Function at 0x4055bd
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], 0xa48bbca6
inc edi
mov dword [ebp - 0x54], ecx
mov esi, edx
mov dword [ebp - 0x2c], edi
xor edx, edx
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x28], esi
mov dword [ebp - 0xc], edx
jmp 0x4055fc
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa4], 0xe62699ff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x4055eb
mov dword [ebp - 0x10], 0xfffffff3
cmp dword [ebp - 0x10], 6
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetMessageTime]
jl 0x405731
mov esi, 0xffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], edx
jmp 0x405639
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x6c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x40562b
mov dword [ebp - 4], edx
jmp 0x405652
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], 0x3ed2
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x405644
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x405664
call ebx
xor edx, edx
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x64]
jl 0x4056e0
mov dword [ebp - 0x18], 0x412894f
xor edx, edx
mov dword [ebp - 0x14], 0x814b11f3
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp esi, edx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
sub eax, edx
imul eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x10]
add eax, 0x11b300eb
je 0x4056b3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x40], 0xfffc
jbe 0x4056cf
cmp dword [ebp - 0x2c], 0
jne 0x4056cf
xor edx, edx
jmp 0x4056d1
mov edx, edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x6c], ecx
jmp 0x40571e
mov dword [ebp - 4], 0xfffffff8
mov dword [ebp - 0xc], edi
dec dword [ebp - 0xa0]
mov dword [ebp - 4], edx
jmp 0x405718
mov dword [ebp - 0xc], edx
jmp 0x40570f
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x40570c
push edx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x4056fa
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xe
jle 0x4056f5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
push 0
pop edx
jge 0x40561f
mov esi, dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x405746
push 0x68
call edi
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x2c], 0x68dd2ac3
mov dword [ebp - 0xc], edx
jmp 0x405771
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe4], 0xffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x405760
mov dword [ebp - 4], edx
jmp 0x4057b7
mov dword [ebp - 0xc], edx
jmp 0x405792
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xcc], 0x7ca0029b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x405781
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x4057ac
push edx
push edx
push edx
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor edx, edx
cmp dword [ebp - 0xc8], edx
jne 0x4057bd
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffa
jg 0x40577c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edx
jne 0x405810
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jge 0x4057e2
cmp dword [ebp - 0x10], edx
jne 0x4057e2
xor ecx, ecx
mov eax, edx
inc ecx
jmp 0x4057e7
xor ecx, ecx
inc ecx
mov eax, ecx
cmp ecx, eax
mov eax, dword [ebp - 4]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x6e3e
setg al
xor ecx, ecx
inc ecx
xor edx, edx
cmp eax, ecx
jae 0x405813
mov eax, dword [ebp - 4]
jmp 0x405813
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], 0xa48bbca6
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x24], 0xbb6748f6
mov dword [ebp - 0x24], 0x814b733c
mov dword [ebp - 0x24], 0x46b6eb6
mov dword [ebp - 0x18], 0xb49d
mov dword [ebp - 0x24], edx
mov dword [ebp - 0xc], edx
jmp 0x405874
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x84], 0xfffffffc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x405863
dec dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x10], 0xc29000d4
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], edx
jmp 0x4058b3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], 0x13b91020
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4058a2
mov dword [ebp - 4], edx
jmp 0x4058cf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x114], 0x4dbf0cf
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4058be
mov dword [ebp - 0x10], edx
jmp 0x405969
mov dword [ebp - 0x14], 0x62751c76
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x20], 0x65cd3860
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], 0x91b0
mov dword [ebp - 0xc], edx
jmp 0x405911
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x108], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x405904
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edx
jl 0x405966
mov dword [ebp - 0x20], 0xab59
mov dword [ebp - 0x20], 0x2a82a10a
mov dword [ebp - 0xc], edx
jmp 0x405943
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xec], 0x4c38b6b0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x405932
inc dword [ebp - 0x18]
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x40595e
push edx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor edx, edx
dec dword [ebp - 0x14]
jns 0x40591f
xor ecx, ecx
inc ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x4058dd
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x2c], 0xab274bf9
mov dword [ebp - 0x20], 0x86bd085
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 0x1a35
mov dword [ebp - 0x18], 0x2a26f3f1
mov dword [ebp - 0x18], 0x41637c1d
mov dword [ebp - 0x18], 0xd70512a3
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], edx
jmp 0x4059c3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x78], 0xbc0d133f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4059b5
mov dword [ebp - 0x10], 0x14
jmp 0x405a2e
mov dword [ebp - 0x1c], 0x3250e6da
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], 0x50315362
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0x32a17d0b
mov dword [ebp - 0x1c], 0xba13b288
mov dword [ebp - 4], edx
jmp 0x405a06
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd4], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4059f9
mov dword [ebp - 4], edx
jmp 0x405a22
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x124], 0xc4a87fce
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x405a11
dec dword [ebp - 0x18]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jg 0x4059d2
mov dword [ebp - 0x10], 0xfffffff3
jmp 0x405aac
mov dword [ebp - 0x18], 0x426ae69e
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xfffffff7
cmp dword [ebp - 0x2c], edx
jne 0x405ab2
cmp dword [ebp - 0x18], edx
jne 0x405a7a
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
mov dword [ebp - 0x1c], edx
xor edx, edx
cmp dword [ebp - 0x1c], edx
jne 0x405a77
mov eax, edx
jmp 0x405a7c
xor ecx, ecx
inc ecx
mov eax, ecx
add eax, 0xffff03ad
xor ecx, ecx
imul eax, eax, 5
push 0
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x74]
setl dl
xor ecx, ecx
cmp edx, eax
pop edx
setge cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x10]
push 1
pop ecx
cmp dword [ebp - 0x10], 0xffffffe6
je 0x405a3d
mov dword [ebp - 0xc], edx
jmp 0x405ac8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x94], 0xe62699ff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x405ab7
mov dword [ebp - 0xc], 0xfffffff3
cmp dword [ebp - 0xc], 6
jl 0x405fda
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], 0xa4c8
mov dword [ebp - 0x10], 0xfffffffa
cmp dword [ebp - 0x10], 0x12
jl 0x405c7a
mov ebx, 0xffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 0x1e1c5a3d
mov dword [ebp - 0x14], edx
jmp 0x405b22
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x80], 0x1188
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x405b14
cmp dword [ebp - 0x10], edx
jne 0x405b32
cmp dword [ebp - 0x80], edx
je 0x405b34
mov edx, ecx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, 0x891c
setl cl
add ecx, edx
je 0x405b5c
mov dword [ebp - 0x20], 0x32cf415d
xor edx, edx
cmp dword [ebp - 0x20], edx
jne 0x405c71
jmp 0x405c61
mov dword [ebp - 0x18], 0xfffffff6
xor edx, edx
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x14], edx
jmp 0x405b7e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x405b71
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, 0x23a266d2
setl cl
imul eax, ecx, 0xb96
test eax, eax
je 0x405be0
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 4], 0xfffffff7
jmp 0x405bd8
inc dword [ebp - 0x18]
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x405bd5
push 0x1e3d
push edx
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jg 0x405bb5
jmp 0x405bf4
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x405bf4
push 0x1c8d
push edx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add ecx, 0xac1e
cmp ecx, eax
setl dl
xor eax, eax
add edx, 0xd2e9
cmp edx, 0x72d5
setl al
xor edx, edx
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
xor ecx, ecx
cmp edx, 0x7d04
setl cl
xor eax, eax
cmp ecx, 0xfffffffd
setge al
xor edx, edx
imul eax, eax, 0x1c8
test eax, eax
je 0x405c59
cmp dword [ebp - 0x1c], edx
je 0x405c59
xor ecx, ecx
lea eax, [ecx + 1]
jmp 0x405c5b
mov eax, edx
mov dword [ebp - 0xfc], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x12
push 1
pop ecx
jge 0x405b05
mov ebx, dword [sym.imp.USER32.dll_GetMessageTime]
xor ecx, ecx
inc ecx
mov dword [ebp - 4], 0xe0648261
mov dword [ebp - 0x18], 0x87a5eafb
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xfefb659b
mov dword [ebp - 0x14], edx
jmp 0x405ca9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0x5e04a276
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x405c9b
mov dword [ebp - 4], 0xffffffeb
cmp dword [ebp - 4], 0xfffffff2
jle 0x405df2
xor edi, edi
inc edi
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], 0x99da9727
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
xor eax, eax
cmp ecx, 0xa14c
setg al
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x20]
sets cl
add eax, 4
add eax, ecx
je 0x405cfe
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, 4
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
xor edx, edx
cmp ecx, dword [ebp - 0x10]
jge 0x405d3f
mov eax, edi
cmp dword [ebp - 0x14], edx
jne 0x405d41
mov eax, edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jne 0x405d50
