Function at 0x40101a
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3ea2c
call fcn.00408c10
push edi
mov dword [ebp - 0xab24], 0
mov dword [ebp - 0xb3fc], 0
mov dword [ebp - 0xbbe4], 0
mov dword [ebp - 0xab20], 0
mov al, byte [0xf0f73c]
mov byte [ebp - 0x2878], al
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x2877]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f740]
mov byte [ebp - 0xa34c], cl
xor edx, edx
mov dword [ebp - 0xa34b], edx
mov al, byte [0xf0f744]
mov byte [ebp - 0x1704], al
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x1703]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov cl, byte [0xf0f748]
mov byte [ebp - 0x1f0c], cl
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x1f0b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dl, byte [0xf0f74c]
mov byte [ebp - 0x270c], dl
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x270b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0x1eec], 0
mov dword [ebp - 0x26ec], 0
mov dword [ebp - 0x3054], 0
mov al, byte [0xf0f750]
mov byte [ebp - 0x3ea24], al
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x3ea23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f754]
mov byte [ebp - 0x9a34], cl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x9a33]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0f758]
mov byte [ebp - 0xab1c], dl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0xab1b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0f75c]
mov byte [ebp - 0xa344], al
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0xa343]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f760]
mov byte [ebp - 0xbbe0], cl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0xbbdf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0f764]
mov byte [ebp - 0xb3f8], dl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0xb3f7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0f768]
mov byte [ebp - 0xcbcc], al
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0xcbcb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f76c]
mov byte [ebp - 0xc3e8], cl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0xc3e7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0f770]
mov byte [ebp - 0x3e8bc], dl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x3e8bb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0f774]
mov byte [ebp - 0x3e0ec], al
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x3e0eb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f778]
mov byte [ebp - 0x26e8], cl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x26e7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0f77c]
mov byte [ebp - 0x3050], dl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x304f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0f780]
mov byte [ebp - 0x16e4], al
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x16e3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f784]
mov byte [ebp - 0x1ee8], cl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x1ee7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0f788]
mov byte [ebp - 0x904], dl
mov ecx, 0x1f3
xor eax, eax
lea edi, [ebp - 0x903]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0f78c]
mov byte [ebp - 0x9264], al
xor ecx, ecx
mov dword [ebp - 0x9263], ecx
mov dword [ebp - 0x925f], ecx
mov dword [ebp - 0x925b], ecx
mov byte [ebp - 0x9257], cl
mov dl, byte [0xf0f790]
mov byte [ebp - 0x3d91c], dl
mov ecx, 0xc34f
xor eax, eax
lea edi, [ebp - 0x3d91b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0f794]
mov byte [ebp - 0x9254], al
mov ecx, 0x1869
xor eax, eax
lea edi, [ebp - 0x9253]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f798]
mov byte [ebp - 0x134], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x133]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0f79c]
mov byte [ebp - 0xa0c], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xa0b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0f7a0]
mov byte [ebp - 0xac28], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xac27]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f7a4]
mov byte [ebp - 0x9b74], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x9b73]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0f7a8]
mov byte [ebp - 0xf14], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xf13]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0f7ac]
mov byte [ebp - 0xbc18], al
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0xbc17]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0f7b0]
mov byte [ebp - 0xb410], cl
xor edx, edx
mov dword [ebp - 0xb40f], edx
mov dword [ebp - 0xb40b], edx
mov dword [ebp - 0xb407], edx
mov dword [ebp - 0xb403], edx
mov word [ebp - 0xb3ff], dx
mov byte [ebp - 0xb3fd], dl
mov al, byte [0xf0f7b4]
mov byte [ebp - 0xc3fc], al
