Function at 0x40ce90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44534e
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x4a4
mov eax, dword [0x452364]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x448], ecx
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x448]
call fcn.0040ce80
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x38]
call fcn.0040fde0
mov byte [ebp - 4], 3
push 0x44c540
lea ecx, [ebp - 0x94]
call fcn.00401ad0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x448]
mov dword [eax + 0x114], fcn.00405670
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040fe10
mov edx, dword [ebp - 0x448]
mov ecx, dword [edx + 0x114]
mov dword [eax], ecx
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0xc8], 0x29
mov byte [ebp - 0xc7], 0x35
mov byte [ebp - 0xc6], 0x35
mov byte [ebp - 0xc5], 0x31
mov byte [ebp - 0xc4], 0x7b
mov byte [ebp - 0xc3], 0x6e
mov byte [ebp - 0xc2], 0x6e
mov byte [ebp - 0xc1], 0x28
mov byte [ebp - 0xc0], 0x2c
mov byte [ebp - 0xbf], 0x31
mov byte [ebp - 0xbe], 0x6f
mov byte [ebp - 0xbd], 0x27
mov byte [ebp - 0xbc], 0x34
mov byte [ebp - 0xbb], 0x32
mov byte [ebp - 0xba], 0x28
mov byte [ebp - 0xb9], 0x2e
mov byte [ebp - 0xb8], 0x2f
mov byte [ebp - 0xb7], 0x28
mov byte [ebp - 0xb6], 0x2f
mov byte [ebp - 0xb5], 0x32
mov byte [ebp - 0xb4], 0x35
mov byte [ebp - 0xb3], 0x20
mov byte [ebp - 0xb2], 0x2d
mov byte [ebp - 0xb1], 0x2d
mov byte [ebp - 0xb0], 0x6f
mov byte [ebp - 0xaf], 0x22
mov byte [ebp - 0xae], 0x2e
mov byte [ebp - 0xad], 0x2c
mov byte [ebp - 0xac], 0x6e
mov byte [ebp - 0xab], 0x28
mov byte [ebp - 0xaa], 0x2c
mov byte [ebp - 0xa9], 0x31
mov byte [ebp - 0xa8], 0x33
mov byte [ebp - 0xa7], 0x24
mov byte [ebp - 0xa6], 0x32
mov byte [ebp - 0xa5], 0x32
mov byte [ebp - 0xa4], 0x28
mov byte [ebp - 0xa3], 0x2e
mov byte [ebp - 0xa2], 0x2f
mov byte [ebp - 0xa1], 0x6f
mov byte [ebp - 0xa0], 0x25
mov byte [ebp - 0x9f], 0x2e
mov byte [ebp - 0x9e], 0x6e
mov byte [ebp - 0x9d], 0x7e
mov byte [ebp - 0x9c], 0x24
mov byte [ebp - 0x9b], 0x37
mov byte [ebp - 0x9a], 0x24
mov byte [ebp - 0x99], 0x2f
mov byte [ebp - 0x98], 0x35
mov byte [ebp - 0x97], 0x7c
push 0x32
lea edx, [ebp - 0xc8]
push edx
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x448]
call fcn.00406960
mov dword [ebp - 0x44c], eax
mov ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x450], ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x450]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x74]
call fcn.00401ad0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2d8]
call fcn.00401bb0
lea edx, [ebp + 0xc]
push edx
lea ecx, [ebp - 0x74]
call fcn.0040f400
mov byte [ebp - 0x58], 0x67
mov byte [ebp - 0x57], 0x28
mov byte [ebp - 0x56], 0x2c
mov byte [ebp - 0x55], 0x31
mov byte [ebp - 0x54], 0x2d
mov byte [ebp - 0x53], 0x24
mov byte [ebp - 0x52], 0x2c
mov byte [ebp - 0x51], 0x24
mov byte [ebp - 0x50], 0x2f
mov byte [ebp - 0x4f], 0x35
mov byte [ebp - 0x4e], 0x20
mov byte [ebp - 0x4d], 0x35
mov byte [ebp - 0x4c], 0x28
mov byte [ebp - 0x4b], 0x2e
mov byte [ebp - 0x4a], 0x2f
mov byte [ebp - 0x49], 0x1e
mov byte [ebp - 0x48], 0x28
mov byte [ebp - 0x47], 0x25
mov byte [ebp - 0x46], 0x7c
mov byte [ebp - 0x45], 0x2d
mov byte [ebp - 0x44], 0x24
mov byte [ebp - 0x43], 0x26
mov byte [ebp - 0x42], 0x6f
mov byte [ebp - 0x41], 0x71
mov byte [ebp - 0x40], 0x6f
mov byte [ebp - 0x3f], 0x71
mov byte [ebp - 0x3e], 0x6f
mov byte [ebp - 0x3d], 0x73
push 0x1c
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
mov ecx, dword [ebp - 0x448]
call fcn.00406960
mov dword [ebp - 0x454], eax
mov edx, dword [ebp - 0x454]
mov dword [ebp - 0x458], edx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x458]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f430
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2f4]
call fcn.00401bb0
push 0x32
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x45c], eax
push 0
mov eax, dword [ebp - 0x45c]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040f560
xor ecx, ecx
cmp eax, dword [0x44ca8c]
setne cl
mov byte [ebp - 0x2f5], cl
lea ecx, [ebp - 0x314]
call fcn.00401bb0
movzx edx, byte [ebp - 0x2f5]
test edx, edx
je 0x40d469
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [eax]
mov dword [ebp - 0x460], ecx
fild dword [ebp - 0x460]
fstp qword [ebp - 0x118]
fld qword [ebp - 0x118]
fdiv qword [0x44cd30]
fstp qword [ebp - 0x1c8]
push 1
push 3
lea ecx, [ebp - 0x250]
call fcn.00410ca0
mov byte [ebp - 4], 9
sub esp, 8
fld qword [ebp - 0x1c8]
fstp qword [esp]
lea ecx, [ebp - 0x248]
call fcn.0040eb20
lea edx, [ebp - 0x280]
push edx
lea ecx, [ebp - 0x250]
call fcn.00410dd0
mov byte [ebp - 4], 0xa
mov byte [ebp - 0x25c], 0x67
mov byte [ebp - 0x25b], 0x33
mov byte [ebp - 0x25a], 0x24
mov byte [ebp - 0x259], 0x27
mov byte [ebp - 0x258], 0x24
mov byte [ebp - 0x257], 0x33
mov byte [ebp - 0x256], 0x33
mov byte [ebp - 0x255], 0x24
mov byte [ebp - 0x254], 0x33
mov byte [ebp - 0x253], 0x7c
push 0xa
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x330]
push ecx
mov ecx, dword [ebp - 0x448]
call fcn.00406960
mov dword [ebp - 0x464], eax
mov edx, dword [ebp - 0x464]
mov dword [ebp - 0x468], edx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x468]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f430
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x330]
call fcn.00401bb0
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f400
push 1
push 3
lea ecx, [ebp - 0x1c0]
call fcn.00410ca0
mov byte [ebp - 4], 0xc
mov ecx, dword [0x454868]
push ecx
lea ecx, [ebp - 0x1b8]
call fcn.0040e7c0
lea edx, [ebp - 0x134]
push edx
lea ecx, [ebp - 0x1c0]
call fcn.00410dd0
mov byte [ebp - 4], 0xd
mov byte [ebp - 0x264], 0x67
mov byte [ebp - 0x263], 0x31
mov byte [ebp - 0x262], 0x20
mov byte [ebp - 0x261], 0x26
mov byte [ebp - 0x260], 0x24
mov byte [ebp - 0x25f], 0x7c
push 6
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x34c]
push ecx
mov ecx, dword [ebp - 0x448]
call fcn.00406960
mov dword [ebp - 0x46c], eax
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x470], edx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x470]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f430
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x34c]
call fcn.00401bb0
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f400
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x134]
call fcn.00401bb0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1c0]
call fcn.0040dc70
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x280]
call fcn.00401bb0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x250]
call fcn.0040dc70
mov ecx, dword [ebp - 0x448]
add ecx, 0x40
call fcn.0040f540
movzx ecx, al
test ecx, ecx
jne 0x40d527
mov byte [ebp - 0x28c], 0x67
mov byte [ebp - 0x28b], 0x34
mov byte [ebp - 0x28a], 0x32
mov byte [ebp - 0x289], 0x24
mov byte [ebp - 0x288], 0x33
mov byte [ebp - 0x287], 0x1e
mov byte [ebp - 0x286], 0x28
mov byte [ebp - 0x285], 0x25
mov byte [ebp - 0x284], 0x7c
push 9
lea edx, [ebp - 0x28c]
push edx
lea eax, [ebp - 0x368]
push eax
mov ecx, dword [ebp - 0x448]
call fcn.00406960
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x474]
mov dword [ebp - 0x478], ecx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x478]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f430
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x368]
call fcn.00401bb0
mov edx, dword [ebp - 0x448]
add edx, 0x40
push edx
lea ecx, [ebp - 0x74]
call fcn.0040f400
mov ecx, dword [ebp - 0x448]
add ecx, 8
call fcn.0040f540
movzx eax, al
test eax, eax
jne 0x40d55b
push str.adprovider
lea ecx, [ebp - 0x74]
call fcn.0040f430
mov ecx, dword [ebp - 0x448]
add ecx, 8
push ecx
lea ecx, [ebp - 0x74]
call fcn.0040f400
mov ecx, dword [ebp - 0x448]
add ecx, 0x24
call fcn.0040f540
movzx edx, al
test edx, edx
jne 0x40d60b
mov byte [ebp - 0x294], 0x67
mov byte [ebp - 0x293], 0x32
mov byte [ebp - 0x292], 0x34
mov byte [ebp - 0x291], 0x23
mov byte [ebp - 0x290], 0x28
mov byte [ebp - 0x28f], 0x25
mov byte [ebp - 0x28e], 0x7c
push 7
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x384]
push ecx
mov ecx, dword [ebp - 0x448]
call fcn.00406960
mov dword [ebp - 0x47c], eax
mov edx, dword [ebp - 0x47c]
mov dword [ebp - 0x480], edx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x480]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f430
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x384]
call fcn.00401bb0
mov eax, dword [ebp - 0x448]
add eax, 0x24
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f400
lea ecx, [ebp + 0x44]
call fcn.0040f540
movzx ecx, al
test ecx, ecx
jne 0x40d6a8
mov byte [ebp - 0x29c], 0x67
mov byte [ebp - 0x29b], 0x31
mov byte [ebp - 0x29a], 0x20
mov byte [ebp - 0x299], 0x26
mov byte [ebp - 0x298], 0x24
mov byte [ebp - 0x297], 0x7c
push 6
lea edx, [ebp - 0x29c]
push edx
lea eax, [ebp - 0x3a0]
push eax
mov ecx, dword [ebp - 0x448]
call fcn.00406960
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x484]
mov dword [ebp - 0x488], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x488]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f430
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3a0]
call fcn.00401bb0
lea edx, [ebp + 0x44]
push edx
lea ecx, [ebp - 0x74]
call fcn.0040f400
push 0xe
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x490], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x490]
push ecx
lea ecx, [ebp - 0xf4]
call fcn.00401b70
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x3bc]
call fcn.00401bb0
lea ecx, [ebp - 0xf4]
call fcn.0040f520
mov dword [ebp - 0xd8], eax
push str.InternetOpenA
mov edx, dword [ebp - 0x448]
mov eax, dword [edx + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x40d7a8
mov dword [ebp - 0x3c0], 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf4]
call fcn.00401bb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x74]
call fcn.00401bb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94]
call fcn.00401bb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00405fa0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401bb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x44]
call fcn.00401bb0
mov eax, dword [ebp - 0x3c0]
jmp 0x40dc45
push 0xf
lea ecx, [ebp - 0x3dc]
push ecx
lea edx, [ebp - 0x94]
push edx
lea ecx, [ebp - 0x38]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x498], ecx
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x498]
push edx
lea ecx, [ebp - 0xf4]
call fcn.00401bd0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x3dc]
call fcn.00401bb0
lea ecx, [ebp - 0xf4]
call fcn.0040f520
mov dword [ebp - 0xd8], eax
push str.InternetOpenUrlA
mov eax, dword [ebp - 0x448]
mov ecx, dword [eax + 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x40d8a8
mov dword [ebp - 0x3e0], 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf4]
call fcn.00401bb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x74]
call fcn.00401bb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94]
call fcn.00401bb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00405fa0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401bb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x44]
call fcn.00401bb0
mov eax, dword [ebp - 0x3e0]
jmp 0x40dc45
push 0x10
lea edx, [ebp - 0x3fc]
push edx
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x49c], eax
mov edx, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], edx
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0xf4]
call fcn.00401bd0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x3fc]
call fcn.00401bb0
lea ecx, [ebp - 0xf4]
call fcn.0040f520
mov dword [ebp - 0xd8], eax
push str.InternetCloseHandle
mov ecx, dword [ebp - 0x448]
mov edx, dword [ecx + 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x40d9a2
mov dword [ebp - 0x400], 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf4]
call fcn.00401bb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x74]
call fcn.00401bb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94]
call fcn.00401bb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00405fa0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401bb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x44]
call fcn.00401bb0
mov eax, dword [ebp - 0x400]
jmp 0x40dc45
push 0x11
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x4a8], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x4a8]
push ecx
lea ecx, [ebp - 0xf4]
call fcn.00401bd0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x41c]
call fcn.00401bb0
lea ecx, [ebp - 0xf4]
call fcn.0040f520
mov dword [ebp - 0xd8], eax
push str.InternetReadFile
mov edx, dword [ebp - 0x448]
mov eax, dword [edx + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jne 0x40daa2
mov dword [ebp - 0x420], 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf4]
call fcn.00401bb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x74]
call fcn.00401bb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94]
call fcn.00401bb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00405fa0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401bb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x44]
call fcn.00401bb0
mov eax, dword [ebp - 0x420]
jmp 0x40dc45
mov byte [ebp - 4], 0x18
push 0
push 0
push 0
push 1
push str.download_manager
call dword [ebp - 0x104]
mov dword [ebp - 0x4ac], eax
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp - 0xfc], ecx
cmp dword [ebp - 0xfc], 0
je 0x40db9d
push 0x20
lea ecx, [ebp - 0x74]
call fcn.00401c50
push eax
lea ecx, [ebp - 0x2b8]
call fcn.0040e440
mov dword [ebp - 0x4b0], eax
mov byte [ebp - 4], 0x19
lea edx, [ebp - 0x428]
push edx
lea ecx, [ebp - 0x2b8]
call fcn.0040e540
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f4c0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040f490
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x440]
push eax
call fcn.0041a280
add esp, 0x1c
lea ecx, [ebp - 0x2b8]
call fcn.0040e5e0
mov dword [ebp - 0x2bc], eax
push 0
push 0x84000000
push 0
push 0
mov ecx, dword [ebp - 0x2bc]
push ecx
mov edx, dword [ebp - 0xfc]
push edx
call dword [ebp - 0xd0]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x2b8]
call fcn.0040e4c0
jmp 0x40dbac
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0xcc], 0
je 0x40dbc6
mov ecx, dword [ebp - 0xcc]
push ecx
call dword [ebp - 0x78]
cmp dword [ebp - 0xfc], 0
je 0x40dbd9
mov edx, dword [ebp - 0xfc]
push edx
call dword [ebp - 0x78]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x444], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf4]
call fcn.00401bb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x74]
call fcn.00401bb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x94]
call fcn.00401bb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00405fa0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401bb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x44]
call fcn.00401bb0
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e20d
mov esp, ebp
pop ebp
ret 0x58