Function at 0x407c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x469f98
mov eax, dword fs:[0]
push eax
sub esp, 0xa74
mov eax, dword [0x47d1a0]
xor eax, esp
mov dword [esp + 0xa70], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47d1a0]
xor eax, esp
push eax
lea eax, [esp + 0xa88]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa98]
xor edi, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
mov ebp, 1
mov dword [esp + 0xa90], ebp
xor ecx, ecx
mov ebx, 7
push 9
mov eax, str._DESKTOP_
lea esi, [esp + 0xa0]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xb4], edi
mov word [esp + 0xa4], cx
call fcn.004074c0
mov dword [esp + 0xb8], edi
mov byte [esp + 0xa90], 2
xor edx, edx
push 0xa
mov eax, str._INTERNET_
lea esi, [esp + 0xc0]
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xd4], edi
mov word [esp + 0xc4], dx
call fcn.004074c0
mov dword [esp + 0xd8], ebp
mov byte [esp + 0xa90], 3
xor eax, eax
mov word [esp + 0xe0], ax
push 0xa
mov eax, str._PROGRAMS_
lea esi, [esp + 0xe0]
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xf4], edi
call fcn.004074c0
mov dword [esp + 0xf8], 2
mov byte [esp + 0xa90], 4
xor ecx, ecx
push 0xa
mov eax, str._CONTROLS_
lea esi, [esp + 0x100]
mov dword [esp + 0x118], ebx
mov dword [esp + 0x114], edi
mov word [esp + 0x104], cx
call fcn.004074c0
mov dword [esp + 0x118], 3
mov byte [esp + 0xa90], 5
xor edx, edx
push 0xa
mov eax, str._PRINTERS_
lea esi, [esp + 0x120]
mov dword [esp + 0x138], ebx
mov dword [esp + 0x134], edi
mov word [esp + 0x124], dx
call fcn.004074c0
mov dword [esp + 0x138], 4
mov byte [esp + 0xa90], 6
xor eax, eax
mov word [esp + 0x140], ax
push 0xa
mov eax, str._PERSONAL_
lea esi, [esp + 0x140]
mov dword [esp + 0x158], ebx
mov dword [esp + 0x154], edi
call fcn.004074c0
mov ebp, 5
mov dword [esp + 0x158], ebp
mov byte [esp + 0xa90], bl
xor ecx, ecx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x170], edi
mov word [esp + 0x160], cx
push 0xb
mov eax, str._FAVORITES_
lea esi, [esp + 0x160]
call fcn.004074c0
mov dword [esp + 0x178], 6
mov byte [esp + 0xa90], 8
xor edx, edx
push 9
mov eax, str._STARTUP_
lea esi, [esp + 0x180]
mov dword [esp + 0x198], ebx
mov dword [esp + 0x194], edi
mov word [esp + 0x184], dx
call fcn.004074c0
mov dword [esp + 0x198], ebx
mov byte [esp + 0xa90], 9
xor eax, eax
mov word [esp + 0x1a0], ax
push 8
mov eax, str._RECENT_
lea esi, [esp + 0x1a0]
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1b4], edi
call fcn.004074c0
mov dword [esp + 0x1b8], 8
mov byte [esp + 0xa90], 0xa
xor ecx, ecx
push 8
mov eax, str._SENDTO_
lea esi, [esp + 0x1c0]
mov dword [esp + 0x1d8], ebx
mov dword [esp + 0x1d4], edi
mov word [esp + 0x1c4], cx
call fcn.004074c0
mov dword [esp + 0x1d8], 9
mov byte [esp + 0xa90], 0xb
xor edx, edx
push 0xb
mov eax, str._BITBUCKET_
lea esi, [esp + 0x1e0]
mov dword [esp + 0x1f8], ebx
mov dword [esp + 0x1f4], edi
mov word [esp + 0x1e4], dx
call fcn.004074c0
mov dword [esp + 0x1f8], 0xa
