Function at 0x405304
Capabilities:
Create directory
Get hostname
Get session user name
Move file
Receive data
Receive data on socket
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x414
push 0
push 0
dec ecx
jne 0x40530c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4062f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x409874]
test eax, eax
jne 0x40534b
cmp ebx, 8
jne 0x405360
push 0
push 0
mov eax, dword [0x40970c]
push eax
call sub.wsock32.dll_accept
mov dword [0x409708], eax
jmp 0x405360
dec eax
jne 0x405360
cmp ebx, 8
jne 0x405360
push 1
mov eax, dword [0x409700]
push eax
call sub.user32.dll_KillTimer
cmp ebx, 0x20
jne 0x405399
mov eax, dword [0x409874]
test eax, eax
jne 0x405377
mov byte [0x409954], 0
jmp 0x405399
dec eax
jne 0x405399
mov byte [0x409955], 0
push fcn.00405024
mov eax, dword [0x4098b4]
push eax
push 1
mov eax, dword [0x409700]
push eax
call sub.user32.dll_SetTimer
dec ebx
jne 0x4062c6
lea eax, [ebp - 0x101c]
xor ecx, ecx
mov edx, 0x1000
call fcn.00401948
cmp dword [0x409874], 0
jne 0x4053d8
push 0
push 0x1000
lea eax, [ebp - 0x101c]
push eax
mov eax, dword [0x409708]
push eax
call sub.wsock32.dll_recv
mov esi, eax
jmp 0x4053f3
push 0
push 0x1000
lea eax, [ebp - 0x101c]
push eax
mov eax, dword [0x409704]
push eax
call sub.wsock32.dll_recv
mov esi, eax
lea eax, [ebp - 4]
lea edx, [ebp - 0x101c]
mov ecx, 0x1000
call fcn.00402320
lea eax, [ebp - 0x10]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004025b0
lea eax, [ebp - 8]
mov edx, 0x4098ee
call fcn.00402314
cmp dword [0x409874], 0
jne 0x4054c4
mov eax, dword [ebp - 0x10]
mov edx, 0x406308
call fcn.004024a0
jne 0x4054b7
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040235c
mov ecx, eax
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004024a0
je 0x405476
cmp dword [ebp - 8], 0
jne 0x405494
mov byte [0x409954], 1
lea eax, [ebp - 4]
mov edx, 0x406314
call fcn.00402250
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4054b7
mov byte [0x409954], 1
lea eax, [ebp - 4]
mov edx, 0x406334
call fcn.00402250
mov eax, dword [ebp - 4]
call fcn.00404268
mov byte [0x409954], 0
cmp byte [0x409954], 0
je 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406350
call fcn.004024a0
jne 0x4055ec
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.004025f0
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004025b0
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.004025f0
push 0x409714
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004025b0
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.004025f0
mov eax, dword [ebp - 0x18]
call fcn.004030f8
mov dword [0x409710], eax
mov eax, dword [0x4080c8]
mov byte [eax], 2
mov edx, dword [0x409714]
mov eax, 0x40971c
call fcn.004016b4
mov edx, 1
mov eax, 0x40971c
call fcn.00401a8c
call fcn.0040120c
mov edx, 1
mov eax, 0x40971c
call fcn.00401a70
call fcn.0040120c
mov eax, 0x40971c
call fcn.0040184c
call fcn.0040120c
mov eax, dword [0x4080c8]
mov byte [eax], 0
lea eax, [ebp - 4]
mov edx, 0x406368
call fcn.00402250
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406378
call fcn.004024a0
jne 0x4056ff
mov eax, dword [0x4080c8]
mov byte [eax], 2
mov edx, dword [0x409714]
mov eax, 0x40971c
call fcn.004016b4
mov edx, 1
mov eax, 0x40971c
call fcn.00401a70
call fcn.0040120c
mov eax, 0x40971c
call fcn.004018fc
call fcn.0040120c
mov edx, eax
mov eax, 0x40971c
call fcn.00401a98
call fcn.0040120c
mov edi, esi
sub edi, 3
test edi, edi
jle 0x405669
lea eax, [ebp - 0x1019]
lea ebx, [ebp - 0x201c]
mov dl, byte [eax]
mov byte [ebx], dl
inc ebx
inc eax
dec edi
jne 0x405660
push 0
mov ecx, esi
sub ecx, 3
lea edx, [ebp - 0x201c]
mov eax, 0x40971c
call fcn.0040182c
call fcn.0040120c
mov eax, 0x40971c
call fcn.004018fc
call fcn.0040120c
mov edx, dword [0x409710]
dec edx
cmp eax, edx
jle 0x4056ae
lea eax, [ebp - 4]
mov edx, 0x406384
call fcn.00402250
jmp 0x4056db
mov eax, 0x40971c
call fcn.004018fc
call fcn.0040120c
lea edx, [ebp - 0x2034]
call fcn.0040314c
mov ecx, dword [ebp - 0x2034]
lea eax, [ebp - 4]
mov edx, 0x406390
