Function at 0x40ee58
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x43424b
call fcn.0042617c
mov eax, 0x6358
call fcn.00426210
push ebx
push esi
push edi
lea ecx, [ebp - 0x6364]
call fcn.0040239a
mov ebx, 0x1000
xor edi, edi
push ebx
lea eax, [ebp - 0x1330]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x330], edi
call fcn.004261a0
push ebx
lea eax, [ebp - 0x2334]
push edi
push eax
mov dword [ebp - 0x1334], edi
call fcn.004261a0
lea eax, [ebp - 0x2334]
mov byte [ebp - 4], 2
push eax
call fcn.0040d911
add esp, 0x1c
lea ecx, [ebp - 0x90]
push str.blank
call fcn.004030c1
mov dword [ebp - 0x90], 0x436480
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x635c]
push eax
mov byte [ebp - 4], 3
call fcn.00403cf7
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.0040311b
mov eax, dword [0x44473c]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, edi
je 0x40ef24
push eax
call esi
test eax, eax
jbe 0x40ef24
push 0x444730
lea ecx, [ebp - 0x6364]
call fcn.00402e6e
lea eax, [ebp - 0x2334]
lea ecx, [ebp - 0x6364]
push eax
lea eax, [ebp - 0x1330]
push eax
call fcn.004024bc
lea eax, [ebp - 0x1330]
push eax
call fcn.0041028b
mov eax, dword [0x44475c]
pop ecx
cmp eax, edi
je 0x40ef5a
push eax
call esi
test eax, eax
jne 0x40ef99
lea eax, [ebp - 0x15c]
mov ecx, 0x4447c8
push eax
call fcn.0040438f
mov esi, 0x444760
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00403cf7
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 2
call fcn.0040311b
push 0x43fd3c
mov ecx, esi
call fcn.00404baf
jmp 0x40efa8
push 0x444750
mov ecx, 0x444760
call fcn.00403cf7
cmp dword [ebp - 0x330], edi
mov dword [ebp - 0x18], edi
jle 0x40fa78
mov esi, 0x436448
cmp byte [0x444880], 0
jne 0x40fa61
mov eax, dword [ebp - 0x18]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], edi
mov ebx, dword [ebp + eax*4 - 0x1330]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x48], esi
lea eax, [ebx + 0x200c]
lea ecx, [ebp - 0x48]
push eax
mov byte [ebp - 4], 5
call fcn.00403cf7
lea ecx, [ebp - 0x3c]
call fcn.00402cd6
lea eax, [ebp - 0x60]
push eax
call fcn.00427a27
pop ecx
lea ecx, [ebp - 0x254]
call fcn.00408e51
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 6
call fcn.00408e51
or eax, 0xffffffff
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x5c], esi
lea eax, [ebp - 0x2c]
and byte [ebp - 0xe], 0
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
and byte [ebp - 0xd], 0
push eax
lea eax, [ebp - 0x30]
mov ecx, 0x4447b8
push eax
lea eax, [ebp - 0x48]
push 1
push eax
mov byte [ebp - 4], 9
call fcn.00407e1c
cmp dword [ebp - 0x30], 0xffffffff
jne 0x40f08f
cmp dword [ebp - 0x28], 0xffffffff
jne 0x40f0ab
cmp dword [ebp - 0x1c], 0xffffffff
je 0x40f129
cmp dword [ebp - 0x28], 0xffffffff
jne 0x40f0ab
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40f0c1
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x44006c
jmp 0x40f0cf
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40f0c1
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x44005c
jmp 0x40f0cf
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x440064
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x254]
call fcn.00409523
push dword [ebp - 0x1c]
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28]
push dword [ebp - 0x30]
push 1
push eax
call fcn.0040942f
cmp dword [ebp - 0x2c], 0xffffffff
je 0x40f115
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x254]
call fcn.00409574
push dword [ebp - 0x60]
lea eax, [ebp - 0x254]
push eax
call fcn.0040fc21
pop ecx
mov byte [ebp - 0xe], al
pop ecx
lea eax, [ebp - 0x2c]
mov ecx, 0x4447b8
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push 2
push eax
call fcn.00407e1c
cmp dword [ebp - 0x30], 0xffffffff
jne 0x40f163
cmp dword [ebp - 0x28], 0xffffffff
jne 0x40f17f
cmp dword [ebp - 0x1c], 0xffffffff
je 0x40f1fd
cmp dword [ebp - 0x28], 0xffffffff
jne 0x40f17f
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40f195
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x44006c
jmp 0x40f1a3
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40f195
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x44005c
jmp 0x40f1a3
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x440064