xor ecx, ecx
mov dword [ebp - 0xc3fb], ecx
mov dword [ebp - 0xc3f7], ecx
mov dword [ebp - 0xc3f3], ecx
mov word [ebp - 0xc3ef], cx
mov dl, byte [0xf0f7b8]
mov byte [ebp - 0x30], dl
xor eax, eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov word [ebp - 0x23], ax
mov cl, byte [0xf0f7bc]
mov byte [ebp - 0xe10], cl
xor edx, edx
mov dword [ebp - 0xe0f], edx
mov dword [ebp - 0xe0b], edx
mov dword [ebp - 0xe07], edx
mov word [ebp - 0xe03], dx
mov al, byte [0xf0f7c0]
mov byte [ebp - 0xcbdc], al
xor ecx, ecx
mov dword [ebp - 0xcbdb], ecx
mov dword [ebp - 0xcbd7], ecx
mov dword [ebp - 0xcbd3], ecx
mov word [ebp - 0xcbcf], cx
mov dword [ebp - 0x908], 0
mov dl, byte [0xf0f7c4]
mov byte [ebp - 0xe00], dl
mov ecx, 0xf9
xor eax, eax
lea edi, [ebp - 0xdff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0xbbf0], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2880], 0
mov dword [ebp - 0x1f18], 0
mov dword [ebp - 0x1718], 0
mov dword [ebp - 0xa18], 0
mov dword [ebp - 0x1714], 0
mov al, byte [0xf0f7c8]
mov byte [ebp - 0x1c], al
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x1b]
rep stosd dword es:[edi], eax
mov cl, byte [0xf0f7cc]
mov byte [ebp - 0x30ac], cl
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x30ab]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xa14], 0
mov dword [ebp - 0x1710], 0
mov dword [ebp - 0x1f14], 0
mov dword [ebp - 0xbbec], 0
mov dword [ebp - 0xc3ec], 0
mov dword [ebp - 0xbbe8], 0
mov dword [ebp - 0x170c], 0
mov dword [0xf0f310], 0x93b
mov dword [ebp - 0x287c], 0
call fcn.00403da4
push 0x104
push 0xf0c7b4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0xab24], eax
mov edx, dword [ebp + 8]
push edx
push 0xf09e9c
call fcn.00408970
add esp, 8
push 0xf0c7b4
call fcn.00408b40
add esp, 4
mov dword [ebp - 0xab24], eax
jmp 0x4015c5
mov eax, dword [ebp - 0xab24]
sub eax, 1
mov dword [ebp - 0xab24], eax
cmp dword [ebp - 0xab24], 1
jle 0x401618
push 1
mov ecx, dword [ebp - 0xab24]
push ecx
push 0xf0c7b4
call fcn.00407638
add esp, 0xc
push eax
call fcn.004075d4
add esp, 4
cmp eax, 0x5c
jne 0x401616
mov edx, dword [ebp - 0xab24]
push edx
push 0xf0c7b4
call fcn.00407774
add esp, 8
push eax
push 0xf0db3c
call fcn.00408970
add esp, 8
jmp 0x401618
jmp 0x4015b6
push str.____170806
push 0xf0f2d0
call fcn.00408970
add esp, 8
call fcn.00403da4
push 0x41003c
push 0xf0f240
call fcn.00408970
add esp, 8
push str.Kb54LnMfbn
push 0xf0f24c
call fcn.00408970
add esp, 8
push 1
call fcn.00407a1f
add esp, 4
mov dword [ebp - 0xab24], eax
mov eax, dword [ebp - 0xab24]
push eax
push 0x410054
push 0xf0f258
call fcn.00408ae4
add esp, 0xc
push 5
push 0xf0f258
call fcn.004077ca
add esp, 8
push eax
push 0xf0f280
call fcn.00408970
add esp, 8
fild dword [ebp - 0xab24]
sub esp, 8
fstp qword [esp]
call fcn.004075f1
add esp, 8
push eax
push 0xf0f258
call fcn.00408970
add esp, 8
push 5
push 0xf0f258
call fcn.004077ca
add esp, 8
push eax
push 0xf0f2a8
call fcn.00408970
add esp, 8
push 0xf0f7d0
lea ecx, [ebp - 0x30ac]
push ecx
call fcn.00408970
add esp, 8
mov dword [ebp - 0xab24], 1
jmp 0x401707
mov edx, dword [ebp - 0xab24]
add edx, 1
mov dword [ebp - 0xab24], edx
cmp dword [ebp - 0xab24], 6
jge 0x40176e
push 1
mov eax, dword [ebp - 0xab24]
push eax
push 0xf0f2a8
call fcn.00407638
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00408970
add esp, 8
push 0x410058
lea edx, [ebp - 0x1c]
push edx
call fcn.00408a60
add esp, 8
test eax, eax
jne 0x401759
push 0x41005c
lea eax, [ebp - 0x1c]
push eax
call fcn.00408970
add esp, 8
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x30ac]
push edx
call fcn.00408980
add esp, 8
jmp 0x4016f8
lea eax, [ebp - 0x30ac]
push eax
push 0xf0f2a8
call fcn.00408970
add esp, 8
push 0xf0f2a8
call fcn.004088d8
add esp, 4
mov dword [ebp - 0x1eec], eax
mov ecx, dword [ebp - 0x1eec]
imul ecx, ecx, 5
mov dword [ebp - 0x1eec], ecx
fild dword [ebp - 0x1eec]
sub esp, 8
fstp qword [esp]
call fcn.004075f1
add esp, 8
push eax
lea edx, [ebp - 0x1704]
push edx
call fcn.00408970
add esp, 8
lea eax, [ebp - 0x1704]
push eax
call fcn.00408309
add esp, 4
push eax
lea ecx, [ebp - 0x1f0c]
push ecx
call fcn.00408970
add esp, 8
push 5
lea edx, [ebp - 0x1f0c]
push edx
call fcn.00407774
add esp, 8
push eax
lea eax, [ebp - 0x270c]
push eax
call fcn.00408970
add esp, 8
lea ecx, [ebp - 0x270c]
push ecx
lea edx, [ebp - 0x1704]
push edx
call fcn.00408970
add esp, 8
lea eax, [ebp - 0x270c]
push eax
lea ecx, [ebp - 0x1704]
push ecx
call fcn.00408980
add esp, 8
lea edx, [ebp - 0x1704]
push edx
push 0xf0f240
call fcn.00408970
add esp, 8
mov dword [ebp - 0xab24], 1
jmp 0x401863
mov eax, dword [ebp - 0xab24]
add eax, 1
mov dword [ebp - 0xab24], eax
cmp dword [ebp - 0xab24], 0xb
jge 0x40189a
push 1
mov ecx, dword [ebp - 0xab24]
push ecx
push 0xf0f240
call fcn.00407638
add esp, 0xc
push eax
call fcn.004075d4
add esp, 4