call fcn.004023a8
mov eax, 0x40971c
call fcn.0040184c
call fcn.0040120c
mov eax, dword [0x4080c8]
mov byte [eax], 0
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x40639c
call fcn.004024a0
jne 0x4057e5
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.004025f0
push 0x409718
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004025b0
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.004025f0
mov eax, dword [0x4080c8]
mov byte [eax], 0
mov edx, dword [0x409718]
mov eax, 0x40971c
call fcn.004016b4
mov edx, 1
mov eax, 0x40971c
call fcn.00401a70
call fcn.0040120c
mov eax, 0x40971c
call fcn.004018fc
call fcn.0040120c
lea edx, [ebp - 4]
call fcn.0040314c
push 0x4063a8
push dword [ebp - 4]
push 0x40635c
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
mov eax, 0x40971c
call fcn.0040184c
call fcn.0040120c
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406390
call fcn.004024a0
jne 0x40591f
lea eax, [ebp - 0x2038]
push eax
mov ecx, esi
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
mov eax, dword [ebp - 0x2038]
call fcn.004030f8
mov ebx, eax
mov eax, dword [0x4080c8]
mov byte [eax], 0
mov edx, dword [0x409718]
mov eax, 0x40971c
call fcn.004016b4
mov edx, 1
mov eax, 0x40971c
call fcn.00401a70
call fcn.0040120c
mov edx, ebx
mov eax, 0x40971c
call fcn.00401a98
call fcn.0040120c
mov eax, 0x40971c
call fcn.004018fc
call fcn.0040120c
test eax, eax
jns 0x405873
add eax, 0x3ff
sar eax, 0xa
shl eax, 0xa
cmp ebx, eax
jne 0x4058a0
mov eax, 0x40971c
call fcn.004018fc
call fcn.0040120c
mov ebx, eax
and ebx, 0x800003ff
jns 0x4058a5
dec ebx
or ebx, 0xfffffc00
inc ebx
jmp 0x4058a5
mov ebx, 0x400
push 0
lea edx, [ebp - 0x201c]
mov ecx, ebx
mov eax, 0x40971c
call fcn.0040180c
call fcn.0040120c
mov eax, 0x40971c
call fcn.0040184c
call fcn.0040120c
lea eax, [ebp - 4]
call fcn.004021b8
mov edi, ebx
dec edi
test edi, edi
jl 0x405902
inc edi
lea ebx, [ebp - 0x201c]
lea eax, [ebp - 0x203c]
mov dl, byte [ebx]
call fcn.004022d4
mov edx, dword [ebp - 0x203c]
lea eax, [ebp - 4]
call fcn.00402364
inc ebx
dec edi
jne 0x4058e3
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x406378
call fcn.004023a8
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x4063b8
call fcn.004024a0
jne 0x40596d
mov eax, 0x409718
call fcn.004021b8
mov eax, 0x409714
call fcn.004021b8
xor eax, eax
mov dword [0x409710], eax
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 4]
mov edx, 0x4063c4
call fcn.00402250
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x4063e4
call fcn.004024a0
jne 0x4059a7
lea eax, [ebp - 0x2040]
call fcn.00403c9c
mov ecx, dword [ebp - 0x2040]
lea eax, [ebp - 4]
mov edx, 0x4063f0
call fcn.004023a8
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406400
call fcn.004024a0
jne 0x405a49
lea eax, [ebp - 0x2044]
push eax
mov eax, dword [ebp - 4]
call fcn.0040235c
mov ecx, eax
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
mov eax, dword [ebp - 0x2044]
call fcn.00403e3c
lea eax, [ebp - 0x2048]
call fcn.00403a0c
mov edx, dword [ebp - 0x2048]
mov eax, 0x409718
mov ecx, 0x40640c
call fcn.004023a8
push 0x406424
mov eax, dword [0x409718]
call fcn.00403dc0
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x204c]
call fcn.004031b8
push dword [ebp - 0x204c]
push 0x40635c
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406434
call fcn.004024a0
jne 0x405b2a
lea eax, [ebp - 4]
mov edx, 0x406440
call fcn.00402250
push dword [ebp - 4]
lea ecx, [ebp - 0x2050]
mov edx, 0x10
xor eax, eax
call fcn.00404064
push dword [ebp - 0x2050]
push 0x406450
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
push dword [ebp - 4]
lea ecx, [ebp - 0x2054]
mov edx, 6
xor eax, eax
call fcn.00404064
push dword [ebp - 0x2054]
push 0x406450
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
push dword [ebp - 4]
lea ecx, [ebp - 0x2058]
mov edx, 5
xor eax, eax
call fcn.00404064
push dword [ebp - 0x2058]
push 0x406450
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
push dword [ebp - 4]
lea ecx, [ebp - 0x205c]
mov edx, 2
xor eax, eax
call fcn.00404064
push dword [ebp - 0x205c]
