Function at 0x407c04
Capabilities:
Create process on windows
Query environment variable
Resume thread
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x110ec
call fcn.0041fb40
mov eax, dword [0x423014]
xor eax, esp
mov dword [esp + 0x110e8], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [esp + 0x3c], eax
push esi
push edi
push 0x407184
mov byte [esp + 0x15], bl
mov dword [esp + 0x20], ebx
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov dword [esp + 0x64], ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x4070b4
call fcn.0041efdc
mov dword [esp + 0x58], eax
pop ecx
test eax, eax
jne 0x407eab
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
push ebx
push 0x406d50
call esi
cmp eax, 1
jbe 0x407cb6
push ebx
push ebx
push 0x406d30
call esi
cmp eax, 1
jbe 0x407cb6
mov byte [esp + 0x1b], 1
mov edi, dword [ebp + 8]
xor ebx, ebx
push 2
inc ebx
pop esi
xor ecx, ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x5c], ecx
mov al, cl
cmp ebx, edi
jge 0x407ec0
mov eax, dword [esp + 0x44]
mov edx, dword [eax + ebx*4]
movzx ecx, word [edx]
lea eax, [edx + 2]
cmp ecx, 0x40
jne 0x407cee
mov dword [esp + 0x1c], eax
jmp 0x407e29
cmp ecx, 0x2d
je 0x407e96
movzx eax, word [eax]
cmp eax, 0x55
ja 0x407d90
je 0x407e08
cmp eax, 0x48
ja 0x407d58
je 0x407dbd
sub eax, 0x3f
je 0x407dbd
sub eax, esi
je 0x407dce
sub eax, 1
je 0x407dcb
sub eax, 1
je 0x407e2f
sub eax, 1
je 0x407dcb
sub eax, 1
je 0x407dc4
sub eax, 1
jne 0x407df4
mov byte [esp + 0x17], 1
jmp 0x407e29
sub eax, 0x49
je 0x407dcb
sub eax, esi
je 0x407e24
sub eax, esi
je 0x407e1d
sub eax, esi
je 0x407e16
sub eax, 1
je 0x407e0f
sub eax, esi
je 0x407dcb
sub eax, esi
jne 0x407df4
mov byte [esp + 0x12], 1
jmp 0x407e29
cmp eax, 0x69
ja 0x407dd5
je 0x407dcb
sub eax, 0x61
je 0x407dce
sub eax, 1
je 0x407dcb
sub eax, 1
je 0x407e2f
sub eax, 1
je 0x407dcb
sub eax, 1
je 0x407dc4
sub eax, 1
je 0x407d4e
sub eax, esi
jne 0x407df4
mov byte [esp + 0x11], 1
jmp 0x407e29
mov byte [esp + 0x13], 1
jmp 0x407e29
inc ebx
jmp 0x407e29
mov byte [esp + 0x14], 1
jmp 0x407e29
sub eax, 0x6b
je 0x407e24
sub eax, esi
je 0x407e1d
sub eax, esi
je 0x407e16
sub eax, 1
je 0x407e0f
sub eax, esi
je 0x407dcb
sub eax, esi
je 0x407d86
sub eax, 1
je 0x407e08
push edx
push 0x2710
mov byte [esp + 0x19], 1
call fcn.004079b0
pop ecx
pop ecx
jmp 0x407e29
mov byte [esp + 0x16], 1
jmp 0x407e29
mov byte [esp + 0x15], 1
jmp 0x407e29
mov byte [esp + 0x19], 1
jmp 0x407e29
mov byte [esp + 0x18], 1
jmp 0x407e29
mov byte [esp + 0x1a], 1
inc ebx
jmp 0x407cbf
mov esi, dword [esp + 0x44]
mov al, 1
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + ebx*4 + 4]
add ebx, 2
mov dword [esp + 0x5c], edx
mov dl, byte [esp + 0x12]
mov byte [esp + 0x12], dl
mov dl, byte [esp + 0x13]
mov byte [esp + 0x13], dl
mov dl, byte [esp + 0x15]
mov byte [esp + 0x15], dl
mov dl, byte [esp + 0x14]
mov byte [esp + 0x14], dl
mov dl, byte [esp + 0x16]
mov byte [esp + 0x16], dl
mov dl, byte [esp + 0x17]
mov byte [esp + 0x17], dl
mov dl, byte [esp + 0x18]
mov byte [esp + 0x18], dl
mov dl, byte [esp + 0x19]
mov byte [esp + 0x19], dl
mov dl, byte [esp + 0x1a]
mov byte [esp + 0x1a], dl
mov dword [esp + 0x4c], ebx
jmp 0x407ec4
push edx
push 0x2710
call fcn.004079b0
pop ecx
pop ecx
call fcn.004079e8
xor eax, eax
inc eax
mov ecx, dword [esp + 0x110f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040ad62
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x44]
mov cl, byte [esp + 0x11]
mov dword [esp + 0xc0], ebx
cmp ebx, edi
jg 0x407ea3
test al, al
je 0x407ea3
test cl, cl
jne 0x407ea3
xor eax, eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], esi
test eax, eax
je 0x407f18
push eax
lea ecx, [esp + 0x24]
call fcn.0041f3ba
test eax, eax
jle 0x407f18
lea ecx, [esp + 0x20]
call fcn.0041f347
xor edi, edi
mov esi, edi
cmp dword [esp + 0x30], esi
jbe 0x407f49
mov eax, dword [esp + 0x34]
cmp dword [eax + esi*4], edi
je 0x407f49
push 0x4070cc
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x407ff8
inc esi
cmp esi, dword [esp + 0x30]
jb 0x407f22
mov esi, edi
cmp dword [esp + 0x28], esi
jbe 0x407f8a
mov eax, dword [esp + 0x2c]
push 0x4070cc
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
test eax, eax
mov eax, dword [esp + 0x30]
pop ecx
je 0x407ffc
push 0x40717c
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x407f8a
inc esi
cmp esi, dword [esp + 0x28]
jb 0x407f51
mov dword [esp + 0x48], edi
mov esi, edi
cmp dword [esp + 0x30], esi
jbe 0x407fb9
mov eax, dword [esp + 0x34]
cmp dword [eax + esi*4], edi
je 0x407fb9
push 0x4070d4
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x408006
inc esi
cmp esi, dword [esp + 0x30]
jb 0x407f96
mov esi, edi
cmp dword [esp + 0x28], esi
jbe 0x40800e
mov eax, dword [esp + 0x2c]
push 0x4070d4
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
test eax, eax
mov eax, dword [esp + 0x30]
pop ecx
je 0x40800a
push 0x40717c
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x40800e
inc esi
cmp esi, dword [esp + 0x28]
jb 0x407fc1
jmp 0x40800e
mov eax, dword [esp + 0x34]
mov eax, dword [eax + esi*4 + 4]
mov dword [esp + 0x48], eax
jmp 0x407f8e
mov eax, dword [esp + 0x34]
mov edi, dword [eax + esi*4 + 4]
xor esi, esi
cmp dword [esp + 0x30], esi
jbe 0x40803e
mov eax, dword [esp + 0x34]
cmp dword [eax + esi*4], 0
je 0x40803e
push 0x4070dc
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x408104
inc esi
cmp esi, dword [esp + 0x30]
jb 0x408016
xor esi, esi
cmp dword [esp + 0x28], esi
jbe 0x40807f
mov eax, dword [esp + 0x2c]
push 0x4070dc
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
test eax, eax
mov eax, dword [esp + 0x30]
pop ecx
je 0x408108
push 0x40717c
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x40807f
inc esi
cmp esi, dword [esp + 0x28]
jb 0x408046
and dword [esp + 0x50], 0
xor esi, esi
cmp dword [esp + 0x30], esi
jbe 0x4080b0
mov eax, dword [esp + 0x34]
cmp dword [eax + esi*4], 0
je 0x4080b0
push 0x4070e4
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x408115
inc esi
cmp esi, dword [esp + 0x30]
jb 0x40808c
xor esi, esi
cmp dword [esp + 0x28], esi
jbe 0x4080ed
mov eax, dword [esp + 0x2c]
push 0x4070e4
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
test eax, eax
mov eax, dword [esp + 0x30]
pop ecx
je 0x408119
push 0x40717c
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x4080ed
inc esi
cmp esi, dword [esp + 0x28]
jb 0x4080b8
xor esi, esi
cmp dword [esp + 0x48], 0
jne 0x40811f
test edi, edi
jne 0x408123
mov dword [esp + 0x48], 0x4070b0
jmp 0x40814b
mov eax, dword [esp + 0x34]
mov eax, dword [eax + esi*4 + 4]
mov dword [esp + 0x50], eax
jmp 0x408084
mov eax, dword [esp + 0x34]
mov esi, dword [eax + esi*4 + 4]
jmp 0x4080ef
test edi, edi
je 0x40814b
push edi
call fcn.0041e7b5
mov edi, eax
mov dword [esp + 0x60], edi
mov eax, dword [edi]
mov dword [esp + 0x48], eax
cmp dword [eax - 4], 1
jle 0x40814b
push dword [eax - 0xc]
mov ecx, edi
call fcn.0040916e
mov eax, dword [edi]
mov dword [esp + 0x48], eax
xor eax, eax
mov dword [esp + 0x40], eax
test esi, esi
je 0x4081cc
push esi
push eax
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ebx, eax
mov dword [esp + 0x40], ebx
test ebx, ebx
jne 0x4081c6
mov edx, esi
mov ecx, 0x2716
call fcn.00407b4c
cmp dword [esp + 0x20], ebx
je 0x40818e
push dword [esp + 0x20]
call fcn.00410ef9
pop ecx
mov dword [esp + 0x20], ebx
jmp 0x408190
xor ebx, ebx
cmp dword [esp + 0x24], 0
je 0x4081a5
push dword [esp + 0x24]
call fcn.00410ef9
pop ecx
mov dword [esp + 0x24], ebx
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x4081be
mov ecx, esi
call fcn.00408f9b
push 0x20
push esi
call fcn.0040ad73
pop ecx
pop ecx
push 0xa
pop eax
jmp 0x407eab
mov ebx, dword [esp + 0x4c]
xor eax, eax
push 0x208
push eax
lea eax, [esp + 0xd0]
push eax
call fcn.0040bb10
add esp, 0xc
xor eax, eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x58], eax
push 0x44
pop esi
push esi
push eax
lea eax, [esp + 0x80]
push eax
call fcn.0040bb10
xor eax, eax
mov dword [esp + 0x84], esi
lea edi, [esp + 0x70]
add esp, 0xc
stosd dword es:[edi], eax
push dword [esp + 0x5c]
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [esp + 0x10f8], ax
lea eax, [esp + 0x2d8]
push eax
call fcn.00408f60
dec ebx
cmp ebx, dword [ebp + 8]
jge 0x408344
mov esi, dword [esp + 0xc0]
push 2
pop edi
mov eax, dword [esp + 0x44]
push 0x20
push dword [eax + ebx*4]
call fcn.0040b752
pop ecx
pop ecx
test eax, eax
jne 0x40827a
mov eax, dword [esp + 0x44]
push 9
push dword [eax + ebx*4]
call fcn.0040b752
pop ecx
pop ecx
test eax, eax
jne 0x40827a
mov eax, dword [esp + 0x44]
push dword [eax + ebx*4]
jmp 0x408309
push 0x4070ec
mov edx, 0x7fff
lea ecx, [esp + 0x10f4]
call fcn.00408ece
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x10f0]
mov edx, 0x7fff
push dword [eax + ebx*4]
call fcn.00408ece
mov edx, 0x7fff
lea eax, [esp + 0x10f0]
xor ecx, ecx
cmp word [eax], cx
je 0x4082c2
add eax, edi
sub edx, 1
jne 0x4082b6
mov eax, 0x7fff
mov ecx, edx
sub eax, edx
neg ecx
sbb ecx, ecx
and ecx, eax
test edx, edx
je 0x408304
cmp word [esp + ecx*2 + 0x10ee], 0x5c
jne 0x408304
lea ecx, [ecx*2 - 2]
cmp ecx, 0xfffe
jae 0x4088be
xor eax, eax
mov word [esp + ecx + 0x10f0], ax
push 0x4070f0
jmp 0x408309
push 0x4070ec
mov edx, 0x7fff
lea ecx, [esp + 0x10f4]
call fcn.00408ece
mov eax, dword [ebp + 8]
cmp esi, eax
jge 0x40833a
push 0x4070f8
mov edx, 0x7fff
lea ecx, [esp + 0x10f4]
call fcn.00408ece
mov eax, dword [ebp + 8]
inc ebx
inc esi
cmp ebx, eax
jl 0x408246
cmp byte [esp + 0x12], 0
mov ebx, 0x4070fc
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
je 0x40835e
push ebx
push 0x406e54
call esi
cmp byte [esp + 0x13], 0
je 0x40836d
