Function at 0x4054e0
Capabilities:
Extract resource via kernel32 functions
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52351e
mov eax, dword fs:[0]
push eax
sub esp, 0x530
mov eax, dword [0x56e188]
xor eax, esp
mov dword [esp + 0x528], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56e188]
xor eax, esp
push eax
lea eax, [esp + 0x544]
mov dword fs:[0], eax
movzx eax, word [esp + 0x554]
movzx ecx, cx
push eax
push ecx
push str.VID__04XPID__04X
lea edx, [esp + 0x138]
call fcn.00408c90
xor ebx, ebx
add esp, 0xc
xor edx, edx
mov ebp, 7
mov eax, str.Usb_Device.inf
mov word [esp + 0x114], dx
mov dword [esp + 0x128], ebp
mov dword [esp + 0x124], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405563
sub eax, edx
sar eax, 1
push eax
mov eax, str.Usb_Device.inf
lea esi, [esp + 0x114]
call fcn.004037a0
mov dword [esp + 0x54c], ebx
xor eax, eax
mov word [esp + 0x38], ax
push 4
mov eax, str..cat
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
call fcn.004037a0
mov byte [esp + 0x54c], 1
xor ecx, ecx
push 4
mov eax, str..inf
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
call fcn.004037a0
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x114]
push eax
mov edi, esi
mov byte [esp + 0x554], 2
call fcn.00406850
add esp, 8
mov byte [esp + 0x54c], 1
cmp dword [esp + 0x30], 8
jb 0x40560c
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00408d8a
add esp, 4
xor edx, edx
mov byte [esp + 0x54c], bl
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
jb 0x405636
mov eax, dword [esp + 0x38]
push eax
call fcn.00408d8a
add esp, 4
lea ecx, [esp + 0x60]
push ecx
call fcn.00408220
mov byte [esp + 0x54c], 3
xor edx, edx
mov eax, str.Usb_Device.inf
mov word [esp + 0x38], dx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405660
sub eax, edx
sar eax, 1
push eax
mov eax, str.Usb_Device.inf
lea esi, [esp + 0x38]
call fcn.004037a0
mov byte [esp + 0x54c], 4
xor eax, eax
mov word [esp + 0x1c], ax
push 0xe
mov eax, str.INF_FILENAME
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
call fcn.004037a0
lea ecx, [esp + 0x34]
push ecx
mov edx, esi
push edx
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x558], 5
call fcn.00407dd0
lea ecx, [esp + 0x84]
push ecx
mov edi, eax
mov byte [esp + 0x550], 6
call fcn.00408cb0
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0x558], 7
call fcn.00407c20
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0x550], 6
call fcn.00406350
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x550], 5
call fcn.00406350
mov byte [esp + 0x54c], 4
cmp dword [esp + 0x30], 8
jb 0x40573e
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00408d8a
add esp, 4
xor edx, edx
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
jb 0x405769
mov eax, dword [esp + 0x38]
push eax
call fcn.00408d8a
add esp, 4
xor ecx, ecx
push 5
mov eax, str.FCUsb
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], cx
call fcn.004037a0
mov byte [esp + 0x54c], 8
xor edx, edx
push 0x14
mov eax, str.DEVICE_DESCRIPTION
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.004037a0
lea eax, [esp + 0x34]
push eax
mov ecx, esi
push ecx
lea edx, [esp + 0xc4]
push edx
mov byte [esp + 0x558], 9
call fcn.00407dd0
lea ecx, [esp + 0x84]
push ecx
mov edi, eax
mov byte [esp + 0x550], 0xa
call fcn.00408cb0
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0x558], 0xb
call fcn.00407c20
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0x550], 0xa
call fcn.00406350
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x550], 9
call fcn.00406350
mov byte [esp + 0x54c], 8
cmp dword [esp + 0x30], 8
jb 0x405848
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00408d8a
add esp, 4
xor edx, edx
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
jb 0x405873
