Function at 0x405ad0
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5120b0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x5428f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00403310
push 0x118
mov esi, eax
lea eax, [ebp - 0x468]
push 0
push eax
call fcn.004bd260
add esp, 0xc
mov dword [ebp - 0x46c], 0x11c
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x405b4b
cmp dword [ebp - 0x468], 5
jne 0x405b4b
cmp dword [ebp - 0x464], 1
je 0x405c82
test esi, esi
jne 0x405c82
lea eax, [ebp - 0x478]
mov dword [ebp - 0x478], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x220], esi
xor ecx, ecx
mov esi, 1
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], cx
cmp dword [ebp - 0x478], esi
jle 0x405bed
nop dword [eax]
mov edx, dword [eax + esi*4]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405bb0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00404ef0
push 1
push 0x5156b4
lea ecx, [ebp - 0x230]
call fcn.00404ef0
mov eax, dword [ebp - 0x47c]
inc esi
cmp esi, dword [ebp - 0x478]
jl 0x405ba0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004bd260
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004010f0
mov edx, dword [ebp - 0x21c]
add esp, 8
cmp edx, 8
jb 0x405c7b
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405c71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40698d
push edx
push ecx
call fcn.0049bb3b
add esp, 8
xor eax, eax
jmp 0x406970
cmp dword [0x542018], 8
mov eax, 0x542004
cmovae eax, dword [0x542004]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x544208], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x405c7b
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 0
call fcn.004046d0
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x480]
push eax
mov dword [ebp - 0x480], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, 1
mov ecx, eax
mov dword [ebp - 0x478], ecx
cmp dword [ebp - 0x480], esi
jle 0x405fd7
nop
lea eax, [esi*4]
mov dword [ebp - 0x238], 0
mov edx, dword [eax + ecx]
mov ecx, edx
mov dword [ebp - 0x47c], eax
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405d42
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x248]
call fcn.00405160
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x260]
push 0xfde9
push eax
call fcn.004039f0
mov edx, dword [ebp - 0x234]
add esp, 0xc
cmp edx, 8
jb 0x405db9
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405daf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40698d
push edx
push ecx
call fcn.0049bb3b
add esp, 8
cmp dword [ebp - 0x250], 1
jbe 0x405f89
cmp dword [ebp - 0x24c], 0x10
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
cmp byte [eax], 0x2d
jne 0x405f89
lea edi, [esi + 1]
cmp edi, dword [ebp - 0x480]
jge 0x405f45
mov eax, dword [ebp - 0x478]
mov edx, dword [ebp - 0x47c]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov edx, dword [edx + eax + 4]
mov ecx, edx
xor eax, eax
mov word [ebp - 0x230], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405e24
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00405160
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push 0xfde9
push eax
call fcn.004039f0
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.00402710
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x474]
call fcn.004057e0
mov esi, dword [ebp - 0x490]
cmp esi, dword [ebp - 0x474]
je 0x405ec7
cmp dword [esi + 0x24], 0x10
lea edx, [esi + 0x10]
jb 0x405e99
mov edx, dword [esi + 0x10]
push dword [esi + 0x20]
cmp dword [ebp - 0x24c], 0x10
lea eax, [ebp - 0x260]
push edx
cmovae eax, dword [ebp - 0x260]
push dword [ebp - 0x250]
push eax
call fcn.00402070
shr eax, 0x1f
add esp, 0x10
test al, al
je 0x405f0f
lea eax, [ebp - 0x260]
mov dword [ebp - 0x47c], eax
lea ecx, [ebp - 0x474]
lea eax, [ebp - 0x481]
push eax
lea eax, [ebp - 0x47c]
push eax
push 0x515516
call fcn.00401810
push eax
add eax, 0x10
lea ecx, [ebp - 0x474]
push eax
push esi
lea eax, [ebp - 0x488]
push eax
call fcn.00401a20
mov esi, dword [ebp - 0x488]
lea ecx, [esi + 0x28]
lea eax, [ebp - 0x248]
cmp ecx, eax
je 0x405f36
cmp dword [ebp - 0x234], 0x10
push dword [ebp - 0x238]
cmovae eax, dword [ebp - 0x248]
push eax
call fcn.00405070
lea ecx, [ebp - 0x248]
mov esi, edi
call fcn.004026c0
jmp 0x405f89
push str.Warning:_No_value_provided_for_key
push 0x545db8
call fcn.00401460
add esp, 8
lea ecx, [ebp - 0x260]
cmp dword [ebp - 0x24c], 0x10
cmovae ecx, dword [ebp - 0x260]
push 0x5156b8
push dword [ebp - 0x250]
push ecx
push eax
call fcn.00401e10
add esp, 0xc
push eax
call fcn.00401460
add esp, 8
mov edx, dword [ebp - 0x24c]
cmp edx, 0x10
jb 0x405fc3
mov ecx, dword [ebp - 0x260]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405fb9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40698d
push edx
push ecx
call fcn.0049bb3b
add esp, 8
inc esi
cmp esi, dword [ebp - 0x480]
jge 0x405fd7
mov ecx, dword [ebp - 0x478]
jmp 0x405d10
push 6
push str._appid
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.00405070
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x474]
call fcn.00402920
push eax
lea ecx, [ebp - 0x308]
call fcn.00402100
mov edx, dword [ebp - 0x234]
cmp edx, 0x10
jb 0x40605c
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406052
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406992
push edx
push ecx
call fcn.0049bb3b
add esp, 8
cmp dword [ebp - 0x2f8], 0
jne 0x406077
push 0x10
push str.2021004164676954
lea ecx, [ebp - 0x308]
call fcn.00405070
push 0xa
push str._alipaynfc
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.00405070
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x474]
call fcn.00402920
push eax
lea ecx, [ebp - 0x248]
call fcn.00402100
mov edx, dword [ebp - 0x21c]
cmp edx, 0x10
jb 0x4060fc
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4060f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406997
push edx
push ecx
call fcn.0049bb3b
add esp, 8
mov esi, dword [ebp - 0x238]
test esi, esi
jne 0x40611e
push 0x20
push str.A6Cy1SpPKIlgAAAAAAAAAAAAAAbowAQ
lea ecx, [ebp - 0x248]
call fcn.00405070
mov esi, dword [ebp - 0x238]
push 6
push str._nfcsn
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.00405070
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x474]
call fcn.00402920
push eax
lea ecx, [ebp - 0x2f0]
call fcn.00402100
mov edx, dword [ebp - 0x21c]
cmp edx, 0x10
jb 0x4061a3
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406199
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40699c
push edx
push ecx
call fcn.0049bb3b
add esp, 8
cmp dword [ebp - 0x2e0], 0
jne 0x4061be
push 4
push str.NOSN
lea ecx, [ebp - 0x2f0]
call fcn.00405070
push 0xb
push str._singlemark
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.00405070
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x474]
call fcn.00402920
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00402100
mov edx, dword [ebp - 0x21c]
cmp edx, 0x10
jb 0x406243
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406239
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069a1
push edx
push ecx
call fcn.0049bb3b
add esp, 8
cmp dword [ebp - 0x2c8], 0
jne 0x40625e
push 1
push 0x515748
lea ecx, [ebp - 0x2d8]
call fcn.00405070
push 7
push str._saasid
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.00405070
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x474]
call fcn.00402920
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00402100
mov edx, dword [ebp - 0x21c]
cmp edx, 0x10
jb 0x4062e3
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4062d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069a6
push edx
push ecx
call fcn.0049bb3b
add esp, 8
cmp dword [ebp - 0x2b0], 0
jne 0x4062fe
push 8
push str.NOSAASID
lea ecx, [ebp - 0x2c0]
call fcn.00405070
push 9
push str._configid
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.00405070
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x474]
call fcn.00402920
push eax
lea ecx, [ebp - 0x338]
call fcn.00402100
mov edx, dword [ebp - 0x21c]
cmp edx, 0x10
jb 0x406383
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406379
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069ab
push edx
push ecx
call fcn.0049bb3b
add esp, 8
lea eax, [ebp - 0x350]
push eax
call fcn.00403160
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x230]
push 0xfde9
push eax
call fcn.004039f0
push 1
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2a8]
push eax
call fcn.00403670
mov edx, dword [ebp - 0x21c]
add esp, 0x1c
cmp edx, 0x10
jb 0x4063f9
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4063ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069b0
push edx
push ecx
call fcn.0049bb3b
add esp, 8
push 0xe
push str.nfc_alipay.exe
lea ecx, [ebp - 0x2a8]
call fcn.00404be0
lea eax, [esi + 0x37]
mov dword [ebp - 0x280], 0
push eax
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x27c], 0xf
mov byte [ebp - 0x290], 0
call fcn.00405970
push 0x37
push str.https:__mdn.alipayobjects.com_biometric_face_afts_file_
lea ecx, [ebp - 0x290]
call fcn.00404be0
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
push esi
cmovae eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x290]
push eax
call fcn.00404be0
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.00405310
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
test al, al
jne 0x40664c
push 0x20
push str.A6Cy1SpPKIlgAAAAAAAAAAAAAAbowAQ
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.00405070
push 0x37
push str.https:__mdn.alipayobjects.com_biometric_face_afts_file_
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 0xf
mov byte [ebp - 0x278], 0
call fcn.00405070
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0x268]
sub eax, ecx
mov edx, dword [ebp - 0x220]
mov edi, dword [ebp - 0x21c]
cmp edx, eax
jbe 0x406531
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x406531
cmp dword [ebp - 0x264], 0x10
lea eax, [ebp - 0x278]
push ecx
cmovae eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x230]
push eax
push 0
call fcn.004055c0
jmp 0x40654e
cmp edi, 0x10
lea eax, [ebp - 0x230]
push edx
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x278]
push eax
call fcn.00404be0
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x290]
movups xmmword [ebp - 0x258], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
movq qword [ebp - 0x48c], xmm0
call fcn.00404930
movups xmm0, xmmword [ebp - 0x258]
mov edx, dword [ebp - 0x264]
movups xmmword [ebp - 0x290], xmm0
movq xmm0, qword [ebp - 0x48c]
movq qword [ebp - 0x280], xmm0
cmp edx, 0x10
jb 0x4065d9
mov ecx, dword [ebp - 0x278]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4065cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069b5
push edx
push ecx
call fcn.0049bb3b
add esp, 8
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 0xf
mov byte [ebp - 0x278], 0
cmp edx, 0x10
jb 0x40662e
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406624
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069ba
push edx
push ecx
call fcn.0049bb3b
add esp, 8
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.00405310
add esp, 8
test al, al
je 0x406876
push 0x40
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x4d4], 0x44
push 0
push eax
call fcn.004bd260
cmp dword [ebp - 0x2ac], 0x10
lea edi, [ebp - 0x2c0]
lea esi, [ebp - 0x2d8]
cmovae edi, dword [ebp - 0x2c0]
lea edx, [ebp - 0x2f0]
cmp dword [ebp - 0x2c4], 0x10
lea ecx, [ebp - 0x308]
push edi
cmovae esi, dword [ebp - 0x2d8]
lea eax, [ebp - 0x2a8]
cmp dword [ebp - 0x2dc], 0x10
push esi
cmovae edx, dword [ebp - 0x2f0]
cmp dword [ebp - 0x2f4], 0x10
push edx
cmovae ecx, dword [ebp - 0x308]
cmp dword [ebp - 0x294], 0x10
push ecx
cmovae eax, dword [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x320]
push str._s__type_ocr__appid__s__nfcsn__s__singlemark__s__saasid__s
push eax
call fcn.00402c10
add esp, 0x28
cmp dword [ebp - 0x328], 0
je 0x4067d3
cmp dword [ebp - 0x324], 0x10
lea eax, [ebp - 0x338]
lea edi, [ebp - 0x2c0]
cmovae eax, dword [ebp - 0x338]
lea esi, [ebp - 0x2d8]
cmp dword [ebp - 0x2ac], 0x10
lea edx, [ebp - 0x2f0]
mov dword [ebp - 0x488], eax
lea ecx, [ebp - 0x308]
cmovae edi, dword [ebp - 0x2c0]
lea eax, [ebp - 0x2a8]
cmp dword [ebp - 0x2c4], 0x10
push dword [ebp - 0x488]
cmovae esi, dword [ebp - 0x2d8]
cmp dword [ebp - 0x2dc], 0x10
push edi
cmovae edx, dword [ebp - 0x2f0]
cmp dword [ebp - 0x2f4], 0x10
push esi
cmovae ecx, dword [ebp - 0x308]
cmp dword [ebp - 0x294], 0x10
push edx
cmovae eax, dword [ebp - 0x2a8]
push ecx
push eax
lea eax, [ebp - 0x278]
push str._s__type_ocr__appid__s__nfcsn__s__singlemark__s__saasid__s__extended_configid_s
push eax
call fcn.00402c10
mov esi, eax
add esp, 0x20
lea eax, [ebp - 0x320]
cmp eax, esi
je 0x4067c8
mov ecx, eax
call fcn.00404930
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x320], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x310], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0x278]
call fcn.004026c0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x230]
push 0xfde9
push eax
call fcn.00404510
add esp, 0xc
lea ecx, [ebp - 0x258]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x4d4]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40684a
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x230]
call fcn.00402710
lea ecx, [ebp - 0x320]
call fcn.004026c0
or edi, 0xffffffff
jmp 0x4068bc
push dword [ebp - 0x258]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x254]
call esi
lea ecx, [ebp - 0x230]
call fcn.00402710
lea ecx, [ebp - 0x320]
call fcn.004026c0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.msiexec.exe
mov word [ecx], ax
call fcn.00405160
call fcn.004033a0
mov eax, dword [0x544208]
add esp, 0x18
test eax, eax
je 0x4068ba
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x544208]
call esi
xor edi, edi
lea ecx, [ebp - 0x290]
call fcn.004026c0
lea ecx, [ebp - 0x2a8]
call fcn.004026c0
lea ecx, [ebp - 0x350]
call fcn.00402710
lea ecx, [ebp - 0x338]
call fcn.004026c0
lea ecx, [ebp - 0x2c0]
call fcn.004026c0
lea ecx, [ebp - 0x2d8]
call fcn.004026c0
lea ecx, [ebp - 0x2f0]
call fcn.004026c0
lea ecx, [ebp - 0x248]
call fcn.004026c0
lea ecx, [ebp - 0x308]
call fcn.004026c0
mov esi, dword [ebp - 0x474]
lea ecx, [ebp - 0x474]
mov dword [ebp - 4], 0
push dword [esi + 4]
call fcn.00404730
mov eax, dword [ebp - 0x474]
push 0x40
mov dword [eax + 4], esi
mov ecx, dword [ebp - 0x474]
mov dword [ecx], esi
mov ecx, dword [ebp - 0x474]
mov dword [ecx + 8], esi
push dword [ebp - 0x474]
mov dword [ebp - 0x470], 0
call fcn.0049bb3b
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049bafa
mov esp, ebp
pop ebp
ret 0x10
call fcn.004d8b57
call fcn.004d8b57
call fcn.004d8b57
call fcn.004d8b57
call fcn.004d8b57
call fcn.004d8b57
call fcn.004d8b57
call fcn.004d8b57
call fcn.004d8b57
call fcn.004d8b57
int3