Function at 0x406da0
Capabilities:
Create directory
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41676e
mov eax, dword fs:[0]
push eax
sub esp, 0x4d0
mov eax, dword [0x420090]
xor eax, esp
mov dword [esp + 0x4c8], eax
push ebx
push esi
push edi
mov eax, dword [0x420090]
xor eax, esp
push eax
lea eax, [esp + 0x4e0]
mov dword fs:[0], eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, ecx
mov eax, dword [edi + 4]
push 0x3f2
push eax
mov dword [esp + 0x38], edi
call esi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [edi + 4]
push 0x3f0
push ecx
call esi
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x800
cmp eax, ecx
je 0x406e2c
push ecx
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [edi + 4]
push 0x3f1
push edx
call esi
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x800
cmp eax, ecx
je 0x406e58
push ecx
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [edi + 4]
push 1
push eax
call esi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
call ebx
mov ecx, dword [edi + 4]
push 2
push ecx
call esi
push 0
push eax
call ebx
push 0
push 0
lea ebx, [edi + 0x15c]
push 1
push 0x3f0
mov eax, ebx
lea ecx, [edi + 0x20]
mov dword [esp + 0x38], ebx
call fcn.00407ff0
test eax, eax
je 0x406ef0
push 0x104
push 1
push 1
push 0x3f0
mov eax, ebx
lea ecx, [edi + 0x20]
call fcn.00407ff0
test eax, eax
je 0x406ef0
push 0
push 0
push 1
lea eax, [edi + 0x160]
push 0x3f1
lea ecx, [edi + 0x20]
call fcn.00407ff0
test eax, eax
je 0x406ef0
push 0x104
push 1
push 1
push 0x3f1
lea eax, [edi + 0x160]
lea ecx, [edi + 0x20]
call fcn.00407ff0
mov edx, dword [ebx]
cmp dword [edx - 8], 0
je 0x407a93
mov eax, dword [edi + 0x160]
cmp dword [eax - 8], 0
je 0x407a93
mov edx, dword [0x42136c]
push 0x104
lea ecx, [esp + 0x2d0]
push ecx
push 0x75
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [edi + 4]
lea eax, [esp + 0x2cc]
push eax
push 0x3ee
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov edx, dword [edi + 0x150]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x640000
push 0
push 0x401
push edx
call esi
mov eax, dword [edi + 0x150]
push 0
push 0
push 0x402
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
xor esi, esi
push edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
call fcn.00407bc0
test al, al
je 0x407a93
mov ecx, dword [esp + 0x18]
cmp dword [ecx], 0x4b504a
jne 0x407a8a
mov eax, dword [ecx + 4]
cmp eax, 0x400
ja 0x407a8a
mov edx, eax
imul edx, edx, 0x214
add edx, 8
cmp dword [esp + 0x14], edx
jb 0x407a8a
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
add ecx, 8
mov dword [esp + 0x4e8], esi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], esi
cmp eax, esi
jbe 0x407030
mov esi, dword [esp + 0x2c]
xor eax, eax
mov ecx, 0x85
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
mov word [esp + 0x2ba], ax
lea eax, [esp + 0xb4]
lea ebx, [esp + 0x34]
call fcn.00408180
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
add dword [esp + 0x2c], 0x214
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [ecx + 4]
jb 0x406fe2
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
mov eax, dword [0x42136c]
push 0x104
lea edx, [esp + 0x2d0]
push edx
push 0x76
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [edi + 4]
lea ecx, [esp + 0x2cc]
push ecx
push 0x3ee
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [esp + 0x38]
sub ecx, dword [esp + 0x34]
mov eax, 0xf6603d99
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
lea edx, [edx + eax + 2]
movzx ecx, dx
mov edx, dword [edi + 0x150]
shl ecx, 0x10
push ecx
push 0
push 0x401
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x421060]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], eax
mov byte [esp + 0x4e8], 1
mov eax, dword [ebx]
xor ecx, ecx
mov word [esp + 0x44], cx
mov ecx, eax
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
lea edx, [ecx + 2]
mov si, word [ecx]
add ecx, 2
test si, si
jne 0x4070d1
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [esp + 0x48]
call fcn.00409ec0
mov byte [esp + 0x4e8], 2
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x44]
mov ecx, eax
cmp edx, 8
jae 0x407105
lea ecx, [esp + 0x44]
mov esi, dword [esp + 0x54]
cmp word [ecx + esi*2 - 2], 0x2f
lea ecx, [ecx + esi*2 - 2]
je 0x40712c
mov ecx, eax
cmp edx, 8
jae 0x407120
lea ecx, [esp + 0x44]
cmp word [ecx + esi*2 - 2], 0x5c
lea ecx, [ecx + esi*2 - 2]
jne 0x407143
lea ecx, [esi - 1]
or eax, 0xffffffff
lea esi, [esp + 0x44]
call fcn.00409b10
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x44]
mov ecx, dword [0x421060]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x4e8], 4
cmp edx, 8
jae 0x407162
lea eax, [esp + 0x44]
push eax
push str._s_setup.ini
lea edx, [esp + 0x30]
call fcn.00409950
mov eax, dword [0x42136c]
add esp, 8
push 0x104
lea edx, [esp + 0x2d0]
push edx
push 0x66
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, dword [esp + 0x28]
push ebx
lea ecx, [esp + 0x2d0]
push ecx
push str.COMPANY
push str.SETUP
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [esp + 0x38]
cmp dword [esp + 0x34], edx
je 0x4073b1
mov esi, dword [esp + 0x34]
add esi, 0x20c
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0x150]
push 0
push eax
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ebx, [esi - 0x20c]
lea edx, [esp + 0x2cc]
push ebx
push edx
lea edx, [esp + 0x34]
call fcn.00409950
mov eax, dword [esi + 4]
add eax, dword [esi]
add esp, 8
cmp dword [esp + 0x14], eax
jb 0x407903
xor ecx, ecx
mov eax, ebx
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], 0
mov word [esp + 0x7c], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407230
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x80]
call fcn.00409ec0
lea edx, [esp + 0x7c]
lea eax, [esp + 0x44]
lea ecx, [esp + 0x98]
mov byte [esp + 0x4e8], 5
call fcn.00408680
mov byte [esp + 0x4e8], 6
cmp dword [eax + 0x14], 8
jb 0x40727a
mov eax, dword [eax]
xor edx, edx
mov ecx, eax
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], dx
lea ebx, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x407296
sub ecx, ebx
sar ecx, 1
push ecx
lea ecx, [esp + 0x64]
call fcn.00409ec0
mov byte [esp + 0x4e8], 7
mov eax, dword [esi - 4]
mov ecx, dword [esi]
push eax
push ecx
mov ecx, dword [esi + 4]
add ecx, dword [esp + 0x20]
push edi
lea edx, [esp + 0x6c]
call fcn.00407c70
test al, al
sete bl
cmp dword [esp + 0x74], 8
jb 0x4072e8
mov edx, dword [esp + 0x60]
push edx
call fcn.0040d343
add esp, 4
xor eax, eax
cmp dword [esp + 0xac], 8
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
jb 0x407319
mov ecx, dword [esp + 0x98]
push ecx
call fcn.0040d343
add esp, 4
xor edx, edx
mov byte [esp + 0x4e8], 4
cmp dword [esp + 0x90], 8
mov dword [esp + 0xac], 7
mov dword [esp + 0xa8], 0
mov word [esp + 0x98], dx
jb 0x407358
mov eax, dword [esp + 0x7c]
push eax
call fcn.0040d343
add esp, 4
test bl, bl
jne 0x4079ca
mov ebx, dword [esp + 0x24]
push ebx
push str.File_d
lea edx, [esp + 0x24]
call fcn.00409950
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
add esp, 8
push ecx
lea edx, [esi - 0x20a]
push edx
push eax
inc ebx
push str.JDCS
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esi, 0x214
lea ecx, [esi - 0x20c]
cmp ecx, dword [esp + 0x38]
jne 0x4071c4
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push esi
push str.File_d
lea edx, [esp + 0x24]
call fcn.00409950
mov eax, dword [esp + 0x24]
add esp, 8
push ebx
push str.setup.ini
push eax
push str.JDCS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
push 0x41c7e4
lea edx, [esp + 0x24]
call fcn.00409950
mov ecx, dword [esp + 0x24]
add esp, 8
push ebx
push ecx
push str.FileCount
push str.JDCS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [esp + 0x18]
push edx
call fcn.0040d6c9
mov ecx, dword [0x42136c]
add esp, 4
push 0x104
lea eax, [esp + 0x2d0]
push eax
push 0x77
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [edi + 4]
lea edx, [esp + 0x2cc]
push edx
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [edi + 0x150]
push 0
push esi
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 0x20]
push edx
push 0x4173c0
push 3
push 0
push 0x4173e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x407797
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0
mov ecx, dword [eax]
push 0x4173f0
push eax
mov eax, dword [ecx]
call eax
test eax, eax
js 0x40778b
mov ecx, dword [0x421060]
mov dword [esp + 0x14], ecx
mov byte [esp + 0x4e8], 8
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x4074d1
lea eax, [esp + 0x44]
push eax
push 0x41c5dc
lea edx, [esp + 0x1c]
call fcn.00409950
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
add esp, 8
push ecx
push eax
call edx
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0
lea eax, [esp + 0x2d4]
push eax
push 0
call esi
mov ecx, dword [edi + 0x160]
push ecx
lea edx, [esp + 0x2d0]
push edx
push str._s_s.lnk
lea edx, [esp + 0x20]
call fcn.00409950
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
add esp, 0xc
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
push 0
push 0x17
lea ecx, [esp + 0x2d4]
push ecx
push 0
call esi
mov edx, dword [0x421060]
mov dword [esp + 0x30], edx
mov byte [esp + 0x4e8], 9
mov eax, dword [edi + 0x160]
push eax
lea ecx, [esp + 0x2d0]
push ecx
push 0x41c690
lea edx, [esp + 0x3c]
call fcn.00409950
mov esi, dword [esp + 0x3c]
add esp, 0xc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [edi + 0x160]
push edx
push esi
push str._s_s.lnk
lea edx, [esp + 0x20]
call fcn.00409950
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
add esp, 0xc
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x4075c7
lea eax, [esp + 0x44]
push eax
push str._sUnJdcs.exe
lea edx, [esp + 0x1c]
call fcn.00409950
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
add esp, 8
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov ecx, dword [edi + 0x160]
push ecx
push esi
push 0x41c6b8
lea edx, [esp + 0x20]
call fcn.00409950
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
add esp, 0xc
push 1
push ecx
push eax
call edx
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x407625
lea eax, [esp + 0x44]
push eax
push str._sjdvr.chm
lea edx, [esp + 0x1c]
call fcn.00409950
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
add esp, 8
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov ecx, dword [edi + 0x160]
push ecx
push esi
push 0x41c6e8
lea edx, [esp + 0x20]
call fcn.00409950
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
add esp, 0xc
push 1
push ecx
push eax
call edx
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x407683
lea eax, [esp + 0x44]
push eax
push str._sJPlayer.exe
lea edx, [esp + 0x1c]
call fcn.00409950
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
add esp, 8
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov ecx, dword [edi + 0x160]
push ecx
push esi
push 0x41c724
lea edx, [esp + 0x20]
call fcn.00409950
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
add esp, 0xc
push 1
push ecx
push eax
call edx
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x4076e1
lea eax, [esp + 0x44]
push eax
push str._sDriverInstall.exe
lea edx, [esp + 0x1c]
call fcn.00409950
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
add esp, 8
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov ecx, dword [edi + 0x160]
push ecx
push esi
push str._s_s
lea edx, [esp + 0x20]
call fcn.00409950
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
add esp, 0xc
push 1
push ecx
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esi - 0xc]
cmp eax, 0x421050
je 0x40775d
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40775d
push esi
call fcn.0040d423
add esp, 4
mov byte [esp + 0x4e8], 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, 0x421050
je 0x40778b
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40778b