mov edx, dword [ebp - 0xab24]
mov dword [edx*4 + 0x410de0], eax
jmp 0x401854
mov dword [ebp - 0xab24], 1
jmp 0x4018b5
mov eax, dword [ebp - 0xab24]
add eax, 1
mov dword [ebp - 0xab24], eax
cmp dword [ebp - 0xab24], 0xb
jge 0x4018ec
push 1
mov ecx, dword [ebp - 0xab24]
push ecx
push 0xf0f24c
call fcn.00407638
add esp, 0xc
push eax
call fcn.004075d4
add esp, 4
mov edx, dword [ebp - 0xab24]
mov dword [edx*4 + 0x410db0], eax
jmp 0x4018a6
mov dword [ebp - 0xab24], 0
mov dword [0xf0f310], 0x115e
push 0xf0f7d4
push 0xf087f8
call fcn.00408970
add esp, 8
push 0xf0f7d8
lea eax, [ebp - 0xa0c]
push eax
call fcn.00408970
add esp, 8
push 0xf087f8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x287c], eax
mov ecx, dword [ebp - 0x287c]
push ecx
push 0xf087f8
call fcn.00407774
add esp, 8
push eax
push 0xf087f8
call fcn.00408970
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
push 0x65
call fcn.00407578
add esp, 4
push eax
push 0x6c
call fcn.00407578
add esp, 4
push eax
push 0x69
call fcn.00407578
add esp, 4
push eax
push 0x66
call fcn.00407578
add esp, 4
push eax
push 0x79
call fcn.00407578
add esp, 4
push eax
push 0x6d
call fcn.00407578
add esp, 4
push eax
push 0xf087f8
push 0x410060
push 0xf08a00
call fcn.00408ae4
add esp, 0x28
push 0
push 0xf08a00
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0xab24], eax
push 0x79
call fcn.00407578
add esp, 4
push eax
push 0x78
call fcn.00407578
add esp, 4
push eax
push 0x77
call fcn.00407578
add esp, 4
push eax
push 0xf087f8
push 0x410074
push 0xf088fc
call fcn.00408ae4
add esp, 0x18
push 0
push 0xf088fc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0xab24], eax
mov dword [ebp - 0xab24], 0
push 0x2e
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xc3fc]
push edx
call fcn.00408970
add esp, 8
push 0x62
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xc3fc]
push eax
call fcn.00408980
add esp, 8
push 0x61
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xc3fc]
push ecx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xc3fc]
push edx
call fcn.00408980
add esp, 8
push 0x2e
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00408970
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00408980
add esp, 8
push 0x78
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00408980
add esp, 8
call fcn.00403da4
lea ecx, [ebp - 0xc3fc]
push ecx
push 4
call fcn.0040721a
add esp, 4
push eax
push 0x410080
push 0xf088fc
push 0x410084
push 0xf0f030
call fcn.00408ae4
add esp, 0x18
lea edx, [ebp - 0xc3fc]
push edx
push 5
call fcn.0040721a
add esp, 4
push eax
push 0x410090
push 0xf088fc
push 0x410094
push 0xf0f134
call fcn.00408ae4
add esp, 0x18
lea eax, [ebp - 0xc3fc]
push eax
push 1
call fcn.0040721a
add esp, 4
push eax
push 0x4100a0
push 0xf088fc
push str._s_s_s_s
push 0xf08b14
call fcn.00408ae4
add esp, 0x18
push 0xf08b14
push 0xf0b224
call fcn.00408970
add esp, 8
push 0xf0f7dc
lea ecx, [ebp - 0x134]
push ecx
call fcn.00408970
add esp, 8
lea edx, [ebp - 0x30]
push edx
push 2
call fcn.0040721a
add esp, 4
push eax
push 0x4100b0
lea eax, [ebp - 0x134]
push eax
call fcn.00408ae4
add esp, 0x10
lea ecx, [ebp - 0x134]
push ecx
push 0x4100b8
push 0xf088fc
push str._s_s_s
push 0xf0b328
call fcn.00408ae4
add esp, 0x14
push 0x73
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9b74]
push edx
call fcn.00408970
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9b74]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9b74]
push ecx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9b74]
push edx
call fcn.00408980
add esp, 8
push 0x7a
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9b74]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9b74]
push ecx
call fcn.00408980
add esp, 8
push 0x6d
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9b74]
push edx
call fcn.00408980
add esp, 8
push 0x70
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9b74]
push eax
call fcn.00408980
add esp, 8
push 0x3d
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9b74]
push ecx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xf14]
push edx
call fcn.00408970
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xf14]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xf14]
push ecx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xf14]
push edx
call fcn.00408980
add esp, 8
push 0x4d
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xf14]
push eax
call fcn.00408980
add esp, 8
push 0x59
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xf14]
push ecx
call fcn.00408980
add esp, 8
push 0x46
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xf14]
push edx
call fcn.00408980
add esp, 8
push 0x49
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xf14]
push eax
call fcn.00408980
add esp, 8
push 0x4c
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xf14]
push ecx
call fcn.00408980
add esp, 8
push 0x45
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xf14]
push edx
call fcn.00408980
add esp, 8
push 0x53
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xf14]
push eax
call fcn.00408980
add esp, 8
push 0x3d
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xf14]
push ecx
call fcn.00408980
add esp, 8
push 0xf088fc
lea edx, [ebp - 0x9b74]
push edx
push 0x4100c4
lea eax, [ebp - 0xa0c]
push eax
call fcn.00408ae4
add esp, 0x10
push 0xf08a00
lea ecx, [ebp - 0xf14]
push ecx
push 0x4100cc
lea edx, [ebp - 0xac28]
push edx
call fcn.00408ae4
add esp, 0x10
mov dword [0xf0f310], 0x8aeb
mov eax, dword [0xf0f310]
imul eax, eax, 3
mov dword [0xf0f310], eax
mov ecx, dword [0xf0f310]
add ecx, 1
mov dword [0xf0f310], ecx
call fcn.00403da4
push 0x73
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9b74]
push edx
call fcn.00408970
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9b74]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9b74]
push ecx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9b74]
push edx
call fcn.00408980
add esp, 8
push 0x62
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9b74]
push eax
call fcn.00408980
add esp, 8
push 0x66
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9b74]
push ecx
call fcn.00408980
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9b74]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9b74]
push eax
call fcn.00408980
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9b74]
push ecx
call fcn.00408980
add esp, 8
push 0x3d
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9b74]
push edx
call fcn.00408980
add esp, 8
push 0x61
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xbc18]
push eax
call fcn.00408970
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xbc18]
push ecx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xbc18]
push edx
call fcn.00408980
add esp, 8
push 0x72
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xbc18]
push eax
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xbc18]
push ecx
call fcn.00408980
add esp, 8
push 0x62
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xbc18]
push edx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xbc18]
push eax
call fcn.00408980
add esp, 8
push 0x2b
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xbc18]
push ecx
call fcn.00408980
add esp, 8
push 0x68
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xbc18]
push edx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xbc18]
push eax
call fcn.00408980
add esp, 8
push 0xf088fc
lea ecx, [ebp - 0xbc18]
push ecx
push 0x4100d4
lea edx, [ebp - 0x3ea24]
push edx
call fcn.00408ae4
add esp, 0x10
push 0xd
call fcn.00407578
add esp, 4
push eax
push 0xf0eec8
call fcn.00408970
add esp, 8
push 0xa
call fcn.00407578
add esp, 4
push eax
push 0xf0eec8
call fcn.00408980
add esp, 8
lea eax, [ebp - 0x3ea24]
push eax
push 0xf0eec8
call fcn.00408980
add esp, 8
push 0xd
call fcn.00407578
add esp, 4
push eax
push 0xf0eec8
call fcn.00408980
add esp, 8
push 0xa
call fcn.00407578
add esp, 4
push eax
push 0xf0eec8
call fcn.00408980
add esp, 8
push 0xf0f7e0
push 0xf0b42c
call fcn.00408970
add esp, 8
push 0x30
call fcn.00407578
add esp, 4
push eax
push 0x2f
call fcn.00407578
add esp, 4
push eax
push 0x20
call fcn.00407578
add esp, 4
push eax
push 0x54
call fcn.00407578
add esp, 4
push eax
push 0x46
call fcn.00407578
add esp, 4
push eax
push 0x49
call fcn.00407578
add esp, 4
push eax
push 0x48
call fcn.00407578
add esp, 4
push eax
push 0x53
call fcn.00407578
add esp, 4
push eax
push str._s_s_s_s_s_s_s_s
lea ecx, [ebp - 0xb410]
push ecx
call fcn.00408ae4
add esp, 0x28
push 0x40
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xe10]
push edx
call fcn.00408970
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xe10]
push eax
call fcn.00408980
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xe10]
push ecx
call fcn.00408980
add esp, 8
push 0x68
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xe10]
push edx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xe10]
push eax
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xe10]
push ecx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xe10]
push edx
call fcn.00408980
add esp, 8
push 0x66
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xe10]
push eax
call fcn.00408980
add esp, 8
push 0x66
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xe10]
push ecx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbdc]
push edx
call fcn.00408970
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbdc]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbdc]
push ecx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbdc]
push edx
call fcn.00408980
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbdc]
push eax
call fcn.00408980
add esp, 8
push 0x6d