push ebx
push 0x406e88
call esi
cmp byte [esp + 0x14], 0
je 0x40837c
push ebx
push 0x406eb8
call esi
cmp byte [esp + 0x15], 0
je 0x40838b
push ebx
push 0x406f00
call esi
cmp byte [esp + 0x16], 0
je 0x40839a
push ebx
push 0x406f6c
call esi
cmp byte [esp + 0x17], 0
je 0x4083a9
push ebx
push 0x406f38
call esi
cmp byte [esp + 0x18], 0
je 0x4083b8
push ebx
push 0x406fa0
call esi
cmp byte [esp + 0x19], 0
je 0x4083c7
push ebx
push 0x406fd0
call esi
cmp byte [esp + 0x1a], 0
je 0x4083d6
push ebx
push 0x407004
call esi
mov eax, dword [esp + 0x48]
push eax
push 0x406d98
call esi
mov ebx, dword [esp + 0x60]
test ebx, ebx
je 0x4083fe
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.0040940a
push 4
push ebx
call fcn.0040ad73
pop ecx
pop ecx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x408416
push eax
push 0x406e28
call esi
mov ebx, 0x407184
push ebx
jmp 0x40842c
mov edi, dword [esp + 0x50]
mov ebx, 0x407184
test edi, edi
je 0x408433
push ebx
push 0x406e28
call esi
push edi
push 0x406e04
call esi
mov edi, 0x4070fc
push edi
push 0x406d74
call esi
push edi
push 0x406d30
call esi
push ebx
push 0x406de0
call esi
push ebx
push 0x406dc4
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_SearchPathW]
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0xcc]
push eax
push 0x104
push 0x407100
lea eax, [esp + 0x2e0]
push eax
push esi
call edi
test eax, eax
jne 0x4084e8
lea edx, [esp + 0x2d0]
mov ecx, 0x2715
call fcn.00407b4c
cmp dword [esp + 0x20], esi
je 0x4084b4
push dword [esp + 0x20]
call fcn.00410ef9
pop ecx
mov dword [esp + 0x20], esi
cmp dword [esp + 0x24], esi
je 0x4084c8
push dword [esp + 0x24]
call fcn.00410ef9
pop ecx
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x4084e1
mov ecx, esi
call fcn.00408f9b
push 0x20
push esi
call fcn.0040ad73
pop ecx
pop ecx
push 5
jmp 0x4081c0
cmp dword [esp + 0x30], esi
jbe 0x408516
mov eax, dword [esp + 0x34]
cmp dword [eax + esi*4], 0
je 0x408516
push 0x40710c
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x40867b
inc esi
cmp esi, dword [esp + 0x30]
jb 0x4084ee
xor eax, eax
mov esi, eax
cmp dword [esp + 0x28], eax
jbe 0x408559
mov eax, dword [esp + 0x2c]
push 0x40710c
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
test eax, eax
mov eax, dword [esp + 0x30]
pop ecx
je 0x40867f
push 0x40717c
push dword [eax + esi*4]
call fcn.004113c4
pop ecx
pop ecx
test eax, eax
je 0x408559
inc esi
cmp esi, dword [esp + 0x28]
jb 0x408520
xor esi, esi
push 0x104
lea eax, [esp + 0x8e4]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp + 0x54], eax
test eax, eax
je 0x408862
mov ecx, 0x100
lea eax, [esp + 0xcf0]
push ecx
push eax
push ecx
lea eax, [esp + 0xefc]
push eax
push ecx
lea eax, [esp + 0x6f4]
push eax
push 3
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x900]
push eax
call fcn.0041176c
add esp, 0x24
lea eax, [esp + 0x6e0]
push eax
lea eax, [esp + 0xc4]
push eax
push 0x407120
lea eax, [esp + 0xaf4]
push 0x104
push eax
call fcn.00408e2c
add esp, 0x14
test eax, eax
js 0x408862
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x4dc]
push eax
push 0x104
push 0x407114
push 0x40712c
lea eax, [esp + 0xafc]
push eax
call edi
test eax, eax
je 0x408862
lea eax, [esp + 0x4d8]
push eax
lea ecx, [esp + 0xc4]
call fcn.004088eb
xor eax, eax
push eax
call ebx
cmp byte [esp + 0x1b], 0
lea eax, [esp + 0x64]
mov esi, dword [esp + 0xc0]
je 0x4086aa
push eax
xor ebx, ebx
lea eax, [esp + 0x7c]
push eax
push ebx
push ebx
push 0x604
push 1
push ebx
push ebx
lea eax, [esp + 0x1110]
push eax
movzx eax, word [esp + 0xec]
lea ecx, [esp + 0xec]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x4086db
mov eax, dword [esp + 0x34]
mov esi, dword [eax + esi*4 + 4]
test esi, esi
je 0x40855b
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x4dc]
push eax
push 0x104
push 0x407114
push esi
xor eax, eax
jmp 0x40860c
push ecx
movzx ecx, word [esp + 0xcc]
lea edx, [esp + 0x10f4]
push esi
push eax
lea eax, [esp + 0x84]
push eax
sub esp, 0x18
lea eax, [esp + 0xf0]
neg ecx
sbb ecx, ecx
and ecx, eax
call fcn.0040a444
xor ebx, ebx
test eax, eax
jne 0x4086f7
lea edx, [esp + 0x10f0]
mov ecx, 0x2712
call fcn.00407b4c
push 2
jmp 0x408809
push dword [esp + 0x68]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc0], eax
lea eax, [esp + 0xc0]
push 0xffffffffffffffff
push ebx
push eax
xor eax, eax
mov dword [esp + 0xd0], ecx
test ecx, ecx
setne al
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x4087b9
cmp eax, 1
jne 0x4087fd
push dword [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x4087ad
mov ecx, 0x2718
call fcn.00407bab
lea ecx, [esi - 0x10]
call fcn.0040940a
cmp dword [esp + 0x20], 0
je 0x408778
push dword [esp + 0x20]
call fcn.00410ef9
pop ecx
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x24], 0
je 0x40878d
push dword [esp + 0x24]
call fcn.00410ef9
pop ecx
mov dword [esp + 0x24], ebx
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x4087a6
mov ecx, esi
call fcn.00408f9b
push 0x20
push esi
call fcn.0040ad73
pop ecx
pop ecx
push 0xb
jmp 0x4081c0
push 0xffffffffffffffff
push dword [esp + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x68]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4087ef
lea edx, [esp + 0x10f0]
mov ecx, 0x2713
call fcn.00407b4c
mov dword [esp + 0x1c], 3
jmp 0x4087f7
mov edi, dword [esp + 0x40]
mov dword [esp + 0x1c], edi
mov ebx, dword [esp + 0x1c]
jmp 0x40880a
mov ecx, 0x2717
call fcn.00407bab
push 0xc
pop ebx
lea ecx, [esi - 0x10]
call fcn.0040940a
cmp dword [esp + 0x20], 0
je 0x40882b
push dword [esp + 0x20]
call fcn.00410ef9
xor esi, esi
pop ecx
mov dword [esp + 0x20], esi
jmp 0x40882d
xor esi, esi
cmp dword [esp + 0x24], 0
je 0x408842
push dword [esp + 0x24]
call fcn.00410ef9
pop ecx
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x40885b
mov ecx, esi
call fcn.00408f9b
push 0x20
push esi
call fcn.0040ad73
pop ecx
pop ecx
mov eax, ebx
jmp 0x407eab
mov edx, esi
mov ecx, 0x2714
call fcn.00407b4c
cmp dword [esp + 0x20], 0
je 0x408887
push dword [esp + 0x20]
call fcn.00410ef9
xor ebx, ebx
pop ecx
mov dword [esp + 0x20], ebx
jmp 0x408889
xor ebx, ebx
cmp dword [esp + 0x24], 0
je 0x40889e
push dword [esp + 0x24]
call fcn.00410ef9
pop ecx
mov dword [esp + 0x24], ebx
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x4088b7
mov ecx, esi
call fcn.00408f9b
push 0x20
push esi
call fcn.0040ad73
pop ecx
pop ecx
push 4
jmp 0x4081c0
call fcn.0040aea3
int3