mov eax, dword [esp + 0x38]
push eax
call fcn.00408d8a
add esp, 4
xor ecx, ecx
push 9
mov eax, str.FirstChip
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], cx
call fcn.004037a0
mov byte [esp + 0x54c], 0xc
xor edx, edx
push 0x15
mov eax, str.DEVICE_MANUFACTURER
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.004037a0
lea eax, [esp + 0x34]
push eax
mov ecx, esi
push ecx
lea edx, [esp + 0xc4]
push edx
mov byte [esp + 0x558], 0xd
call fcn.00407dd0
lea ecx, [esp + 0x84]
push ecx
mov edi, eax
mov byte [esp + 0x550], 0xe
call fcn.00408cb0
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0x558], 0xf
call fcn.00407c20
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0x550], 0xe
call fcn.00406350
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x550], 0xd
call fcn.00406350
mov byte [esp + 0x54c], 0xc
cmp dword [esp + 0x30], 8
jb 0x405952
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00408d8a
add esp, 4
xor edx, edx
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
jb 0x40597d
mov eax, dword [esp + 0x38]
push eax
call fcn.00408d8a
add esp, 4
xor ecx, ecx
lea eax, [esp + 0x12c]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405996
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x130]
lea esi, [esp + 0x38]
call fcn.004037a0
mov byte [esp + 0x54c], 0x10
xor edx, edx
push 0x14
mov eax, str.DEVICE_HARDWARE_ID
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.004037a0
lea eax, [esp + 0x34]
push eax
mov ecx, esi
push ecx
lea edx, [esp + 0xc4]
push edx
mov byte [esp + 0x558], 0x11
call fcn.00407dd0
lea ecx, [esp + 0x84]
push ecx
mov edi, eax
mov byte [esp + 0x550], 0x12
call fcn.00408cb0
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0x558], 0x13
call fcn.00407c20
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0x550], 0x12
call fcn.00406350
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x550], 0x11
call fcn.00406350
mov byte [esp + 0x54c], 0x10
cmp dword [esp + 0x30], 8
jb 0x405a76
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00408d8a
add esp, 4
xor edx, edx
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
jb 0x405aa1
mov eax, dword [esp + 0x38]
push eax
call fcn.00408d8a
add esp, 4
xor ecx, ecx
push 0x26
mov eax, str.40C05DAE_1384_45B9_B0F2_35E267A7DF70
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], cx
call fcn.004037a0
mov byte [esp + 0x54c], 0x14
xor edx, edx
push 0x17
mov eax, str.DEVICE_INTERFACE_GUID
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.004037a0
lea eax, [esp + 0x34]
push eax
mov ecx, esi
push ecx
lea edx, [esp + 0xc4]
push edx
mov byte [esp + 0x558], 0x15
call fcn.00407dd0
lea ecx, [esp + 0x84]
push ecx
mov edi, eax
mov byte [esp + 0x550], 0x16
call fcn.00408cb0
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0x558], 0x17
call fcn.00407c20
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0x550], 0x16
call fcn.00406350
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x550], 0x15
call fcn.00406350
mov byte [esp + 0x54c], 0x14
cmp dword [esp + 0x30], 8
jb 0x405b80
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00408d8a
add esp, 4
xor edx, edx
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
jb 0x405bab
mov eax, dword [esp + 0x38]
push eax
call fcn.00408d8a
add esp, 4
xor ecx, ecx
push 0xe
mov eax, str.CAT_FILENAME
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], cx
call fcn.004037a0
lea edx, [esp + 0x110]
push edx
mov eax, esi
push eax
lea ecx, [esp + 0xc4]
push ecx
mov byte [esp + 0x558], 0x18
call fcn.00407dd0
lea edx, [esp + 0x84]
push edx
mov edi, eax
mov byte [esp + 0x550], 0x19
call fcn.00408cb0
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x68]
push edx
mov byte [esp + 0x558], 0x1a
call fcn.00407c20