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbdc]
push ecx
call fcn.00408980
add esp, 8
push 0x64
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbdc]
push edx
call fcn.00408980
add esp, 8
push 0x6c
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbdc]
push eax
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbdc]
push ecx
call fcn.00408980
add esp, 8
push 0x6e
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbdc]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbdc]
push eax
call fcn.00408980
add esp, 8
push 0x3d
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbdc]
push ecx
call fcn.00408980
add esp, 8
push 0xd
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xa34c]
push edx
call fcn.00408970
add esp, 8
push 0xa
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xa34c]
push eax
call fcn.00408980
add esp, 8
lea ecx, [ebp - 0xa34c]
push ecx
lea edx, [ebp - 0xb410]
push edx
lea eax, [ebp - 0xa34c]
push eax
push 0xf09e9c
lea ecx, [ebp - 0xcbdc]
push ecx
lea edx, [ebp - 0xa34c]
push edx
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x9b74]
push ecx
lea edx, [ebp - 0xa34c]
push edx
lea eax, [ebp - 0xac28]
push eax
lea ecx, [ebp - 0xa34c]
push ecx
lea edx, [ebp - 0xa0c]
push edx
lea eax, [ebp - 0xa34c]
push eax
lea ecx, [ebp - 0xe10]
push ecx
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s
push 0xf0b42c
call fcn.00408ae4
add esp, 0x40
mov edx, dword [ebp + 8]
push edx
push 0x20
call fcn.00407578
add esp, 4
push eax
push 0x22
call fcn.00407578
add esp, 4
push eax
push 0xf0c7b4
push 0x22
call fcn.00407578
add esp, 4
push eax
push 0x410110
push 0xf08b14
call fcn.00408ae4
add esp, 0x1c
mov dword [0xf0f310], 0x8bb3
mov eax, dword [0xf0f310]
sub eax, 0x19
mov dword [0xf0f310], eax
push 0xf0b224
push 0x20
call fcn.00407578
add esp, 4
push eax
push 0x6c
call fcn.00407578
add esp, 4
push eax
push 0x65
call fcn.00407578
add esp, 4
push eax
push 0x64
call fcn.00407578
add esp, 4
push eax
push str._s_s_s_s_s
lea ecx, [ebp - 0x2878]
push ecx
call fcn.00408ae4
add esp, 0x1c
push 0xf087f8
lea edx, [ebp - 0xab1c]
push edx
call fcn.00408970
add esp, 8
lea eax, [ebp - 0xab1c]
push eax
lea ecx, [ebp - 0xc3e8]
push ecx
call fcn.00408970
add esp, 8
lea edx, [ebp - 0xab1c]
push edx
lea eax, [ebp - 0x3e0ec]
push eax
call fcn.00408970
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xab1c]
push ecx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xab1c]
push edx
call fcn.00408980
add esp, 8
push 0x36
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xab1c]
push eax
call fcn.00408980
add esp, 8
push 0x34
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xab1c]
push ecx
call fcn.00408980
add esp, 8
push 0x2e
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xab1c]
push edx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xab1c]
push eax
call fcn.00408980
add esp, 8
push 0x78
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xab1c]
push ecx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xab1c]
push edx
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xc3e8]
push eax
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xc3e8]
push ecx
call fcn.00408980
add esp, 8
push 0x36
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xc3e8]
push edx
call fcn.00408980
add esp, 8
push 0x34
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xc3e8]
push eax
call fcn.00408980
add esp, 8
push 0x2e
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xc3e8]
push ecx
call fcn.00408980
add esp, 8
push 0x62
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xc3e8]
push edx
call fcn.00408980
add esp, 8
push 0x61
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xc3e8]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xc3e8]
push ecx
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e0ec]
push edx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e0ec]
push eax
call fcn.00408980
add esp, 8
push 0x36
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e0ec]
push ecx
call fcn.00408980
add esp, 8
push 0x34
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e0ec]
push edx
call fcn.00408980
add esp, 8
push 0x2e
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e0ec]
push eax
call fcn.00408980
add esp, 8
push 0x66
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e0ec]
push ecx
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e0ec]
push edx
call fcn.00408980
add esp, 8
push 0x6c
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e0ec]
push eax
call fcn.00408980
add esp, 8
push 0x25
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xa344]
push ecx
call fcn.00408970
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xbbe0]
push edx
call fcn.00408970
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xbbe0]
push eax
call fcn.00408980
add esp, 8
push 0x68
