Function at 0x401a20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x41401c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov word [ebp - 0x7a8], ax
xor ebx, ebx
push 0x1b
mov eax, str.mm_00000000_0000000_0000000
lea esi, [ebp - 0x7a8]
mov dword [ebp - 0x804], 1
mov dword [ebp - 0x794], 7
mov dword [ebp - 0x798], ebx
call fcn.00403530
mov esi, dword [0x41007c]
push 0x103
push 0x415e40
push ebx
call esi
push 0x6d
push edi
call dword [0x410164]
push ebx
call dword [0x410080]
push 0x206
lea edx, [ebp - 0x272]
xor ecx, ecx
push ebx
push edx
mov edi, eax
mov word [ebp - 0x274], cx
call fcn.00408080
add esp, 0xc
push 0x104
lea eax, [ebp - 0x274]
push eax
push edi
call esi
call dword [0x410078]
xor ecx, ecx
mov word [ebp - 0x700], cx
mov edi, 7
mov ecx, eax
mov dword [ebp - 0x6ec], edi
mov dword [ebp - 0x6f0], ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x401ae7
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x700]
call fcn.00403530
push 0xa
push str._uninstall
mov edx, esi
push edx
xor eax, eax
call fcn.00403250
cmp eax, 0xffffffff
je 0x401d5c
xor eax, eax
mov word [ebp - 0x6c8], ax
push ebx
mov eax, 0x4122cc
lea esi, [ebp - 0x6c8]
mov dword [ebp - 0x6b4], edi
mov dword [ebp - 0x6b8], ebx
call fcn.00403530
xor ecx, ecx
push 4
mov eax, str.path
lea esi, [ebp - 0x6ac]
mov dword [ebp - 0x698], edi
mov dword [ebp - 0x69c], ebx
mov word [ebp - 0x6ac], cx
call fcn.00403530
xor edx, edx
push 4
mov eax, str.1001
lea esi, [ebp - 0x690]
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x680], ebx
mov word [ebp - 0x690], dx
call fcn.00403530
lea eax, [ebp - 0x6c8]
push eax
lea edx, [ebp - 0x6ac]
mov ecx, esi
call fcn.00404100
mov esi, 8
add esp, 4
cmp dword [ebp - 0x67c], esi
jb 0x401bc3
mov ecx, dword [ebp - 0x690]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x680], ebx
mov word [ebp - 0x690], dx
cmp dword [ebp - 0x698], esi
jb 0x401bef
mov eax, dword [ebp - 0x6ac]
push eax
call fcn.0040580e
add esp, 4
cmp dword [ebp - 0x6b8], ebx
je 0x401c14
mov eax, dword [ebp - 0x6c8]
cmp dword [ebp - 0x6b4], esi
jae 0x401c0b
lea eax, [ebp - 0x6c8]
push eax
call fcn.004053e0
add esp, 4
lea edi, [ebp - 0x274]
call fcn.00402910
call fcn.00405310
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x800], esp
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push ebx
mov eax, 0x4122cc
mov word [esi], cx
call fcn.00403530
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x800], esp
mov edi, 7
xor edx, edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
push ebx
mov eax, 0x4122cc
mov word [esi], dx
call fcn.00403530
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x800], esp
mov word [esi], ax
push 4
mov eax, str.1001
call fcn.00403530
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x800], esp
push ebx
lea eax, [ebp - 0x6c8]
xor edx, edx
push eax
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403150
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x800], esp
xor ecx, ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
push 3
mov eax, 0x412328
mov word [esi], cx
call fcn.00403530
call fcn.004048f0
add esp, 0x8c
cmp dword [ebp - 0x6b4], 8
jb 0x401cfc
mov edx, dword [ebp - 0x6c8]
push edx
call fcn.0040580e
add esp, 4
mov esi, edi
xor eax, eax
mov edi, 8
mov dword [ebp - 0x6b4], esi
mov dword [ebp - 0x6b8], ebx
mov word [ebp - 0x6c8], ax
cmp dword [ebp - 0x6ec], edi
jb 0x401d2f
mov ecx, dword [ebp - 0x700]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