push esi
call fcn.0040d423
add esp, 4
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [edi + 0x160]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebx
push ecx
push str.Shortcut
push str.SETUP
call esi
push ebx
push 0x41c568
push str.Brand
push str.SETUP
call esi
mov eax, dword [0x42136c]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea edx, [esp + 0x2d0]
push edx
push 0x73
push eax
call esi
mov edx, dword [edi + 4]
lea ecx, [esp + 0x2cc]
push ecx
push 0x3ee
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0x150]
push 0
push eax
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x42136c]
push 0x104
lea edx, [esp + 0x2d0]
push edx
push 0x73
push eax
call esi
mov ecx, dword [edi + 4]
push 0x3f4
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
lea edx, [esp + 0x2cc]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 2
mov esi, edi
mov byte [edi + 0x158], 1
call fcn.00406880
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add eax, 0xfffffff4
cmp eax, 0x421050
je 0x407880
mov esi, dword [esp + 0x1c]
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x407880
push esi
call fcn.0040d423
add esp, 4
lea ecx, [ebx - 0xc]
cmp ecx, 0x421050
je 0x40789e
add ebx, 0xfffffff4
push ebx
call edi
test eax, eax
jg 0x40789e
push ebx
call fcn.0040d423
add esp, 4
cmp dword [esp + 0x58], 8
jb 0x4078b2
mov edx, dword [esp + 0x44]
push edx
call fcn.0040d343
add esp, 4
xor eax, eax
mov word [esp + 0x44], ax
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
cmp ecx, 0x421050
je 0x4078eb
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x4078eb
push esi
call fcn.0040d423
add esp, 4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4078fc
push eax
call fcn.0040d343
add esp, 4
mov al, 1
jmp 0x407a9e
mov edx, dword [esp + 0x18]
push edx
call fcn.0040d6c9
add esp, 4
push 2
mov esi, edi
call fcn.00406880
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, 0x421050
je 0x407941
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x407941
push esi
call fcn.0040d423
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [eax - 0xc]
cmp edx, 0x421050
je 0x407963
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x407963
push esi
call fcn.0040d423
add esp, 4
cmp dword [esp + 0x58], 8
jb 0x407977
mov eax, dword [esp + 0x44]
push eax
call fcn.0040d343
add esp, 4
mov eax, dword [esp + 0x2c]
xor ecx, ecx
lea edx, [eax - 0xc]
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
mov word [esp + 0x44], cx
cmp edx, 0x421050
je 0x4079b0
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x4079b0
push esi
call fcn.0040d423
add esp, 4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x407a9c
push eax
call fcn.0040d343
add esp, 4
jmp 0x407a9c
mov eax, dword [esp + 0x18]
push eax
call fcn.0040d6c9
add esp, 4
push 2
mov esi, edi
call fcn.00406880
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, 0x421050
je 0x407a08
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x407a08
push esi
call fcn.0040d423
add esp, 4
mov eax, dword [esp + 0x28]
lea edx, [eax - 0xc]
cmp edx, 0x421050
je 0x407a2a
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x407a2a
push esi
call fcn.0040d423
add esp, 4
cmp dword [esp + 0x58], 8
jb 0x407a3e
mov eax, dword [esp + 0x44]
push eax
call fcn.0040d343
add esp, 4
mov eax, dword [esp + 0x2c]
xor ecx, ecx
lea edx, [eax - 0xc]
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
mov word [esp + 0x44], cx
cmp edx, 0x421050
je 0x407a77
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x407a77
push esi
call fcn.0040d423
add esp, 4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x407a9c
push eax
call fcn.0040d343
add esp, 4
jmp 0x407a9c
push ecx
call fcn.0040d6c9
add esp, 4
push 2
mov esi, edi
call fcn.00406880
xor al, al
mov ecx, dword [esp + 0x4e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c8]
xor ecx, esp
call fcn.0040d34e
mov esp, ebp
pop ebp
ret