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xbbe0]
push ecx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xbbe0]
push edx
call fcn.00408980
add esp, 8
push 0x3a
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xbbe0]
push eax
call fcn.00408980
add esp, 8
push 0x30
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xbbe0]
push ecx
call fcn.00408980
add esp, 8
push 0x3e
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xbbe0]
push edx
call fcn.00408980
add esp, 8
lea eax, [ebp - 0xbbe0]
push eax
lea ecx, [ebp - 0xb3f8]
push ecx
call fcn.00408970
add esp, 8
lea edx, [ebp - 0xab1c]
push edx
lea eax, [ebp - 0xb3f8]
push eax
call fcn.00408980
add esp, 8
push 0x410128
lea ecx, [ebp - 0xab1c]
push ecx
call fcn.004088c5
add esp, 8
mov dword [ebp - 0x2710], eax
cmp dword [ebp - 0x2710], 0
je 0x40293a
push 0
push 0
mov edx, dword [ebp - 0x2710]
push edx
call fcn.00408819
add esp, 0xc
mov eax, dword [ebp - 0x2710]
mov ecx, dword [eax + 4]
sub ecx, 1
mov edx, dword [ebp - 0x2710]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x2710]
cmp dword [eax + 4], 0
jl 0x402923
mov ecx, dword [ebp - 0x2710]
mov edx, dword [ecx]
mov byte [edx], 0x30
mov eax, 0x30
and eax, 0xff
mov dword [ebp - 0x3ea28], eax
mov ecx, dword [ebp - 0x2710]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 0x2710]
mov dword [eax], edx
jmp 0x40293a
mov ecx, dword [ebp - 0x2710]
push ecx
push 0x30
call fcn.00408704
add esp, 8
mov dword [ebp - 0x3ea28], eax
mov edx, dword [ebp - 0x2710]
push edx
call fcn.004086ae
add esp, 4
push 0x69
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408970
add esp, 8
push 0x66
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x78
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x22
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
lea ecx, [ebp - 0xa344]
push ecx
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x53
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x79
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x6d
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x52
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
lea ecx, [ebp - 0xa344]
push ecx
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x5c
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x53
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x79
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x6e
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x61
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x76
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x5c
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x22
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x68
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x3a
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x31
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x3e
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408970
add esp, 8
push 0x66
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x78
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x22
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
lea eax, [ebp - 0xa344]
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x53
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x79
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x6d
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x52
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
lea eax, [ebp - 0xa344]
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x5c
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x53
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x79
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x6e
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x61
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x76
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x5c
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x22
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x68
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x3a
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x31
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x9a34]
push edx
call fcn.00408980
add esp, 8
push 0x3e
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x22
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
lea edx, [ebp - 0xab1c]
push edx
lea eax, [ebp - 0x9a34]
push eax
call fcn.00408980
add esp, 8
push 0x22
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x9a34]
push ecx
call fcn.00408980
add esp, 8
push 0x40
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbcc]
push edx
call fcn.00408970
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbcc]
push eax
call fcn.00408980
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbcc]
push ecx
call fcn.00408980
add esp, 8
push 0x68
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbcc]