mov dword [ebp - 0x6ec], esi
mov dword [ebp - 0x6f0], ebx
mov word [ebp - 0x700], dx
cmp dword [ebp - 0x794], edi
jb 0x4028f4
mov eax, dword [ebp - 0x7a8]
push eax
jmp 0x4028ec
push edi
push str._noopen
lea ecx, [ebp - 0x700]
push ecx
xor eax, eax
call fcn.00403250
cmp eax, 0xffffffff
je 0x401d7b
mov dword [ebp - 0x804], ebx
lea edi, [ebp - 0x274]
call fcn.00402ab0
push 5
push str._pid:
lea edx, [ebp - 0x700]
mov dword [ebp - 0x800], eax
push edx
xor eax, eax
call fcn.00403250
cmp eax, 0xffffffff
je 0x401ee3
push 5
push str._pid:
lea eax, [ebp - 0x700]
push eax
xor eax, eax
call fcn.00403250
push 1
lea esi, [eax + 5]
push 0x41234c
lea ecx, [ebp - 0x700]
push ecx
mov eax, esi
call fcn.00403250
cmp eax, 0xffffffff
jne 0x401de2
mov eax, dword [ebp - 0x6f0]
sub eax, esi
mov ecx, esi
push eax
lea esi, [ebp - 0x738]
lea edx, [ebp - 0x700]
call fcn.004030b0
mov edi, eax
lea esi, [ebp - 0x7a8]
call fcn.004030e0
mov esi, 8
cmp dword [ebp - 0x724], esi
jb 0x401e21
mov edx, dword [ebp - 0x738]
push edx
call fcn.0040580e
add esp, 4
cmp dword [ebp - 0x800], ebx
jne 0x401ee3
lea edi, [ebp - 0x274]
call fcn.00402c70
mov eax, 0x412350
lea ecx, [ebp - 0x738]
call fcn.00403010
mov eax, str.1001
lea ecx, [ebp - 0x6ac]
call fcn.00403010
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x800], esp
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
push ebx
lea edx, [ebp - 0x7a8]
mov word [ecx], ax
push edx
or eax, 0xffffffff
call fcn.00403150
lea ebx, [ebp - 0x738]
lea ecx, [ebp - 0x6ac]
call fcn.004042e0
add esp, 0x1c
cmp dword [ebp - 0x698], esi
jb 0x401ead
mov eax, dword [ebp - 0x6ac]
push eax
call fcn.0040580e
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x698], 7
mov dword [ebp - 0x69c], 0
mov word [ebp - 0x6ac], cx
cmp dword [ebp - 0x724], esi
jb 0x401ee1
mov edx, dword [ebp - 0x738]
push edx
call fcn.0040580e
add esp, 4
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x78c], ax
mov edi, 7
push ebx
mov eax, 0x4122cc
lea esi, [ebp - 0x78c]
mov dword [ebp - 0x778], edi
mov dword [ebp - 0x77c], ebx
call fcn.00403530
xor ecx, ecx
push 4
mov eax, str.path
lea esi, [ebp - 0x6ac]
mov dword [ebp - 0x698], edi
mov dword [ebp - 0x69c], ebx
mov word [ebp - 0x6ac], cx
call fcn.00403530
xor edx, edx
push 4
mov eax, str.1001
lea esi, [ebp - 0x690]
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x680], ebx
mov word [ebp - 0x690], dx
call fcn.00403530
lea eax, [ebp - 0x78c]
push eax
lea edx, [ebp - 0x6ac]
mov ecx, esi
call fcn.00404100
add esp, 4
cmp dword [ebp - 0x67c], 8
jb 0x401f8b
mov ecx, dword [ebp - 0x690]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
cmp dword [ebp - 0x698], 8
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x680], ebx
mov word [ebp - 0x690], dx
jb 0x401fb8
mov eax, dword [ebp - 0x6ac]
push eax
call fcn.0040580e
add esp, 4
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x800], esp
xor ecx, ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
push ebx
mov eax, 0x4122cc
mov word [esi], cx
call fcn.00403530
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x800], esp
xor edx, edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
push ebx
mov eax, 0x4122cc
mov word [esi], dx
call fcn.00403530
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x800], esp
mov word [esi], ax
push 4
mov eax, str.1001
call fcn.00403530
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x800], esp
push ebx
