Function at 0x408590
Capabilities:
Create process on windows
Get geographical location
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x74
push 0xffffffffffffffff
push 0x45ccab
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x498f90]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x7c]
xor ebx, ebx
mov dword [ebp + 0x50], 0xf
mov dword [ebp + 0x4c], ebx
mov byte [ebp + 0x3c], bl
push 0x1f
push str.http:__www.iar.com_register.htm
lea ecx, [ebp + 0x38]
mov dword [ebp - 4], ebx
call fcn.00402040
lea eax, [esi + 0x1c]
push 1
push eax
mov ecx, str.Name
lea edi, [ebp + 0x38]
call fcn.004084d0
lea ecx, [esi + 0x38]
push ebx
push ecx
mov ecx, str.Company
call fcn.004084d0
lea edx, [esi + 0x54]
push ebx
push edx
mov ecx, str.Department
call fcn.004084d0
lea eax, [esi + 0x70]
push ebx
push eax
mov ecx, str.Address
call fcn.004084d0
lea ecx, [esi + 0xc4]
push ebx
push ecx
mov ecx, str.City
call fcn.004084d0
lea edx, [esi + 0xa8]
push ebx
push edx
mov ecx, str.State
call fcn.004084d0
lea eax, [esi + 0x8c]
push ebx
push eax
mov ecx, 0x46388c
call fcn.004084d0
lea ecx, [esi + 0xfc]
push ebx
push ecx
mov ecx, str.Phone
call fcn.004084d0
add esp, 0x40
lea edx, [esi + 0x118]
push ebx
push edx
mov ecx, 0x4636a4
call fcn.004084d0
lea eax, [esi + 0x134]
push ebx
push eax
mov ecx, str.Email
call fcn.004084d0
lea ecx, [esi + 0x16c]
push ebx
push ecx
mov ecx, str.Product_name
call fcn.004084d0
lea edx, [esi + 0x188]
push ebx
push edx
mov ecx, str.Product_version
call fcn.004084d0
push ebx
push esi
mov ecx, str.LicenseNo
call fcn.004084d0
push ebx
lea eax, [esi + 0x1a4]
push eax
mov ecx, str.HostID
call fcn.004084d0
add esp, 0x30
push 0xffffffffffffffff
lea eax, [esi + 0x150]
push ebx
push eax
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
call fcn.00401d70
mov eax, str.Other...__
mov byte [ebp - 4], 1
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x408710
sub eax, edi
push eax
push ebx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp]
call fcn.004063c0
mov edi, eax
mov edx, str.Other...__
mov byte [ebp - 4], 2
lea eax, [edx + 1]
mov cl, byte [edx]
add edx, 1
cmp cl, bl
jne 0x408737
sub edx, eax
push edx
mov edx, dword [edi + 0x14]
push str.Other...__
push edx
push ebx
mov ecx, edi
call fcn.00401650
test eax, eax
sete byte [ebp - 0x11]
cmp dword [ebp - 0x28], 0x10
mov byte [ebp - 4], 1
jb 0x408770
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0042f7d6
add esp, 4
cmp byte [ebp - 0x11], bl
je 0x4087c8
mov eax, str.Other...__
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x408780
push 0xffffffffffffffff
sub eax, edx
push eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp]
call fcn.004063c0
push ebx
push eax
mov ecx, str.Distributor
lea edi, [ebp + 0x38]
mov byte [ebp - 4], 3
call fcn.004084d0
add esp, 8
cmp dword [ebp - 0x28], 0x10
mov byte [ebp - 4], 1
jb 0x4087dd
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0042f7d6
add esp, 4
jmp 0x4087dd
lea eax, [ebp]
push ebx
push eax
mov ecx, str.Distributor
lea edi, [ebp + 0x38]
call fcn.004084d0
add esp, 8
add esi, 0xe0
push esi
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x20], esi
call fcn.004062d0
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x11]
call fcn.004043e0
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax]
je 0x408825
lea ecx, [ebp - 0x18]
call fcn.00405570
push ebx
push eax
mov ecx, str.CountryCode
lea edi, [ebp + 0x38]
call fcn.004084d0
add esp, 8
jmp 0x408955
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x11]
call fcn.004043e0
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
jmp 0x408840
sub dword [ebp - 0x18], 1
lea ecx, [ebp - 0x18]
call fcn.00405510
mov eax, dword [eax + 0x14]
push eax
push ebx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.004063c0
mov edi, eax
lea ecx, [ebp - 0x18]
call fcn.00405510
cmp dword [eax + 0x18], 0x10
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x1c], edx
jb 0x408878
mov eax, dword [eax + 4]
jmp 0x40887b
add eax, 4
mov esi, dword [edi + 0x14]
mov ecx, esi
cmp ecx, esi
jae 0x408884
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
jae 0x40888d
mov ecx, esi
cmp dword [edi + 0x18], 0x10
jb 0x408898
mov edi, dword [edi + 4]
jmp 0x40889b
add edi, 4
push ecx
push eax
push edi
call fcn.00401230
add esp, 0xc
cmp eax, ebx
jne 0x4088c1
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jae 0x4088b6
or eax, 0xffffffff
jmp 0x4088bf
xor ecx, ecx
cmp esi, eax
setne cl
mov eax, ecx
cmp eax, ebx
sete byte [ebp - 0x11]
cmp dword [ebp - 0x28], 0x10
mov byte [ebp - 4], 1
jb 0x4088db
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0042f7d6
add esp, 4
cmp byte [ebp - 0x11], bl
jne 0x4088f9
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x11]
call fcn.004040d0
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax]
jne 0x408840
jmp 0x408955
lea ecx, [ebp - 0x18]
call fcn.00405570
push ebx
push eax
mov ecx, str.CountryCode
lea edi, [ebp + 0x38]
call fcn.004084d0
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.00405510
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x20]
push 0xffffffffffffffff
add eax, 3
push eax
lea edx, [ebp - 0x40]
push edx
call fcn.004063c0
push ebx
push eax
mov ecx, str.Country
mov byte [ebp - 4], 5
call fcn.004084d0
add esp, 8
cmp dword [ebp - 0x28], 0x10
jb 0x408955
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0042f7d6
add esp, 4
mov dword [ebp + 0x6c], 0xf
mov dword [ebp + 0x68], ebx
mov byte [ebp + 0x58], bl
push str.TEMP
mov byte [ebp - 4], 6
call fcn.0044030d
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [ebp - 0x48], esi
je 0x408cf9
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x408985
sub ecx, edx
push ecx
push esi
lea ecx, [ebp + 0x54]
call fcn.00402040
push 0xe
push str._redirect.html
lea ecx, [ebp + 0x54]
call fcn.00401f50
mov eax, dword [ebp + 0x58]
mov edi, 0x10
cmp dword [ebp + 0x6c], edi
jae 0x4089b9
lea eax, [ebp + 0x58]
push 0x46382c
push eax
call fcn.00440279
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x408cfe
push str._HTML__n
push esi
call fcn.00440066
push str._HEAD__n
push esi
call fcn.00440066
mov eax, dword [ebp + 0x3c]
add esp, 0x10
cmp dword [ebp + 0x50], edi
jae 0x4089f5
lea eax, [ebp + 0x3c]
push eax
push str._META_http_equiv_refresh__content_0_URL_s___n
push esi
call fcn.00440066
push str._TITLE_Redirecting_to_www.iar.com__TITLE__n
push esi
call fcn.00440066
push str.__HEAD__n
push esi
call fcn.00440066
push str._BODY___BODY__n
push esi
call fcn.00440066
push str.__HTML__n
push esi
call fcn.00440066
push esi
call fcn.0043ffea
add esp, 0x30
push ebx
lea ecx, [ebp - 0x214]
call fcn.00402ef0
push ebx
push 0x98
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 7
call fcn.00438ce0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x41]
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 8
call fcn.004146b0
push 5
mov esi, 0xf
push str..html
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 9
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x90], ebx
mov byte [ebp - 0xa0], bl
call fcn.00402040
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
call fcn.00414070
cmp dword [ebp - 0x8c], edi
mov byte [ebp - 4], 0xc
jb 0x408ad6
mov ecx, dword [ebp - 0xa0]
push ecx
call fcn.0042f7d6
add esp, 4
push ebx
push 0x462f68
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x90], ebx
mov byte [ebp - 0xa0], bl
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xac], ebx
mov byte [ebp - 0xbc], bl
call fcn.00402040
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xd
call fcn.00414140
lea ecx, [ebp - 0x168]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.00414580
lea edx, [ebp - 0x168]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xf
call fcn.00414070
cmp dword [ebp - 0x150], edi
jb 0x408b62
mov ecx, dword [ebp - 0x164]
push ecx
call fcn.0042f7d6
add esp, 4
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x154], ebx
mov byte [ebp - 0x164], bl
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x12
call fcn.00413fa0
cmp dword [ebp - 0xa8], edi
mov byte [ebp - 4], 0x13
jb 0x408b9b
mov edx, dword [ebp - 0xbc]
push edx
call fcn.0042f7d6
add esp, 4
push 0x12
push str.shellopencommand
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xac], ebx
mov byte [ebp - 0xbc], bl
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
call fcn.00402040
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x14
call fcn.00414070
cmp dword [ebp - 0x50], edi
mov byte [ebp - 4], 0x16
jb 0x408bee
mov edx, dword [ebp - 0x64]
push edx
call fcn.0042f7d6
add esp, 4
push ebx
push 0x462f68
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc8], ebx
mov byte [ebp - 0xd8], bl
call fcn.00402040
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x17
call fcn.00414140
lea edx, [ebp - 0x14c]
push edx
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.00414580
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0x19
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x30], ebx
mov byte [ebp + 0x20], bl
call fcn.00401d70
cmp dword [ebp - 0x134], edi
jb 0x408c79
mov ecx, dword [ebp - 0x148]
push ecx
call fcn.0042f7d6
add esp, 4
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x138], ebx
mov byte [ebp - 0x148], bl
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1c
call fcn.00413fa0
cmp dword [ebp - 0xc4], edi
mov byte [ebp - 4], 0x1d
jb 0x408cb2
mov edx, dword [ebp - 0xd8]
push edx
call fcn.0042f7d6
add esp, 4
mov esi, dword [ebp + 0x34]
mov edi, dword [ebp + 0x20]
xor dl, dl
mov dword [ebp - 0xc4], 0xf
mov dword [ebp - 0xc8], ebx
mov byte [ebp - 0xd8], bl
xor eax, eax
cmp eax, dword [ebp + 0x30]
jae 0x408dcb
cmp esi, 0x10
mov ecx, edi
jae 0x408ce5
lea ecx, [ebp + 0x20]
cmp byte [ecx + eax], 0x22
jne 0x408daf
cmp dl, bl
sete dl
add eax, 1
jmp 0x408cd2
mov edi, 0x10
push 0x463778
call fcn.0044030d
add esp, 4
cmp eax, ebx
mov dword [ebp - 0x48], eax
je 0x408d5e
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x408d17
sub ecx, esi
push ecx
push eax
lea ecx, [ebp + 0x54]
call fcn.00402040
push 0xe
push str._redirect.html
lea ecx, [ebp + 0x54]
call fcn.00401f50
cmp dword [ebp + 0x6c], edi
mov eax, dword [ebp + 0x58]
jae 0x408d46
lea eax, [ebp + 0x58]
push 0x46382c
push eax
call fcn.00440279
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x4089d1
cmp dword [ebp + 0x6c], edi
jb 0x408d6f
mov ecx, dword [ebp + 0x58]
push ecx
call fcn.0042f7d6
add esp, 4
cmp dword [ebp + 0x18], edi
mov esi, 0xf
mov dword [ebp + 0x6c], esi
mov dword [ebp + 0x68], ebx
mov byte [ebp + 0x58], bl
jb 0x408d8e
mov edx, dword [ebp + 4]
push edx
call fcn.0042f7d6
add esp, 4
cmp dword [ebp + 0x50], edi
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
jb 0x408da8
mov eax, dword [ebp + 0x3c]
push eax
call fcn.0042f7d6
add esp, 4
mov al, 1
jmp 0x4091a5
cmp dl, bl
jne 0x408dc3
cmp esi, 0x10
mov ecx, edi
jae 0x408dbd
lea ecx, [ebp + 0x20]
cmp byte [ecx + eax], 0x20
je 0x408dcb
add eax, 1
jmp 0x408cd2
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + 0x1c]
call fcn.004063c0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0x1e
call fcn.00401d70
mov esi, 0x10
cmp dword [ebp - 0x28], esi
mov byte [ebp - 4], 0x1d
jb 0x408e03
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0042f7d6
add esp, 4
push 1
mov edi, 0xf
push 0x463774
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x170], ebx
mov byte [ebp - 0x180], bl