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x550], 0x19
call fcn.00406350
lea ecx, [esp + 0xbc]
push ecx
mov byte [esp + 0x550], 0x18
call fcn.00406350
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x4c], 8
jb 0x405c66
mov edx, dword [esp + 0x38]
push edx
call fcn.00408d8a
add esp, 4
xor eax, eax
mov word [esp + 0x38], ax
push 0xa
mov eax, str.01_18_2012
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
call fcn.004037a0
mov byte [esp + 0x54c], 0x1b
xor ecx, ecx
push 0xd
mov eax, str.DRIVER_DATE
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
call fcn.004037a0
lea edx, [esp + 0x34]
push edx
mov eax, esi
push eax
lea ecx, [esp + 0xc4]
push ecx
mov byte [esp + 0x558], 0x1c
call fcn.00407dd0
lea edx, [esp + 0x84]
push edx
mov edi, eax
mov byte [esp + 0x550], 0x1d
call fcn.00408cb0
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x68]
push edx
mov byte [esp + 0x558], 0x1e
call fcn.00407c20
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x550], 0x1d
call fcn.00406350
lea ecx, [esp + 0xbc]
push ecx
mov byte [esp + 0x550], 0x1c
call fcn.00406350
mov byte [esp + 0x54c], 0x1b
cmp dword [esp + 0x30], 8
jb 0x405d45
mov edx, dword [esp + 0x1c]
push edx
call fcn.00408d8a
add esp, 4
xor eax, eax
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
jb 0x405d70
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00408d8a
add esp, 4
xor edx, edx
push ebp
mov eax, str.1.2.6.0
lea esi, [esp + 0x38]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], dx
call fcn.004037a0
mov byte [esp + 0x54c], 0x1f
xor eax, eax
mov word [esp + 0x1c], ax
push 0x10
mov eax, str.DRIVER_VERSION
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
call fcn.004037a0
lea ecx, [esp + 0x34]
push ecx
mov edx, esi
push edx
lea eax, [esp + 0xc4]
push eax
mov byte [esp + 0x558], 0x20
call fcn.00407dd0
lea ecx, [esp + 0x84]
push ecx
mov edi, eax
mov byte [esp + 0x550], 0x21
call fcn.00408cb0
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0x558], 0x22
call fcn.00407c20
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0x550], 0x21
call fcn.00406350
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x550], 0x20
call fcn.00406350
mov byte [esp + 0x54c], 0x1f
cmp dword [esp + 0x30], 8
jb 0x405e4e
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00408d8a
add esp, 4
xor edx, edx
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
jb 0x405e79
mov eax, dword [esp + 0x38]
push eax
call fcn.00408d8a
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceW]
push str.RAW_DATA
push 0x81
push ebx
call ebp
mov esi, eax
cmp esi, ebx
je 0x405eb9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x405eb9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x405eb9
cmp esi, ebx
jg 0x405ef6
lea ecx, [esp + 0x60]
push ecx
mov byte [esp + 0x550], bl
call fcn.004062f0
mov dword [esp + 0x54c], 0xffffffff
cmp dword [esp + 0x128], 8
jb 0x405eef
mov edx, dword [esp + 0x114]
push edx
call fcn.00408d8a
add esp, 4
xor eax, eax
jmp 0x4062c1
push esi
call fcn.00408d7f
add esp, 4
push str.RAW_DATA
push 0x81
push ebx
mov edi, eax
call ebp
cmp eax, ebx
je 0x405f22
lea ecx, [esi - 2]
push ecx
mov ebx, edi
call fcn.004067e0
add esp, 4
xor ebx, ebx
mov byte [edi + esi - 2], bl
mov byte [edi + esi - 1], bl
xor edx, edx
mov eax, edi
mov word [esp + 0xf8], dx
mov dword [esp + 0x10c], 7
mov dword [esp + 0x108], ebx
lea edx, [eax + 2]
jmp 0x405f50
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405f50
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0xf8]
call fcn.004037a0
push edi
mov byte [esp + 0x550], 0x23
call fcn.00408d8a
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov ebp, dword [esp + 0x64]
add esp, 4
lea esp, [esp]
mov edi, dword [esp + 0x78]
cmp ebp, ebx
je 0x405f9e