push edx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbcc]
push eax
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbcc]
push ecx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbcc]
push edx
call fcn.00408980
add esp, 8
push 0x66
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbcc]
push eax
call fcn.00408980
add esp, 8
push 0x66
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbcc]
push ecx
call fcn.00408980
add esp, 8
push 0xd
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbcc]
push edx
call fcn.00408980
add esp, 8
push 0xa
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbcc]
push eax
call fcn.00408980
add esp, 8
lea ecx, [ebp - 0x9a34]
push ecx
lea edx, [ebp - 0xcbcc]
push edx
call fcn.00408980
add esp, 8
push 0xd
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0xcbcc]
push eax
call fcn.00408980
add esp, 8
push 0xa
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbcc]
push ecx
call fcn.00408980
add esp, 8
push 0x22
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408970
add esp, 8
push 0x25
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x53
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x79
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x6d
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x52
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x25
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x5c
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x53
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x79
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x73
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x6e
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x61
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x74
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x69
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x76
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x5c
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x6d
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x64
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x2e
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x78
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x3e8bc]
push ecx
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x3e8bc]
push edx
call fcn.00408980
add esp, 8
push 0x22
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x3e8bc]
push eax
call fcn.00408980
add esp, 8
push 0x65
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x26e8]
push ecx
call fcn.00408970
add esp, 8
push 0x63
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x26e8]
push edx
call fcn.00408980
add esp, 8
push 0x68
call fcn.00407578
add esp, 4
push eax
lea eax, [ebp - 0x26e8]
push eax
call fcn.00408980
add esp, 8
push 0x6f
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0x26e8]
push ecx
call fcn.00408980
add esp, 8
push 0x3a
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x26e8]
push edx
call fcn.00408980
add esp, 8
lea eax, [ebp - 0x3e8bc]
push eax
lea ecx, [ebp - 0x26e8]
push ecx
call fcn.00408980
add esp, 8
push 0x3e
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x26e8]
push edx
call fcn.00408980
add esp, 8
lea eax, [ebp - 0x3e0ec]
push eax
lea ecx, [ebp - 0x26e8]
push ecx
call fcn.00408980
add esp, 8
lea edx, [ebp - 0x26e8]
push edx
lea eax, [ebp - 0xcbcc]
push eax
call fcn.00408980
add esp, 8
push 0xd
call fcn.00407578
add esp, 4
push eax
lea ecx, [ebp - 0xcbcc]
push ecx
call fcn.00408980
add esp, 8
push 0xa
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0xcbcc]
push edx
call fcn.00408980
add esp, 8
push 0x41012c
lea eax, [ebp - 0xc3e8]
push eax
call fcn.004088c5
add esp, 8
mov dword [ebp - 0xa10], eax
cmp dword [ebp - 0xa10], 0
je 0x4037fe
mov ecx, dword [ebp - 0xa10]
push ecx
lea edx, [ebp - 0xcbcc]
push edx
call fcn.0040866b
add esp, 8
mov eax, dword [ebp - 0xa10]
push eax
call fcn.004086ae
add esp, 4
mov dword [ebp - 0x9a70], 0x3c
lea ecx, [ebp - 0xc3e8]
mov dword [ebp - 0x9a60], ecx
mov dword [ebp - 0x9a6c], 0x40
mov dword [ebp - 0x9a68], 0
mov dword [ebp - 0x9a64], 0x410130
mov dword [ebp - 0x9a5c], 0xf0f7e4
mov dword [ebp - 0x9a58], 0
mov dword [ebp - 0x9a54], 0
mov dword [ebp - 0x9a50], 0x1d
lea edx, [ebp - 0x9a70]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x9a38], 0
je 0x4038a3
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x9a38]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x9a38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00403dfa
mov dword [ebp - 0x2880], 0
push 0x410138
lea edx, [ebp - 0x3e0ec]
push edx
call fcn.004088c5
add esp, 8
mov dword [ebp - 0x1f10], eax
cmp dword [ebp - 0x1f10], 0
je 0x40392a
push 2
push 0
mov eax, dword [ebp - 0x1f10]
push eax
call fcn.00408819
add esp, 0xc
mov ecx, dword [ebp - 0x1f10]
push ecx
call fcn.00408513
add esp, 4
mov dword [ebp - 0x20], eax
push 0
push 1