call fcn.00402040
push 1
push 0x463774
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
call fcn.00402040
lea edx, [ebp + 0x54]
push edx
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x40]
push ecx
mov byte [ebp - 4], 0x20
call fcn.00406b30
add esp, 0xc
lea edx, [ebp - 0x184]
push edx
push eax
lea eax, [ebp - 0x88]
push eax
mov byte [ebp - 4], 0x21
call fcn.00406b30
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x22
call fcn.00401d70
cmp dword [ebp - 0x70], esi
jb 0x408e9f
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.0042f7d6
add esp, 4
cmp dword [ebp - 0x28], esi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x84], bl
jb 0x408ebc
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0042f7d6
add esp, 4
cmp dword [ebp - 0x50], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
jb 0x408ed6
mov eax, dword [ebp - 0x64]
push eax
call fcn.0042f7d6
add esp, 4
cmp dword [ebp - 0x16c], esi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
mov byte [ebp - 4], 0x1d
jb 0x408efa
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.0042f7d6
add esp, 4
push 0x463770
lea edx, [ebp + 0x1c]
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.00406be0
add esp, 0xc
lea ecx, [ebp + 0x54]
push ecx
push eax
lea edx, [ebp - 0x40]
push edx
mov byte [ebp - 4], 0x23
call fcn.00406b30
add esp, 0xc
cmp dword [eax + 0x18], esi
jb 0x408f31
mov eax, dword [eax + 4]
jmp 0x408f34
add eax, 4
push eax
call fcn.00441351
add esp, 4
cmp dword [ebp - 0x28], 0x10
mov esi, eax
jb 0x408f51
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0042f7d6
add esp, 4
cmp dword [ebp - 0x70], 0x10
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
mov byte [ebp - 4], 0x1d
jb 0x408f73
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.0042f7d6
add esp, 4
cmp dword [ebp + 0x34], 0x10
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x84], bl
mov dword [ebp - 0x130], 0x44
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], ebx
mov word [ebp - 0x100], 1
mov word [ebp - 0xfe], bx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
jae 0x409017
lea eax, [ebp + 0x20]
lea edx, [ebp - 0xec]
push edx
lea ecx, [ebp - 0x130]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
push esi
jne 0x409090
call fcn.0043e245
add esp, 4
push ebx
push 0x462f68
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
call fcn.00402040
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x188], edi
mov dword [ebp - 0x18c], ebx
mov byte [ebp - 0x19c], bl
call fcn.00401d70
push 0x470a38
lea eax, [ebp - 0x1a0]
push eax
call fcn.0043e8af
call fcn.0043e245
add esp, 4
cmp dword [ebp + 0x34], 0x10
jb 0x4090aa
mov ecx, dword [ebp + 0x20]
push ecx
call fcn.0042f7d6
add esp, 4
lea ecx, [ebp - 0x20]
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x30], ebx
mov byte [ebp + 0x20], bl
mov byte [ebp - 4], 0x13
call fcn.00413dd0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00413dd0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00413dd0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00413dd0
mov dword [ebp - 4], 7
jmp 0x409138
push ebx
lea ecx, [ebp - 0x214]
mov esi, 0x10
call fcn.004368aa
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 6
call fcn.00438420
cmp dword [ebp + 0x6c], esi
jb 0x409169
mov ecx, dword [ebp + 0x58]
push ecx
call fcn.0042f7d6
add esp, 4
cmp dword [ebp + 0x18], esi
mov edi, 0xf
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
mov byte [ebp + 0x58], bl
jb 0x409188
mov edx, dword [ebp + 4]
push edx
call fcn.0042f7d6
add esp, 4
cmp dword [ebp + 0x50], esi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
jb 0x4091a2
mov eax, dword [ebp + 0x3c]
push eax
call fcn.0042f7d6
add esp, 4
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.0043ec69
add ebp, 0x74
mov esp, ebp
pop ebp
ret