lea eax, [ebp - 0x78c]
xor edx, edx
push eax
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403150
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x800], esp
xor ecx, ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
push 3
mov eax, 0x412358
mov word [esi], cx
call fcn.00403530
call fcn.004048f0
add esp, 0x8c
xor edx, edx
push ebx
mov eax, 0x4122cc
lea esi, [ebp - 0x71c]
mov dword [ebp - 0x708], edi
mov dword [ebp - 0x70c], ebx
mov word [ebp - 0x71c], dx
call fcn.00403530
xor eax, eax
mov word [ebp - 0x7c4], ax
push ebx
mov eax, 0x4122cc
lea esi, [ebp - 0x7c4]
mov dword [ebp - 0x7b0], edi
mov dword [ebp - 0x7b4], ebx
call fcn.00403530
mov ecx, esi
push ecx
sub esp, 0x1c
mov esi, esp
xor edx, edx
mov dword [ebp - 0x800], esp
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov word [esi], dx
push 4
mov eax, str.1001
call fcn.00403530
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov word [esi], ax
lea eax, [ebp - 0x274]
mov dword [ebp - 0x800], esp
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x402100
sub eax, ecx
sar eax, 1
push eax
lea eax, [ebp - 0x274]
call fcn.00403530
lea ecx, [ebp - 0x71c]
call fcn.00403d80
add esp, 0x3c
cmp dword [ebp - 0x70c], ebx
je 0x402627
cmp dword [ebp - 0x804], ebx
je 0x402627
mov eax, 0x4122cc
lea ecx, [ebp - 0x738]
call fcn.00403010
mov eax, 0x412350
lea ecx, [ebp - 0x7e0]
call fcn.00403010
mov eax, str.1001
lea ecx, [ebp - 0x770]
call fcn.00403010
lea ecx, [ebp - 0x738]
push ecx
lea edx, [ebp - 0x7e0]
lea ecx, [ebp - 0x770]
call fcn.00404100
mov esi, 8
add esp, 4
cmp dword [ebp - 0x75c], esi
jb 0x4021a8
mov edx, dword [ebp - 0x770]
push edx
call fcn.0040580e
add esp, 4
xor eax, eax
mov dword [ebp - 0x75c], edi
mov dword [ebp - 0x760], ebx
mov word [ebp - 0x770], ax
cmp dword [ebp - 0x7cc], esi
jb 0x4021d4
mov ecx, dword [ebp - 0x7e0]
push ecx
call fcn.0040580e
add esp, 4
mov eax, 0x4122cc
lea ecx, [ebp - 0x6c8]
call fcn.00403010
lea ecx, [ebp - 0x6ac]
call fcn.004045a0
lea ecx, [ebp - 0x690]
call fcn.00404440
mov eax, 0x412360
lea ecx, [ebp - 0x6e4]
call fcn.00403010
lea edx, [ebp - 0x738]
push edx
lea eax, [ebp - 0x7fc]
push eax
lea ebx, [ebp - 0x6ac]
call fcn.00403920
mov ecx, eax
add esp, 8
lea eax, [ebp - 0x690]
lea ebx, [ebp - 0x7e0]
call fcn.004039d0
mov ecx, eax
lea eax, [ebp - 0x6e4]
lea ebx, [ebp - 0x770]
call fcn.004039d0
xor ebx, ebx
push ebx
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x6c8]
call fcn.00403310
mov edi, 8
cmp dword [ebp - 0x75c], edi
jb 0x40227a
mov ecx, dword [ebp - 0x770]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
mov esi, 7
mov dword [ebp - 0x75c], esi
mov dword [ebp - 0x760], ebx
mov word [ebp - 0x770], dx
cmp dword [ebp - 0x7cc], edi
jb 0x4022ab
mov eax, dword [ebp - 0x7e0]
push eax
call fcn.0040580e
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x7cc], esi
mov dword [ebp - 0x7d0], ebx
mov word [ebp - 0x7e0], cx
cmp dword [ebp - 0x7e8], edi
jb 0x4022d7
mov edx, dword [ebp - 0x7fc]
push edx
call fcn.0040580e
add esp, 4
push 0x27
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.00408080
push 0x3ff
lea ecx, [ebp - 0x673]
push ebx
push ecx
mov byte [ebp - 0x674], bl
call fcn.00408080
mov eax, dword [ebp - 0x6c8]
add esp, 0x18
cmp dword [ebp - 0x6b4], edi
jae 0x402312
lea eax, [ebp - 0x6c8]
mov esi, dword [0x410084]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push 0xfde9
call esi
mov ecx, dword [ebp - 0x6c8]
cmp dword [ebp - 0x6b4], edi
jae 0x40233b
lea ecx, [ebp - 0x6c8]
push ebx
push ebx
push eax
lea edx, [ebp - 0x674]
push edx
push 0xffffffffffffffff
push ecx
push ebx
push 0xfde9
call esi
lea edi, [ebp - 0x2c]
lea ecx, [ebp - 0x674]
call fcn.00401880
push ebx
push ebx
push 0xffffffffffffffff
mov eax, edi
push eax
push ebx
push ebx
mov ebx, dword [0x41008c]
call ebx
mov esi, eax
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00405d92
mov edi, eax
lea eax, [esi + esi + 2]
push eax
push 0
push edi
call fcn.00408080
add esp, 0x10
push esi
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
call ebx
push 0
lea edx, [ebp - 0x738]
push edx
or eax, 0xffffffff
lea esi, [ebp - 0x71c]
call fcn.00403310
push 1
mov eax, 0x4123a4
mov ecx, esi
call fcn.00403400
lea eax, [ebp - 0x7fc]
push 0x4123a8
push eax
lea ebx, [ebp - 0x6ac]
call fcn.00403a10
add esp, 8
push 0
push eax
or eax, 0xffffffff
call fcn.00403310
cmp dword [ebp - 0x7e8], 8
jb 0x40240c
mov ecx, dword [ebp - 0x7fc]
push ecx
call fcn.0040580e
add esp, 4
lea edx, [ebp - 0x7fc]
push 0x4123b0
push edx
lea ebx, [ebp - 0x690]
call fcn.00403a10
add esp, 8
xor ebx, ebx
push ebx
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x71c]
call fcn.00403310
mov esi, 8
cmp dword [ebp - 0x7e8], esi
jb 0x402454
mov eax, dword [ebp - 0x7fc]
push eax
call fcn.0040580e
add esp, 4
push 3
mov eax, 0x4123b8
lea ecx, [ebp - 0x71c]
call fcn.00403400
mov eax, edi
lea edx, [eax + 2]
jmp 0x402470
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402470
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea ecx, [ebp - 0x71c]
call fcn.00403400
cmp edi, ebx
je 0x40249a
push edi
call fcn.00405819
add esp, 4
cmp dword [ebp - 0x708], esi
mov esi, dword [ebp - 0x71c]
jae 0x4024ae
lea esi, [ebp - 0x71c]
push 5
push ebx
push ebx
push esi
push str.open
push ebx
call dword [0x410154]
cmp eax, 0x20
ja 0x4024cd
push eax
call fcn.00402f50
add esp, 4
sub esp, 0x1c
mov eax, str.channelcode
mov ecx, esp
mov dword [ebp - 0x800], esp
call fcn.00403010
sub esp, 0x1c
mov eax, 0x4123d8
mov ecx, esp
mov dword [ebp - 0x800], esp
call fcn.00403010
sub esp, 0x1c
mov eax, str.1001
mov ecx, esp
mov dword [ebp - 0x800], esp
call fcn.00403010
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x800], esp
push ebx
lea eax, [ebp - 0x78c]
mov esi, 7
xor edx, edx
push eax
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403150
sub esp, 0x1c
mov eax, 0x4123e0
mov ecx, esp
mov dword [ebp - 0x800], esp
call fcn.00403010
call fcn.004048f0
mov edi, 8
add esp, 0x8c
cmp dword [ebp - 0x6d0], edi
jb 0x402573
mov ecx, dword [ebp - 0x6e4]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
mov dword [ebp - 0x6d0], esi
mov dword [ebp - 0x6d4], ebx
mov word [ebp - 0x6e4], dx
cmp dword [ebp - 0x67c], edi
jb 0x40259f
mov eax, dword [ebp - 0x690]
push eax
call fcn.0040580e
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x67c], esi
mov dword [ebp - 0x680], ebx
mov word [ebp - 0x690], cx
cmp dword [ebp - 0x698], edi
jb 0x4025cb
mov edx, dword [ebp - 0x6ac]
push edx
call fcn.0040580e
add esp, 4
xor eax, eax
mov dword [ebp - 0x698], esi
mov dword [ebp - 0x69c], ebx
mov word [ebp - 0x6ac], ax
cmp dword [ebp - 0x6b4], edi
jb 0x4025f7
mov ecx, dword [ebp - 0x6c8]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
mov dword [ebp - 0x6b4], esi
mov dword [ebp - 0x6b8], ebx
mov word [ebp - 0x6c8], dx
cmp dword [ebp - 0x724], edi
jb 0x402623
mov eax, dword [ebp - 0x738]
push eax
call fcn.0040580e
add esp, 4
mov edi, esi
xor ebx, ebx
xor ecx, ecx
push 1
mov eax, 0x4123e8
lea esi, [ebp - 0x754]
mov dword [ebp - 0x740], edi
mov dword [ebp - 0x744], ebx
mov word [ebp - 0x754], cx
call fcn.00403530
push 0x3e
lea eax, [ebp - 0x6a]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x6c], dx
call fcn.00408080
add esp, 0xc
xor ecx, ecx
push 8
mov eax, 0x4123ec
lea esi, [ebp - 0x6e4]
mov dword [ebp - 0x6d0], edi
mov dword [ebp - 0x6d4], ebx
mov word [ebp - 0x6e4], cx
call fcn.00403530
xor edx, edx
push 4
mov eax, str.1001
lea esi, [ebp - 0x690]
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x680], ebx
mov word [ebp - 0x690], dx
call fcn.00403530
lea eax, [ebp - 0x754]
push eax
lea edx, [ebp - 0x6e4]
mov ecx, esi
call fcn.00404100
add esp, 4
cmp dword [ebp - 0x67c], 8
jb 0x4026e0
mov ecx, dword [ebp - 0x690]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
mov esi, 8
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x680], ebx
mov word [ebp - 0x690], dx
cmp dword [ebp - 0x6d0], esi
jb 0x402711
mov eax, dword [ebp - 0x6e4]
push eax
call fcn.0040580e
add esp, 4
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x740], esi
jae 0x402725
lea eax, [ebp - 0x754]
push eax
call fcn.00405db3
push 0xa
lea ecx, [ebp - 0x6c]
inc eax
push ecx
push eax
call fcn.00405e14
mov ecx, eax
add esp, 0x10
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x402740
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x754]
call fcn.00403530
mov eax, 0x4123ec
lea ecx, [ebp - 0x738]
call fcn.00403010
mov eax, str.1001
lea ecx, [ebp - 0x6e4]
call fcn.00403010
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x800], esp
push ebx
mov eax, esi
xor edx, edx
push eax
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403150
lea ebx, [ebp - 0x738]
lea ecx, [ebp - 0x6e4]
call fcn.004042e0
add esp, 0x1c
cmp dword [ebp - 0x6d0], 8
jb 0x4027c9
mov ecx, dword [ebp - 0x6e4]
push ecx
call fcn.0040580e
add esp, 4
xor edi, edi
xor edx, edx
mov esi, 8
mov ebx, 7
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6d4], edi
mov word [ebp - 0x6e4], dx
cmp dword [ebp - 0x724], esi
jb 0x402801
mov eax, dword [ebp - 0x738]
push eax
call fcn.0040580e
add esp, 4
cmp dword [ebp - 0x740], esi
jb 0x402818
mov ecx, dword [ebp - 0x754]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
mov dword [ebp - 0x740], ebx
mov dword [ebp - 0x744], edi
mov word [ebp - 0x754], dx
cmp dword [ebp - 0x7b0], esi
jb 0x402844
mov eax, dword [ebp - 0x7c4]
push eax
call fcn.0040580e
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x7b0], ebx
mov dword [ebp - 0x7b4], edi
mov word [ebp - 0x7c4], cx
cmp dword [ebp - 0x708], esi
jb 0x402870
mov edx, dword [ebp - 0x71c]
push edx
call fcn.0040580e
add esp, 4
xor eax, eax
mov dword [ebp - 0x708], ebx
mov dword [ebp - 0x70c], edi
mov word [ebp - 0x71c], ax
cmp dword [ebp - 0x778], esi
jb 0x40289c
mov ecx, dword [ebp - 0x78c]
push ecx
call fcn.0040580e
add esp, 4
xor edx, edx
mov dword [ebp - 0x778], ebx
mov dword [ebp - 0x77c], edi
mov word [ebp - 0x78c], dx
cmp dword [ebp - 0x6ec], esi
jb 0x4028c8
mov eax, dword [ebp - 0x700]
push eax
call fcn.0040580e
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x6ec], ebx
mov dword [ebp - 0x6f0], edi
mov word [ebp - 0x700], cx
cmp dword [ebp - 0x794], esi
jb 0x4028f4
mov edx, dword [ebp - 0x7a8]
push edx
call fcn.0040580e
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004055b6
mov esp, ebp
pop ebp
ret 0x10