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x1f4]
call fcn.00409523
push dword [ebp - 0x1c]
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x1f4]
push dword [ebp - 0x28]
push dword [ebp - 0x30]
push 1
push eax
call fcn.0040942f
cmp dword [ebp - 0x2c], 0xffffffff
je 0x40f1e9
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1f4]
call fcn.00409574
push dword [ebp - 0x60]
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040fc21
pop ecx
mov byte [ebp - 0xd], al
pop ecx
cmp byte [ebp - 0xe], 0
jne 0x40f20d
cmp byte [ebp - 0xd], 0
je 0x40fa1f
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x6364]
push eax
call fcn.004023f0
test al, al
je 0x40fa1f
mov ecx, ebx
call fcn.00402004
test eax, eax
jne 0x40fa1f
push dword [ebp - 0x60]
lea eax, [ebp - 0xb0]
push eax
call fcn.00418e2d
pop ecx
pop ecx
cmp byte [ebp - 0xe], 0
mov byte [ebp - 4], 0xa
je 0x40f27d
lea eax, [ebp - 0xb0]
mov ecx, 0x4447b8
push eax
lea eax, [ebp - 0x48]
push 1
push eax
call fcn.0040e5b1
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push 1
push eax
mov ecx, 0x4447b8
call fcn.0040fb4c
cmp byte [ebp - 0xd], 0
je 0x40f2b2
lea eax, [ebp - 0xb0]
mov ecx, 0x4447b8
push eax
lea eax, [ebp - 0x48]
push 2
push eax
call fcn.0040e5b1
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push 2
push eax
mov ecx, 0x4447b8
call fcn.0040fb4c
cmp byte [0x444880], 0
jne 0x40fa10
mov eax, dword [ebx + 0x1000]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x40fa10
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x4c], edi
jle 0x40f357
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov edi, dword [eax]
mov ecx, edi
call fcn.00417c64
test al, al
je 0x40f33f
mov ecx, edi
call fcn.00417cb8
test al, al
jne 0x40f33f
cmp byte [ebp - 0xe], al
je 0x40f31b
cmp byte [edi + 0xdc], al
je 0x40f31b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x24], 0
jl 0x40f315
or dword [ebp - 0x24], 0xffffffff
jmp 0x40f31b
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
cmp byte [ebp - 0xd], 0
je 0x40f33f
cmp byte [edi + 0xdc], 0
jne 0x40f33f
inc dword [ebp - 0x38]
cmp dword [ebp - 0x24], 0
jl 0x40f339
or dword [ebp - 0x24], 0xffffffff
jmp 0x40f33f
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x4c]
add dword [ebp - 0x34], 4
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x14]
jl 0x40f2de
cmp byte [0x444880], 0
jne 0x40f378
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
add eax, ecx
test eax, eax
mov dword [ebp - 0x34], eax
je 0x40fa0e
lea eax, [ebp - 0x48]
push eax
call fcn.0041871d
test al, al
pop ecx
jne 0x40f3d0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 9
call fcn.004031de
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call fcn.004031de
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 7
call fcn.004031de
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 6
call fcn.00408ecc
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 5
call fcn.00408ecc
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.004031de
xor edi, edi
jmp 0x40fa61
and dword [ebp - 0x20], 0
lea ecx, [ebp - 0x190]
call fcn.00411ae1
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0xb
call fcn.00411ae1
mov dword [ebp - 0x194], 0x43677c
lea eax, [ebp - 0x194]
mov ecx, 0x4447d8
push eax
mov byte [ebp - 4], 0xc
call fcn.00412742
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x4446dc
call edi
mov dword [ebp - 0x74], eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xd
call fcn.004042fb
mov dword [ebp - 0x80], esi
push str.Strings
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xe
call fcn.004069c4
mov eax, dword [0x44479c]
test eax, eax
je 0x40f475
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x40f475
mov ecx, dword [0x44479c]
mov eax, ecx
cmp word [ecx], 0
je 0x40f467
inc eax
inc eax
cmp word [eax], 0
jne 0x40f45f
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x80]
call fcn.00406a07
push str.ToasterCSS
lea ecx, [ebp - 0x80]
call fcn.004069c4
mov eax, dword [0x44477c]
test eax, eax
je 0x40f4ba
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x40f4ba
mov ecx, dword [0x44477c]
mov eax, ecx
cmp word [ecx], 0
je 0x40f4ac
inc eax
inc eax
cmp word [eax], 0
jne 0x40f4a4
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x80]