mov byte [esp + 0xa90], 0xc
xor eax, eax
mov word [esp + 0x200], ax
push 0xb
mov eax, str._STARTMENU_
lea esi, [esp + 0x200]
mov dword [esp + 0x218], ebx
mov dword [esp + 0x214], edi
call fcn.004074c0
mov dword [esp + 0x218], 0xb
mov byte [esp + 0xa90], 0xd
xor ecx, ecx
push 0xd
mov eax, str._MYDOCUMENTS_
lea esi, [esp + 0x220]
mov dword [esp + 0x238], ebx
mov dword [esp + 0x234], edi
mov word [esp + 0x224], cx
call fcn.004074c0
mov dword [esp + 0x238], ebp
mov byte [esp + 0xa90], 0xe
xor edx, edx
push 9
mov eax, str._MYMUSIC_
lea esi, [esp + 0x240]
mov dword [esp + 0x258], ebx
mov dword [esp + 0x254], edi
mov word [esp + 0x244], dx
call fcn.004074c0
mov dword [esp + 0x258], 0xd
mov byte [esp + 0xa90], 0xf
xor eax, eax
mov word [esp + 0x260], ax
push 9
mov eax, str._MYVIDEO_
lea esi, [esp + 0x260]
mov dword [esp + 0x278], ebx
mov dword [esp + 0x274], edi
call fcn.004074c0
mov dword [esp + 0x278], 0xe
mov byte [esp + 0xa90], 0x10
xor ecx, ecx
push 0x12
mov eax, str._DESKTOPDIRECTORY_
lea esi, [esp + 0x280]
mov dword [esp + 0x298], ebx
mov dword [esp + 0x294], edi
mov word [esp + 0x284], cx
call fcn.004074c0
mov dword [esp + 0x298], 0x10
mov byte [esp + 0xa90], 0x11
xor edx, edx
push 8
mov eax, str._DRIVES_
lea esi, [esp + 0x2a0]
mov dword [esp + 0x2b8], ebx
mov dword [esp + 0x2b4], edi
mov word [esp + 0x2a4], dx
call fcn.004074c0
mov dword [esp + 0x2b8], 0x11
mov byte [esp + 0xa90], 0x12
xor eax, eax
mov word [esp + 0x2c0], ax
push 9
mov eax, str._NETWORK_
lea esi, [esp + 0x2c0]
mov dword [esp + 0x2d8], ebx
mov dword [esp + 0x2d4], edi
call fcn.004074c0
mov dword [esp + 0x2d8], 0x12
mov byte [esp + 0xa90], 0x13
xor ecx, ecx
push 9
mov eax, str._NETHOOD_
lea esi, [esp + 0x2e0]
mov dword [esp + 0x2f8], ebx
mov dword [esp + 0x2f4], edi
mov word [esp + 0x2e4], cx
call fcn.004074c0
mov dword [esp + 0x2f8], 0x13
mov byte [esp + 0xa90], 0x14
xor edx, edx
push ebx
mov eax, str._FONTS_
lea esi, [esp + 0x300]
mov dword [esp + 0x318], ebx
mov dword [esp + 0x314], edi
mov word [esp + 0x304], dx
call fcn.004074c0
mov dword [esp + 0x318], 0x14
mov byte [esp + 0xa90], 0x15
xor eax, eax
mov word [esp + 0x320], ax
push 0xb
mov eax, str._TEMPLATES_
lea esi, [esp + 0x320]
mov dword [esp + 0x338], ebx
mov dword [esp + 0x334], edi
call fcn.004074c0
mov dword [esp + 0x338], 0x15
mov byte [esp + 0xa90], 0x16
mov dword [esp + 0x354], ebx
mov dword [esp + 0x350], edi
xor ecx, ecx
push 0x12
mov eax, str._COMMON_STARTMENU_
lea esi, [esp + 0x340]
mov word [esp + 0x344], cx
call fcn.004074c0
mov dword [esp + 0x358], 0x16
mov byte [esp + 0xa90], 0x17
xor edx, edx
push 0x11
mov eax, str._COMMON_PROGRAMS_
lea esi, [esp + 0x360]
mov dword [esp + 0x378], ebx
mov dword [esp + 0x374], edi
mov word [esp + 0x364], dx
call fcn.004074c0
mov dword [esp + 0x378], 0x17
mov byte [esp + 0xa90], 0x18
xor eax, eax
mov word [esp + 0x380], ax
push 0x10
mov eax, str._COMMON_STARTUP_
lea esi, [esp + 0x380]
mov dword [esp + 0x398], ebx
