Function at 0x401e80
Capabilities:
Create directory
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c737
mov eax, dword fs:[0]
push eax
sub esp, 0x9ec
mov eax, dword [0x43b83c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.004034c0
test al, al
jne 0x402105
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x978], 0
xor esi, esi
lea ecx, [ebp - 0x978]
call fcn.004031f0
push 0x64
mov edi, eax
inc esi
call ebx
test edi, edi
jne 0x401eee
cmp esi, 0x12c
jl 0x401ed0
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp byte [ebp - 0x120], 0
mov dword [ebp - 0x70c], 0xf
mov dword [ebp - 0x710], 0
mov byte [ebp - 0x720], 0
jne 0x401f2b
xor ecx, ecx
jmp 0x401f3d
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401f34
sub ecx, edx
push ecx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x720]
call fcn.004041c0
push 6
push str._temp_
lea ecx, [ebp - 0x720]
mov dword [ebp - 4], 0
call fcn.00403bb0
cmp dword [ebp - 0x70c], 0x10
lea eax, [ebp - 0x720]
cmovae eax, dword [ebp - 0x720]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp - 0x70c], 0x10
push esi
lea eax, [ebp - 0x720]
cmovae eax, dword [ebp - 0x720]
push eax
push str._s_d.txt
lea eax, [ebp - 0x6f0]
push 0xc8
push eax
call fcn.004159db
add esp, 0x14
lea eax, [ebp - 0x6f0]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x94
lea eax, [ebp - 0x938]
push 0
push eax
call fcn.0041ba20
add esp, 0xc
lea eax, [ebp - 0x938]
push eax
mov dword [ebp - 0x938], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test edi, edi
jne 0x40210d
lea ecx, [ebp - 0x7c0]
mov dword [ebp - 0x7c0], edi
mov dword [ebp - 0x7bc], edi
mov dword [ebp - 0x7b8], edi
mov dword [ebp - 0x7b4], edi
mov dword [ebp - 0x7b0], edi
mov dword [ebp - 0x7ac], edi
mov dword [ebp - 0x778], edi
mov dword [ebp - 0x774], edi
call fcn.00410390
push 0x3ff
lea eax, [ebp - 0x627]
push edi
mov byte [ebp - 4], 1
push eax
mov byte [ebp - 0x628], 0
call fcn.0041ba20
add esp, 0xc
lea eax, [ebp - 0x628]
push dword [ebp - 0x930]
push dword [ebp - 0x934]
push str.http:__xmlinstcp.ddbbvt.eu_cmd_precompiled.html_q2mayor_dminor_d
push eax
call fcn.00404710
add esp, 0x10
cmp byte [ebp - 0x628], 0
jne 0x402095
xor ecx, ecx
jmp 0x4020a9
lea ecx, [ebp - 0x628]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4020a0
sub ecx, edx
push ecx
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x7a8]
call fcn.004041c0
push 0
push 0x434cdc
lea ecx, [ebp - 0x790]
call fcn.004041c0
lea ecx, [ebp - 0x7c0]
mov dword [ebp - 0x76c], 1
call fcn.00410540
lea ecx, [ebp - 0x7c0]
call fcn.00410bc0
cmp dword [ebp - 0x70c], 0x10
jb 0x402105
push dword [ebp - 0x720]
call fcn.004152b7
add esp, 4
or eax, 0xffffffff
jmp 0x402e6f
mov dword [ebp - 0x73c], 0xf
mov dword [ebp - 0x740], 0
mov byte [ebp - 0x750], 0
sub esp, 0x18
mov ecx, esp
push str.value0
mov byte [ebp - 4], 2
call fcn.00403ae0
mov ebx, dword [ebp - 0x978]
push ebx
push 0
mov edx, edi
lea ecx, [ebp - 0x750]
call fcn.00403800
add esp, 0x20
mov esi, eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x708]
mov dword [ebp - 0x6f4], 0xf
mov dword [ebp - 0x6f8], 0
mov byte [ebp - 0x708], 0
call fcn.00404090
push str.Installer.exe
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 3
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 4
call fcn.00403f90