cmp ebp, dword [esp + 0x60]
je 0x405fa3
call fcn.004fd947
cmp esi, edi
je 0x40604c
cmp ebp, ebx
jne 0x406001
call fcn.004fd947
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x405fc0
call fcn.004fd947
lea edi, [esi + 0xc]
cmp ebp, ebx
jne 0x406006
call fcn.004fd947
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x405fd8
call fcn.004fd947
lea ecx, [edi + 0x1c]
push ecx
lea edx, [esp + 0xf8]
push edx
call fcn.00406850
add esp, 8
cmp ebp, ebx
jne 0x405ff5
call fcn.004fd947
cmp byte [esi + 0x45], bl
je 0x40600b
call fcn.004fd947
jmp 0x405f90
mov eax, dword [ebp]
jmp 0x405fb6
mov eax, dword [ebp]
jmp 0x405fce
mov eax, dword [esi + 8]
cmp byte [eax + 0x45], bl
jne 0x40602e
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x45], bl
jne 0x405f90
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x45], bl
je 0x406020
jmp 0x405f90
mov eax, dword [esi + 4]
cmp byte [eax + 0x45], bl
jne 0x406045
cmp esi, dword [eax + 8]
jne 0x406045
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x45], bl
je 0x406036
mov esi, eax
jmp 0x405f90
lea ecx, [esp + 0x34]
call fcn.004068e0
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x406064
mov eax, dword [eax + 4]
jmp 0x406067
add eax, 4
push str.Usb_Device.inf
push eax
push str._sPackage_s
lea edx, [esp + 0x340]
call fcn.00408c90
add esp, 0xc
cmp dword [esp + 0x4c], ebp
jb 0x406094
mov eax, dword [esp + 0x38]
push eax
call fcn.00408d8a
add esp, 4
push ebx
push 0x80
push 2
push ebx
push 2
push 0x40000000
lea edx, [esp + 0x34c]
xor ecx, ecx
mov edi, 7
push edx
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406146
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x10c], ebp
jb 0x4060ee
mov eax, dword [esp + 0xf8]
push eax
call fcn.00408d8a
add esp, 4
mov dword [esp + 0x10c], edi
lea edx, [esp + 0x60]
xor ecx, ecx
push edx
mov dword [esp + 0x10c], ebx
mov word [esp + 0xfc], cx
mov byte [esp + 0x550], bl
call fcn.004062f0
mov dword [esp + 0x54c], 0xffffffff
cmp dword [esp + 0x128], ebp
jb 0x405eef
mov eax, dword [esp + 0x114]
push eax
call fcn.00408d8a
add esp, 4
xor eax, eax
jmp 0x4062c1
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea ecx, [esp + 0x84]
push ecx
push 2
lea edx, [esp + 0x5c]
push edx
push esi
mov byte [esp + 0x64], 0xff
mov byte [esp + 0x65], 0xfe
call edi
test eax, eax
jne 0x4061a5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x10c], ebp
jb 0x406195
mov eax, dword [esp + 0xf8]
push eax
call fcn.00408d8a
add esp, 4
mov dword [esp + 0x10c], 7
jmp 0x4060f5
mov eax, dword [esp + 0xf8]
cmp dword [esp + 0x10c], ebp
jae 0x4061bc
lea eax, [esp + 0xf8]
mov edx, dword [esp + 0x108]
push ebx
lea ecx, [esp + 0x84]
push ecx
lea ecx, [edx + edx]
push ecx
push eax
push esi
call edi
push esi
test eax, eax
jne 0x406244
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x10c], ebp
jb 0x406200
mov edx, dword [esp + 0xf8]
push edx
call fcn.00408d8a
add esp, 4
lea ecx, [esp + 0x60]
xor eax, eax
push ecx
mov dword [esp + 0x110], 7
mov dword [esp + 0x10c], ebx
mov word [esp + 0xfc], ax
mov byte [esp + 0x550], bl
call fcn.004062f0
mov dword [esp + 0x54c], 0xffffffff
cmp dword [esp + 0x128], ebp
jmp 0x405edd
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x54c], 3
cmp dword [esp + 0x10c], ebp
jb 0x40626b
mov eax, dword [esp + 0xf8]
push eax
call fcn.00408d8a
add esp, 4
lea edx, [esp + 0x60]
xor ecx, ecx
push edx
mov dword [esp + 0x110], 7
mov dword [esp + 0x10c], ebx
mov word [esp + 0xfc], cx
mov byte [esp + 0x550], bl
call fcn.004062f0
mov dword [esp + 0x54c], 0xffffffff
cmp dword [esp + 0x128], ebp
jb 0x4062bc
mov eax, dword [esp + 0x114]
push eax
call fcn.00408d8a
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x544]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.004fd1b4
add esp, 0x53c
ret