Function at 0x405744
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0xb110c93b
xor ecx, ecx
inc ecx
push esi
mov dword [ebp - 0x34], ecx
xor esi, esi
push edi
mov dword [ebp - 0x28], 0xfffffffb
mov edi, edx
mov dword [ebp - 4], esi
jmp 0x40577d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x58], 0xfbce008f
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x40576f
mov dword [ebp - 4], esi
jmp 0x405791
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x405787
mov dword [ebp - 8], esi
jmp 0x4058cb
mov dword [ebp - 0xc], 0xdf98a59c
mov dword [ebp - 4], 0xfffffffd
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x20], 0xebda1846
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0xb870004d
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], 0xfffffff5
jle 0x4058c8
mov dword [ebp - 0x24], 0x509cf13e
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x64f6128b
mov dword [ebp - 4], esi
jmp 0x40581a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x11c], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x40580d
mov dword [ebp - 4], esi
jmp 0x40582f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x68], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x405825
inc dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x44]
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push 1
setne dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x114]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
sub eax, 0x5cf1
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul edx, eax, 0xf3bb
add edx, dword [ebp - 4]
mov eax, dword [ebp - 0x58]
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff5
pop ecx
jg 0x4057e2
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe8
jle 0x40579e
mov dword [ebp - 0xc], 0x97a888ad
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], 0xfc6c064b
mov dword [ebp - 8], esi
jmp 0x4058fc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf8], 0x25062d7b
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4058eb
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp eax, 0xa5dec4f
setle cl
sub ecx, 8
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0xc]
cmp eax, edx
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp eax, ecx
setg dl
imul edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jne 0x405954
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1c], 0xe5077045
mov dword [ebp - 0x1c], 0x8c105a83
mov dword [ebp - 4], 0xb110c93b
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0xc0e07525
mov dword [ebp - 0x18], 0x9829cbc2
mov dword [ebp - 0x1c], 0x8475761a
mov dword [ebp - 4], esi
jmp 0x40599a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x30], 0xe0cf5720
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
jl 0x40598c
mov dword [ebp - 4], esi
jmp 0x4059b3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x64], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4059a5
mov dword [ebp - 4], esi
jmp 0x4059cf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb8], 0xb82c4475
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4059be
dec dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xcd32
jle 0x4059f0
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x14], 0xfffffffa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
xor esi, esi
mov dword [ebp - 0x1c], ecx
inc esi
xor edx, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], edx
jmp 0x405b75
mov dword [ebp - 4], edx
jmp 0x405a61
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd0], 0xeb0647dc
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x405a50
mov dword [ebp - 4], edx
jmp 0x405a7d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe8], 0x17c10977
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x405a6c
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x405a9e
push edx
push edx
push 0x20b
push edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
mov dword [ebp - 0xcc], 0x14
jmp 0x405b65
mov dword [ebp - 0x14], 0x355fff83
mov dword [ebp - 4], edx
jmp 0x405aca
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x138], 0xaeb9
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x405ab9
mov dword [ebp - 4], edx
jmp 0x405ae3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x70], 0xded68044
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x405ad5
mov dword [ebp - 4], edx
jmp 0x405aff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x94], 0x733582f8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x405aee
mov dword [ebp - 0x6c], edx
jmp 0x405b59
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0xc], edx
jmp 0x405b26
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe0], 0xc67ee39f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x405b15
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xe8]
add ecx, eax
jne 0x405b4e
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
test eax, eax
mov eax, edx
je 0x405b50
mov eax, esi
mov dword [ebp - 0x94], eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 2
jle 0x405b09
dec dword [ebp - 0xcc]
cmp dword [ebp - 0xcc], 0xffffffff
jg 0x405aad
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jg 0x405a4b
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 4], edx
jmp 0x405b98
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], 0x5dcec3d7
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x405b8a
push 2
mov dword [ebp - 4], edx
pop ecx
jmp 0x405bb3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x50], 0xe5ccc90a
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x405ba5
mov dword [ebp - 0x4c], edx
jmp 0x405c12
or eax, 0xffffffff
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x40], edx
jne 0x405c17
mov dword [ebp - 0x84], edx
jmp 0x405c07
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0x40], edx
jne 0x405c0f
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0x40], edx
jne 0x405c0f
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], edx
jle 0x405be9
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jle 0x405bbd
mov dword [ebp - 8], 0x56915a13
mov dword [ebp - 0x1c], 0x3111
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2c], 0xeca51c18
mov dword [ebp - 0xc], edx
jmp 0x405c45