mov byte [ebp - 4], 3
cmp dword [ebp - 0x754], 0x10
jb 0x4021d3
push dword [ebp - 0x768]
call fcn.004152b7
add esp, 4
sub esp, 0x18
mov ecx, esp
push str.value1
call fcn.00403ae0
cmp dword [ebp - 0x6f4], 0x10
lea ecx, [ebp - 0x708]
cmovae ecx, dword [ebp - 0x708]
push ebx
push esi
mov edx, edi
call fcn.00402f00
mov esi, eax
add esp, 0x20
test esi, esi
jns 0x402291
cmp dword [ebp - 0x6f4], 0x10
jb 0x402223
push dword [ebp - 0x708]
call fcn.004152b7
add esp, 4
cmp dword [ebp - 0x73c], 0x10
mov dword [ebp - 0x6f4], 0xf
mov dword [ebp - 0x6f8], 0
mov byte [ebp - 0x708], 0
jb 0x402255
push dword [ebp - 0x750]
call fcn.004152b7
add esp, 4
cmp dword [ebp - 0x70c], 0x10
mov dword [ebp - 0x73c], 0xf
mov dword [ebp - 0x740], 0
mov byte [ebp - 0x750], 0
jb 0x402287
push dword [ebp - 0x720]
call fcn.004152b7
add esp, 4
mov eax, 0xfffffffb
jmp 0x402e6f
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x708]
call fcn.00404090
push str.Installer.INI
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x768]
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 5
call fcn.00403f90
mov byte [ebp - 4], 3
cmp dword [ebp - 0x754], 0x10
jb 0x4022ef
push dword [ebp - 0x768]
call fcn.004152b7
add esp, 4
sub esp, 0x18
mov ecx, esp
push str.value2
call fcn.00403ae0
cmp dword [ebp - 0x6f4], 0x10
lea ecx, [ebp - 0x708]
cmovae ecx, dword [ebp - 0x708]
push ebx
push esi
mov edx, edi
call fcn.00402f00
mov esi, eax
add esp, 0x20
lea ecx, [ebp - 0x708]
test esi, esi
jns 0x40234f
call fcn.00403b80
lea ecx, [ebp - 0x750]
call fcn.00403b80
lea ecx, [ebp - 0x720]
call fcn.00403b80
mov eax, 0xfffffffc
jmp 0x402e6f
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
call fcn.00404090
push str.fondo.bmp
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x768]
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 6
call fcn.00403f90
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 3
call fcn.00403b80
push str..zip
lea edx, [ebp - 0x708]
lea ecx, [ebp - 0x738]
call fcn.00404730
sub esp, 0x14
mov ecx, esp
push str.value3
mov byte [ebp - 4], 7
call fcn.00403ae0
cmp dword [ebp - 0x724], 0x10
lea ecx, [ebp - 0x738]
cmovae ecx, dword [ebp - 0x738]
push ebx
push esi
mov edx, edi
call fcn.00402f00
add esp, 0x20
mov dword [ebp - 0x978], eax
lea ecx, [ebp - 0x738]
test eax, eax
jns 0x402424
call fcn.00403b80
lea ecx, [ebp - 0x708]
call fcn.00403b80
lea ecx, [ebp - 0x750]
call fcn.00403b80
lea ecx, [ebp - 0x720]
call fcn.00403b80
mov eax, 0xfffffffd
jmp 0x402e6f
cmp dword [ebp - 0x724], 0x10
cmovae ecx, dword [ebp - 0x738]
call fcn.00403600
cmp dword [ebp - 0x6f4], 0x10
lea eax, [ebp - 0x708]
cmovae eax, dword [ebp - 0x708]
push eax
push str.fondo.bmp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp dword [ebp - 0x724], 0x10
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x738]
cmovae eax, dword [ebp - 0x738]
push eax
call esi
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x708]
call fcn.00404090
push str.header.bmp
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x768]
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 8
call fcn.00403f90
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 7
call fcn.00403b80
push str..zip
lea edx, [ebp - 0x708]
lea ecx, [ebp - 0x768]
call fcn.00404730
add esp, 4
lea ecx, [ebp - 0x738]
push eax
call fcn.00403b40
lea ecx, [ebp - 0x768]
call fcn.00403b80
sub esp, 0x18
mov ecx, esp
push str.value4
call fcn.00403ae0
cmp dword [ebp - 0x724], 0x10
push ebx
push dword [ebp - 0x978]
lea ecx, [ebp - 0x738]
cmovae ecx, dword [ebp - 0x738]
mov edx, edi
call fcn.00402f00
add esp, 0x20
mov dword [ebp - 0x978], eax
lea ecx, [ebp - 0x738]
test eax, eax
jns 0x40256a
call fcn.00403b80
lea ecx, [ebp - 0x708]
call fcn.00403b80
lea ecx, [ebp - 0x750]
call fcn.00403b80
lea ecx, [ebp - 0x720]
call fcn.00403b80
mov eax, 0xfffffffe
jmp 0x402e6f
cmp dword [ebp - 0x724], 0x10
cmovae ecx, dword [ebp - 0x738]
call fcn.00403600
cmp dword [ebp - 0x6f4], 0x10
lea eax, [ebp - 0x708]
cmovae eax, dword [ebp - 0x708]
push eax
push str.header.bmp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp dword [ebp - 0x724], 0x10
lea eax, [ebp - 0x738]
cmovae eax, dword [ebp - 0x738]
push eax
call esi
mov dword [ebp - 0x7f4], 0xf
mov dword [ebp - 0x7f8], 0
mov byte [ebp - 0x808], 0
sub esp, 0x18
mov ecx, esp
push str.value5
mov byte [ebp - 4], 9
call fcn.00403ae0
push ebx
push dword [ebp - 0x978]
mov edx, edi
lea ecx, [ebp - 0x808]
call fcn.00403800
mov esi, eax
mov dword [ebp - 0x7dc], 0xf
mov dword [ebp - 0x7e0], 0
mov byte [ebp - 0x7f0], 0
add esp, 8
mov ecx, esp
push str.value6
mov byte [ebp - 4], 0xa
call fcn.00403ae0
push ebx
push esi
mov edx, edi
lea ecx, [ebp - 0x7f0]
call fcn.00403800
push 0x103
lea eax, [ebp - 0x227]
push 0
push eax
mov byte [ebp - 0x228], 0
call fcn.0041ba20
add esp, 0x2c
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x8a0]
call fcn.00403ae0
push 0x434cdc
lea ecx, [ebp - 0x838]
mov byte [ebp - 4], 0xb
call fcn.00403ae0
push 0x434cdc
lea ecx, [ebp - 0x850]
mov byte [ebp - 4], 0xc
call fcn.00403ae0
mov byte [ebp - 4], 0xe
push ecx
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x760]
mov dword [ebp - 0x760], 0
mov dword [ebp - 0x75c], 0
mov dword [ebp - 0x758], 0
mov dword [ebp - 0x754], 0
call fcn.00404820
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 0x7a0], 0
mov dword [ebp - 0x798], 0
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0
call fcn.00403d60
push ecx
lea eax, [ebp - 0x760]
push eax
lea edx, [ebp - 0x7a0]
lea ecx, [ebp - 0x8a0]
mov byte [ebp - 4], 0x10
call fcn.004048b0
add esp, 8
test al, al
je 0x4027c7
mov ecx, dword [ebp - 0x794]
sub ecx, dword [ebp - 0x798]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4027c7
lea eax, [ebp - 0x9ac]
push eax
push ecx
lea ecx, [ebp - 0x7a0]
call fcn.00403dc0
mov ecx, eax
call fcn.00403df0
mov esi, eax
lea eax, [ebp - 0x9c4]
push eax
push ecx
lea ecx, [ebp - 0x7a0]
mov byte [ebp - 4], 0x11
call fcn.00403dc0
mov ecx, eax
call fcn.00403df0
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 0x10
jb 0x40279e
mov eax, dword [eax]
push dword [esi + 0x10]
lea ecx, [ebp - 0x838]
push eax
call fcn.00403bb0
lea ecx, [ebp - 0x9c4]
call fcn.00403b80
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 0x10
call fcn.00403b80
push ecx
lea eax, [ebp - 0x7f0]
push eax
lea ecx, [ebp - 0x7d0]
mov dword [ebp - 0x7d0], 0
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0x7c8], 0
mov dword [ebp - 0x7c4], 0
call fcn.00404820
lea ecx, [ebp - 0x888]
mov dword [ebp - 0x888], 0
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0
mov dword [ebp - 0x878], 0
call fcn.00403d60
push ecx
lea eax, [ebp - 0x7d0]
push eax
lea edx, [ebp - 0x888]
lea ecx, [ebp - 0x8a0]
mov byte [ebp - 4], 0x14
call fcn.004048b0
add esp, 8
test al, al
je 0x4028e6
mov ecx, dword [ebp - 0x87c]
sub ecx, dword [ebp - 0x880]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4028e6
lea eax, [ebp - 0x9c4]
push eax
push ecx
lea ecx, [ebp - 0x888]
call fcn.00403dc0
mov ecx, eax
call fcn.00403df0
mov esi, eax
lea eax, [ebp - 0x9ac]
push eax
push ecx
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0x15
call fcn.00403dc0
mov ecx, eax
call fcn.00403df0
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 0x10
jb 0x4028c1
mov eax, dword [eax]
push dword [esi + 0x10]
lea ecx, [ebp - 0x850]
push eax
call fcn.00403bb0
lea ecx, [ebp - 0x9ac]
call fcn.00403b80
lea ecx, [ebp - 0x9c4]
call fcn.00403b80
lea ecx, [ebp - 0x888]
call fcn.00402ed0
lea ecx, [ebp - 0x7d0]
call fcn.00403d20
lea ecx, [ebp - 0x7a0]
call fcn.00402ed0
lea ecx, [ebp - 0x760]
call fcn.00403d20
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x708]
mov dword [ebp - 4], 0xd
call fcn.00404090
push str.Installer.exe
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x9ac]
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x18
call fcn.00403f90
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 0xd
call fcn.00403b80
lea eax, [ebp - 0x750]
push eax
mov edx, str._KEYWORD
lea ecx, [ebp - 0x768]
call fcn.004048f0
add esp, 4
push str.___PATHFILES
mov edx, eax
lea ecx, [ebp - 0x9c4]
mov byte [ebp - 4], 0x19
call fcn.004049e0
add esp, 4
lea ecx, [ebp - 0x720]
push ecx
mov edx, eax
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 0x1a
call fcn.00404a80
add esp, 4
push 0x434ea0
mov edx, eax
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 0x1b
call fcn.004049e0
add esp, 4
lea ecx, [ebp - 0x9ac]
call fcn.00403b80
lea ecx, [ebp - 0x9c4]
call fcn.00403b80
lea ecx, [ebp - 0x768]
mov byte [ebp - 4], 0x1f
call fcn.00403b80
cmp dword [ebp - 0x828], 1
jbe 0x402abc
cmp dword [ebp - 0x840], 1
jbe 0x402abc
lea eax, [ebp - 0x838]
push eax
mov edx, str.___AD
lea ecx, [ebp - 0x994]
call fcn.004048f0
add esp, 4
push str.____CKEY
mov edx, eax
lea ecx, [ebp - 0x9f4]
mov byte [ebp - 4], 0x20
call fcn.004049e0
add esp, 4
lea ecx, [ebp - 0x850]
push ecx
mov edx, eax
lea ecx, [ebp - 0x9dc]
mov byte [ebp - 4], 0x21
call fcn.00404a80
add esp, 4
push 0x434ea0
mov edx, eax
lea ecx, [ebp - 0x7d8]
mov byte [ebp - 4], 0x22
call fcn.004049e0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 0x23
call fcn.00403f90
lea ecx, [ebp - 0x7d8]
call fcn.00403b80
lea ecx, [ebp - 0x9dc]
call fcn.00403b80
lea ecx, [ebp - 0x9f4]
call fcn.00403b80
lea ecx, [ebp - 0x994]
mov byte [ebp - 4], 0x1f
call fcn.00403b80
push 0x38
lea eax, [ebp - 0x970]
push 0
push eax
call fcn.0041ba20
add esp, 0xc
cmp dword [ebp - 0x6f4], 0x10
lea eax, [ebp - 0x708]
cmovae eax, dword [ebp - 0x708]
cmp dword [ebp - 0x80c], 0x10
mov dword [ebp - 0x964], eax
lea eax, [ebp - 0x820]
cmovae eax, dword [ebp - 0x820]
mov dword [ebp - 0x960], eax
lea eax, [ebp - 0x974]
push eax
mov dword [ebp - 0x974], 0x3c
mov dword [ebp - 0x970], 0x40
mov dword [ebp - 0x96c], 0
mov dword [ebp - 0x968], 0
mov dword [ebp - 0x95c], 0
mov dword [ebp - 0x958], 5