mov edx, dword [ebp - 0x1f10]
push edx
call fcn.00408819
add esp, 0xc
mov eax, dword [ebp - 0x1f10]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 3
push ecx
lea edx, [ebp - 0x16e4]
push edx
call fcn.004084bc
add esp, 0xc
mov eax, dword [ebp - 0x1f10]
push eax
call fcn.004086ae
add esp, 4
lea ecx, [ebp - 0x16e4]
push ecx
lea edx, [ebp - 0xe00]
push edx
call fcn.00408970
add esp, 8
push str.__C
lea eax, [ebp - 0x904]
push eax
call fcn.00408970
add esp, 8
push 0xf0b224
lea ecx, [ebp - 0x904]
push ecx
call fcn.00408980
add esp, 8
push 0x20
call fcn.00407578
add esp, 4
push eax
lea edx, [ebp - 0x904]
push edx
call fcn.00408980
add esp, 8
push 0xf08b14
lea eax, [ebp - 0x904]
push eax
call fcn.00408980
add esp, 8
push 0x410144
lea ecx, [ebp - 0xab1c]
push ecx
call fcn.004088c5
add esp, 8
mov dword [ebp - 0x1708], eax
cmp dword [ebp - 0x1708], 0
je 0x403cf2
push 0
push 0
mov edx, dword [ebp - 0x1708]
push edx
call fcn.00408819
add esp, 0xc
mov eax, dword [ebp - 0x1708]
mov ecx, dword [eax + 4]
sub ecx, 1
mov edx, dword [ebp - 0x1708]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1708]
cmp dword [eax + 4], 0
jl 0x403a2b
mov ecx, dword [ebp - 0x1708]
mov edx, dword [ecx]
movsx eax, byte [edx]
and eax, 0xff
mov dword [ebp - 0x3ea2c], eax
mov ecx, dword [ebp - 0x1708]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 0x1708]
mov dword [eax], edx
jmp 0x403a40
mov ecx, dword [ebp - 0x1708]
push ecx
call fcn.004083e3
add esp, 4
mov dword [ebp - 0x3ea2c], eax
mov edx, dword [ebp - 0x3ea2c]
mov dword [ebp - 0x908], edx
cmp dword [ebp - 0x908], 0x31
jne 0x403ba3
cmp dword [0xf0f314], 0
jne 0x403afe
mov dword [ebp - 0x3090], 0x3c
lea eax, [ebp - 0xe00]
mov dword [ebp - 0x3080], eax
mov dword [ebp - 0x308c], 0x40
mov dword [ebp - 0x3088], 0
mov dword [ebp - 0x3084], 0x410148
lea ecx, [ebp - 0x904]
mov dword [ebp - 0x307c], ecx
mov dword [ebp - 0x3078], 0
mov dword [ebp - 0x3074], 0
mov dword [ebp - 0x3070], 0x1d
lea edx, [ebp - 0x3090]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x3058], 0
je 0x403afe
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x3058]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x3058]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0xf0f314], 6
jne 0x403ba3
mov dword [ebp - 0x3090], 0x3c
lea edx, [ebp - 0xe00]
mov dword [ebp - 0x3080], edx
mov dword [ebp - 0x308c], 0x40
mov dword [ebp - 0x3088], 0
mov dword [ebp - 0x3084], 0x410150
lea eax, [ebp - 0x904]
mov dword [ebp - 0x307c], eax
mov dword [ebp - 0x3078], 0
mov dword [ebp - 0x3074], 1
mov dword [ebp - 0x3070], 0x1d
lea ecx, [ebp - 0x3090]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x3058], 0
je 0x403ba3
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x3058]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x3058]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x908], 0x30
jne 0x403cf2
cmp dword [0xf0f314], 0
jne 0x403c51
mov dword [ebp - 0x3090], 0x3c
mov dword [ebp - 0x3080], 0xf0b224
mov dword [ebp - 0x308c], 0x40
mov dword [ebp - 0x3088], 0
mov dword [ebp - 0x3084], 0x410158
mov dword [ebp - 0x307c], 0xf08b14
mov dword [ebp - 0x3078], 0
mov dword [ebp - 0x3074], 0
mov dword [ebp - 0x3070], 0x1d
lea ecx, [ebp - 0x3090]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x3058], 0
je 0x403c51
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x3058]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x3058]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0xf0f314], 6
jne 0x403cf2
mov dword [ebp - 0x3090], 0x3c
mov dword [ebp - 0x3080], 0xf0b224
mov dword [ebp - 0x308c], 0x40
mov dword [ebp - 0x3088], 0
mov dword [ebp - 0x3084], str.open
mov dword [ebp - 0x307c], 0xf08b14
mov dword [ebp - 0x3078], 0
mov dword [ebp - 0x3074], 1
mov dword [ebp - 0x3070], 0x1d
lea ecx, [ebp - 0x3090]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x3058], 0
je 0x403cf2
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x3058]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x3058]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1708]
push ecx
call fcn.004086ae
add esp, 4
cmp dword [0xf08b0c], 1
jne 0x403d52
mov dword [ebp - 0xab24], 0
jmp 0x403d25
mov edx, dword [ebp - 0xab24]
add edx, 1
mov dword [ebp - 0xab24], edx
mov eax, dword [0xf08b10]
sub eax, 2
cmp dword [ebp - 0xab24], eax
jge 0x403d52
mov ecx, dword [ebp - 0xab24]
imul ecx, ecx, 0x3e8
add ecx, 0x410e14
push ecx
call fcn.004083b9
add esp, 4
jmp 0x403d16
mov edx, dword [0xf08b10]
sub edx, 2
mov dword [ebp - 0xab24], edx
jmp 0x403d72
mov eax, dword [ebp - 0xab24]
add eax, 1
mov dword [ebp - 0xab24], eax
mov ecx, dword [ebp - 0xab24]
cmp ecx, dword [0xf08b10]
jge 0x403d9d
mov edx, dword [ebp - 0xab24]
imul edx, edx, 0x3e8
add edx, 0x410e14
push edx
call fcn.004083b9
add esp, 4
jmp 0x403d63
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret