Function at 0x410d40
Capabilities:
Manipulate boot configuration

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66c870
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa0
mov eax, dword [0x74b1ac]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xb0], esi
cmp dword [esi + 0x7d8], 8
lea edi, [esi + 0x7c4]
mov edx, edi
jb 0x410d9c
mov edx, dword [edi]
cmp dword [esi + 0x7f0], 8
lea ecx, [esi + 0x7dc]
jb 0x410db1
mov ecx, dword [esi + 0x7dc]
add esi, 0x794
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x410dc1
mov eax, dword [esi]
push edx
push ecx
push eax
lea eax, [ebp - 0xa4]
push str._s7z.exe_e___s___aoa__o__spefileBOOT__petool_pe.wim
push eax
call fcn.00404f60
push ecx
lea eax, [ebp - 0xa4]
mov dword [ebp - 4], 0
mov ecx, esp
push eax
call fcn.004088b0
lea ecx, [ebp - 0x5c]
call fcn.004078f0
mov byte [ebp - 4], 1
lea eax, [ebp - 0xa4]
mov ecx, esp
mov dword [ebp - 0xac], esp
push eax
call fcn.004088b0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
xor eax, eax
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x7097ac
mov word [ecx], ax
call fcn.00409b90
mov byte [ebp - 4], 1
call fcn.00404cb0
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
mov edx, dword [ebp - 0x4c]
cmovae ecx, dword [ebp - 0x5c]
push 0x10
push str.Everything_is_Ok
push 0
call fcn.0040b610
add esp, 0x3c
cmp eax, 0xffffffff
jne 0x410e6a
mov ecx, dword [ebp - 0x5c]
xor esi, esi
jmp 0x4117dc
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x410e74
mov edx, dword [edi]
mov eax, dword [ebp - 0xb0]
add eax, 0x7dc
cmp dword [eax + 0x14], 8
jb 0x410e87
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x410e91
mov ecx, dword [esi]
push edx
push eax
push ecx
lea eax, [ebp - 0x8c]
push str._s7z.exe_e___s___aoa__o__spefile__petool_BOOT.SDI
push eax
call fcn.00404f60
push ecx
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 3
mov ecx, esp
push eax
call fcn.004088b0
lea ecx, [ebp - 0x2c]
call fcn.004078f0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xac], eax
add esp, 0x18
cmp ecx, eax
je 0x410eff
call fcn.00403260
mov eax, dword [ebp - 0xac]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x410f39
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410f2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411883
push edx
push ecx
call fcn.004cd516
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x8c]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004088b0
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
xor eax, eax
push 6
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x709848
mov word [ecx], ax
call fcn.00409b90
mov byte [ebp - 4], 3
call fcn.00404cb0
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
mov edx, dword [ebp - 0x4c]
cmovae ecx, dword [ebp - 0x5c]
push 0x10
push str.Everything_is_Ok
push 0
call fcn.0040b610
add esp, 0x3c
cmp eax, 0xffffffff
jne 0x410fac
xor esi, esi
jmp 0x411782
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x410fb6
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x74]
push str._sbcdedit.exe__delete_FFFFFFFF_F095_4CDB_A3B4_FFFFFFFFFFFF
push eax
call fcn.00404f60
sub esp, 0xc
mov byte [ebp - 4], 5
lea eax, [ebp - 0x74]
mov ecx, esp
push eax
call fcn.004088b0
lea ecx, [ebp - 0x2c]
call fcn.004078f0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xac], eax
add esp, 0x18
cmp ecx, eax
je 0x41101e
call fcn.00403260
mov eax, dword [ebp - 0xac]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x411058
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41104e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411888
push edx
push ecx
call fcn.004cd516
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x5c]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004088b0
sub esp, 0x18
mov byte [ebp - 4], 6
lea eax, [ebp - 0x74]
mov ecx, esp
push eax
call fcn.004088b0
mov byte [ebp - 4], 5
call fcn.00404cb0
add esp, 0x30
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x411094
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__delete_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF
push eax
call fcn.00404f60
lea ecx, [ebp - 0x74]
mov dword [ebp - 0xac], eax
add esp, 0xc
cmp ecx, eax
je 0x4110e2
call fcn.00403260
mov eax, dword [ebp - 0xac]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x41111c
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411112
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41188d
push edx
push ecx
call fcn.004cd516
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x74]
mov ecx, esp
push eax
call fcn.004088b0
lea ecx, [ebp - 0x2c]
call fcn.004078f0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xac], eax
add esp, 0x18
cmp ecx, eax
je 0x411171
call fcn.00403260
mov eax, dword [ebp - 0xac]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4111ab
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4111a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411892
push edx
push ecx
call fcn.004cd516
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x5c]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004088b0
sub esp, 0x18
mov byte [ebp - 4], 7
lea eax, [ebp - 0x74]
mov ecx, esp
push eax
call fcn.004088b0
mov byte [ebp - 4], 5
call fcn.00404cb0
add esp, 0x30
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4111e7
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x44]
push str._sbcdedit.exe__create_FFFFFFFF_F095_4CDB_A3B4_FFFFFFFFFFFF__d__WinPE___device
push eax
call fcn.00404f60
sub esp, 0xc
mov byte [ebp - 4], 8
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x41121f
mov eax, dword [edi]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x411229
mov ecx, dword [esi]
push eax
push ecx
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_F095_4CDB_A3B4_FFFFFFFFFFFF_ramdisksdidevice_partition_s
push eax
call fcn.00404f60
lea ecx, [ebp - 0x44]
mov dword [ebp - 0xac], eax
add esp, 0x10
cmp ecx, eax
je 0x411278
call fcn.00403260
mov eax, dword [ebp - 0xac]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4112b2
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4112a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411897
push edx
push ecx
call fcn.004cd516
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4112d7
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_F095_4CDB_A3B4_FFFFFFFFFFFF_ramdisksdipath__pefile_boot.sdi_
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x41132c
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411322
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41189c
push edx
push ecx
call fcn.004cd516
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x411351
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__create_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF__d__WinPE___application_osloader
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4113a6
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41139c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118a1
push edx
push ecx
call fcn.004cd516
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4113cb
mov eax, dword [edi]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4113d5
mov ecx, dword [esi]
push eax
push ecx
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF_device_ramdisk__s__pefileBOOTpe.wim__FFFFFFFF_F095_4CDB_A3B4_FFFFFFFFFFFF
push eax
call fcn.00404f60
add esp, 0x10
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
mov ecx, dword [ebp - 0xb0]
add ecx, 0x824
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x41142b
mov ecx, dword [ecx]
cmp eax, 4
jne 0x411467
push eax
mov edx, 0x709394
call fcn.0040a050
add esp, 4
test eax, eax
jne 0x411467
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa8], esp
push 0x708fec
call fcn.00408860
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
push 0x709e10
jmp 0x4114d1
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x411471
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF_path_windows_system32_bootwinload.efi
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push eax
call fcn.004088b0
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
push 0x709dfc
call fcn.00408860
mov byte [ebp - 4], 8
call fcn.00404cb0
add esp, 0x30
cmp dword [edi + 0x14], 8
jb 0x4114ea
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4114f4
mov eax, dword [esi]
push edi
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF_osdevice_ramdisk__s__pefileBOOTpe.wim__FFFFFFFF_F095_4CDB_A3B4_FFFFFFFFFFFF
push eax
call fcn.00404f60
add esp, 0x10
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41153d
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF_systemroot_windows
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x411585
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF_winpe_Yes
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4115cd
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF_detecthal_Yes
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x411615
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF_inherit_bootloadersettings
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41165d
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__set_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF_locale_zh_CN
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4116a5
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__displayorder_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF__addlast
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4116ed
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__default_FFFFFFFF_56AE_4C46_A0D7_FFFFFFFFFFFF
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
cmp dword [esi + 0x14], 8
jb 0x41172f
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x2c]
push str._sbcdedit.exe__timeout_10
push eax
call fcn.00404f60
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.00408820
lea ecx, [ebp - 0x2c]
call fcn.00403260
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004088b0
call fcn.004118c0
test eax, eax
je 0x411770
mov esi, 1
jmp 0x411772
xor esi, esi
lea ecx, [ebp - 0x44]
call fcn.00403260
lea ecx, [ebp - 0x74]
call fcn.00403260
mov edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x4117c5
mov ecx, dword [ebp - 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4117b8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118a6
push edx
push ecx
call fcn.004cd516
mov ecx, dword [ebp - 0x5c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 7
mov word [ebp - 0x8c], ax
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x411813
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411809
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118ab
push edx
push ecx
call fcn.004cd516
add esp, 8
mov edx, dword [ebp - 0x90]
xor eax, eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
cmp edx, 8
jb 0x411863
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411859
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b0
push edx
push ecx
call fcn.004cd516
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cd30a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004e9059
call fcn.004e9059
call fcn.004e9059
call fcn.004e9059
call fcn.004e9059
call fcn.004e9059
call fcn.004e9059
call fcn.004e9059
call fcn.004e9059
call fcn.004e9059
int3