Function at 0x407300
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422165
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1b8
mov eax, dword [0x434064]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x22
xor eax, eax
mov byte [ebp - 0x145], 0
push str.SystemCurrentControlSetServices_
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
call fcn.00404110
add esi, 4
mov dword [ebp - 4], 0
mov dword [ebp - 0x168], esi
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x407387
mov edx, dword [esi]
mov edi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov ecx, dword [esi + 0x10]
sub eax, edi
mov dword [ebp - 0x14c], edi
cmp ecx, eax
ja 0x4073d1
add edi, ecx
lea eax, [ecx + ecx]
cmp dword [ebp - 0x54], 8
lea esi, [ebp - 0x68]
push eax
cmovae esi, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14c]
push edx
mov dword [ebp - 0x58], edi
lea eax, [esi + eax*2]
push eax
call fcn.0040bbf0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
mov esi, dword [ebp - 0x168]
jmp 0x4073e9
push ecx
push edx
mov byte [ebp - 0x14c], 0
push dword [ebp - 0x14c]
push ecx
lea ecx, [ebp - 0x68]
call fcn.004086e0
cmp dword [ebp - 0x54], 8
lea ecx, [ebp - 0x12c]
push ecx
push 0x20019
lea eax, [ebp - 0x68]
cmovae eax, dword [ebp - 0x68]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407508
push 0xc
xor eax, eax
mov dword [ebp - 0x154], 0
push str.RegOpenKeyEx
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
call fcn.00404110
push esi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00408270
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x164]
lea ecx, [ebp - 0x44]
call fcn.004020d0
mov edx, dword [ebp - 0x30]
add esp, 4
cmp edx, 8
jb 0x4074a8
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40749e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40818d
push edx
push ecx
call fcn.0040a239
add esp, 8
mov edx, dword [ebp - 0x150]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp edx, 8
jb 0x4074fc
mov ecx, dword [ebp - 0x164]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4074f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408192
push edx
push ecx
call fcn.0040a239
add esp, 8
mov byte [ebp - 0x145], 0
jmp 0x40812f
xor eax, eax
mov dword [ebp - 0x34], 0
push eax
push 0x43065c
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.00404110
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x144]
push 0xd
xor eax, eax
mov dword [ebp - 0x134], 0
push str.InstallerPath
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
call fcn.00404110
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x12c]
lea ecx, [ebp - 0x80]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00408fe0
add esp, 8
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x130]
cmp edx, 8
jb 0x4075c1
mov ecx, dword [ebp - 0x144]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4075b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408197
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x40761c
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407612
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40819c
push edx
push ecx
call fcn.0040a239
add esp, 8
push 2
xor eax, eax
mov dword [ebp - 0x34], 0
push 0x43067c
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.00404110
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2c]
push 0xc
xor eax, eax
mov dword [ebp - 0x1c], 0
push str.LanguageCode
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00404110
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x12c]
lea ecx, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00408fe0
add esp, 8
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4076c4
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4076ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081a1
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x407716
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40770c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081a6
push edx
push ecx
call fcn.0040a239
add esp, 8
push 2
xor eax, eax
mov dword [ebp - 0x34], 0
push 0x4306a0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.00404110
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x144]
push 0x16
xor eax, eax
mov dword [ebp - 0x134], 0
push str.ForceBusinessMessaging
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
call fcn.00404110
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x12c]
lea ecx, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00408fe0
add esp, 8
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x130]
cmp edx, 8
jb 0x4077d3
mov ecx, dword [ebp - 0x144]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4077c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081ab
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x40782e
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407824
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081b0
push edx
push ecx
call fcn.0040a239
add esp, 8
push 2
xor eax, eax
mov dword [ebp - 0x154], 0
push 0x4306a0
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
call fcn.00404110
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2c]
push 0x14
xor eax, eax
mov dword [ebp - 0x1c], 0
push str.ResumeServiceInstall
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00404110
lea eax, [ebp - 0x164]
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x12c]
lea ecx, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00408fe0
add esp, 8
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4078e2
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4078d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081b5
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x150]
cmp edx, 8
jb 0x40793a
mov ecx, dword [ebp - 0x164]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407930
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081ba
push edx
push ecx
call fcn.0040a239
add esp, 8
cmp dword [ebp - 0x70], 0
je 0x408027
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
mov byte [ebp - 4], 0x17
lea esi, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
cmovae esi, dword [ebp - 0x44]
cmp dword [ebp - 0x34], 3
jne 0x40799a
mov ecx, 0x430704
lea edx, [eax + 3]
sub esi, ecx
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x40799a
add ecx, 2
sub edx, 1
jne 0x407980
push 2
push 0x4306a0
jmp 0x4079a1
push 3
push 0x430704
lea ecx, [ebp - 0xb0]
call fcn.00404110
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00408350
add esp, 4
push str.__VERYSILENT__ForceUI
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.00408870
mov dword [ebp - 0x154], 0
xor ecx, ecx
mov dword [ebp - 0x150], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x164], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x154], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 0x19
push eax
lea edx, [ebp - 0x164]
lea ecx, [ebp - 0x1b0]
call fcn.004084d0
add esp, 4
push str.__ForceBusinessMessaging
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.00408870
mov dword [ebp - 0x170], 0
xor ecx, ecx
mov dword [ebp - 0x16c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x180], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x170], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 0x1b
push eax
lea edx, [ebp - 0x180]
lea ecx, [ebp - 0x198]
call fcn.004084d0
add esp, 4
push str.__ResumeServiceInstall
mov ecx, eax
mov byte [ebp - 4], 0x1c
call fcn.00408870
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x1d
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x98]
call fcn.004084d0
add esp, 4
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x407b34
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407b2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081bf
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x184]
cmp edx, 8
jb 0x407b8c
mov ecx, dword [ebp - 0x198]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407b82
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081c4
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 7
mov word [ebp - 0x198], ax
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x16c]
cmp edx, 8
jb 0x407bed
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407be3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081c9
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x19c]
cmp edx, 8
jb 0x407c4e
mov ecx, dword [ebp - 0x1b0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407c44
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081ce
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 7
mov word [ebp - 0x1b0], ax
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x150]
cmp edx, 8
jb 0x407caf
mov ecx, dword [ebp - 0x164]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407ca5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081d3
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x1b4]
cmp edx, 8
jb 0x407d10
mov ecx, dword [ebp - 0x1c8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407d06
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081d8
push edx
push ecx
call fcn.0040a239
add esp, 8
push dword [ebp - 0x14c]
xor eax, eax
mov dword [ebp - 0x1b8], 0
cmp dword [ebp - 0x84], 8
lea edx, [ebp - 0x98]
mov word [ebp - 0x1c8], ax
lea ecx, [ebp - 0x50]
cmovae edx, dword [ebp - 0x98]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x88]
movq qword [ebp - 0x50], xmm0
mov dword [ebp - 0x1b4], 7
mov dword [ebp - 0x50], 0
lea eax, [edx + eax*2]
mov dword [ebp - 0x4c], 0
lea edx, [ebp - 0x98]
mov dword [ebp - 0x48], 0
cmovae edx, dword [ebp - 0x98]
push eax
push edx
call fcn.004088f0
mov byte [ebp - 4], 0x25
lea edx, [ebp - 0x80]
cmp dword [ebp - 0x6c], 8
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x70]
xorps xmm0, xmm0
cmovae edx, dword [ebp - 0x80]
push dword [ebp - 0x14c]
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
lea eax, [edx + eax*2]
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x80]
mov dword [ebp - 0x1c], 0
cmovae edx, dword [ebp - 0x80]
push eax
push edx
mov dword [ebp - 0x18], 0
call fcn.004088f0
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x14c], 0
cmp dword [ebp - 0x48], ecx
je 0x407df7
xor eax, eax
mov word [ecx], ax
add ecx, 2
mov dword [ebp - 0x4c], ecx
jmp 0x407e07
lea eax, [ebp - 0x14c]
push eax
push ecx
lea ecx, [ebp - 0x50]
call fcn.00408580
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14c], 0
cmp edi, eax
je 0x407e28
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x1c], eax
jmp 0x407e3b
lea ecx, [ebp - 0x14c]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.00408580
mov edi, dword [ebp - 0x18]
push 0x40
lea eax, [ebp - 0x124]
mov dword [ebp - 0x128], 0x44
push 0
push eax
call fcn.0040c170
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x128]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x50]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x407f89
push 0xd
push str.CreateProcess
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.00404110
push dword [ebp - 0x168]
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 0x27
call fcn.00408270
mov byte [ebp - 4], 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x180]
lea ecx, [ebp - 0x164]
call fcn.004020d0
mov edx, dword [ebp - 0x150]
add esp, 4
cmp edx, 8
jb 0x407f23
mov ecx, dword [ebp - 0x164]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407f19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081dd
push edx
push ecx
call fcn.0040a239
add esp, 8
mov edx, dword [ebp - 0x16c]
xor eax, eax
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
cmp edx, 8
jb 0x407f80
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407f76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081e2
push edx
push ecx
call fcn.0040a239
add esp, 8
mov byte [ebp - 0x145], 0
jmp 0x407f90
mov byte [ebp - 0x145], 1
push dword [ebp - 0x13c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x138]
call esi
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x407fda
sub edi, ecx
mov eax, ecx
and edi, 0xfffffffe
cmp edi, 0x1000
jb 0x407fd0
mov ecx, dword [ecx - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081e7
push edi
push ecx
call fcn.0040a239
add esp, 8
mov edx, dword [ebp - 0x50]
test edx, edx
je 0x408011
mov ecx, dword [ebp - 0x48]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x408007
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081ec
push ecx
push edx
call fcn.0040a239
add esp, 8
lea ecx, [ebp - 0x98]
call fcn.004023d0
lea ecx, [ebp - 0xb0]
call fcn.004023d0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x408061
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408057
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081f1
push edx
push ecx
call fcn.0040a239
add esp, 8
mov edx, dword [ebp - 0xb4]
cmp edx, 8
jb 0x4080a1
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408097
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081f6
push edx
push ecx
call fcn.0040a239
add esp, 8
mov edx, dword [ebp - 0xcc]
cmp edx, 8
jb 0x4080e1
mov ecx, dword [ebp - 0xe0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4080d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4081fb
push edx
push ecx
call fcn.0040a239
add esp, 8
mov edx, dword [ebp - 0x6c]
cmp edx, 8
jb 0x40811b
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408111
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408200
push edx
push ecx
call fcn.0040a239
add esp, 8
xor eax, eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x408169
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40815f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408205
push edx
push ecx
call fcn.0040a239
add esp, 8
mov al, byte [ebp - 0x145]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a1f8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
call fcn.004101f6
int3