mov dword [ebp - 0x954], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push ecx
lea ecx, [ebp - 0x7c0]
test eax, eax
je 0x402bab
call fcn.00402e90
lea ecx, [ebp - 0x7c0]
call fcn.00410390
push 0x3ff
lea eax, [ebp - 0x627]
push 0
mov byte [ebp - 4], 0x24
push eax
mov byte [ebp - 0x628], 0
call fcn.0041ba20
add esp, 0xc
push dword [ebp - 0x930]
push dword [ebp - 0x934]
push str.http:__xmlinstcp.ddbbvt.eu_cmd_precompiled.html_q1mayor_dminor_d
jmp 0x402bed
call fcn.00402e90
lea ecx, [ebp - 0x7c0]
call fcn.00410390
push 0x3ff
lea eax, [ebp - 0x627]
push 0
mov byte [ebp - 4], 0x25
push eax
mov byte [ebp - 0x628], 0
call fcn.0041ba20
add esp, 0xc
push dword [ebp - 0x930]
push dword [ebp - 0x934]
push str.http:__xmlinstcp.ddbbvt.eu_cmd_precompiled.html_q3mayor_dminor_d
lea eax, [ebp - 0x628]
push eax
call fcn.00404710
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x7c0]
call fcn.00410500
push 0
push 0x434cdc
lea ecx, [ebp - 0x790]
call fcn.004041c0
lea ecx, [ebp - 0x7c0]
mov dword [ebp - 0x76c], 1
call fcn.00410540
lea ecx, [ebp - 0x7c0]
mov byte [ebp - 4], 0x1f
call fcn.00410bc0
push 0xffffffffffffffff
push dword [ebp - 0x93c]
mov byte [0x43dca0], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x708]
call fcn.00404090
push str.Installer.exe
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x994]
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x26
call fcn.00403f90
lea ecx, [ebp - 0x994]
mov byte [ebp - 4], 0x1f
call fcn.00403b80
cmp dword [ebp - 0x6f4], 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x708]
cmovae eax, dword [ebp - 0x708]
push eax
call ebx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x708]
call fcn.00404090
push str.Installer.INI
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x994]
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x27
call fcn.00403f90
lea ecx, [ebp - 0x994]
mov byte [ebp - 4], 0x1f
call fcn.00403b80
cmp dword [ebp - 0x6f4], 0x10
lea eax, [ebp - 0x708]
cmovae eax, dword [ebp - 0x708]
push eax
call ebx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x708]
call fcn.00404090
push str.header.bmp
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x994]
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x28
call fcn.00403f90
lea ecx, [ebp - 0x994]
mov byte [ebp - 4], 0x1f
call fcn.00403b80
cmp dword [ebp - 0x6f4], 0x10
lea eax, [ebp - 0x708]
cmovae eax, dword [ebp - 0x708]
push eax
call ebx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x708]
call fcn.00404090
push str.fondo.bmp
lea edx, [ebp - 0x750]
lea ecx, [ebp - 0x994]
call fcn.00404730
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x29
call fcn.00403f90
lea ecx, [ebp - 0x994]
call fcn.00403b80
cmp dword [ebp - 0x6f4], 0x10
lea eax, [ebp - 0x708]
cmovae eax, dword [ebp - 0x708]
push eax
call ebx
lea ecx, [ebp - 0x820]
call fcn.00403b80
lea ecx, [ebp - 0x850]
call fcn.00403b80
lea ecx, [ebp - 0x838]
call fcn.00403b80
lea ecx, [ebp - 0x8a0]
call fcn.00403b80
lea ecx, [ebp - 0x7f0]
call fcn.00403b80
lea ecx, [ebp - 0x808]
call fcn.00403b80
lea ecx, [ebp - 0x738]
call fcn.00403b80
lea ecx, [ebp - 0x708]
call fcn.00403b80
lea ecx, [ebp - 0x750]
call fcn.00403b80
lea ecx, [ebp - 0x720]
call fcn.00403b80
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00415144
mov esp, ebp
pop ebp
ret