword [eax + 0x10], 0
je 0x40276e
push eax
mov edx, 0x462cf0
lea ecx, [ebp - 0x74]
call fcn.004040d0
add esp, 4
mov byte [ebp - 4], 7
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x4026e8
mov ecx, dword [eax]
mov ebx, dword [eax + 0x10]
mov esi, dword [ebp - 0x48]
mov eax, esi
mov edx, dword [ebp - 0x4c]
sub eax, edx
cmp ebx, eax
ja 0x40271e
lea eax, [edx + ebx]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x5c]
cmp esi, 0x10
jb 0x40270a
mov eax, dword [ebp - 0x5c]
push ebx
lea esi, [eax + edx]
push ecx
push esi
call fcn.00433ea0
add esp, 0xc
mov byte [esi + ebx], 0
jmp 0x402736
push ebx
push ecx
mov byte [ebp - 0x2e0], 0
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x2e0]
push ebx
call fcn.004044e0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x60]
cmp edx, 0x10
jb 0x40276e
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402764
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402cf9
push edx
push ecx
call fcn.0041b677
add esp, 8
mov edx, dword [ebp - 0x48]
mov eax, edx
mov ecx, dword [ebp - 0x4c]
sub eax, ecx
cmp eax, 4
jb 0x4027a7
lea eax, [ecx + 4]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x5c]
cmp edx, 0x10
jb 0x40278e
mov eax, dword [ebp - 0x5c]
push 4
lea esi, [eax + ecx]
push 0x462cf4
push esi
call fcn.00433ea0
add esp, 0xc
mov byte [esi + 4], 0
jmp 0x4027c5
push 4
push 0x462cf4
mov byte [ebp - 0x2e0], 0
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x2e0]
push 4
call fcn.004044e0
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.004085b0
mov ebx, dword [ebp - 0x300]
lea ecx, [ebp - 0x2e0]
push edi
push ebx
mov edx, eax
call fcn.00404220
mov edx, dword [ebp - 0x60]
add esp, 8
cmp edx, 8
jb 0x402822
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402818
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402cfe
push edx
push ecx
call fcn.0041b677
add esp, 8
mov esi, dword [ebp - 0x2e0]
cmp esi, edi
jne 0x4028fa
mov edx, dword [ebp - 0x2f0]
lea ecx, [ebp - 0x74]
call fcn.004085b0
push str..cfg
mov edx, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2c]
call fcn.00404070
add esp, 4
lea ecx, [ebp - 0x2e0]
mov edx, eax
push edi
push ebx
call fcn.00404220
mov edx, dword [ebp - 0x18]
add esp, 8
mov esi, dword [eax]
cmp edx, 8
jb 0x4028a2
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402898
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d03
push edx
push ecx
call fcn.0041b677
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 8
jb 0x4028f4
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4028ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d08
push edx
push ecx
call fcn.0041b677
add esp, 8
cmp esi, edi
jne 0x4028fa
mov esi, ebx
push esi
lea ecx, [ebp - 0x44]
call fcn.00403380
mov esi, dword [ebp - 0x2ec]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x34]
add eax, dword [esi + 0x10]
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x2e4], 0x38
call fcn.00404820
push esi
lea ecx, [ebp - 0x2c]
call fcn.00404a50
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404a50
lea ecx, [ebp - 0x8c]
call fcn.004012a0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x2ec], ecx
jb 0x4029a3
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x2ec], ecx
mov eax, dword [ebp - 0x34]
cmp eax, 4
jb 0x4029ce
add eax, 0xfffffffd
lea eax, [ecx + eax*2]
mov dword [ebp - 0x2e0], eax
sub eax, ecx
sar eax, 1
je 0x4029ce
lea ecx, [ecx]
cmp word [ecx], 0x2e
je 0x402a1c
add ecx, 2
sub eax, 1
jne 0x4029c0
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x74]
call fcn.00408460
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.004034c0
mov edx, dword [ebp - 0x60]
cmp edx, 0x10
jb 0x402b34
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402b2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d0d
jmp 0x402b2a
test ecx, ecx
je 0x4029ce
mov edx, str..cfg
mov ebx, ecx
mov esi, 4
sub ebx, edx
mov edi, edi
mov ax, word [ebx + edx]
cmp ax, word [edx]
jne 0x402acc
add edx, 2
sub esi, 1
jne 0x402a30
sub ecx, dword [ebp - 0x2ec]
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4029ce
mov edx, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, ecx
jb 0x402a6f
mov edx, ecx
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
jb 0x402a7b
mov eax, dword [ebp - 0x44]
push edx
push eax
lea ecx, [ebp - 0x2c]
call fcn.004013e0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x74]
call fcn.00408460
mov ecx, dword [ebp - 0x2fc]
push eax
call fcn.004034c0
mov edx, dword [ebp - 0x60]
cmp edx, 0x10
jb 0x402ae4
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402ada
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d12
jmp 0x402ada
mov eax, dword [ebp - 0x2e0]
add ecx, 2
jmp 0x4029b7
push edx
push ecx
call fcn.0041b677
add esp, 8
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
cmp edx, 8
jb 0x402b34
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402b2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d17
push edx
push ecx
call fcn.0041b677
add esp, 8
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x402b72
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402b68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d1c
push edx
push ecx
call fcn.0041b677
add esp, 8
xor eax, eax
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov byte [ebp - 4], 1
call fcn.00401350
jmp 0x402c19
mov edx, dword [ebp - 0x2ec]
lea ecx, [ebp - 0x74]
push str.en_us.cfg
call fcn.00403fc0
mov esi, eax
add esp, 4
lea eax, [ebp - 0x8c]
cmp eax, esi
je 0x402bff
mov ecx, eax
call fcn.004012a0
mov eax, dword [esi]
mov dword [ebp - 0x8c], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x84], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x80], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x78], eax
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x74]
call fcn.004012a0
mov ecx, dword [ebp - 0x2fc]
push 5
push str.en_us
call fcn.004015a0
push dword [ebp - 0x31c]
mov ecx, dword [ebp - 0x320]
lea eax, [ebp - 0x8c]
push eax
call fcn.00404fc0
mov esi, dword [ebp - 0x300]
mov bl, al
test esi, esi
je 0x402c91
push ecx
mov edx, edi
mov ecx, esi
call fcn.00401cc0
mov ecx, dword [ebp - 0x304]
mov eax, 0x2aaaaaab
sub ecx, esi
add esp, 4
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x402c87
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d21
push ecx
push esi
call fcn.0041b677
add esp, 8
mov edx, dword [ebp - 0x78]
cmp edx, 8
jb 0x402cca
mov ecx, dword [ebp - 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402cc0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d26
push edx
push ecx
call fcn.0041b677
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041b636
mov esp, ebp
pop ebp
ret 0x14
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
int3