push 0x406450
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x40645c
call fcn.004024a0
jne 0x405b87
push 0
lea eax, [ebp - 0x2060]
push eax
mov eax, dword [ebp - 4]
call fcn.0040235c
mov ecx, eax
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
mov eax, dword [ebp - 0x2060]
call fcn.00402554
push eax
call sub.kernel32.dll_CreateDirectoryA
lea eax, [ebp - 4]
mov edx, 0x406468
call fcn.00402250
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406484
call fcn.004024a0
jne 0x405bc7
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.0040235c
mov ecx, eax
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
lea edx, [ebp - 0x2064]
mov eax, dword [ebp - 4]
call fcn.004042f0
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406490
call fcn.004024a0
jne 0x405c07
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.0040235c
mov ecx, eax
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
lea edx, [ebp - 0x2068]
mov eax, dword [ebp - 4]
call fcn.004043d0
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x40649c
call fcn.004024a0
jne 0x405cb3
lea eax, [ebp - 0x206c]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0040235c
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.004025b0
mov eax, dword [ebp - 0x206c]
call fcn.00402554
push eax
lea eax, [ebp - 0x2070]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
sub ecx, 4
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
mov eax, dword [ebp - 0x2070]
call fcn.00402554
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x405c99
lea eax, [ebp - 4]
mov edx, 0x4064a8
call fcn.00402250
jmp 0x405ca6
lea eax, [ebp - 4]
mov edx, 0x4064c4
call fcn.00402250
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x4064e8
call fcn.004024a0
jne 0x405ced
lea eax, [ebp - 0x2074]
call fcn.00403a0c
mov ecx, dword [ebp - 0x2074]
lea eax, [ebp - 4]
mov edx, 0x4064e8
call fcn.004023a8
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x4064f4
call fcn.004024a0
jne 0x405d27
lea eax, [ebp - 0x2078]
call fcn.004036bc
mov ecx, dword [ebp - 0x2078]
lea eax, [ebp - 4]
mov edx, 0x4064e8
call fcn.004023a8
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406500
call fcn.004024a0
jne 0x405d55
lea eax, [ebp - 4]
mov edx, 0x40650c
call fcn.00402250
mov eax, dword [ebp - 4]
call fcn.00404268
call fcn.00404778
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406530
call fcn.004024a0
jne 0x405e38
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
mov ecx, eax
sub ecx, 4
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x40635c
call fcn.00402638
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0040235c
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.004025b0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x41
jne 0x405dbe
add ebx, 0x20
mov eax, dword [ebp - 0x14]
cmp byte [eax + 1], 0x48
jne 0x405dca
add ebx, 2
mov eax, dword [ebp - 0x14]
cmp byte [eax + 2], 0x52
jne 0x405dd4
inc ebx
mov eax, dword [ebp - 0x14]
cmp byte [eax + 3], 0x53
jne 0x405de0
add ebx, 4
xor eax, eax
push ebp
push 0x405e14
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 0x18]
call fcn.00402554
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 4]
mov edx, 0x40653c
call fcn.00402250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405e2b
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x406594
call fcn.004024a0
jne 0x406273
lea eax, [ebp - 4]
mov edx, 0x4065a0
call fcn.00402250
lea eax, [ebp - 0x202d]
xor ecx, ecx
mov edx, 0x11
call fcn.00401948
mov dword [ebp - 0x1c], 0x400
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x202d]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x202d]
mov ecx, 0x11
call fcn.00402320
push dword [ebp - 4]
push 0x4065b0
push dword [ebp - 0x18]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
lea eax, [ebp - 0x202d]
xor ecx, ecx
mov edx, 0x11
call fcn.00401948
mov dword [ebp - 0x1c], 0x400
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x202d]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x202d]
mov ecx, 0x11
call fcn.00402320
push dword [ebp - 4]