call fcn.00406a07
push 0x43fd3c
call edi
mov dword [ebp - 0xe4], eax
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xf
call fcn.004042fb
mov dword [ebp - 0xf0], esi
cmp dword [ebp - 0x34], 1
mov byte [ebp - 4], 0x10
jle 0x40f4ee
mov edi, dword [ebp - 0x24]
or eax, 0xffffffff
jmp 0x40f4f3
mov edi, dword [ebp - 0x24]
mov eax, edi
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push eax
push ebx
lea ecx, [ebp - 0x32c]
call fcn.0040967b
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x12
call fcn.004031de
xor eax, eax
lea ecx, [ebp - 0x32c]
push eax
push eax
push eax
push eax
call fcn.00412e40
test eax, eax
je 0x40f54f
push 0x40008
push 5
lea ecx, [ebp - 0x32c]
call fcn.0040a133
lea ecx, [ebp - 0x194]
call fcn.00412543
mov dword [ebp - 0x20], eax
mov ecx, 0x4447d8
call fcn.004127e9
mov eax, dword [ebp - 0x20]
dec eax
dec eax
je 0x40f99c
dec eax
dec eax
je 0x40f96e
dec eax
dec eax
je 0x40f88a
dec eax
je 0x40f6d5
dec eax
je 0x40f5ed
mov eax, 0x444760
lea ecx, [ebp - 0x130]
neg eax
sbb eax, eax
and eax, 0x44476c
push eax
call fcn.00409583
push str.umbcpc.htm
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 0x22
call fcn.0040315d
mov edi, dword [ebp - 0x134]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push edi
lea ecx, [ebp - 0x124]
call fcn.004051d1
lea ecx, [ebp - 0x140]
call fcn.004031de
lea eax, [ebp - 0x130]
push eax
call fcn.0040d1d9
pop ecx
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x130]
jmp 0x40f758
test edi, edi
jl 0x40f9d5
lea ecx, [ebp - 0xa0]
call fcn.0040377f
mov ecx, dword [ebx + edi*4]
lea eax, [ebp - 0xa0]
push eax
push 9
mov byte [ebp - 4], 0x20
call fcn.004016ae
cmp dword [ebp - 0x94], 0
je 0x40f657
push dword [ebp - 0x94]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jbe 0x40f657
lea ecx, [ebp - 0xa0]
call fcn.00403c8a
push 1
push 0
push dword [ebp - 0x9c]
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40f6c6
mov eax, 0x444760
lea ecx, [ebp - 0x120]
neg eax
sbb eax, eax
and eax, 0x44476c
push eax
call fcn.00409583
push str.umbcpc.htm
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x21
call fcn.0040315d
mov edi, dword [ebp - 0x144]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push edi
lea ecx, [ebp - 0x114]
call fcn.004051d1
lea ecx, [ebp - 0x150]
call fcn.004031de
lea eax, [ebp - 0x120]
push eax
call fcn.0040d1d9
pop ecx
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x120]
call fcn.004031de
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa0]
jmp 0x40f758
or dword [ebp - 0x38], 0xffffffff
cmp byte [ebp - 0xe], 0
je 0x40f6f3
lea eax, [ebp - 0x38]
mov ecx, 0x4447b8
push eax
lea eax, [ebp - 0x48]
push 1
push eax
call fcn.0040fb4c
cmp byte [ebp - 0xd], 0
je 0x40f70d
lea eax, [ebp - 0x38]
mov ecx, 0x4447b8
push eax
lea eax, [ebp - 0x48]
push 2
push eax
call fcn.0040fb4c
cmp dword [ebp - 0x34], 1
jne 0x40f762
push 0x440144
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x104], eax
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x13
call fcn.004042fb
mov dword [ebp - 0x110], esi
mov ecx, dword [ebx + edi*4]
lea eax, [ebp - 0x110]
push eax
push 0x1b
mov byte [ebp - 4], 0x14
call fcn.0040175a
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x110]
call fcn.004031de
jmp 0x40f9d5
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x40f9d5
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], eax
mov ebx, 0x440144
mov eax, dword [ebp - 0x20]
and dword [ebp - 0xc4], 0
mov edi, dword [eax]
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x15
call fcn.004042fb
mov dword [ebp - 0xd0], esi
lea eax, [ebp - 0xd0]
mov ecx, edi
push eax
push 0x1b
mov byte [ebp - 4], 0x16
call fcn.004016ae
push ebx
lea ecx, [ebp - 0xd0]
call fcn.00412dea
test eax, eax
je 0x40f869
cmp byte [ebp - 0xe], 0
je 0x40f815
cmp byte [edi + 0xdc], 0
je 0x40f815
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0xf4], eax
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x17
call fcn.004042fb
mov dword [ebp - 0x100], esi
lea eax, [ebp - 0x100]
mov ecx, edi
push eax
push 0x1b
mov byte [ebp - 4], 0x18
call fcn.0040175a
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x16
call fcn.004031de
cmp byte [ebp - 0xd], 0
je 0x40f869
cmp byte [edi + 0xdc], 0