mov dword [esp + 0x394], edi
call fcn.004074c0
mov dword [esp + 0x398], 0x18
mov byte [esp + 0xa90], 0x19
xor ecx, ecx
push 0x19
mov eax, str._COMMON_DESKTOPDIRECTORY_
lea esi, [esp + 0x3a0]
mov dword [esp + 0x3b8], ebx
mov dword [esp + 0x3b4], edi
mov word [esp + 0x3a4], cx
call fcn.004074c0
mov dword [esp + 0x3b8], 0x19
mov byte [esp + 0xa90], 0x1a
xor edx, edx
push 9
mov eax, str._APPDATA_
lea esi, [esp + 0x3c0]
mov dword [esp + 0x3d8], ebx
mov dword [esp + 0x3d4], edi
mov word [esp + 0x3c4], dx
call fcn.004074c0
mov dword [esp + 0x3d8], 0x1a
mov byte [esp + 0xa90], 0x1b
xor eax, eax
mov word [esp + 0x3e0], ax
push 0xb
mov eax, str._PRINTHOOD_
lea esi, [esp + 0x3e0]
mov dword [esp + 0x3f8], ebx
mov dword [esp + 0x3f4], edi
call fcn.004074c0
mov dword [esp + 0x3f8], 0x1b
mov byte [esp + 0xa90], 0x1c
xor ecx, ecx
push 0xf
mov eax, str._LOCAL_APPDATA_
lea esi, [esp + 0x400]
mov dword [esp + 0x418], ebx
mov dword [esp + 0x414], edi
mov word [esp + 0x404], cx
call fcn.004074c0
mov dword [esp + 0x418], 0x1c
mov byte [esp + 0xa90], 0x1d
xor edx, edx
mov dword [esp + 0x434], ebx
mov dword [esp + 0x430], edi
mov word [esp + 0x420], dx
push 0xc
mov eax, str._ALTSTARTUP_
lea esi, [esp + 0x420]
call fcn.004074c0
mov dword [esp + 0x438], 0x1d
mov byte [esp + 0xa90], 0x1e
xor eax, eax
mov word [esp + 0x440], ax
push 0x13
mov eax, str._COMMON_ALTSTARTUP_
lea esi, [esp + 0x440]
mov dword [esp + 0x458], ebx
mov dword [esp + 0x454], edi
call fcn.004074c0
mov dword [esp + 0x458], 0x1e
mov byte [esp + 0xa90], 0x1f
xor ecx, ecx
push 0x12
mov eax, str._COMMON_FAVORITES_
lea esi, [esp + 0x460]
mov dword [esp + 0x478], ebx
mov dword [esp + 0x474], edi
mov word [esp + 0x464], cx
call fcn.004074c0
mov dword [esp + 0x478], 0x1f
mov byte [esp + 0xa90], 0x20
xor edx, edx
push 0x10
mov eax, str._INTERNET_CACHE_
lea esi, [esp + 0x480]
mov dword [esp + 0x498], ebx
mov dword [esp + 0x494], edi
mov word [esp + 0x484], dx
call fcn.004074c0
mov dword [esp + 0x498], 0x20
mov byte [esp + 0xa90], 0x21
xor eax, eax
mov word [esp + 0x4a0], ax
push 9
mov eax, str._COOKIES_
lea esi, [esp + 0x4a0]
mov dword [esp + 0x4b8], ebx
mov dword [esp + 0x4b4], edi
call fcn.004074c0
mov dword [esp + 0x4b8], 0x21
mov byte [esp + 0xa90], 0x22
xor ecx, ecx
push 9
mov eax, str._HISTORY_
lea esi, [esp + 0x4c0]
mov dword [esp + 0x4d8], ebx
mov dword [esp + 0x4d4], edi
mov word [esp + 0x4c4], cx
call fcn.004074c0
mov dword [esp + 0x4d8], 0x22
mov byte [esp + 0xa90], 0x23
xor edx, edx
push 0x10
mov eax, str._COMMON_APPDATA_
lea esi, [esp + 0x4e0]
mov dword [esp + 0x4f8], ebx
mov dword [esp + 0x4f4], edi
mov word [esp + 0x4e4], dx
call fcn.004074c0
mov dword [esp + 0x4f8], 0x23
mov byte [esp + 0xa90], 0x24
xor eax, eax
mov word [esp + 0x500], ax
push 9
mov eax, str._WINDOWS_
lea esi, [esp + 0x500]
mov dword [esp + 0x518], ebx
mov dword [esp + 0x514], edi
call fcn.004074c0
mov dword [esp + 0x518], 0x24
mov byte [esp + 0xa90], 0x25
xor ecx, ecx
push 8
mov eax, str._SYSTEM_
lea esi, [esp + 0x520]
mov dword [esp + 0x538], ebx
mov dword [esp + 0x534], edi
mov word [esp + 0x524], cx
call fcn.004074c0
mov dword [esp + 0x538], 0x25
mov byte [esp + 0xa90], 0x26
xor edx, edx
push 0xf
mov eax, str._PROGRAM_FILES_
lea esi, [esp + 0x540]
mov dword [esp + 0x558], ebx
mov dword [esp + 0x554], edi
mov word [esp + 0x544], dx
call fcn.004074c0
mov dword [esp + 0x558], 0x26
mov byte [esp + 0xa90], 0x27
xor eax, eax
mov word [esp + 0x560], ax
push 0xc
mov eax, str._MYPICTURES_
lea esi, [esp + 0x560]
mov dword [esp + 0x578], ebx
mov dword [esp + 0x574], edi
call fcn.004074c0
mov dword [esp + 0x578], 0x27
mov byte [esp + 0xa90], 0x28
xor ecx, ecx
push 9
mov eax, str._PROFILE_
lea esi, [esp + 0x580]
mov dword [esp + 0x598], ebx
mov dword [esp + 0x594], edi
mov word [esp + 0x584], cx
call fcn.004074c0
mov dword [esp + 0x598], 0x28
mov byte [esp + 0xa90], 0x29
xor edx, edx
push 0xb
mov eax, str._SYSTEMX86_
lea esi, [esp + 0x5a0]
mov dword [esp + 0x5b8], ebx
mov dword [esp + 0x5b4], edi
mov word [esp + 0x5a4], dx
call fcn.004074c0
mov dword [esp + 0x5b8], 0x29
mov byte [esp + 0xa90], 0x2a
xor eax, eax
mov word [esp + 0x5c0], ax
push 0x12
mov eax, str._PROGRAM_FILESX86_
lea esi, [esp + 0x5c0]
mov dword [esp + 0x5d8], ebx
mov dword [esp + 0x5d4], edi
call fcn.004074c0
mov dword [esp + 0x5d8], 0x2a
mov byte [esp + 0xa90], 0x2b
xor ecx, ecx
push 0x16
mov eax, str._PROGRAM_FILES_COMMON_
lea esi, [esp + 0x5e0]
mov dword [esp + 0x5f8], ebx
mov dword [esp + 0x5f4], edi
mov word [esp + 0x5e4], cx
call fcn.004074c0
mov dword [esp + 0x5f8], 0x2b
mov byte [esp + 0xa90], 0x2c
xor edx, edx
mov dword [esp + 0x614], ebx
mov dword [esp + 0x610], edi
mov word [esp + 0x600], dx
push 0x19
mov eax, str._PROGRAM_FILES_COMMONX86_
lea esi, [esp + 0x600]
call fcn.004074c0
mov dword [esp + 0x618], 0x2c
mov byte [esp + 0xa90], 0x2d
xor eax, eax
mov word [esp + 0x620], ax
push 0x12
mov eax, str._COMMON_TEMPLATES_
lea esi, [esp + 0x620]
mov dword [esp + 0x638], ebx
mov dword [esp + 0x634], edi
call fcn.004074c0
mov dword [esp + 0x638], 0x2d
mov byte [esp + 0xa90], 0x2e
xor ecx, ecx
push 0x12
mov eax, str._COMMON_DOCUMENTS_
lea esi, [esp + 0x640]
mov dword [esp + 0x658], ebx
mov dword [esp + 0x654], edi
mov word [esp + 0x644], cx
call fcn.004074c0
mov dword [esp + 0x658], 0x2e
mov ebx, 0x2f
mov eax, str._COMMON_ADMINTOOLS_
lea ecx, [esp + 0x65c]
mov byte [esp + 0xa90], bl
call fcn.00407600
mov dword [esp + 0x678], ebx
mov ebx, 0x30
mov eax, str._ADMINTOOLS_
lea ecx, [esp + 0x67c]
mov byte [esp + 0xa90], bl
call fcn.00407600
mov dword [esp + 0x698], ebx
mov ebx, 0x31
mov eax, str._CONNECTIONS_
lea ecx, [esp + 0x69c]
mov byte [esp + 0xa90], bl
call fcn.00407600
mov dword [esp + 0x6b8], ebx
mov eax, str._COMMON_MUSIC_
lea ecx, [esp + 0x6bc]
mov byte [esp + 0xa90], 0x32
call fcn.00407600
mov dword [esp + 0x6d8], 0x35
mov eax, str._COMMON_PICTURES_
lea ecx, [esp + 0x6dc]
mov byte [esp + 0xa90], 0x33
call fcn.00407600
mov ebx, 0x36
mov dword [esp + 0x6f8], ebx
mov eax, str._COMMON_VIDEO_
lea ecx, [esp + 0x6fc]
mov byte [esp + 0xa90], 0x34
call fcn.00407600
mov dword [esp + 0x718], 0x37
mov eax, str._RESOURCES_
lea ecx, [esp + 0x71c]
mov byte [esp + 0xa90], 0x35
call fcn.00407600
mov dword [esp + 0x738], 0x38
mov eax, str._RESOURCES_LOCALIZED_
lea ecx, [esp + 0x73c]
mov byte [esp + 0xa90], bl
call fcn.00407600
mov ebx, 0x39
mov dword [esp + 0x758], ebx
mov eax, str._COMMON_OEM_LINKS_
lea ecx, [esp + 0x75c]
mov byte [esp + 0xa90], 0x37
call fcn.00407600
mov dword [esp + 0x778], 0x3a
mov eax, str._CDBURN_AREA_
lea ecx, [esp + 0x77c]
mov byte [esp + 0xa90], 0x38
call fcn.00407600
mov dword [esp + 0x798], 0x3b
mov eax, str._COMPUTERSNEARME_
lea ecx, [esp + 0x79c]
mov byte [esp + 0xa90], bl
call fcn.00407600
mov ebx, 0x3d
mov dword [esp + 0x7b8], ebx
mov eax, str._FLAG_CREATE_
lea ecx, [esp + 0x7bc]
mov byte [esp + 0xa90], 0x3a
call fcn.00407600
mov dword [esp + 0x7d8], 0x8000
mov eax, str._FLAG_DONT_VERIFY_
lea ecx, [esp + 0x7dc]
mov byte [esp + 0xa90], 0x3b
call fcn.00407600
mov dword [esp + 0x7f8], 0x4000
mov eax, str._FLAG_DONT_UNEXPAND_
lea ecx, [esp + 0x7fc]
mov byte [esp + 0xa90], 0x3c
call fcn.00407600
mov dword [esp + 0x818], 0x2000
mov eax, str._FLAG_NO_ALIAS_
lea ecx, [esp + 0x81c]
mov byte [esp + 0xa90], bl
call fcn.00407600
mov dword [esp + 0x838], 0x1000
mov eax, str._FLAG_PER_USER_INIT_
lea ecx, [esp + 0x83c]
mov byte [esp + 0xa90], 0x3e
call fcn.00407600
mov dword [esp + 0x858], 0x800
mov eax, str._FLAG_MASK_
lea ecx, [esp + 0x85c]
mov byte [esp + 0xa90], 0x3f
call fcn.00407600
mov dword [esp + 0x878], 0xff00
mov eax, 0x4766ec
lea ecx, [esp + 0x64]
mov byte [esp + 0xa90], 0x40
call fcn.00407600
mov eax, 0x4766f4
lea ecx, [esp + 0x80]
mov byte [esp + 0xa90], 0x41
call fcn.00407600
push str.SHGetSpecialFolderPathW
push str.shell32.dll
mov byte [esp + 0xa98], 0x42
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x206
mov ebp, eax
lea eax, [esp + 0x882]
xor edx, edx
push edi
push eax
mov word [esp + 0x888], dx
call fcn.00416fc0
add esp, 0xc
lea esi, [esp + 0xa0]
cmp dword [esi + 0x14], 8
mov ebx, dword [esi + 0x10]
jb 0x408a50
mov eax, dword [esi]
jmp 0x408a52
mov eax, esi
push eax
xor eax, eax
lea edx, [esp + 0xaa0]
call fcn.00406c20
cmp eax, 0xffffffff
jne 0x408c1e
inc edi
add esi, 0x20
cmp edi, 0x3f
jb 0x408a43
lea ecx, [esp + 0xa9c]
push ecx
mov ecx, dword [esp + 0x7c]
xor edx, edx
lea esi, [esp + 0x24]
call fcn.00407310
mov ecx, eax
mov byte [esp + 0xa90], 0x45
mov eax, dword [esp + 0x68]
mov ebp, 8
cmp dword [esp + 0x7c], ebp
jae 0x408aa7
lea eax, [esp + 0x68]
mov edi, dword [esp + 0x78]
push eax
mov eax, dword [ecx + 0x14]
call fcn.00407070
test eax, eax
sete byte [esp + 0x17]
mov byte [esp + 0xa90], 0x42
cmp dword [esp + 0x38], ebp
jb 0x408ad6
mov edx, dword [esp + 0x24]
push edx
call fcn.00412333
add esp, 4
xor ebx, ebx
lea eax, [esp + 0xa9c]
lea esi, [esp + 0x20]
push eax
cmp byte [esp + 0x1b], bl
je 0x408d8e
mov edx, dword [esp + 0x7c]
or ecx, 0xffffffff
call fcn.00407310
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push ecx
mov byte [esp + 0xab4], 0x46
call fcn.00407640
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00407400
add esp, 0x1c
mov byte [esp + 0xa94], 0x47
mov edi, dword [esp + 0x1c]
push eax
call fcn.00407230
add esp, 8
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x58], ebp
jb 0x408b51
mov edx, dword [esp + 0x44]
push edx
call fcn.00412333
add esp, 4
xor eax, eax
mov esi, 7
mov dword [esp + 0x58], esi
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], ax
cmp dword [esp + 0x38], ebp
jb 0x408b78
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00412333
add esp, 4
xor edx, edx
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
cmp dword [esp + 0x98], ebp
jb 0x408ba0
mov eax, dword [esp + 0x84]
push eax
call fcn.00412333
add esp, 4
xor ecx, ecx
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], cx
cmp dword [esp + 0x7c], ebp
jb 0x408bcb
mov edx, dword [esp + 0x68]
push edx
call fcn.00412333
add esp, 4
push 0x406bf0
push 0x3f
push 0x20
lea ecx, [esp + 0xa8]
xor eax, eax
push ecx
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], ax
mov byte [esp + 0xaa0], 1
call fcn.00412c15
cmp dword [esp + 0xab4], ebp
jb 0x408c17
mov edx, dword [esp + 0xaa0]
push edx
call fcn.00412333
add esp, 4
mov eax, edi
jmp 0x408fea
xor ebx, ebx
push ebx
shl edi, 5
mov ecx, dword [esp + edi + 0xbc]
push ecx
lea edx, [esp + 0x884]
push edx
push ebx
call ebp
sub esp, 0x1c
mov esi, esp
mov ebp, 7
xor eax, eax
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
mov word [esi + 4], ax
lea eax, [esp + 0x898]
mov dword [esp + 0x78], esp
lea ecx, [eax + 2]
jmp 0x408c60
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x408c60
sub eax, ecx
sar eax, 1
push eax
lea eax, [esp + 0x89c]
call fcn.004074c0
sub esp, 0x1c
mov byte [esp + 0xac8], 0x43
mov ecx, esp
mov dword [esp + 0x98], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
lea eax, [esp + edi + 0xd8]
push ebx
mov word [ecx + 4], dx
call fcn.00407ae0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0xae4], 0x44
mov dword [esp + 0x90], esp
xor eax, eax
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0xffffffffffffffff
mov word [ecx + 4], ax
push ebx
lea eax, [esp + 0xaf8]
call fcn.00407ae0
mov esi, dword [esp + 0x6c]
mov ecx, esi
mov byte [esp + 0xae4], 0x42
call fcn.00406f40
add esp, 0x54
mov edi, 8
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x98], edi
jb 0x408d16
mov ecx, dword [esp + 0x84]
push ecx
call fcn.00412333
add esp, 4
xor edx, edx
mov dword [esp + 0x98], ebp
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], dx
cmp dword [esp + 0x7c], edi
jb 0x408d41
mov eax, dword [esp + 0x68]
push eax
call fcn.00412333
add esp, 4
push 0x406bf0
push 0x3f
push 0x20
lea edx, [esp + 0xa8]
xor ecx, ecx
push edx
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], cx
mov byte [esp + 0xaa0], 1
call fcn.00412c15
cmp dword [esp + 0xab4], edi
jb 0x408fe8
mov eax, dword [esp + 0xaa0]
push eax
jmp 0x408fe0
mov ecx, dword [esp + 0x98]
xor edx, edx
call fcn.00407310
mov ecx, eax
mov byte [esp + 0xa90], 0x48
mov eax, dword [esp + 0x84]
cmp dword [esp + 0x98], ebp
jae 0x408dbd
lea eax, [esp + 0x84]
mov edi, dword [esp + 0x94]
push eax
mov eax, dword [ecx + 0x14]
call fcn.00407070
test eax, eax
sete byte [esp + 0x17]
mov byte [esp + 0xa90], 0x42
cmp dword [esp + 0x38], ebp
jb 0x408def
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00412333
add esp, 4
cmp byte [esp + 0x17], bl
je 0x408f2a
lea edx, [esp + 0xa9c]
push edx
mov edx, dword [esp + 0x98]
or ecx, 0xffffffff
lea esi, [esp + 0x44]
call fcn.00407310
mov esi, eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0xa94], 0x49
call fcn.00407640
mov byte [esp + 0xa94], 0x4a
mov edi, dword [esp + 0x1c]
push esi
push eax
call fcn.00407230
add esp, 0xc
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x38], ebp
jb 0x408e59
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00412333
add esp, 4
xor edx, edx
mov esi, 7
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
cmp dword [esp + 0x58], ebp
jb 0x408e80
mov eax, dword [esp + 0x44]
push eax
call fcn.00412333
add esp, 4
xor ecx, ecx
mov dword [esp + 0x58], esi
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], cx
cmp dword [esp + 0x98], ebp
jb 0x408ea8
mov edx, dword [esp + 0x84]
push edx
call fcn.00412333
add esp, 4
xor eax, eax
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], ax
cmp dword [esp + 0x7c], ebp
jb 0x408ed3
mov ecx, dword [esp + 0x68]
push ecx
call fcn.00412333
add esp, 4
push 0x406bf0
push 0x3f
push 0x20
lea eax, [esp + 0xa8]
xor edx, edx
push eax
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], dx
mov byte [esp + 0xaa0], 1
call fcn.00412c15
cmp dword [esp + 0xab4], ebp
jb 0x408c17
mov ecx, dword [esp + 0xaa0]
push ecx
call fcn.00412333
add esp, 4
mov eax, edi
jmp 0x408fea
mov esi, dword [esp + 0x18]
push 0xffffffffffffffff
mov edi, 7
xor edx, edx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push ebx
lea eax, [esp + 0xaa4]
mov ecx, esi
mov word [esi + 4], dx
call fcn.00407ae0
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x98], ebp
jb 0x408f71
mov eax, dword [esp + 0x84]
push eax
call fcn.00412333
add esp, 4
xor ecx, ecx
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], cx
cmp dword [esp + 0x7c], ebp
jb 0x408f9c
mov edx, dword [esp + 0x68]
push edx
call fcn.00412333
add esp, 4
push 0x406bf0
push 0x3f
push 0x20
lea ecx, [esp + 0xa8]
xor eax, eax
push ecx
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], ax
mov byte [esp + 0xaa0], 1
call fcn.00412c15
cmp dword [esp + 0xab4], ebp
jb 0x408fe8
mov edx, dword [esp + 0xaa0]
push edx
call fcn.00412333
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xa88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa70]
xor ecx, esp
call fcn.0041233e
add esp, 0xa80
ret