push 0x4065c8
push dword [ebp - 0x18]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
push dword [ebp - 4]
push 0x4065dc
lea eax, [ebp - 0x207c]
call fcn.0040414c
push dword [ebp - 0x207c]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4065f8
mov edx, 0x406614
mov eax, 0x80000002
call fcn.004050b4
push dword [ebp - 4]
push 0x40664c
push dword [ebp - 0x18]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
lea eax, [ebp - 4]
mov edx, 0x406450
call fcn.00402364
cmp dword [0x409874], 0
jne 0x40605c
push dword [ebp - 4]
push 0x406660
push 0x406450
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
push dword [ebp - 4]
push 0x406680
lea edx, [ebp - 0x2080]
mov eax, dword [0x4098b8]
call fcn.0040314c
push dword [ebp - 0x2080]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
push dword [ebp - 4]
push 0x406690
lea eax, [ebp - 0x2084]
mov edx, 0x4098ee
call fcn.00402314
push dword [ebp - 0x2084]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
cmp dword [0x409900], 1
jne 0x406106
push dword [ebp - 4]
push 0x4066a4
push 0x406450
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
push dword [ebp - 4]
push 0x4066c0
lea eax, [ebp - 0x2088]
mov edx, 0x409904
call fcn.00402314
push dword [ebp - 0x2088]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
jmp 0x406106
push dword [ebp - 4]
push 0x4066d4
push 0x406450
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040241c
push dword [ebp - 4]
push 0x4066f8
lea eax, [ebp - 0x208c]
mov edx, 0x40987c
call fcn.00402314
push dword [ebp - 0x208c]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
push dword [ebp - 4]
push 0x406680
lea edx, [ebp - 0x2090]
mov eax, dword [0x4098b0]
call fcn.0040314c
push dword [ebp - 0x2090]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
push dword [ebp - 4]
push 0x406708
lea edx, [ebp - 0x2094]
mov eax, dword [0x4098b4]
call fcn.0040314c
push dword [ebp - 0x2094]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
lea eax, [ebp - 4]
mov edx, 0x406450
call fcn.00402364
cmp dword [0x4098bc], 1
jne 0x406269
push dword [ebp - 4]
push 0x40671c
lea eax, [ebp - 0x2098]
mov edx, 0x4098c4
call fcn.00402314
push dword [ebp - 0x2098]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
cmp dword [0x4098c0], 0
jne 0x406163
lea eax, [ebp - 0x18]
call fcn.004036bc
jmp 0x40616b
lea eax, [ebp - 0x18]
call fcn.00403864
push dword [ebp - 4]
push 0x406730
push dword [ebp - 0x18]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
push dword [ebp - 4]
push 0x40674c
lea eax, [ebp - 0x209c]
mov edx, 0x4098d9
call fcn.00402314
push dword [ebp - 0x209c]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
cmp dword [0x409878], 0
jne 0x4061d0
lea eax, [ebp - 0x18]
mov edx, 0x406768
call fcn.00402250
jmp 0x4061dd
lea eax, [ebp - 0x18]
mov edx, 0x40677c
call fcn.00402250
push dword [ebp - 4]
push 0x40678c
push dword [ebp - 0x18]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
cmp dword [0x409950], 0
jne 0x406212
lea eax, [ebp - 0x18]
mov edx, 0x406768
call fcn.00402250
jmp 0x40621f
lea eax, [ebp - 0x18]
mov edx, 0x40677c
call fcn.00402250
push dword [ebp - 4]
push 0x4067b4
push dword [ebp - 0x18]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
push dword [ebp - 4]
push 0x4067c4
lea edx, [ebp - 0x20a0]
xor eax, eax
call fcn.00401394
push dword [ebp - 0x20a0]
push 0x406450
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040241c
mov eax, dword [ebp - 4]
call fcn.00404268
jmp 0x4062c6
mov eax, dword [ebp - 0x10]
mov edx, 0x4067dc
call fcn.004024a0
jne 0x4062c6
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.0040235c
mov ecx, eax
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.004025b0
lea edx, [ebp - 0x20a4]
mov eax, dword [ebp - 4]
call fcn.0040521c
mov ecx, dword [ebp - 0x20a4]
lea eax, [ebp - 4]
mov edx, 0x4067dc
call fcn.004023a8
mov eax, dword [ebp - 4]
call fcn.00404268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4062f8
lea eax, [ebp - 0x20a4]
mov edx, 0x1d
call fcn.004021dc
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004021dc
ret