jne 0x40f869
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x19
call fcn.004042fb
mov dword [ebp - 0x90], esi
lea eax, [ebp - 0x90]
mov ecx, edi
push eax
push 0x1b
mov byte [ebp - 4], 0x1a
call fcn.0040175a
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x16
call fcn.004031de
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x12
call fcn.004031de
add dword [ebp - 0x20], 4
dec dword [ebp - 0x14]
jne 0x40f778
jmp 0x40f9d5
test edi, edi
jl 0x40f9d5
and dword [ebp - 0xb4], 0
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x1b
call fcn.004042fb
mov dword [ebp - 0xc0], esi
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebx + eax*4]
lea edi, [ebx + eax*4]
lea eax, [ebp - 0xc0]
push eax
push 0x12
call fcn.004016ae
lea ecx, [ebp - 0xc0]
call fcn.00403c8a
push 0xa
push dword [ebp - 0xbc]
call fcn.00403220
pop ecx
test al, 2
pop ecx
jne 0x40f913
mov edi, dword [edi]
mov edi, dword [edi + 4]
test edi, edi
mov dword [ebp - 0x14], edi
je 0x40f8f9
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [edi]
push edi
mov byte [ebp - 4], 0x1d
call dword [eax + 0x34]
test edi, edi
mov byte [ebp - 4], 0x1c
je 0x40f95f
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x40f95f
and dword [ebp - 0xd4], 0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x1e
call fcn.004042fb
mov dword [ebp - 0xe0], esi
mov ecx, dword [edi]
lea eax, [ebp - 0xe0]
push eax
push 9
mov byte [ebp - 4], 0x1f
call fcn.004016ae
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d1d9
pop ecx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xe0]
call fcn.004031de
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xc0]
jmp 0x40f758
mov eax, dword [ebp - 0x288]
cmp byte [ebp - 0xe], 0
mov dword [ebp - 0x14], eax
je 0x40f991
lea eax, [ebp - 0x14]
mov ecx, 0x4447b8
push eax
lea eax, [ebp - 0x48]
push 1
push eax
call fcn.0040fb4c
cmp byte [ebp - 0xd], 0
je 0x40f9d5
lea eax, [ebp - 0x14]
jmp 0x40f9c4
cmp byte [ebp - 0xe], 0
push 1
pop eax
mov dword [ebp - 0x14], eax
je 0x40f9bb
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x48]
mov ecx, 0x4447b8
push eax
call fcn.0040fb4c
cmp byte [ebp - 0xd], 0
je 0x40f9d5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push 2
push eax
mov ecx, 0x4447b8
call fcn.0040fb4c
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 0xe
call fcn.004098f7
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xc
call fcn.004031de
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x23
call fcn.00413810
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0xa
call fcn.00413810
xor edi, edi
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 9
call fcn.004031de
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 8
call fcn.004031de
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 7
call fcn.004031de
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 6
call fcn.00408ecc
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 5
call fcn.00408ecc
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.004031de
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x330]
jl 0x40efbc
mov ebx, 0x1000
cmp dword [ebp - 0x330], edi
mov dword [ebp - 0x18], edi
jle 0x40faa7
lea esi, [ebp - 0x1330]
mov ecx, dword [esi]
cmp ecx, edi
je 0x40fa96
push 1
call fcn.0040fbcf
inc dword [ebp - 0x18]
add esi, 4
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x330]
jl 0x40fa89
push ebx
lea eax, [ebp - 0x1330]
push edi
push eax
call fcn.004261a0
add esp, 0xc
cmp dword [ebp - 0x1334], edi
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x18], edi
jle 0x40faed
lea esi, [ebp - 0x2334]
mov ecx, dword [esi]
cmp ecx, edi
je 0x40fadc
push 1
call fcn.0040fbcf
inc dword [ebp - 0x18]
add esi, 4
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1334]
jl 0x40facf
push ebx
lea eax, [ebp - 0x2334]
push edi
push eax
call fcn.004261a0
push ebx
lea eax, [ebp - 0x2334]
push edi
push eax
mov dword [ebp - 0x1334], edi
call fcn.004261a0
push ebx
lea eax, [ebp - 0x1330]
push edi
push eax
mov dword [ebp - 0x1334], edi
call fcn.004261a0
or dword [ebp - 4], 0xffffffff
add esp, 0x24
lea ecx, [ebp - 0x6364]
mov dword [ebp - 0x330], edi
call fcn.0040d153
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
leave
ret