mov ecx, edx
cmp dword [ebp - 0x10], edx
je 0x405d52
mov ecx, edi
or eax, 0xffffffff
mov dword [ebp - 0x30], ecx
sub eax, ecx
mov dword [ebp - 0x14], eax
je 0x405d66
mov eax, edi
cmp dword [ebp - 0x30], edx
jne 0x405d68
mov eax, edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x30], edx
je 0x405dae
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x405de5
push edx
push 0xd2d
push 0x2052
push 0x167b
push 0x21e2
push 0x1e8a
push 0xf5e
push 0xac9
push 0x1cde
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor edx, edx
jmp 0x405de5
mov dword [ebp - 0x10], edx
jmp 0x405ddf
mov dword [ebp - 0x14], edx
jmp 0x405dc5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x405db8
mov eax, dword [ebp - 0xb4]
xor ecx, ecx
cmp eax, 0xffffffff
setl cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jle 0x405db3
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff2
jg 0x405cc2
mov dword [ebp - 4], 0x13
jmp 0x405e19
cmp dword [ebp - 0x1c], edx
jne 0x405e1f
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x405e16
push edx
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x13
jl 0x405dfb
mov dword [ebp - 0x18], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x20], 0xfffffff6
inc ecx
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 2
jge 0x405e45
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], ecx
inc dword [ebp - 4]
jmp 0x405e33
mov dword [ebp - 4], edx
jmp 0x405e58
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0x3c633843
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x405e4a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x405e7b
cmp dword [ebp - 0x3c], edx
je 0x405e6f
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x14], 0x10
jmp 0x405e9b
mov dword [ebp - 0x1c], 0xcad
inc dword [ebp - 0x1c]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jge 0x405e8e
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x405eb7
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 4], edx
jmp 0x405eca
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x50], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x405ebc
mov dword [ebp - 4], edx
jmp 0x405ee3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], 0x3ed2
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x405ed5
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x405ef8
call ebx
xor ecx, ecx
xor edx, edx
inc ecx
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x48]
jl 0x405f7c
mov dword [ebp - 0x14], 0x412894f
xor edx, edx
mov dword [ebp - 0x1c], 0x814b11f3
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, 0xffff
setg dl
imul edx, dword [ebp - 0xc]
cmp eax, edx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne dl
sub eax, edx
imul eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
add eax, 0x11b300eb
je 0x405f4c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x44], 0xfffc
jbe 0x405f68
cmp dword [ebp - 0x24], 0
jne 0x405f68
xor edx, edx
jmp 0x405f6d
xor ecx, ecx
lea edx, [ecx + 1]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x50], ecx
jmp 0x405fbe
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0x90]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xe
jg 0x405fc1
mov dword [ebp - 0x14], edx
jmp 0x405faf
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x405fac
push edx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor edx, edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x405f9a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
jle 0x405f95
xor ecx, ecx
inc ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 6
push 0
pop edx
jge 0x405ae5
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x24], 0xbb6748f6
mov dword [ebp - 0x24], 0x814b733c
mov dword [ebp - 0x24], 0x46b6eb6
mov dword [ebp - 0x28], 0xb49d
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], edx
pop ebx
jmp 0x40601a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x40600c
dec dword [ebp - 0x28]
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x406034
push 0x68
call edi
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x28], 0xfff8
mov dword [ebp - 0x18], 0x9827
mov dword [ebp - 0x28], 0x4dbf0cf
mov dword [ebp - 0x24], 0x335c22c9
mov dword [ebp - 4], edx
jmp 0x406063
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x60], 0xe8f21009
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x406055
mov dword [ebp - 4], edx
jmp 0x40607b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x5c], 0xfffffff9
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x40606d
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
jne 0x406094
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x60]
inc ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x58]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 0xd04c
setge al
xor ecx, ecx
cmp ecx, eax
mov ecx, 0x3e8
sbb eax, eax
neg eax
mov dword [ebp - 0x58], eax
mov eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x54]
mov esi, edx
mov edi, eax
call fcn.004053ab
add eax, esi
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret