Function at 0x42baff
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push 0x348
mov eax, 0x433313
call fcn.00430dfb
mov ebx, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2bc], ecx
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x320], eax
mov edi, 0x40bd3c
mov dword [ebp - 4], eax
cmp word [0x437bd0], ax
je 0x42bd85
mov dword [ebp - 0x2c0], eax
cmp dword [ebp + 0x10], eax
jbe 0x42bd85
mov eax, dword [ebx]
lea edx, [ebp - 0x2ac]
push edx
sub esp, 0x10
mov esi, ecx
mov edi, esp
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 0xa8]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42bbbb
push esi
call fcn.0042423d
push eax
push esi
push 0x40cbc8
push 0x4fc
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
mov eax, dword [ebp - 0x288]
xor edx, edx
test eax, eax
je 0x42bc18
cmp word [eax], dx
je 0x42bc18
push dword [ebp - 0x280]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x27c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x278]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x274]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x288]
lea ecx, [ebp - 0x334]
push dword [ebp - 0x284]
call fcn.00427cbb
jmp 0x42bd5b
mov ecx, dword [ebp - 0x278]
test ecx, ecx
je 0x42bd5b
cmp word [ecx], dx
je 0x42bd5b
mov edx, dword [ebp - 0x280]
xor ebx, ebx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x42bc3a
sub edx, esi
lea esi, [ecx + 2]
sar edx, 1
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42bc4c
sub ecx, esi
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 0x14]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ebx, eax
test ebx, ebx
je 0x42c7ff
mov ecx, dword [0x406d10]
mov dword [ebx], ecx
mov cx, word [0x406d14]
mov word [ebx + 4], cx
xor ecx, ecx
mov edx, dword [ebp - 0x280]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x42bc93
sub edx, esi
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x42bca3
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
xor ecx, ecx
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, cx
jne 0x42bcc2
mov eax, dword [0x40e5b8]
mov dword [edi], eax
mov edx, dword [ebp - 0x278]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x42bcdd
sub edx, esi
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x42bced
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 0x280]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x27c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x278]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x274]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x288]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push ebx
push dword [ebp - 0x284]
lea ecx, [ebp - 0x334]
call fcn.00427cbb
mov ebx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0x2bc]
inc eax
add ecx, 0x10
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x2bc], ecx
cmp eax, dword [ebp + 0x10]
jb 0x42bb6a
mov edi, 0x40bd3c
mov eax, dword [ebx]
lea ecx, [ebp - 0x2fc]
push ecx
push ebx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42bdc4
push esi
call fcn.0042423d
push eax
push esi
push 0x404f0c
push 0x52a
push edi
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
mov eax, dword [ebx]
lea ecx, [ebp - 0x2e8]
push ecx
push ebx
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42be03
push esi
call fcn.0042423d
push eax
push esi
push 0x403bbc
push 0x52b
push edi
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
xor ecx, ecx
mov dword [ebp - 0x340], ebx
mov eax, ecx
mov dword [ebp - 0x2e4], ecx
cmp dword [ebp - 0x2fc], eax
jbe 0x42c7e1
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2b8], ecx
mov esi, dword [ebx]
lea ecx, [ebp - 0x2cc]
push ecx
push eax
push ebx
mov ecx, dword [esi + 0x10]
mov byte [ebp - 4], 2
call dword [0x4392d8]
call dword [esi + 0x10]
mov esi, eax
test esi, esi
je 0x42be6e
push esi
call fcn.0042423d
push eax
push esi
push 0x40cc5c
push 0x533
push edi
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
mov eax, dword [ebp - 0x2cc]
lea edx, [ebp - 0x2f4]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42beb2
push esi
call fcn.0042423d
push eax
push esi
push 0x404f78
push 0x536
push edi
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
mov eax, dword [ebp - 0x2cc]
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x24c]
push ecx
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 4]
call dword [0x4392d8]
call dword [esi + 4]
mov esi, eax
test esi, esi
je 0x42befd
push esi
call fcn.0042423d
push eax
push esi
push 0x404fa4
push 0x538
push edi
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
cmp word [0x437bd0], 0
je 0x42c3d8
xor edx, edx
mov edi, edx
cmp dword [ebp - 0x2e8], edx
jbe 0x42bfa5
mov esi, dword [ebx]
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [esi + 0x2c]
push edi
push ebx
call dword [0x4392d8]
call dword [esi + 0x2c]
mov esi, eax
test esi, esi
je 0x42bf65
push esi
call fcn.0042423d
push eax
push esi
push 0x40cc90
push 0x53f
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
xor edx, edx
lea esi, [ebp - 0x24c]
mov ecx, edx
mov eax, dword [esi + ecx*4]
lea edx, [ebp - 0x23c]
cmp eax, dword [edx + ecx*4]
push 0
pop edx
jne 0x42bf88
inc ecx
cmp ecx, 4
jne 0x42bf6f
jmp 0x42bfa5
push edx
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.ATL.DLL_AtlComPtrAssign]
inc edi
cmp edi, dword [ebp - 0x2e8]
jb 0x42bf1b
xor edx, edx
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 3
push ecx
mov esi, dword [eax]
lea ecx, [ebp - 0x2bc]
push ecx
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x24c]
push ecx
mov ecx, dword [esi + 0xc]
push eax
call dword [0x4392d8]
call dword [esi + 0xc]
mov esi, eax
test esi, esi
je 0x42c013
push esi
call fcn.0042423d
push eax
push esi
push 0x40ccd8
push 0x549
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
push dword [ebp - 0x2bc]
push 0x40cd20
call sub.msvcrt.dll_wprintf
pop ecx
xor eax, eax
pop ecx
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2b8]
lea edx, [ebp - 0x2d8]
push edx
push eax
mov byte [ebp - 4], 4
mov ecx, dword [eax]
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42c07a
push esi
call fcn.0042423d
push eax
push esi
push 0x40cd60
push 0x550
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
push 1
sub esp, 0x10
lea esi, [ebp - 0x24c]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00429239
mov esi, eax
mov dword [ebp - 0x31c], 0x40e59c
mov dword [ebp - 0x304], esi
mov dword [ebp - 0x318], esi
mov ecx, dword [ebp - 0x2d8]
xor edi, edi
mov byte [ebp - 4], 5
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42c0b7
sub ecx, edx
lea eax, [ebp - 0x34c]
push edi
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push dword [ebp - 0x2d8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42c110
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x42c0f8
mov ecx, eax
jmp 0x42c101
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40cd88
push ecx
call fcn.004241bf
add esp, 0xc
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x350]
push ecx
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x338], eax
push ecx
mov esi, dword [eax]
lea ecx, [ebp - 0x354]
push ecx
push eax
mov ecx, dword [esi + 0x10]
call dword [0x4392d8]
call dword [esi + 0x10]
mov esi, eax
test esi, esi
je 0x42c16c
push esi
call fcn.0042423d
push eax
push esi
push 0x40cdd0
push 0x55f
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
cmp dword [ebp - 0x2ec], edi
jbe 0x42c39d
xor ebx, ebx
mov dword [ebp - 0x2b0], ebx
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x2b0]
push ecx
push edi
push eax
mov esi, dword [eax]
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0x18]
call dword [0x4392d8]
call dword [esi + 0x18]
mov esi, eax
test esi, esi
je 0x42c1cd
push esi
call fcn.0042423d
push eax
push esi
push 0x40ce0c
push 0x565
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2d4], ebx
mov eax, dword [ebp - 0x2b0]
lea edx, [ebp - 0x2b4]
push edx
push eax
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42c226
push esi
call fcn.0042423d
push eax
push esi
push 0x40ce34
push 0x569
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
mov eax, dword [ebp - 0x2b0]
lea edx, [ebp - 0x2d4]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42c26f
push esi
call fcn.0042423d
push eax
push esi
push 0x40ce54
push 0x56a
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
mov eax, dword [ebp - 0x2b0]
lea edx, [ebp - 0x300]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42c2b8
push esi
call fcn.0042423d
push eax
push esi
push 0x40ce7c
push 0x56b
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
push dword [ebp - 0x2d4]
push dword [ebp - 0x2b4]
push 0x40cea0
call sub.msvcrt.dll_wprintf
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x105
push eax
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
lea ecx, [ebp - 0x2b4]
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], esi
push eax
call fcn.0041b32b
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x2b4]
push 0x40cf10
call sub.msvcrt.dll_wprintf
pop ecx
pop ecx
push 1
sub esp, 0xc
mov ecx, esp
push dword [ebp - 0x300]
push dword [ebp - 0x2d4]
push dword [ebp - 0x2b4]
call fcn.00427817
lea ecx, [ebp - 0x328]
call fcn.00427daa
test eax, eax
jne 0x42c367
push 0x40c680
push 0x8007000e
call fcn.004241bf
pop ecx
pop ecx
push dword [ebp - 0x2d4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x2b4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x2b0]
call fcn.00414b1b
inc edi
cmp edi, dword [ebp - 0x2ec]
jb 0x42c17a
mov ebx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x304]
cmp eax, 0xffffffff
je 0x42c3af
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2d8]
or dword [ebp - 0x318], 0xffffffff
mov dword [ebp - 0x31c], 0x40e53c
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x2bc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2f4], eax
jbe 0x42c7a5
jmp 0x42c3f2
xor eax, eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2cc]
lea edx, [ebp - 0x2b0]
push edx
push ecx
push eax
mov esi, dword [eax]
mov byte [ebp - 4], 9
mov ecx, dword [esi + 8]
call dword [0x4392d8]
call dword [esi + 8]
mov esi, eax
test esi, esi
je 0x42c449
push esi
call fcn.0042423d
push eax
push esi
push 0x404fd4
push 0x57e
push 0x40bd3c
xor edi, edi
push 0x402cb8
inc edi
push edi
call fcn.00424141
add esp, 0x1c
jmp 0x42c44c
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2b0]
lea ecx, [ebp - 0x2c0]
push ecx
push 0x40bd2c
push eax
mov esi, dword [eax]
mov byte [ebp - 4], 0xa
mov ecx, dword [esi]
call dword [0x4392d8]
call dword [esi]
mov esi, eax
test esi, esi
je 0x42c4a2
push esi
call fcn.0042423d
push eax
push esi
push 0x40cf70
push 0x582
push 0x40bd3c
push 0x402cb8
push edi
call fcn.00424141
add esp, 0x1c
xor eax, eax
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x308], eax
lea edx, [ebp - 0x2e0]
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2f0], edi
mov dword [ebp - 0x30c], edi
push edx
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 0xd
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
jns 0x42c514
push esi
call fcn.0042423d
push eax
push esi
push 0x40507c
push 0x58e
push 0x40bd3c
push 0x402cb8
push edi
call fcn.00424141
add esp, 0x1c
mov eax, dword [ebp - 0x2b0]
lea edx, [ebp - 0x314]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42c55c
push esi
call fcn.0042423d
push eax
push esi
push 0x405058
push 0x58f
push 0x40bd3c
push 0x402cb8
push edi
call fcn.00424141
add esp, 0x1c
mov eax, dword [ebp - 0x2b0]
lea edx, [ebp - 0x2c4]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42c5a4
push esi
call fcn.0042423d
push eax
push esi
push 0x4050ac
push 0x590
push 0x40bd3c
push 0x402cb8
push edi
call fcn.00424141
add esp, 0x1c
xor eax, eax
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2b0]
lea edx, [ebp - 0x2dc]
push edx
push eax
mov byte [ebp - 4], 0xe
mov ecx, dword [eax]
mov esi, dword [ecx + 0x78]
mov ecx, esi
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
jns 0x42c5f8
push esi
call fcn.0042423d
push eax
push esi
push 0x40cfbc
push 0x593
push 0x40bd3c
push 0x402cb8
push edi
call fcn.00424141
add esp, 0x1c
cmp dword [ebp - 0x2dc], 0
je 0x42c61a
push dword [ebp - 0x2dc]
push dword [ebp - 0x2c4]
push 0x40cfe8
call sub.msvcrt.dll_wprintf
add esp, 0xc
push dword [ebp - 0x2c4]
push dword [ebp - 0x2e0]
push 0x40d030
call sub.msvcrt.dll_wprintf
add esp, 0xc
cmp dword [ebp + 0x14], 0
jne 0x42c65c
cmp word [0x437bd0], 0
je 0x42c65c
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x340]
push eax
push ebx
call fcn.0042afac
mov eax, dword [ebp - 0x2c0]
lea ecx, [ebp - 0x308]
push ecx
lea ecx, [ebp - 0x2f8]
push ecx
mov esi, dword [eax]
lea ecx, [ebp - 0x30c]
push ecx
lea ecx, [ebp - 0x2f0]
push ecx
mov esi, dword [esi + 0xc4]
mov ecx, esi
push eax
call dword [0x4392d8]
call esi
mov esi, eax
test esi, esi
je 0x42c6bc
push esi
call fcn.0042423d
push eax
push esi
push 0x40d068
push 0x5a3
push 0x40bd3c
push 0x402cb8
push edi
call fcn.00424141
add esp, 0x1c
cmp dword [ebp - 0x2f0], 0
lea esi, [ebp - 0x22c]
mov ebx, dword [ebx]
sete byte [ebp - 0x310]
push dword [ebp - 0x310]
push dword [ebp - 0x2c4]
mov ecx, dword [ebx + 0x50]
push dword [ebp - 0x2e0]
push dword [ebp - 0x314]
sub esp, 0x10
mov edi, esp
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x24c]
push dword [ebp - 0x2c8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [0x4392d8]
call dword [ebx + 0x50]
mov esi, eax
test esi, esi
je 0x42c740
push esi
call fcn.0042423d
push eax
push esi
push 0x40d0b8
push 0x5ab
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
push dword [ebp - 0x2dc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x2f8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x2c4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x2e0]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x2c0]
call fcn.00414b1b
lea ecx, [ebp - 0x2b0]
call fcn.00414b1b
mov ecx, dword [ebp - 0x2d0]
mov ebx, dword [ebp - 0x2c8]
inc ecx
mov dword [ebp - 0x2d0], ecx
cmp ecx, dword [ebp - 0x2f4]
jb 0x42c3f0
lea ecx, [ebp - 0x2b8]
call fcn.00414b1b
xor eax, eax
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], al
call fcn.00415995
mov eax, dword [ebp - 0x2e4]
mov edi, 0x40bd3c
inc eax
push 0
mov dword [ebp - 0x2e4], eax
pop ecx
cmp eax, dword [ebp - 0x2fc]
jb 0x42be1f
lea ecx, [ebp - 0x328]
call fcn.00429b67
lea ecx, [ebp - 0x334]
call fcn.0041c624
call fcn.00430daa
ret 0x10
push 0x40cc08
call sub.msvcrt.dll_wprintf
lea eax, [ebp - 0x2e4]
mov dword [esp], 0x436ac0
push eax
mov dword [ebp - 0x2e4], 0x8007000e
call sub.msvcrt.dll__CxxThrowException
int3