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa0], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x405c38
mov dword [ebp - 8], edx
jmp 0x405db3
mov dword [ebp - 4], 0xc6e5c7a0
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x28], 0xfb6c7178
mov dword [ebp - 4], edx
jmp 0x405d60
mov dword [ebp - 0xc], 0xf6c74aa0
mov dword [ebp - 0x18], 0xdc509ca4
mov dword [ebp - 0x18], 0xda37b187
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xafe2
mov dword [ebp - 0xc], edx
jmp 0x405ca9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc0], 0x7d7c869b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x405c98
mov dword [ebp - 0xc], edx
jmp 0x405d54
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 8]
cmp eax, 0x2d6273d5
setne cl
xor edx, edx
mov dword [ebp - 0xbc], ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0xf261
setg al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x405d28
cmp dword [ebp - 0xc], 0
je 0x405d28
mov edx, esi
jmp 0x405d2a
xor edx, edx
mov eax, dword [ebp - 8]
push 2
mov ecx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 8]
add ecx, edx
xor edx, edx
mov dword [ebp + eax*4 - 0xa0], ecx
mov eax, dword [ebp - 4]
pop ecx
cmp dword [ebp + eax*4 - 0xa0], edx
jne 0x405d5d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x405cb6
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jle 0x405c70
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setge cl
cmp ecx, 7
jae 0x405d8f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x98], 0xffffffff
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
push 2
mov dword [ebp - 0x28], esi
inc dword [ebp - 8]
pop ecx
cmp dword [ebp - 8], ecx
jle 0x405c53
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x405dce
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x405de1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x5c], 0xfbce008f
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x405dd3
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xc], 0x4dd03248
push 2
pop eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x24], 0xfffffffb
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x405e25
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor edx, edx
cmp dword [ebp - 0xc], edx
jne 0x405e74
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
imul edx, eax
mov eax, dword [ebp - 0xc]
cmp eax, edx
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, 0xe6f7fbf2
neg edx
sbb edx, edx
inc edx
cmp edx, 0xfffa
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x78]
jg 0x405e74
xor ecx, ecx
jmp 0x405e77
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x74]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x405e9f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3c], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x405e95
mov dword [ebp - 8], 0xfffffff9
mov dword [ebp - 0x1c], 7
mov dword [ebp - 8], ecx
jmp 0x405ec9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xac], 0xa473eb90
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x405eb8
mov dword [ebp - 8], ecx
jmp 0x405ee5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x405ed4
mov dword [ebp - 8], 0xffffffe8
jmp 0x405f5b
mov dword [ebp - 0xc], 0xffffffff
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x405f14
push 0x2138
call esi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor ecx, ecx
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ecx
jl 0x405f58
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xac], ecx
je 0x405f3a
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xac], ecx
jne 0x405f58
jmp 0x405f50
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x405f50
push 0x1563
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
jns 0x405f20
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jle 0x405ef4
mov dword [ebp - 8], 1
cmp dword [ebp - 8], ecx
jl 0x405f8a
mov edx, 0x13244d51
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0xac]
dec dword [ebp - 8]
jns 0x405f72
mov dword [ebp - 4], ecx
jmp 0x406119
mov dword [ebp - 0xc], 0xdf98a59c
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x20], 0xcec79e67
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
jmp 0x405fc0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x124], 1
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x405faf
mov dword [ebp - 8], ecx
jmp 0x405fdc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x12c], 0x43cdf98a
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x405fcb
dec dword [ebp - 0x18]
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x405ff7
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x20], 0xebda1846
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xb870004d
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0xfffffff5
jle 0x406116
mov dword [ebp - 0x48], 0x509cf13e
mov dword [ebp - 0x24], 0xfffffff9
push 3
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x34], 0x64f6128b
mov dword [ebp - 8], ecx
jmp 0x406068
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x104], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x40605b
mov dword [ebp - 8], ecx
jmp 0x40607c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x406072
inc dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3c]
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push 0
setne dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
sub eax, 0x5cf1
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul edx, eax, 0xf3bb
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff5
pop ecx
jg 0x406031
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe8
jle 0x405f92
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0x2f4a8b10
mov dword [ebp - 0xc], 0xd21f1eb3
mov dword [ebp - 8], ecx
jmp 0x40614e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x110], 0x9ef72d4e
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x40613d
inc dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
jmp 0x40616b
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x110], ecx
jne 0x406171
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x40615c
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, ebx
mov edi, edx
mov esi, eax
call int.00405452
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret